www.dcard.tw Open in urlscan Pro
2606:4700::6810:cc3a Public Scan

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:12 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 04ba3b31-bcb0-46a7-ad0c-f9fc780a7005
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:12 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: cb50c4f3-8d04-46ee-b172-9763f0db8cfc
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFwb490aah9VsdsPJZnzWmg%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7090
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI2ODQ4ODY5MjY1MjMyOTUzMQ%3D%3D

170 B
188 B

33ms
32ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI2ODQ4ODY5MjY1MjMyOTUzMQ%3D%3D

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:12 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 1b9060d9-63f7-4b0a-a642-bd9f0282688d
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI2ODQ4ODY5MjY1MjMyOTUzMQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 0597
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1

43 B
879 B

58ms
34ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYr8jFlQEwAQ&v=APEucNUZeSzsDDHGVE7M98tCqujrb119oEho9EGqyqNXTiKfz13L_rxYBhm2jbGRFVfCA-Rz6yVWI7l-e5aLdRu2xFeRLztR9IDV022hJzZcvw3dm--rtJK9-yaM3BIpzylNs6986ix8MQEALMSAHZTCYUAprbQGuJVQZgcTy2HgN10GAileXSM
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

cf-ray: 745d1a90fa3c913a-FRA
pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hHdEHntz1fY9Iv5PRedhKsRROuLhG%2BXJw1Lsv3o4T%2FS0QDFoLCZZE8AX9ecpaauz9jQSLRXr8eNeEcOQevn5HMxU1Nrlg3fqfOeroNscjU2zbL23rf3C4pK9A4J%2Fg%2FErVjC0EhYa8gOWtg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 0597
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YxWfMILA-dzhxOBM2Rg7RwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1

43 B
850 B

34ms
33ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYr8jFlQEwAQ&v=APEucNUZeSzsDDHGVE7M98tCqujrb119oEho9EGqyqNXTiKfz13L_rxYBhm2jbGRFVfCA-Rz6yVWI7l-e5aLdRu2xFeRLztR9IDV022hJzZcvw3dm--rtJK9-yaM3BIpzylNs6986ix8MQEALMSAHZTCYUAprbQGuJVQZgcTy2HgN10GAileXSM
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

cf-ray: 745d1a924c3a913a-FRA
pragma: no-cache
date: Mon, 05 Sep 2022 07:03:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IpQOCilEp5ZRwxk536FT%2B%2BG8ZMjPee9L3IWOIJQmzo3rXTIIUSq6ztiy8K3%2BzwNd4c5sHKIL8udmUWzV4P6wgUxTH%2B%2FuZ6M6wTPTg%2FLQRCcdXNf0x%2FUvj0Qop0mbju31TvZ4wVBj5ggu8g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 0597
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFwb490aah9VsdsPJZnzWmg&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFwb490aah9VsdsPJZnzWmg%26google_cver%3D1

43 B
1 KB

57ms
27ms

Image
image/gif

185.89.211.12
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFwb490aah9VsdsPJZnzWmg%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYr8jFlQEwAQ&v=APEucNUZeSzsDDHGVE7M98tCqujrb119oEho9EGqyqNXTiKfz13L_rxYBhm2jbGRFVfCA-Rz6yVWI7l-e5aLdRu2xFeRLztR9IDV022hJzZcvw3dm--rtJK9-yaM3BIpzylNs6986ix8MQEALMSAHZTCYUAprbQGuJVQZgcTy2HgN10GAileXSM

Protocol

HTTP/1.1

Server

185.89.211.12 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:12 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: b3acf343-1d30-42cc-a38b-bd1c3823b69b
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:12 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: bad72eb5-ce9a-459b-abfa-9f066cdead54
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFwb490aah9VsdsPJZnzWmg%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0597
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI2ODQ4ODY5MjY1MjMyOTUzMQ%3D%3D

170 B
188 B

37ms
36ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI2ODQ4ODY5MjY1MjMyOTUzMQ%3D%3D

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:12 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 410b5f14-9890-4a46-9439-64004641f2af
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI2ODQ4ODY5MjY1MjMyOTUzMQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame DE9A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1

43 B
843 B

80ms
56ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYteHDmAEwAQ&v=APEucNVc-CBEDMoLuWP760FDdjZ0Pj04fIJ3dPk81xOEAHpVii6_qS6HvcQ4kyYhV_MSC_Gl5c6dWhDBj0fywI7XSGUUfSoW_mXrqYZLN1yekUPw9WjD6kX7aPp9NlDgWzfhjcpI7hmf2BLKcTI0g1UPtdOROZc79ohsTAtaMBOcJErLZMmY_sg
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

cf-ray: 745d1a90fa42913a-FRA
pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ByVPrihIqD6OLERH5IQtXBdlhjBwsU%2F7Bq3gVeH5JMJVyuKzDhaBT5%2BwBtAcDVgpEbj9aUXqqH640f0urzzOOnCIu21UeH86GKak7omroEvCnShx%2BBjc3qWKGX21VSsQImG8lXPD9Kpaxg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame DE9A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YxWfMILA-dzhxOBM2Rg7RwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1

43 B
841 B

47ms
47ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYteHDmAEwAQ&v=APEucNVc-CBEDMoLuWP760FDdjZ0Pj04fIJ3dPk81xOEAHpVii6_qS6HvcQ4kyYhV_MSC_Gl5c6dWhDBj0fywI7XSGUUfSoW_mXrqYZLN1yekUPw9WjD6kX7aPp9NlDgWzfhjcpI7hmf2BLKcTI0g1UPtdOROZc79ohsTAtaMBOcJErLZMmY_sg
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

cf-ray: 745d1a924c39913a-FRA
pragma: no-cache
date: Mon, 05 Sep 2022 07:03:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uzEWbRmcHejSxZeQTszuQiPgybbdIGmLrH3olHpEmVfiyQrwTx9sZccZXf6iO7rQaznw50igEJroVWE%2BEQODqkWEkuMEAXJump7dOkOObsuCTR18fIUr57mWnJJkIlcXHUZKbzwYiC0b5w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame DE9A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFwb490aah9VsdsPJZnzWmg&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFwb490aah9VsdsPJZnzWmg%26google_cver%3D1

43 B
1 KB

60ms
30ms

Image
image/gif

185.89.211.12
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFwb490aah9VsdsPJZnzWmg%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYteHDmAEwAQ&v=APEucNVc-CBEDMoLuWP760FDdjZ0Pj04fIJ3dPk81xOEAHpVii6_qS6HvcQ4kyYhV_MSC_Gl5c6dWhDBj0fywI7XSGUUfSoW_mXrqYZLN1yekUPw9WjD6kX7aPp9NlDgWzfhjcpI7hmf2BLKcTI0g1UPtdOROZc79ohsTAtaMBOcJErLZMmY_sg

Protocol

HTTP/1.1

Server

185.89.211.12 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:12 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: c7954927-4f7e-4de4-8fd1-f430eaef1ed8
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:12 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 8169ca53-ee70-4207-81a5-597973a07568
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFwb490aah9VsdsPJZnzWmg%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DE9A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI2ODQ4ODY5MjY1MjMyOTUzMQ%3D%3D

170 B
188 B

32ms
32ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI2ODQ4ODY5MjY1MjMyOTUzMQ%3D%3D

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:12 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 0b23602d-28ac-4312-80ed-bd2841ce7247
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI2ODQ4ODY5MjY1MjMyOTUzMQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0575 0
20 B 56ms
55ms Ping
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=3469037814736&version=m202207220101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0575 0
20 B 55ms
54ms Ping
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=3469037814736&version=m202207220101&ct=76&x=1&cor=5213036314406419000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0575 79 KB
33 KB 112ms
66ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CS1bkLgLt8XEFdOCuvq6eUy5_VAjOFoAXU7vDJUjNi-TA6Bfh6cSrOqE_OsLXroSGdKvfvlGr9WRvbO_9wQucZHywJxQ&cry=1&dbm_d=AKAmf-C9EykIRnHKz1655_NYeL6AUoS1Q2t9FIGKA8QMWfnV2K1PnyPg0qRtdtCgSrAzld2yXN8uHCtlzSUswe5eUUjP8lWeuoHHX47HQXXTr2lt0ViiVlaGQh0vtaoWOZf_kLxnsCdbl47H10qUVGlHeLrj97F7gnqTQa9qIa6t2gk2q7UvqYOUMGCsC17br3rMWtdov-wmVDJ9CPTF16dulqscmHCK9GZuJlRxbckTUS8NdAW7LX748_oP3GTkbF6EksCflDS_UORzFQNCrPAakkdTr30oJjkTQ72dS75SZ1JE1eZaNQWG3qYfgMGVIDHAen-txm4HJ0x1fK9KP4lWsAwQ4e3z8uFLqSASemMZWiNkJ30-T2yrCKqUoMF_Zaj1YYhuW1vpTG4F1gSb-6uvkI492SHLxzUu6dqVcL66aQ5lZW8p0V3ZJ7FBD2UBwoJIMNM5m1roj4enqfG4FldlL9fbcIaHnaQbc25TPgvbdfuoB5Rx_dFBZdtf9CCSHDXwtACTQaunSLGY_7BCeEpo64iquzoRxOHOqbuW-YiTJI_zrvxJ0nUiRhaBJBw-SXBQlUmHy0qA9bCzpHDktjOi7CuHGv2M1uiqXSC6L6iLxIMJ2iiLSI6cSaXnX0dwgG0KMVBfMFyqzOTNfB6JDSnYCMdIgHZJLY2hWgXNNOmJaSuaJswq0-Faj5sMJf7YkgBaiMor6crod6vppOaPmT4iS5q7c26QvsHFJGHypmANHQjCf0ssd-3igd6G5EROJUgApx10AwoR7YIm1ubS8xipGaBcDANcPCteICh2R3ngxxEjmBuBdkdNklJc-TC00uAs5TqNxgojPVnma_1mMK2gnmlopI6j4IupjirO6ghP0Cx9v-OJJTa0z8yIVtOFhEbqz2Oz-mIwTHBKxJtIAEGXaAAATwxGqPbn0J_eNgG1mgV0q6e06ZOD0AeTzOoZHaxcIN11nhobzsbN4fN4oi-YquFG-QGgv9h9WlVd5IppO_oDJ3rwdnq8_RfYLntd05aceCikzD7InGtCF7RkTRvpTQ9YgL4o_MBIw9AIMzSLP-yAjJ4swEkaFAXzjOozcKZG4I5c6lu0WdwJ4Znp8cev-nIRWas8fJW-iYGl37RWSiJpz4OCwrp3hWkI7VAN9QlbD5k328IlIKDGdtjMF_ATHUSNy1HKAeHD8fVzafMjzGs__XEX_qF79UoZMyBcmjCPwrXIPOFud0RHNREN2sW0pXxzZoZqkIeJuVRTS60oF5HY_AXbEsd1-FvV6LTn0GOCoN4pHvc-eOQ4swkC2sECt6gx-6CJoEPWr5jq-n4i5fZNJcSR2v1I_LSKRo62ZHSkFgXMe4FE0RkFBTSIM9NVQeelmyS3pF6UCkrYboZe_HzOx8Zi0tQW9TFwHoUNkBshVqmLxg3SQ0VPmc4ZA7TGu2ur8peUX2rUTRJd-92H1R261gcml0VMvGzZrwziy_OMonllvmKaCWukaWZ3c3AnNGZP5FuRjq8wUpSWwu4yATmqdZvY_2TjF4qAJvej2upPrQnylyvZaplGWO2rtfzS8Jk1tU0BRqfejMQamEG3m42bWudaVX0znc6nJv3rIyrGut_qGHaP3K1onR_6vVbrICghz9d00QXoWMi-TZNC2GF-oBoc8bOMJfc5shfrd30Mlz-tMrhnIIfP4MnV2QGOzhPqlOWbIlgM-59jCMquoTYX2jWniX0nFedv_tKqk1uZlstADaa3SyVRMvPPxSeIrUnopiS_loXPrHfP3qO5M_mgWQFK7fBVw3hkw3KzttwpmtP9WbdJ080kjKmOD-MIMS6SRuuZXJo1UYqN-LoDdDsMOTiqOc4axkwm-_1vxZPjhIRv3eStj-u4psdXXC8-GYjXSeMdsZ46VZZYhBIA6sLGZwKiYyIskQ-38qkS-ymNMfJB45MpxmDBg6CcKh9xEqMgVI7WcHdCf0I_ehCLYKsogwwWyb6B8mnjcDwqsWWDM2rPySLcnl6DtsHqWQFvMG391OOH58uQ-sLHAdc6CVYaPRyT7tb0RCd-xk4RKrB_H6ERIV--2XjwjJRZA5cJDY5f2NcOYr37gqN0yhifVGW_sNJXN4kbBTRMmAaiV6TS8sMaLlpJSoHw-W1Mv2Zs1oHOY0l1vO_N-j-EoWABF4Gy_8prT75RlWo7XhPuzUedozXKvLMNny6QrwkEwixyVU6pWQlqySsDyW-62M6wSBM2gWP2mGPh0VBi2U4NlpctPssOcEf9uI0QUA_Y7863bUZD8Naps1KKpwvfDK-Btp_QrouaxMPQ4sKuVAxbeLTbZ-OcDV9S02OoCHudrfr_QCZN-Ywipvaefg07N-_poPNKkBDSmNXYEg_wUBshMnP6T-jThECzV-2sh_s7FAgn6t5HdLPcbhgQrKWjZvQNLR3Zi7XIihY13k1dtCJ3EM8T9QSBJoE00bsOXL-1kcmwHi4xChVl1Q4EoZQU9L37KHWeZfmc6F9PbVx2YSkZ5k0ifCCtnA_0lpo1h-nw89Nb29Ti0rpnNMnShY4B-Eroftk0jnjBYZocuKLU4R8f394u7db5MQHm7oJldvYyuVW6S68kpriexywVhZARiWLEQ1Yn_5p5QYpDlO8WwNqffx3ZY2kLls8UmSyRBjRYKnlrW6ZmiMDEBc3ZqdiPLQzJoZBcMTrxiYCPxptHTeM3-SQtXMVp3iKryejfDrRW8sBAKQ3wsMUaWM8hIrOD4AUcUrCv6WQiNSq1VdqB-duXDZAoRhE3xRfjor6ZbWa8-lQQ5xSlMQzt3f1tTchY9FET3UJSykEV29sZ7iXnLgXNZb2xKXlAUhiWE-4UTlvHCTqjojGqnnt7idwSDTN557kJcnI2KdEyI4PSGTgG_rScl1uVdMNESnk7WpYP1lsv2rOBpHZb_-VyuObH_AQNBtcx2GH4Zilq5aZGOFeUK5AS0T3kTcZODTOvepkfTm5_NGjrBzH1uu2u1Mzft68sAi2LPoPvhVlCvJA&cid=CAASKORotJGuIuQNZfuJYxCV-Tuaif02skOC3dh_7C4D0QdSvIXLvuxa0bU&dv3_ver=m202207220101&rfl=https%3A%2F%2Fwww.dcard.tw%2F&ds=l&xdt=0&iif=1&cor=5213036314406419000&idt=105&cac=0&dtd=5

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

81e42175c515e146475acbd50df170b74270a8d1e16f4557634eddda094d6fc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33946
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/ Frame E2C7 30 KB
12 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cn9fEjlGhMpQ8vRwuN_7gK_KxQNzX_zlm_QHdnoLEJYATvd579Bt9Nqj1os3Re_hQi6woG3zDG_gL9k9MkEqHcTYluaJRMIyxq9PvL1i5XYgPNGeOAeStNyBh5TGttyxXbQOqgSuf_jLopPWOhHuQS8ymblA&cry=1&dbm_d=AKAmf-APnpX_Ci5jZm5BLV0nFBZpcjfYNXJuhdjM-_B7fZ-cLQWhA2bipCLOCXhwZWN-BJH9iIZ6rzwL7_p5GGZ-uiCNvEvdL3Wk6uQzxjeeUfpB0mPwupbNgFK0YlZgiCYexINpkwxTo-EUyCYP7cJB8JlThUy-4v6I2wFGksl9H-M1-gd5VlaqpSBj38Q-UNtI8RPAEZ2Vh6sdU5Awfv9S187fWNzAp4MFrYNJyeHLK-mU-YP-lfIKeFuP6wCboRaTIb1gzbU5EIE4RogWcoLCAmWTE4aKJNnayoYrtivuive5ARYsA_LX2UutOn1cLD725rrbDJu5wkJqD2TeKfuhCVHrEH4l8zizZwWvFoIwg8FSRU2t7lJDRTMLVmDSy0_ujraLw9SMTyhEc62aMtgVXO2sqP_cVMjHu4J1PDKEY4pQN3uU_tyyJ4vcivieCxGCKkuAoNihWzowKHNfLDFHd-wIvTevGqMqouzS3hvQ0JO809IREiyDN-CVPzswqenMETkYjygd81fOo8qN_lBclZ7iFAn1qmYHf5zC-GrC4DSTjN6lgPJ1MugvaYGEXYX6FvjEaTGee5shZok8dIIOejJ-51zQfKZlMKbJwNfl8sghEOJU4DgIaNo7OawkX80WWmGAmEmzAp4GqPchcqGKa1AIQq3zjvPEtHz3L0_cVlByY6_u61ItwKrPJ6bw5sF87MTa8kq67T-q2PjdlSQZu-nsrFqyNtmZcjGDPqemCjX3uBjli2xW7tNw9vO26cyVTJewbZzHSLlTZSth9DWdvxImhwubnkpXMTU0q2De6j6jveBEDw-6rQINsgpFmbnuu9U1Y9IOP8ciZyX2q9lVP51rDR67tceZIycx9eEmZ8_T32mrkeKtzDCptnDVK_4KmXGwrp9vDbzCriNyE3v-D_LDudiPK5HZxsAozBqSaQRA8SwgEwRUK4yaREUhU8-8gPF7q5sJkUts24J4cMbraTf9fz_l4uAzIKy-ZncYCeOzl2HQryxULFV61hkDYv4KeNVQlhrNhPYP47rffvQSx44lzgii6CxIrxdYu_XDuS0M_62b4GB4mzVNwd9oDpz_fpLmvUmGeUgkq301q2yfsunV1NxoTj44fhxY3IyF0pyd2U3toRvLNsKg1G-Qt6tFLpfpWnn6Zr0TCEY4WS_G-4drU7izMt7tSA8KWObbxRcq_uPmx9oIlPdQdcFPht-ITLNpwC7_OnDnS4tXGQWM8FIrHEVw1FnPkuJA3wqhQOAu5Jv8XLkDcO2TjQhIGwQ6g3KL0qHHMGwsotDf1rOf8C1Lj_slTAxoYoa1LrSQ6F8Ucs5Zt8F8D4eg_pK97LOQJL_43r1qjyERnqGhUN-LOJVSjaYmPFQCbqYzlhOSWxe7TYMdnhRjFT3wdYsJ5KH9zAPjb88s9EfUO0VAlBwqVT-3byzb1LDrszcwyOwX-PN7PvwB7K9RWsHLlePjjfZC50WvefNANDSLiE4AE00V8kBHSsm-kD-B9AOm05aVkXLm6fVcDAt4RSVAyxI_kO35C71oN0B9Id7Xn1ZscM2bk1EFRzgEpRLQDsewbGR4PzruiA9LpEZeRk2lS5rB3oEzCvcLu9B6GLkNt4ENKC0uNZtkDk7ujw3r1MqPQKnIJ0mm7uFp9uD18qNroX2snmsYAzHw-AFVgokGFbVE7nhC0iULAMSG1S4y9H6_5escKXQB4vcFm64SGwXwud3RztVxaSQSlsPRcUBi5LhnRje-EMAgBV45cK6NK4PWoSqrkHENPTi_BSjhOyMbVcNJIQleQoYl7yt2EwnZtwGRv3XYpzxJSA3Hfw5C8qPSDz6APZa_RqUTJsNGu7Eakg0q6OIySroe5kNDbGVdkgICvQleNZH1iy7_AJ7k6Jn_L832uw8ahaKw4gCAHmalR3OKoC5aF0XKjJ7FOb0AYrwTjorybUg0oWP1RsQPZ2KiJVp4OzWXcQNFcyQVp_sAycMi5X6qfY3YtLqTUDmwpN54w2j8XdhRkPM7Zjz2dMUpImR5E2xplOYzQKnV50-NJH5_3QSyVMZ8nlzPqnv8H0jYOKFRv5v8YxJJP8-vAUyATdRl9kNWo_e127Hv4itNtZvgpJBnULXHSq7BJdQ2XwGgQm9p1GpwXu9uyGE_-cCi0YjQu0eaBODcTJFq-lDdlzh0Ffq_CIRuuCq0llP02SL7gYbmVkdHPsVmAIFXeFBbtmoZDoPF4w9omXs67VBXvvdHzm-21yNP4uyo5DY7SgDXyB7cRwpI5vlnp7ZFJgCqJJrp0thH8CJ3322RRnDXZuOPm0Z1fTqZ4V8SS4hFdbfKNgk8HkEGFiZ0M1-ISB07XFoo97jq2uZbbJdOq9EZbH-4dEFVJtklVG1PV9Fgbnetor5KXGNDSC4sCgVo3lslNXZYB4szR1e1TrFhBFWA93YVzXApKPhODmZd3GRCpDnbgAId-g6qryqbBjRQaocvGXzz4p6TsVsiByHL5_IkfKs4zBYgEmnQieXQ13Y_okni60HhjMXbJh5mLyRpC3div25gvBwzjpW6w1grrv5txpXEGtxcghMPfc-obBsvFFMr1oGZ9IyngENhLc24Y1Dp2ZVAUeixkeV2ZQeomd-bdukoElmwKd1IACgQd6h51Bg9G7NSMOOdEAbIQ_7yy2J22JX_rL7dIepPKpDwtOZBI60ceCimVqCPsVYA90FOccEg67hkuh7P7J_9C5Nc3nnoOQa0GSq59QeeKKJzNrqK_SkTd2q8j9lN2BsLVAFIzG1KY91UIXvN_fzzFnBacqO1NhYwFZxfPCDisDUvat9HV6jlfu_j4A4xbysthIe_6YXeOHeJ9ahC_K0xv30D4mpcLrp-YNprI5rT5VW9IaGkiMcIEe3qZno9fjI9BVsc8XtxSR3-IE51Z2aE2w3LarX8dyCOoUkLOJqPOKmPhQOwhGYAAHe5KcguaEB--wNNxHtX8x3x5j6Zyn0NAe2Vt2E4PFCKq_KWbt5LvagB3SX0c80-Y0x3K7dbcX5gQ8aFyn88gAlAWkrP37QD9Xgna9kF-TdoMCrElfsavraJDv4w6OvIxa486rjIRnzYjsfPBQiP9LdbxQzZEZpYf7wEE-4WVeLaesWbLGqfLY80AUZHRrpuT9hzmrYC2BLVUB8LMBfvVNTG_zgfpjA0ZMEkveQ0DOqL8j58F7sKRssSZd0lJKvWlGMP5HhofGyCEqaaHQVVefI6_uziXEGWPZKT_ggm1rvGzsZeSQ1PIrw&cid=CAASJ-Roh-K9Hk_HCdF7Gjx7IBVphU4jQ7Icz10veKHFFnSjff4yk26H8Q&rfl=1%2Chttps%253A%252F%252Fwww.dcard.tw%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35700fd4dc1a4008ab66bc0e57c19689f6daca9368bfd2a6beea1b86dc0159d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 07:01:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 87
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11778
x-xss-protection: 0
server: cafe
etag: 15541287485089275602
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Sep 2022 07:01:45 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E2C7 41 KB
15 KB 55ms
23ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 16:11:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53506
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Sep 2023 16:11:26 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/ Frame 6927 30 KB
12 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CjO8m_VM5aWcA78uiOUEgOvF9LyNc6e9S5YQotIS7P007UEF9JnuldirLQjLPSuvsEHp3HiASyX92RMq5Xo-DJiylOBcEdHLo3uRhtnv_xtg_3Mu9-cV5dUQkn2SSLiOh6SYrhFLA1C-DheTLwskNy3nMwdw&cry=1&dbm_d=AKAmf-B1Vfkumcy-HNFTdK4whEzmaCqLknk7rN1wS-YMYrNK6hpkmYVsZxX8Zom56-uEwlEf1C9026fBDkLRmzIVtAwu1Onbaj8QparjOC2sRuh-JQneZndlVE-3nKelVWSLVCyz2Qg21e4Xip01tPDtJtU763pidX6FSMC7iB35taNDQyzZFJeKSnkz2uC77Zyl2Nqsed12ZwmrwGinlIcwjtCF1u5d0RU-Oj-3DFYj4TxBxUiDLt19b59PRjFmOpOU35SY9f12dxKvqw1ankFEtGhiobbrTerxPOL16yolwHXiuXjBx08jKpmOzUwoXFWsE-Reb8jZDlNaobVTMnNFht9nR3NhABxPVd9_USbvstSrmEbZwksNx1zhvmOaCqJhuil1LE0XJGZhDkJG0pPyL4uXso8USOPcHQqSUtLNg7Az58A8_mIAOTv47sF3p07TCPW-HUSm_XdoepklSulKAf8ehGFIN6VBwFMZfS5CDREla5nBJxLNL-jfzvUd8pCL1Nmnl3wiMUwhnfzDWSRCgjRB8uryVhbgWgYz4CdBWnG0dZ8DljBhtm3YvSdWO-jDKb_ekQqW1S2Unn756DjOHEkFzhvSrWvJbCyK8BUF7pxRhBcaOXdyDH4BR5Ql8fBc7vJpQdOnE2kKwmMSAVM_v2vnDw7EGPw0o4SzFp_nlasNRUXwsCQ9uE1QrN0xydhgnilsRSFlML8yhrh-cpkEa3pFAN7OuKZRXoEClCduSlp19bXlmYjAwivABAHDvO9j7lSke3dcZJpjm9l_mUqBtCHF54Z5jtE0P1b9PZMGieNUFrQCYQ1LQ1WsPtb0XA0tW-Zp1I0BKpqLKzGFiqjb4MnrvY_IHU2oBgL4ulqsJIMy-zMXG-kPprECRM2h5NOqYJkbTPD3zT362XQv5wGOGIcu0msTqO44TpzKQjFHXmocO6I2tg0QQk9sVnzHmekbEvAeVuRZ2aN78s2MBteJZ1gNIwhXHB4xiyTT9fcbp--FghcuypQ0gnSRhQXQHZuvuNBoEQ5BHNLGWlTmeTaq1BpzVJ6YeBAwFiOJRXvw0cD63cKozKyIXymDshMiEnG-VwfEplhwCqhEpvlSZMEV8BYdNsT3eT1_HWkHZ5rAH5FugUb78jnqJ4g8RlVDSHg6wwtuQ-BSnR-tcq5HVSGuA8o_BhDXX0Ny0-DTN2l_rcK5SGqHscUvGHwRqQPo1-KCRbWr6mmSFrkj61fvOrOmCJWrIBTkkdxJXgtSO9jx8MKZMlgrzOzUpZF9TG0sjNuodbfPZzNr1KC7ydYcpF9JlF80M1vK4PO7YPRPcwwtyNM_RtCFcFb23YQYUY9f_bS2cRPb1Va1wWcQO0rCtm0d_nhc7Z_eU_1NuffWovfxrG5y91hBUJITGohTyrJmne1wsXFkXbDYbiEmapJzUYtYeM7gIHZZzwH8NZvlA6ytxYlxB8Kbsk78ZpRaB5eJMg9O02Mrp_pMQfEdOGaCXIBOwvusPru81feqR0MU274bxUzWR-kyQS-rz7fhVqelIw4JPw_Jtr9Wnvg8VtDnWNtluPcEROfszDM-H70-ZUoqsF6SyAD6RCiv6kV4WPyfXZAQ62dL60cVNAKoQQty4aD8R5tV_XboP_9QVZq4AbDY73epomG0SCRtxMdn39S4F5mw5BbMpxM9K1eruX3zfmwEpCLimaSwajiri2ZV6muG7tPP_QKlFtdxPQ0gc5JDmdACTmcKMdflgzlUhQS-6AbL6pFySfvMIEiFoquguuNt9RKCXnqvFOZW42JfhThYj01v3smYeM8AWlpeeWFXDvGeiw9T9r8RuG21AZYK9l7cVSWc8RkNlPE8hs-F9yTFq8nUp6svR81em7mGBwURLScsP_lFCvo6CAt0Ac3M15DK1HfEMgFdQHhxRkCHrXy_CWi57TxuEUSPYU0qZ3y9MWzOkhhYUAYBlxFmh7wBuOQhPYQZckL66zXusWNE-AGaz20MZZRPT9bf_dhuY5wwCJV8Qd4X2t8tmEhcz6mE-OFrr6Oq55-avFfcI65E5dEdP-P-WOajuTNFTuWCy7P_lwuPK8-p7Un2P-PB-OR_RaL2Mbl5TlCRts-ej_IdUeQw67NpKQTgqKtd2jCLYS3gOMCoXL2s1ZSCAnwZGlGFn8NUedTPR5kEDepktET05rZBkYOUb4Yor4cBvUVnuPpPyiY2Y5KVcQz6QPFIAqxwpcTVZSqwK2tZQdGpdkfSFj1mmwZ7n_yzUlvgfpvAc-WX3Xz-2kHIoWPm35PSTUWNfbQc_ojo1OZ2zSDbdai3X-2cBTGzyBkY3fxWfOYNRf9iqSKdNBJHqsieV259jSSeM1y_9jgumRidA2I3yebwLWl93yxq4R46ohkFNz1RbxgcUl8ujfZpm3OvP-zRNL7I34jMl9gbK2CoK0DdB6p6v4pup5bAmA14NUu2oeJt5FamNbGwaayxn6xfJ6hTDUkIzW7Zo_WYM9kbJewMlqzsV6r_XiNQ2svFLDUCiqy8n-nuuI8kuP_dwRpjDl-U5nJhGWIvbE-oClJg9-PuGF1nY9ScEsrzxvGLKYPqRGFbmk4q7XCWrN0uA1URAfYS9_FLPYDz3XtsOY0Z6OSAYcMHvieoHo2n1odLRQOW0Qd7JwevQfURZOOyIUGArpmeeX3jsjoIMSE3u-G_p-CGoz_YNuv1GOCGlrnQbay0_AuVf6epEjo3SQaBsKmfz2YMJ6EhLry1KdZx4xJX9nU4DIgz_RCEdlpQqtgG9NaNMoYCRxGkgQwpyJWbj-670rsgAzG7qhSfxSqHKGjoSBRJHp2uI-irblEVeYva4Yu2O3G2cqaAu_1UdxigcBQMBc2hF2tmGEM7xXG9JWY6RFOjNf2cSIov9HmVKYXp0zAwZzrityV_Ywb4l3bduXTEtYygFIYjsrQ2s66lQXLXmnK2gVqDwEpn-9d33Tc_GlLY2Kt-D2D3ZLIQCFLUfXQVDBQmK7Uomkuq1TU4dJbCdY2ViptNmTyLBAzZ1I02w8TX-H_NNkB7vbwGLeeqC49ZY21LsFXJMweY593GAJYvsUszSVzV48Q2w7-aRWIX0IzZYSZvjphoivSTX7lMwtNiohb7Vy1W9kxhrAnBsgVsikRQCklXCDdB5MKrLKW3s3Z-UANKZGcmNnULyaD3G6o4_9UzU60_3k4QDXnxgiwtFTC8oevWBBCHp1Tk7FdMMF8kXyQAfJSlhCBmlPPU5RzA5zBlR_XlC_Wka19BCuJpOa5uSs0KlRRHcJJl5kvWuQU2&cid=CAASKORoXxQ5YLsfMRyH4FZO4OYXfoFb4RtcdXCujboksDY9nT4TM0CsA38&rfl=1%2Chttps%253A%252F%252Fwww.dcard.tw%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35700fd4dc1a4008ab66bc0e57c19689f6daca9368bfd2a6beea1b86dc0159d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 07:01:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 87
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11778
x-xss-protection: 0
server: cafe
etag: 15541287485089275602
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Sep 2022 07:01:45 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 6927 41 KB
15 KB 40ms
28ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 16:11:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53506
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Sep 2023 16:11:26 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C8BC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1

43 B
841 B

78ms
55ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPxZBCT7Z4BGMj5rc4BMAE&v=APEucNVQZk2QjPrbzLX15Y_-s20u6BYrFpUjpiCejwkCXVkad2xX_n9ffhSGm-JUJDi68RAPWQnlt28x2M4v0y2_bikApdUrp_z_YqfMASVMEagW4adSaeI3ufiai7c0ar7t-KIulFyceoYzoUjyGLzngLYcR3d9wm-X8-BefZqyMyKKZKVrz5s
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

cf-ray: 745d1a90fa44913a-FRA
pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O7gqJnCZe1mgcw1HOFdpwISRS5PLG26PqcvKd%2FpKtvwxzCn127dMNGxfcLiFiD6O3oir%2B8oHJ6oPq70c8dRM54O7keuHhzu%2FdVvOGYKenCqpeVdMgM66skaVXlOelxdBu9wvbEH1zyoU3w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C8BC
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YxWfMILA-dzhxOBM2Rg7RwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1

43 B
842 B

43ms
43ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPxZBCT7Z4BGMj5rc4BMAE&v=APEucNVQZk2QjPrbzLX15Y_-s20u6BYrFpUjpiCejwkCXVkad2xX_n9ffhSGm-JUJDi68RAPWQnlt28x2M4v0y2_bikApdUrp_z_YqfMASVMEagW4adSaeI3ufiai7c0ar7t-KIulFyceoYzoUjyGLzngLYcR3d9wm-X8-BefZqyMyKKZKVrz5s
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

cf-ray: 745d1a924c3d913a-FRA
pragma: no-cache
date: Mon, 05 Sep 2022 07:03:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FWeZoSSCJf13ld%2B0edXpEjBQr9ERIswCrl5NLL89IIkRfXD8u8Nyk0Agi9qVEKKkpJzwg7jsf1aPzm33LdrBkurV1FvtQqH8h7uMnY9xRNTqXplumGDXe3LPtJrcFwk2hRZ0W3iZ3uZ6Zg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame C8BC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFwb490aah9VsdsPJZnzWmg&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFwb490aah9VsdsPJZnzWmg%26google_cver%3D1

43 B
1 KB

40ms
28ms

Image
image/gif

185.89.211.12
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFwb490aah9VsdsPJZnzWmg%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPxZBCT7Z4BGMj5rc4BMAE&v=APEucNVQZk2QjPrbzLX15Y_-s20u6BYrFpUjpiCejwkCXVkad2xX_n9ffhSGm-JUJDi68RAPWQnlt28x2M4v0y2_bikApdUrp_z_YqfMASVMEagW4adSaeI3ufiai7c0ar7t-KIulFyceoYzoUjyGLzngLYcR3d9wm-X8-BefZqyMyKKZKVrz5s

Protocol

HTTP/1.1

Server

185.89.211.12 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:12 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 88fb7231-7006-457d-b73f-5388d85fae62
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:12 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 14b4c7ec-bed8-4fce-a370-f6ff30cb5eca
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFwb490aah9VsdsPJZnzWmg%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C8BC
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI2ODQ4ODY5MjY1MjMyOTUzMQ%3D%3D

170 B
188 B

32ms
32ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI2ODQ4ODY5MjY1MjMyOTUzMQ%3D%3D

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:12 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: f435abac-6ee6-4518-a49e-d1375f72baa0
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI2ODQ4ODY5MjY1MjMyOTUzMQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 73D9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1

43 B
844 B

83ms
59ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYtKK9lQEwAQ&v=APEucNXbNLIN0_oWUXEWMg2ZaoqCRhyU0c7k-it9DuwDSV1YvQAY-AITJ1LwuqyD4dJLk6LaY5X8v0Yl7jEyoaxlDg81NfyBnoAIJElnOepgNHqYwTGihtoIo1NTPBsBTEK2UQd1-HxDNzBXnVVAYePZz-Y0FwcMC1rAQ6_Yi3rxGEvRym4VgwU
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

cf-ray: 745d1a90fa40913a-FRA
pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2rq4EXtzU1SDq7o9xAKNgNlNQKcqyqxFkVUQPMSRH6YxQapWQzVjhJVTn0vS7DKtKeObxKZHSODhxt4xTuAB%2FDlSyWpRIeL09RGk3BZe8iaT5jpo3irl4qDX1SnhEzb%2BnUU2%2FAywSk8ILA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 73D9
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YxWfMILA-dzhxOBM2Rg7RwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1

43 B
840 B

41ms
41ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYtKK9lQEwAQ&v=APEucNXbNLIN0_oWUXEWMg2ZaoqCRhyU0c7k-it9DuwDSV1YvQAY-AITJ1LwuqyD4dJLk6LaY5X8v0Yl7jEyoaxlDg81NfyBnoAIJElnOepgNHqYwTGihtoIo1NTPBsBTEK2UQd1-HxDNzBXnVVAYePZz-Y0FwcMC1rAQ6_Yi3rxGEvRym4VgwU
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

cf-ray: 745d1a924c3c913a-FRA
pragma: no-cache
date: Mon, 05 Sep 2022 07:03:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ho19iHjylb3gP4gFGrQMUmTLRgPdD2zfpRMy1%2FZmU4dhwDoPeQi7E83OzRAKEcfvB7Xal7jVs4eWQgFspCQAJOSSFsTO2Sl0McejINgUuPmrs9lwnvwm%2BfkSAu4FDfe8liD2vrKhu8DFsg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENotcxlCSzgEfRcZDiwg1os&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 73D9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFwb490aah9VsdsPJZnzWmg&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFwb490aah9VsdsPJZnzWmg%26google_cver%3D1

43 B
1 KB

74ms
57ms

Image
image/gif

185.89.211.12
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFwb490aah9VsdsPJZnzWmg%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYtKK9lQEwAQ&v=APEucNXbNLIN0_oWUXEWMg2ZaoqCRhyU0c7k-it9DuwDSV1YvQAY-AITJ1LwuqyD4dJLk6LaY5X8v0Yl7jEyoaxlDg81NfyBnoAIJElnOepgNHqYwTGihtoIo1NTPBsBTEK2UQd1-HxDNzBXnVVAYePZz-Y0FwcMC1rAQ6_Yi3rxGEvRym4VgwU

Protocol

HTTP/1.1

Server

185.89.211.12 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:12 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: a9cf6817-ddfd-48b4-9a9a-83a62a497f1f
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:12 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 10facb3d-e2cb-4afc-92df-a4e563bfc907
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFwb490aah9VsdsPJZnzWmg%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 73D9
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI2ODQ4ODY5MjY1MjMyOTUzMQ%3D%3D

170 B
188 B

31ms
31ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI2ODQ4ODY5MjY1MjMyOTUzMQ%3D%3D

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:13 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: b5703b8a-46d9-43d9-9376-02308292ed81
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI2ODQ4ODY5MjY1MjMyOTUzMQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/ Frame D910 30 KB
12 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ArRchj4D3yp5meNiAuS-5lpX6Loq3hvSAud8qgpmCjJNsr1hvO9EfU3BD_hchigQapLUkvvnwyL77aEPBH62f6-MtJSVo9wT1K8pAqKTXHBny9-ow_oFtVis4IGQJTuWn8jDSFD5pbPI97SjynZ2zPvmtahg&cry=1&dbm_d=AKAmf-Amj099QD3Xd_vPd4jMyKEUcWMQPFwQiJ3OWe4evCq-5ngG1u7GfO_hDtEqrIXniNnos5e1QP6GNxZ14-7pfVL7LnL0ndDRQC5005wy8NTP6ofPRl1dJGlhiEic9dpXhucW0-PS9phm28LT7_jP068lh4Ef_7QdS_gSBDjUepiKpx5nXiYf_i_e310rK2uRVzQ_QHBk4fR7wzDywzTb9T6ouJIuu3DbSHGu-Eu3X-kAsjWFuDIJM_NXmTUeakcy_DgiSLzPmTwabYJlDElO2FaZQlxijTv2mA-BzNl5yzcEHHIkaYinIb4JKUPHtjlQVxcFpwCTlVZxWSZahbgPe9sOBgL3tDKV-_KzxYGkBI8qDAwBNBX0Hd9hLFxqIRf6Od1iruwPgFbVvXAX5grgplvbuF9IDXlCqaOK28OWqB1gIWh1f-LhmQa8Tw_UOp1av1wauN8iodMJG9oTsKaBY4PDAC8p26XxVACWCKvyvRFvld6ahR9dl24Q0ouXpTs39i_UI1yUTRlfGMo8gRQMMM8j3ZbpxcEsedWwvI6dqZ632WNgqES7E4iUpEBlaGRy_g7hmelKxmcnZehlRDnlxElt9E77xBroVCk2_JYSxsxOWGouz4YAOuKKb-gKdBwnN-dXh7Q1W8oG6mB3U3YdGQlxFz9kjoyqIyR1_CzIZGCAbE0mW64eMz7nZyXXKATVidL8jUyS3M5J_ygLrEOmaHuthpfAIqLVg8UAXwmciQG2sB_ufdkXGS5t3xLzv2AJ8LS3HpkncaIt5CUPUVHpklHeW5qFD3wg1x80O4wB_-Iv7PSW9WNilRO_7cR2rkECeZrXfKmJJlNuU16URM-wfKv_Tutb-xnyRSHGneJnOfUPVPddnTdXXtrVJE09rJr_z3Epl5rmKqjZKUM6OVCKHZII6Umc546OhGop6ijba2q7wCF0FDHdZ8d8JRvjFANsSFmlz6VLblbyBxfHqGDKh8haA7H0eLKQAWQIyy39kcZ4fzUU3l0UF_LNUtZ6zjGdXKy_eK4b4mdMpg38LCpkFmxJSO-4zqBTupeT1rA1gnho3pRX-7HbK-ZLyJmQaN81Yi_fb7zSr6iAp61urU8wNvMR6gNCziWMZ7DbZUaOfBxSQdM4fJOXMyWyRCmR7BY0jqNDekBMGqbguHW27ZZAPIaAsMJa-Dvn0xFRe_tadvTe8ycK9dJcLAAJHaVUNP2uLIdoxZcak_Tt_RYPW9iIi95SOtOqpylimoxDXrZwrqCDVAsJAypo9qwuJNPe6zK8EpIssFA8wyCbeHWz9xO7JDuVJcoaOoADrN89DqQCCw5KGA67u5pU8aGzo3hQLgF_Y6VVGkBsDJiHqBbX0XuKZt5I6lcjgUqEHq9hOmnP-qGxoTtR4hLSX1DULBFJJHtQes4WL4m0rW7kNngQ93Ls26vV3kcPFeEtCxt3s2UqCs_Vv-2d33jWWutfQRufRXMfc71zePq3WPI-P4jR4yldrbJts_7IVXdTfNHisOqc2-OTpQc-in-fQnEjN0fUFwOEbE30zgOG9jAxg6Ej0sJxHKy0NRaN6BFZZZkY40Kxt1e_ilOmHec2dBZIO73BgU-rgaRa02QZ62qWOKahXtiDYKv0dyxARyWaIJTfgJVr8gNC_cqsk60PfXjAgxIejDvBKnDXQ8QU2sDspRg6daz2N3-7oBnab0rhu7FfMzc9Qx6qLhMYaOdRGEcuCCoQECCosD1GRQgKbJGw1d4ktC8csFiRC-_zW1yVXhVMTqYigM88JUCWBsB7toBqw4fZNWXMB0hV6ynz8lDzXwx92Kju3pX_dF4EXv6Oefdqhh5u_XlfzvkspZLJfobtjJIcTpPaOxKwjasYo-j0r04EHXqxdp1CPa66yZA6Sa9aXkjxp-f4uSd3CnPAwY738xJZz3A69S0kcyscAzeJWnNF8XWmgHQK0KV7IIjn8xjHfthVkZIbRGlPCHsKT3bKUe9I1ljFY7IbsEDZ8zp2vD6Lnv_grn7jc6I5Hq5dBLOs1Nt_Dtbrkzm9w3q_4EH6oRaeRhfJq6-6movJpwnFJdTpwzQ3mSZp_Kwq2NvBFXLGcrf9fOjmd-sqbBguwr6iDi2fOdhH1q9LgO3nVemgHyFHaWI8iTOeIUtVPpWWLc0orYCzk5D2pQWf_CczPW1w9ZZAfSOHEPZ-3fHqSMlZIUKToCGcpqjy-R5F8ieoVOaOvYBDbLdYN-_72aPVvTtsq7z0kY_k_sfBftcuG1jayqsP-X61yTakcay3PqpE2sIw6jJyVcHZ_zNyM22TGxsRK_Avm2jB-6tvFzoDqfaeHeUMsASPfVA7IVEh-uPqjP4S5lLzRqTjwomSWsALGdIKTbNhuwZ2eZykaRhAF5k9ByOZvrNUBfVZ1lV-1nkXxPP2a1AzTAGrusZlRj6kuRVqMxweZgnyRYecRADZ1-kLkBX89xWQkbU0LgXYueiHL6Huk01kmFSrhu8-LAwgjW00sMW4cb-nMJwjNR6A9fJMczCr3oVOftxtaMHOTlqSs3E2-cp-kW3gxgVO8nKgdU_IEmIm6rV24GZXIgiFdmOcJfuG-tuTD2t63u8jlWFzKV7UyKBhbKqdyudcyF2KgEzr7acdBolBl-75obeaSAcsyM0B_fh86v6MgZNtZ5Wq7epoWIazm196oki03y3zE9WAaS-dmhcnnZexisPjiL6ayj8k50j4Db_y0cchmKZENu7COSgxYFoG2J732o4AYaDULCviMhgzut5PGFAJjgy7EVyFqDtjWoA7itPAST4FNPqr41_SXBtw8b9K8UaAGUaRK2ETbA_peeTeKdriN5Qhzqi-I0RZzrfRL0Ja8wEq91X-WARm55E2H2gR8VzBVIvssb1uIyIAlTe5P3qWIGmhTH2S5P5GRAqV-p6LC14z2C1Fgj0uGDHU-6JRZ6aCaYsngx5P_mzqaAdYK17Qq4Mrmfs173uMA1phjsMWzcZB-mkmjTGIueQAsUsoPManBzrx5b5YwIiQro68RoWgXxjhZxm6JSs2xRaLfkipaCZCY0LwPYFEj9LQ9djjiPVCcOi7YyGarPeDVx0xTFiucMggZIRF75S3-Si9IuwmCNFUasd1hQdcaOLQYNO5Dv4HAY5AHc_H8dHqmX3gwtD2OcgG7ArItp8bnQ8FCEfn5PSNQzH0kWrfDE5rFw0GLFUBeT68IHcOuesfpuX8-GIVXC_hkaD5aXYQOE-gmM6LhwNIQGOrFnsiWWYADMYWJqA&cid=CAASJ-Ro8_B7cWK7p2tCawNei3ClfAUtZlIQm6yww7LPqa2Sg6EnWBa04A&rfl=1%2Chttps%253A%252F%252Fwww.dcard.tw%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35700fd4dc1a4008ab66bc0e57c19689f6daca9368bfd2a6beea1b86dc0159d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 07:01:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 87
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11778
x-xss-protection: 0
server: cafe
etag: 15541287485089275602
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Sep 2022 07:01:45 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame D910 41 KB
15 KB 34ms
33ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 16:11:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53506
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Sep 2023 16:11:26 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/ Frame 3140 30 KB
12 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BYM4BVgKK39dqYvhGMPqcGJSZtl8ugR1l0x-9umU4feXC0aGnuEPXv1U5KJqzA8VKRW3Uv799qjsCiTwEZZa0Hk5JWOMSKfcujMC-kXc9_PqB7QFolR31k9BqzjeNi7Wt4N1dQHlaOwoE-KdmvJYgQ7LfCyw&dbm_d=AKAmf-AwZIEu_UjM4dqzmGZHTOHZHhAVxWprn-nxfdS8CpIhlZbPxsnp__RM51lIMVW67YVJqxcwkHHKX9O34-SHS9DnQeoJOonuvjcY3Y8hTgDrjFGRTKTh1DhZ1af8WCPT7aWx3NWqbgxHeBOfEty_IZPKVJFJ0JVY2HuCBp60MbcWrzgtYPEv4Ne1o88lVHA3uM0hnQmYpG9BJNNKmALNO4PFXjlUnfKsfUezQWhpl54BIYEP6mEXKCby-vLcZNkVaW-l18oO6MB8TKXGhYgJ_7qv71v97qD4D9ZcAwi8ydfK9blWqaMQ9S8dJVC5bMCvmPbgwxlear82XoG6YMBL38EkLx_FH2YVLs-Y-xXwrddxhXvptIuuInT1OGWVA4C-DOmlzNyKS1yvBE-xTroCw5OkXHrl7B9YCdaVxNK-s4wfbmB_glDHzcKa99a-RlmcXj1_zheHtYFMlRZoa10E8i9_-dAfYLTDIGB066Cx-e46yxrIeTaAyalS_a1J_1AM0OC5kPTGZRXHgq4ftzMo37zNzuz55fs4LYFJvgectJ7Z6fptZKlegG-efoXqRidoa9ocL-T_UGzGOS1Awd3RJSBB4tTKAvy3B58mC0DglqrZOY5Hc609DfG_JGRpF4abzWea7Ch3USfFKPFLk9vLLb03XeZB05IYurjsLuYmnDryezdPZQBWZKIGvwPhZhyeIZz-864bOcvYCmU2TDuRH4DssnmktC1qjls1r-runqJ74_ora1-NC-M1sa2nDNQkCzrLk3dvwVaLj5HRaBRz_aCmTvsm3UFLmtKaIYQkizxXrj2S6N7-N2Dz-cpeEF06j82cUetJ5UYd1L8B9NZgTsGYEEywzRBtYnObXZqLAMfzNJmJ0rSUM8EIvdYiVslzjzFFPX-LuE-4y1BltxWFRhZFSXK0qPxzdmyPL1y756GBl7Tnv8CefdP9jemSnUR075_Ibe489ha2niw0aaNqTKlRCDFp1ipieHfmaghaS7DbHSOtohQED_vSvwt11m27ZeEI1K-ijWeWObSPBJbqeTyds_yq07M_Vd3hmyM53a1fmRhNXAGraYMCJXmBFKHhE8bTyuvOmRzxreLEzgNIddD1dg6EInJWfKf1jEJyLLb6DEKyqjVoaVGyPytsisk0CTt0mUrgu3daH9H60GTDXoMqpnVVVGa-A3Yz9rQn0DqEBQ7NlB6EiEY3ARERlTwNsF4hdk1rIMwjfkxz_iAa34RNNwEApnQPLJrkozk8179XJ7ohe60kVOCysFkCMUiWOmDTJw37TPfy-JI9LpTrkM6tv6Xhd5tiIsrJ9W3JKgqRyfwIrFozuORD4Lp9nsGlfdpXpAzt9lv1Xo4gTZtp7GME9EsN4AxjVkGqvo9_4rXD2aQXhu3qDnANtSJ5mPNRI93hba9ALTTEwodejjO2hJ_8aJSwJBgq7K-LC2E35KjyKrl-vP-VjS923l7jBqHF_0HpaFovI_e4gGer0q4mIefpXERPojx0e_ajvVWtLX0THiJOMkZC9304k-pqhb7Zzrsf2Gmgn6S5oZ0Xfx8GfBf8Ut9sxWhd3YmeFfvVBfnfukM0wEtj4OZykutzcVwa7BFycJTLiOGyqUH4RjOYxsg24C5s-vi1555Z55_QUUM5pnwggrxQLwpkLIO8Jw_TGquFJy0ENMU4RsWxCgFwTZpHVsRgUID3B_y0olU-0D4McpUSDaF0Ns1lbMytre-0HlQrTiwtz0QpwDmANnqmRqrw3c9TwPSuQLkaR0Gtx6t5Ufm2-0Arde2UPYjPKz9IHljbmDrkIFEUpgvQ3pWwBRRDvhAFyKjWxlZ6C1cSI12uhVpoonpcZLBsTVYtxKphy_u041oka9Viq8YoSmIibS7XVQ4DAjxVjuegZ_YCBNeVcuW2jsIHYeRxxf-QF25LHeDK_f-q13UycOgjmLgb8OlYZImRQMPvQNiW8Chg8QNoRiXX4yQl1wNlLjGCA3H0ijyOdqDL1wSmPdHU-6lCBvkbyPzYbZwXa-wBRj_lFANpivWVUHKL7Om4fMHZmHXf5DqsxyTUDj4hpf3h-oaUZqJf7oUITHab6f6IXvJS7wdw8qC-DvhuXWFt4XpWp97coJPORi7UtxOpBcjOUJZ_OgDzmfSm-QsmWuTWAAhrRZ9YXovf-nYHF28MdEbFechU4TpZ59h96Dnkr5e1kev282jNBx2_ZQXiWGznbom7ucTupi3zI4vRC0GxYnSaT6FIawhWmyuBW5b6ptI0gqHtyy8rsacqSW8H2YP2IgBt0iB7k-bWLeH2yZLqVLH_vbbs20paO3ZLVfp7Z-Q2MIBEAkfP7AuAZIEkxZf-OYMHdcS0o91xdS5k2JIT9NdQjeMPFVZFML06zVxy1w4t90WUI-df6XJHHCWZ2eyus3zrca8rRpyRP7id6npTx3OtRKxlD81dfmG3kc0uWi3pMePjhKi-MBn2TA1QEUoq8cNRB0Kj5EDQRLusFtRZawz9TAISmQUd6mdGpwS3EsKDPgrV9_M0bFFthWplqpsfB_RMDhoRUkur7qhm1Zcp_pHiJa49HzRk8jFhGQdWpJ6kq_BvG36QvSPflFhw0-VeznEvhl6ZDTb3mPNrTTEclwHnKpcJrupQdyeGSVpKdeEcHiE7BPuybc_tEyQDI8ZghESlBmb5XvvOwBKFUHbRjwoFUIDqktYCwWXdg2n2xXnP3WBYNaKmgGPl-Av-9r8PWhOVywWB8RueEw0CvJTWh0JT0St9AgIG8Mkd2W8-4zFz_PSQac4XF46zWZE5YVyfenkv6Y330kNAdNVtQiARPggVxINvEIDz9fS1gAkP0-4Z_EnETrbf6XdEUztRMQtamuSfHMGZr2NFGpO1dELVUvSg1K35c81d4RRhyHAlC8WnmqB9aD-pK0nMGu5ArcGFl4MdvKMTyqlGGfgtE7oMIfyn7542cISPRYn3OH4uvi-4lEo6osH_QVxQuDQp99RjK_85iazi0LBPwULl0YgVKaXgWzYC1Bg9W7WQlSolkF1R5CyXXFyHoRucBA&cid=CAASJ-RoDjoYLJZTjsnGblU-wlzgIErA2WyfbPE2F2_ZB0LvbMNQWPoj7g&rfl=1%2Chttps%253A%252F%252Fwww.dcard.tw%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35700fd4dc1a4008ab66bc0e57c19689f6daca9368bfd2a6beea1b86dc0159d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 07:01:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 87
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11778
x-xss-protection: 0
server: cafe
etag: 15541287485089275602
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Sep 2022 07:01:45 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/elements/html/ Frame 3140 8 KB
3 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 07:02:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Sep 2022 07:02:32 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3140 0
622 B 141ms
69ms Ping
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv_kBhvjtNt3hfHkyOw8UwfICelvdSh82dFhU6Y3BhQft3wYHj55VPhL0VWOqXNy6iUKsJxh7hFGo-vEAz-BDldnzZsdv3BbSuF6MgebA04J-672IbwTlFSmDt2T-WqkKmmtili1ZA0TnZlNaAgjfBQqM0xiHgSms6PZ054G8nhQyieBCzsMwgJQT8a3rAXNrhqsSEMN-nveT9OQsTa2IXBlxISYqjXb3iQaWH0zQZsd0G435jlAgeBP39_Vg_l-vFzMM_o9jPiJ8u-F_i5lgeCIWJYyLE7Gt4JAFQxDSjkuI8NXeI5yG-NjBXWlqElZO5clwqN_SYDdU4wgGyzJnAc8Ud2K-1WOD_su7MVywEV2j9WZhIxAsEt5eHCuN6KAcC-eInWuwZvhZSmIwZOpszP9YToVd2UIwGpGyRuvBb7pAb9SFTqP9lWcCV_Vs_K0n1c01-9WTyBfx2tTfyWhocV9GwOI7kzU4q_l8X-MHMiQms3TOrBns3JdKywB4x-HYUsAlxI_Ez9TpkA6jcNGbJG9QvwbmwKSBbVQRZV6Khf0QsKUAOkQVIbOwE9YBT80KL31iX4xSfDnl5o5HTQVI9EufzQG-1Cszy_UZB75NQbI-M33EEz0stBuAxy62dB-wRpmt2x2hxpmndRQAFo58Hz6uiEHS93wpEj_hV5-m2rEk2n35R7xBLtsf-_sCBO1EeEG27qi01mbNAJqvVaDkV5uYLL69O1KLBniDPdxrVyTBZ45oe88s937dRcguT3n0q1IgvkMptwN1_Bt_fxs_Yvn29OTShOXr-swMpbIZOGCvO9MjwnoQi0wvAYSpuROkzXoeLeu9aZhQjH62hGEYUHD2MR77l_QjW6CwNzP1X1PX3dYnr6-ngdXzxzAGzHG8oMs8jH8w4NjajW8GppTOjYKXlCTWAYUTcmbIKYOZwNTRu03gxWaZ-C1VofG5vHb-UmLJGwauqaPesZKP5ATyZUlG5wlIgGqomIO5pL3THW1B2Qw6QoPN3bNfWnyVZQCkR-VIoSuFtCeBe_xVPe-N0p_GrfRoRoCK-pSGBXp-BxOrv9lNJ05v_-6qhBzn72JwafrZh-WrZ_CGhC77N2UdMar2E-OxVi6xVZC2QP0_3drDp9FGJ1W2FNT_mhhP0dlxPC-s60R7PefLwsAe7cfo2QIOdxoktuy6CRdRYnUg&sai=AMfl-YTj38i_JMOF3YjLIrAf1W5QGhGAG5ZsDesGw0g35QsUCTkIqYLQOzxGT-sFTIt03RxWOKcAMZ-DJuTXgCxTVMR0t2lgBRs-K7ZkFsbEp0IYmafowSWNwNbrJqPiOjFxGfVYlD6l1nKmPuZ8Q0A08-YQs-lGaI2KVTdQ6z0PGp_qbLF7pKKN9S10w4c03NxNr8xRRgOfeKq4N-vzVH4AR6nfZLSYS9Y&sig=Cg0ArKJSzCEeSh8b48VmEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220831.71014&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Mon, 05 Sep 2022 07:03:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 3140 41 KB
15 KB 24ms
22ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 16:11:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53506
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Sep 2023 16:11:26 GMT

GET
H2 200 18058415698020110633
s0.2mdn.net/simgad/ Frame 3140 78 KB
79 KB 103ms
22ms Image
image/gif 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/18058415698020110633

Requested by

Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

291a089abdff11ec5195d662b9122a5b226830417111d3f892fd5fbed060a14e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Tue, 30 Aug 2022 15:23:43 GMT
x-content-type-options: nosniff
age: 488369
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 80061
x-xss-protection: 0
last-modified: Sun, 30 Aug 2020 20:20:20 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 30 Aug 2023 15:23:43 GMT

GET
H2 204 ad_impression.gif
beacon.krxd.net/ Frame 3140 0
338 B 189ms
46ms Image
text/plain 46.137.145.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/ad_impression.gif?confid=rxyssgjjc&advertiserid=5452057&campaignid=27157530&adid=518449382&siteid=6033185&placementid=340121853&creativeid=94679203
Requested by: Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.137.145.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-46-137-145-59.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 07:03:12 GMT
cache-control: private, no-cache, no-store
x-request-time: D=30 t=1662361392
x-served-by: beacon-n011-dub-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1

200
OK

impression_pixel
t.myvisualiq.net/ul_cb/ Frame 3140
Redirect Chain

https://t.myvisualiq.net/impression_pixel?r=2293281234&et=i&ago=212&ao=795&aca=27157530&si=6033185&ci=94679203&pi=340121853&ad=518449382&advt=5452057&chnl=-7&vndr=115&sz=8913&u=17333112239|12659631...
https://t.myvisualiq.net/ul_cb/impression_pixel?r=2293281234&et=i&ago=212&ao=795&aca=27157530&si=6033185&ci=94679203&pi=340121853&ad=518449382&advt=5452057&chnl=-7&vndr=115&sz=8913&u=17333112239|12...

43 B
573 B

22ms
22ms

Image
image/gif

3.122.37.130
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.myvisualiq.net/ul_cb/impression_pixel?r=2293281234&et=i&ago=212&ao=795&aca=27157530&si=6033185&ci=94679203&pi=340121853&ad=518449382&advt=5452057&chnl=-7&vndr=115&sz=8913&u=17333112239|12659631|ABAjH0gchrbYTXptpJEbg4MhkB0H&pt=i
Requested by: Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 3.122.37.130 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-122-37-130.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

access-control-allow-origin: *
Date: Mon, 05 Sep 2022 07:03:12 GMT
Cache-Control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://t.myvisualiq.net/ul_cb/impression_pixel?r=2293281234&et=i&ago=212&ao=795&aca=27157530&si=6033185&ci=94679203&pi=340121853&ad=518449382&advt=5452057&chnl=-7&vndr=115&sz=8913&u=17333112239|12659631|ABAjH0gchrbYTXptpJEbg4MhkB0H&pt=i
Date: Mon, 05 Sep 2022 07:03:12 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK npoee1nv94vs Show response
hal9000.redintelligence.net/zone/ Frame E2C7 11 KB
4 KB 130ms
32ms Script
text/html 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/npoee1nv94vs?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCceiqMJ8VY-rJCJTw3gOhpqSYDbXN-YNXzN65q-UM8C4QASD06PEeYJWipIKwB8gBCakC1oYXkBazsD6oAwGqBOIBT9DGCwo-o-LUBpjeoYeZboTJAatf7xqqG5kib3URTv5zS2t9FFKSk3MKgQ-6Ya6t3DTvzJfDrgbS_tE6XdVPkvRmLjpzvghcU4O9XJPp-bSov687XxjkhhFDJnFEyKUxtC8z4zB78meHIq3OdVVbetlhPyHB31Knm4LO6DUaMQyEr8TK1qeP5Fl7q3C6D4vsIhdBYeC-OoDgZ2pkp8RxZiLYMokqKiB_fgdvOJhXZzJ_pNUX5OYUTYD3JguBJBsyUOoAmn55CHbP0akOjTAar4TpprB2Vtmr52e8kIuCFI0lNMAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIIEgiI4YAQEAEYHTIDqoIBOgKAQIAKAZgLAcgLAYAMAbAT3JnrDdATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASJ-Roh-K9Hk_HCdF7Gjx7IBVphU4jQ7Icz10veKHFFnSjff4yk26H8Q%26sig%3DAOD64_36bXtSJ5XJ9kLcXhDtjpr191ZZNg%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-BWOer3_FVLhbKmKSEBDv9gb5seO9-qeB2kMWaMqZ6vhkFnAYaARB8Avsbid3SlCPwg0O7p_cBgU5tS1OPU8JLfDhUAVWEHyuZ6sddYGIGUWLwF8l1m4MFneSgUvcFMfKsbcwenD8yaCjlCjxNVb8KTN-dSUg%26cry%3D1%26dbm_d%3DAKAmf-AzEBg22ky__Hgjhz-nO6DU9x4xH5cOfQF2pAebo1FSPvOBJQ9wCQy15SGuMRiTTpjk1880DoNn_ubykBC0kCkmQjz9hZYlQZU4sJnImZHDJ_TS1BdX5WrDAtJYNiTgu3ZrQ65RCPouZhRLU-fKHrqTGeJbXzQm0I2bTh51FX8wNA1EGs1YJEFYKHP0Y1WSxXQRmOQf1bhL1B-8hjuVrItapz9enaZvqn7umAueZ0MNXEtkOmE8tdfxeCP3Yyw2QB9jqe3z99a0K4-UXEU53k_pivWoNqiCO2lcqNham_Kcose2Ah_eUZQbUizLy69vBMSDGTbuFDTjqZWvZXo21-zs7_wXFavT0sF7DkkC-gy9KNXkx6MlIeBFe9ecn_3zVYlfgioDCybc2jlwnyxTohxd5-VTYuh0BfmXl9Gu-nrN5zkOqjl13__Fw0Z4TwRqWeStitSN6dtIQ1HTV4zc4jGj5cYuYXRQfl7eNyRPULyTvEWDBAD3F-CdJk6jjHmgguLAGu86jR3EQk2vUTeLwq58fEr4PA%26adurl%3D
Requested by: Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: cb2e6d1a6345ac5ec462eda5040f3989561cfd716e3cac829de67d089efce0bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:03:12 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3996
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK ma1tq3l10cm4 Show response
hal9000.redintelligence.net/zone/ Frame D910 11 KB
4 KB 125ms
33ms Script
text/html 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/ma1tq3l10cm4?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCwbpFMJ8VY9ifCK6FjuwPme-B0A-1zfmDV5zfuavlDPAuEAEg9OjxHmCVoqSCsAfIAQmpAtaGF5AWs7A-qAMBqgTiAU_QVPAifO4atcjSb7rB_Hgrt2CIXryivYUO6Cleb0RwMKv6vNU56hYdxjThETODCSSvUgn-7oyxHF_23BsaAZyzERXrVrLrc8kDIrNFfbVnMoQLDx-KQWvN-UZmoCdlgWJ-TPNZ13OiA3vHwO0m1xnpkTHbKIWVXMHD5C4MGj31tHaQamhfBUvPWJ5-67SRHUbelGa1zlWm-YwxadC8TvdblFDuXyFmZ817zm5orPgu4mXKSvxDyYta7DFkysPSUrFiOhdtpGmKiFdGRk6AdnBoRcFRwdzUYqhoIbMbBElxvGPABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgGYCwHICwGADAGwE9yZ6w3QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASJ-Ro8_B7cWK7p2tCawNei3ClfAUtZlIQm6yww7LPqa2Sg6EnWBa04A%26sig%3DAOD64_1JRR1PYdBj6dsqDJXy2UcrPVC_Gg%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-AQVsTntV7A8Af3vO8eAciO_C624j5I2cK_w_0eJgAV9qlcS4Fk_LqvqJ3aKl6cfZHw_3vS0tlZp-YGFWt0tJWNNCTjVHgdw2oAlxpnp2T_EfySkk5OBwkXOkCp61bpexHJ2ztycIppzAh63xaGBaMKAtKIUQ%26cry%3D1%26dbm_d%3DAKAmf-DUUxQSF8jOnZ0GMrU7cvP3MycQHyZFcgwmv2mZxWcqaJLAkThq_VpOfp1-WsJZ6JXpWC5n_s2KRFNzljK5feg3XZxbWC6PfmhAGVFFmSHZzfkG4x88VuYrQuyL1YU_4-_ictB-zP6gJbk5u4JQO8-zdcvFUtBsp5wmeYV3sgLjHmzAGaQ75dKAbKTlYgRI-RLufMQRKGwbj_eWe74hrV9CZFyRQeJc6fI_z0SQFCtL4Y9FAIYrafE_8_TDcVq7OO75W4Bt96ioZi-tz7wxco2gFCBGaazK_gPlYun0Ww738WfHkjEZeLy7tOmr4t955lhAcs94iIsiLDbUFXQQLbsiW57Rz_YAcEnD6sEkNQvZAhsk2BdOxrQmC6qYpH_bKdpWxku6Ih2Bwd3mfJG7Meg81GQjEBB1_EXhS0wNIYt1Rsgb6vBFKCqXNu4aSQQbFXRZ48Fk7FoOkHpfCi8w4G64CezAOs6xULWZtlDv4z0-hTb04C_kemNAIKEcDoa6Msbk0vuW8CI_VbKU0C7Xk3DvNqhyrw%26adurl%3D
Requested by: Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 53a4eafe3d222cb77f1d4ee6e74f6702bea31c26b5f8f20eca21ae443813e20f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:03:12 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3999
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK npoee1nv94vs Show response
hal9000.redintelligence.net/zone/ Frame 6927 11 KB
4 KB 125ms
33ms Script
text/html 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/npoee1nv94vs?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCBZzsMJ8VY8mwCIrp3gPxvLJAtc35g1fM3rmr5QzwLhABIPTo8R5glaKkgrAHyAEJqQLWhheQFrOwPqgDAaoE5gFP0JXbmzE_7aA0gR-syZUKuz3qMfW0KgpaUI5uCMN2HuEW6h1R0kdXy1ajDCTZ4NZ7pJOn6zS1tj8Zo9DxxotDceuJPstEgjInfTPP2cLZXTnENxAw8MKs4yWr7M0E1RFSvVzReG50uOEkCyBFYH-xE8QM9jHximdKk57r6FPETfe6Oq2ToCsK5v9hW5aMMfNu7ZChgDD6JjaQH_W1GotZoIWJPQjE0siVf4yO3z73kVQ8vamw9CqXTLpyesu5pw3hqaw6L_Ua6Nt3O5QCWENoNTquUslWRl86nG9MaWcDV7LcFUIhuMAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIIEgiI4YAQEAEYHTIDqoIBOgKAQIAKAZgLAcgLAYAMAbAT3JnrDdATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASKORoXxQ5YLsfMRyH4FZO4OYXfoFb4RtcdXCujboksDY9nT4TM0CsA38%26sig%3DAOD64_3BCrTozTtHP8eH4lNvHnEMi5XGhw%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-AGYYyzIvvYa7zGPNI47o6e_I9wmwrArUNchMqkrl2N5QM4BLF_r4o0lFZcq2tpvdyYFsneBloOFvsVOZYm3Z3sodFgGXx-53B4vtEB8ALBasmkD_2xXNOs9tIpiGzOknPQXAvmmBt2zSjgmThNAywnz_3CqQ%26cry%3D1%26dbm_d%3DAKAmf-AfAv9FJLlgg9Fe78C28W_BGalVofUtylKdboKjhlXXfZ_ynu5glen0Kk_ii8sLGOkzQLg6LDKuZpXPp9X3966Oj2RtiB8Z73wJnzmHwIhn87_k0_ve6OzyEYkdA7QLDn39M_a7-Y3Y-VNKH4F4JiBoS60KO5cc90GanD2vpwBTF4JZ76wMk2eN2gbjCfTqeuWf7BcEjiKQ0F8BWOPR8kA9gaPfAsXIEyMWcHpA9Vo5-95dxehwIcF7oXi1v8vA6ifwoMb8Yzc-RPxKnTXFP2A0O6anH_NnuhvOSNOOf3gMSRPmvboixf-uV62nYiDXFkQYmbFXMAk_A8OMR8lbjU6iAuu4TNcZnuLYxX-eOj7gOSSsCS-31ZysDiuYrB-kG9zGiAabBH7VUZp3EEUhgZipyBp_B3_t8HsvMImHw6W0b3hq7laRZWv-0n2i6TvDlGeJV3ZXckd9UaPBzdtzX0hdzpLfDXb4D_eMvyJSCx6gouMLMbt8Ebl57IgbtTowonV9lEQ-koKdWu0BviKQvo2tCTX_Fg%26adurl%3D
Requested by: Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: b6481ebe198b258ec6a19306a9c39216ab4c9d5c7656ebada13b827f2f173d20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:03:12 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3993
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 0575 106 KB
38 KB 89ms
21ms Script
text/javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: www.dcard.tw
URL: https://www.dcard.tw/f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
Origin: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 07:50:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83536
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 05 Sep 2022 07:50:56 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/elements/html/ Frame 0575 8 KB
3 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CS1bkLgLt8XEFdOCuvq6eUy5_VAjOFoAXU7vDJUjNi-TA6Bfh6cSrOqE_OsLXroSGdKvfvlGr9WRvbO_9wQucZHywJxQ&cry=1&dbm_d=AKAmf-C9EykIRnHKz1655_NYeL6AUoS1Q2t9FIGKA8QMWfnV2K1PnyPg0qRtdtCgSrAzld2yXN8uHCtlzSUswe5eUUjP8lWeuoHHX47HQXXTr2lt0ViiVlaGQh0vtaoWOZf_kLxnsCdbl47H10qUVGlHeLrj97F7gnqTQa9qIa6t2gk2q7UvqYOUMGCsC17br3rMWtdov-wmVDJ9CPTF16dulqscmHCK9GZuJlRxbckTUS8NdAW7LX748_oP3GTkbF6EksCflDS_UORzFQNCrPAakkdTr30oJjkTQ72dS75SZ1JE1eZaNQWG3qYfgMGVIDHAen-txm4HJ0x1fK9KP4lWsAwQ4e3z8uFLqSASemMZWiNkJ30-T2yrCKqUoMF_Zaj1YYhuW1vpTG4F1gSb-6uvkI492SHLxzUu6dqVcL66aQ5lZW8p0V3ZJ7FBD2UBwoJIMNM5m1roj4enqfG4FldlL9fbcIaHnaQbc25TPgvbdfuoB5Rx_dFBZdtf9CCSHDXwtACTQaunSLGY_7BCeEpo64iquzoRxOHOqbuW-YiTJI_zrvxJ0nUiRhaBJBw-SXBQlUmHy0qA9bCzpHDktjOi7CuHGv2M1uiqXSC6L6iLxIMJ2iiLSI6cSaXnX0dwgG0KMVBfMFyqzOTNfB6JDSnYCMdIgHZJLY2hWgXNNOmJaSuaJswq0-Faj5sMJf7YkgBaiMor6crod6vppOaPmT4iS5q7c26QvsHFJGHypmANHQjCf0ssd-3igd6G5EROJUgApx10AwoR7YIm1ubS8xipGaBcDANcPCteICh2R3ngxxEjmBuBdkdNklJc-TC00uAs5TqNxgojPVnma_1mMK2gnmlopI6j4IupjirO6ghP0Cx9v-OJJTa0z8yIVtOFhEbqz2Oz-mIwTHBKxJtIAEGXaAAATwxGqPbn0J_eNgG1mgV0q6e06ZOD0AeTzOoZHaxcIN11nhobzsbN4fN4oi-YquFG-QGgv9h9WlVd5IppO_oDJ3rwdnq8_RfYLntd05aceCikzD7InGtCF7RkTRvpTQ9YgL4o_MBIw9AIMzSLP-yAjJ4swEkaFAXzjOozcKZG4I5c6lu0WdwJ4Znp8cev-nIRWas8fJW-iYGl37RWSiJpz4OCwrp3hWkI7VAN9QlbD5k328IlIKDGdtjMF_ATHUSNy1HKAeHD8fVzafMjzGs__XEX_qF79UoZMyBcmjCPwrXIPOFud0RHNREN2sW0pXxzZoZqkIeJuVRTS60oF5HY_AXbEsd1-FvV6LTn0GOCoN4pHvc-eOQ4swkC2sECt6gx-6CJoEPWr5jq-n4i5fZNJcSR2v1I_LSKRo62ZHSkFgXMe4FE0RkFBTSIM9NVQeelmyS3pF6UCkrYboZe_HzOx8Zi0tQW9TFwHoUNkBshVqmLxg3SQ0VPmc4ZA7TGu2ur8peUX2rUTRJd-92H1R261gcml0VMvGzZrwziy_OMonllvmKaCWukaWZ3c3AnNGZP5FuRjq8wUpSWwu4yATmqdZvY_2TjF4qAJvej2upPrQnylyvZaplGWO2rtfzS8Jk1tU0BRqfejMQamEG3m42bWudaVX0znc6nJv3rIyrGut_qGHaP3K1onR_6vVbrICghz9d00QXoWMi-TZNC2GF-oBoc8bOMJfc5shfrd30Mlz-tMrhnIIfP4MnV2QGOzhPqlOWbIlgM-59jCMquoTYX2jWniX0nFedv_tKqk1uZlstADaa3SyVRMvPPxSeIrUnopiS_loXPrHfP3qO5M_mgWQFK7fBVw3hkw3KzttwpmtP9WbdJ080kjKmOD-MIMS6SRuuZXJo1UYqN-LoDdDsMOTiqOc4axkwm-_1vxZPjhIRv3eStj-u4psdXXC8-GYjXSeMdsZ46VZZYhBIA6sLGZwKiYyIskQ-38qkS-ymNMfJB45MpxmDBg6CcKh9xEqMgVI7WcHdCf0I_ehCLYKsogwwWyb6B8mnjcDwqsWWDM2rPySLcnl6DtsHqWQFvMG391OOH58uQ-sLHAdc6CVYaPRyT7tb0RCd-xk4RKrB_H6ERIV--2XjwjJRZA5cJDY5f2NcOYr37gqN0yhifVGW_sNJXN4kbBTRMmAaiV6TS8sMaLlpJSoHw-W1Mv2Zs1oHOY0l1vO_N-j-EoWABF4Gy_8prT75RlWo7XhPuzUedozXKvLMNny6QrwkEwixyVU6pWQlqySsDyW-62M6wSBM2gWP2mGPh0VBi2U4NlpctPssOcEf9uI0QUA_Y7863bUZD8Naps1KKpwvfDK-Btp_QrouaxMPQ4sKuVAxbeLTbZ-OcDV9S02OoCHudrfr_QCZN-Ywipvaefg07N-_poPNKkBDSmNXYEg_wUBshMnP6T-jThECzV-2sh_s7FAgn6t5HdLPcbhgQrKWjZvQNLR3Zi7XIihY13k1dtCJ3EM8T9QSBJoE00bsOXL-1kcmwHi4xChVl1Q4EoZQU9L37KHWeZfmc6F9PbVx2YSkZ5k0ifCCtnA_0lpo1h-nw89Nb29Ti0rpnNMnShY4B-Eroftk0jnjBYZocuKLU4R8f394u7db5MQHm7oJldvYyuVW6S68kpriexywVhZARiWLEQ1Yn_5p5QYpDlO8WwNqffx3ZY2kLls8UmSyRBjRYKnlrW6ZmiMDEBc3ZqdiPLQzJoZBcMTrxiYCPxptHTeM3-SQtXMVp3iKryejfDrRW8sBAKQ3wsMUaWM8hIrOD4AUcUrCv6WQiNSq1VdqB-duXDZAoRhE3xRfjor6ZbWa8-lQQ5xSlMQzt3f1tTchY9FET3UJSykEV29sZ7iXnLgXNZb2xKXlAUhiWE-4UTlvHCTqjojGqnnt7idwSDTN557kJcnI2KdEyI4PSGTgG_rScl1uVdMNESnk7WpYP1lsv2rOBpHZb_-VyuObH_AQNBtcx2GH4Zilq5aZGOFeUK5AS0T3kTcZODTOvepkfTm5_NGjrBzH1uu2u1Mzft68sAi2LPoPvhVlCvJA&cid=CAASKORotJGuIuQNZfuJYxCV-Tuaif02skOC3dh_7C4D0QdSvIXLvuxa0bU&dv3_ver=m202207220101&rfl=https%3A%2F%2Fwww.dcard.tw%2F&ds=l&xdt=0&iif=1&cor=5213036314406419000&idt=105&cac=0&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58b603271da250778cca7450c81343eba7a896c87d93812f4de54ca5e1108488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 07:02:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 10699485926258732851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Sep 2022 07:02:32 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/ Frame 0575 30 KB
12 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220831/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35700fd4dc1a4008ab66bc0e57c19689f6daca9368bfd2a6beea1b86dc0159d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 07:01:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 87
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11778
x-xss-protection: 0
server: cafe
etag: 15541287485089275602
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 19 Sep 2022 07:01:45 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame C182 0
0 54ms
54ms Image
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022083101&jk=1072548200582&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 3140 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4986a9504e0c999ce6f77e24485be989b17b01813fa3e2adbf186803d777cd4f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 98C5 22 KB
8 KB 30ms
29ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 53505
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 04 Sep 2022 16:11:27 GMT
expires: Mon, 04 Sep 2023 16:11:27 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 1A15 22 KB
8 KB 32ms
32ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 53505
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 04 Sep 2022 16:11:27 GMT
expires: Mon, 04 Sep 2023 16:11:27 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 0337 22 KB
8 KB 27ms
26ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 53505
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 04 Sep 2022 16:11:27 GMT
expires: Mon, 04 Sep 2023 16:11:27 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame E49B 22 KB
8 KB 29ms
21ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 53505
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 04 Sep 2022 16:11:27 GMT
expires: Mon, 04 Sep 2023 16:11:27 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dMUMwKlHRkKFxm324gu_shN2JBGfr2rZRInLP1vMiqM.js Show response
pagead2.googlesyndication.com/bg/ Frame F229 36 KB
16 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/dMUMwKlHRkKFxm324gu_shN2JBGfr2rZRInLP1vMiqM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74c50cc0a947464285c66df6e20bbfb2137624119faf6ad94489cb3f5bcc8aa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 20:19:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38635
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15929
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 04 Sep 2023 20:19:17 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 0575 41 KB
15 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 16:11:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53506
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 04 Sep 2023 16:11:26 GMT

GET
DATA 200
OK truncated
/ Frame 0575 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f5396cd49522cc8f323e947a2830e4121175e3c5350ec1fa50855bd131bedffc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3140 0
26 B 102ms
59ms Ping
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Sep 2022 07:03:12 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

request.php Show response
hal900013.redintelligence.net/ Frame E2C7
Redirect Chain

https://hal900013.redintelligence.net/request.php?zone=npoee1nv94vs&nw=20&renderingType=javascript&namespace=c88d04f4bc&subid=&uid=638bf485c91320f0&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900013.redintelligence.net/request.php?zone=npoee1nv94vs&nw=20&renderingType=javascript&namespace=c88d04f4bc&subid=&uid=638bf485c91320f0&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

3 KB
2 KB

146ms
92ms

Script
application/x-javascript

116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900013.redintelligence.net/request.php?zone=npoee1nv94vs&nw=20&renderingType=javascript&namespace=c88d04f4bc&subid=&uid=638bf485c91320f0&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCceiqMJ8VY-rJCJTw3gOhpqSYDbXN-YNXzN65q-UM8C4QASD06PEeYJWipIKwB8gBCakC1oYXkBazsD6oAwGqBOIBT9DGCwo-o-LUBpjeoYeZboTJAatf7xqqG5kib3URTv5zS2t9FFKSk3MKgQ-6Ya6t3DTvzJfDrgbS_tE6XdVPkvRmLjpzvghcU4O9XJPp-bSov687XxjkhhFDJnFEyKUxtC8z4zB78meHIq3OdVVbetlhPyHB31Knm4LO6DUaMQyEr8TK1qeP5Fl7q3C6D4vsIhdBYeC-OoDgZ2pkp8RxZiLYMokqKiB_fgdvOJhXZzJ_pNUX5OYUTYD3JguBJBsyUOoAmn55CHbP0akOjTAar4TpprB2Vtmr52e8kIuCFI0lNMAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIIEgiI4YAQEAEYHTIDqoIBOgKAQIAKAZgLAcgLAYAMAbAT3JnrDdATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASJ-Roh-K9Hk_HCdF7Gjx7IBVphU4jQ7Icz10veKHFFnSjff4yk26H8Q%26sig%3DAOD64_36bXtSJ5XJ9kLcXhDtjpr191ZZNg%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-BWOer3_FVLhbKmKSEBDv9gb5seO9-qeB2kMWaMqZ6vhkFnAYaARB8Avsbid3SlCPwg0O7p_cBgU5tS1OPU8JLfDhUAVWEHyuZ6sddYGIGUWLwF8l1m4MFneSgUvcFMfKsbcwenD8yaCjlCjxNVb8KTN-dSUg%26cry%3D1%26dbm_d%3DAKAmf-AzEBg22ky__Hgjhz-nO6DU9x4xH5cOfQF2pAebo1FSPvOBJQ9wCQy15SGuMRiTTpjk1880DoNn_ubykBC0kCkmQjz9hZYlQZU4sJnImZHDJ_TS1BdX5WrDAtJYNiTgu3ZrQ65RCPouZhRLU-fKHrqTGeJbXzQm0I2bTh51FX8wNA1EGs1YJEFYKHP0Y1WSxXQRmOQf1bhL1B-8hjuVrItapz9enaZvqn7umAueZ0MNXEtkOmE8tdfxeCP3Yyw2QB9jqe3z99a0K4-UXEU53k_pivWoNqiCO2lcqNham_Kcose2Ah_eUZQbUizLy69vBMSDGTbuFDTjqZWvZXo21-zs7_wXFavT0sF7DkkC-gy9KNXkx6MlIeBFe9ecn_3zVYlfgioDCybc2jlwnyxTohxd5-VTYuh0BfmXl9Gu-nrN5zkOqjl13__Fw0Z4TwRqWeStitSN6dtIQ1HTV4zc4jGj5cYuYXRQfl7eNyRPULyTvEWDBAD3F-CdJk6jjHmgguLAGu86jR3EQk2vUTeLwq58fEr4PA%26adurl%3D&documentReferer=https%3A%2F%2Fwww.dcard.tw%2F&ancestorOrigins=https%3A%2F%2Fwww.dcard.tw&random=7651394901866&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 116.202.48.214 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: cedfa38f9a385e3126a13e3d19f25275fafcbbeebb959734c612ceee70485d4f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:13 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 29812100033687600710616012073013
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1091
Expires: Mon, 05 Sep 2022 08:03:13 +0200

Redirect headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:13 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=npoee1nv94vs&nw=20&renderingType=javascript&namespace=c88d04f4bc&subid=&uid=638bf485c91320f0&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCceiqMJ8VY-rJCJTw3gOhpqSYDbXN-YNXzN65q-UM8C4QASD06PEeYJWipIKwB8gBCakC1oYXkBazsD6oAwGqBOIBT9DGCwo-o-LUBpjeoYeZboTJAatf7xqqG5kib3URTv5zS2t9FFKSk3MKgQ-6Ya6t3DTvzJfDrgbS_tE6XdVPkvRmLjpzvghcU4O9XJPp-bSov687XxjkhhFDJnFEyKUxtC8z4zB78meHIq3OdVVbetlhPyHB31Knm4LO6DUaMQyEr8TK1qeP5Fl7q3C6D4vsIhdBYeC-OoDgZ2pkp8RxZiLYMokqKiB_fgdvOJhXZzJ_pNUX5OYUTYD3JguBJBsyUOoAmn55CHbP0akOjTAar4TpprB2Vtmr52e8kIuCFI0lNMAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIIEgiI4YAQEAEYHTIDqoIBOgKAQIAKAZgLAcgLAYAMAbAT3JnrDdATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASJ-Roh-K9Hk_HCdF7Gjx7IBVphU4jQ7Icz10veKHFFnSjff4yk26H8Q%26sig%3DAOD64_36bXtSJ5XJ9kLcXhDtjpr191ZZNg%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-BWOer3_FVLhbKmKSEBDv9gb5seO9-qeB2kMWaMqZ6vhkFnAYaARB8Avsbid3SlCPwg0O7p_cBgU5tS1OPU8JLfDhUAVWEHyuZ6sddYGIGUWLwF8l1m4MFneSgUvcFMfKsbcwenD8yaCjlCjxNVb8KTN-dSUg%26cry%3D1%26dbm_d%3DAKAmf-AzEBg22ky__Hgjhz-nO6DU9x4xH5cOfQF2pAebo1FSPvOBJQ9wCQy15SGuMRiTTpjk1880DoNn_ubykBC0kCkmQjz9hZYlQZU4sJnImZHDJ_TS1BdX5WrDAtJYNiTgu3ZrQ65RCPouZhRLU-fKHrqTGeJbXzQm0I2bTh51FX8wNA1EGs1YJEFYKHP0Y1WSxXQRmOQf1bhL1B-8hjuVrItapz9enaZvqn7umAueZ0MNXEtkOmE8tdfxeCP3Yyw2QB9jqe3z99a0K4-UXEU53k_pivWoNqiCO2lcqNham_Kcose2Ah_eUZQbUizLy69vBMSDGTbuFDTjqZWvZXo21-zs7_wXFavT0sF7DkkC-gy9KNXkx6MlIeBFe9ecn_3zVYlfgioDCybc2jlwnyxTohxd5-VTYuh0BfmXl9Gu-nrN5zkOqjl13__Fw0Z4TwRqWeStitSN6dtIQ1HTV4zc4jGj5cYuYXRQfl7eNyRPULyTvEWDBAD3F-CdJk6jjHmgguLAGu86jR3EQk2vUTeLwq58fEr4PA%26adurl%3D&documentReferer=https%3A%2F%2Fwww.dcard.tw%2F&ancestorOrigins=https%3A%2F%2Fwww.dcard.tw&random=7651394901866&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Mon, 05 Sep 2022 08:03:13 +0200

GET
H/1.1

200
OK

request.php Show response
hal900025.redintelligence.net/ Frame D910
Redirect Chain

https://hal900025.redintelligence.net/request.php?zone=ma1tq3l10cm4&nw=20&renderingType=javascript&namespace=3955d1f2eb&subid=&uid=092acba8ab47a9ac&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900025.redintelligence.net/request.php?zone=ma1tq3l10cm4&nw=20&renderingType=javascript&namespace=3955d1f2eb&subid=&uid=092acba8ab47a9ac&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

3 KB
2 KB

234ms
178ms

Script
application/x-javascript

138.201.84.245
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900025.redintelligence.net/request.php?zone=ma1tq3l10cm4&nw=20&renderingType=javascript&namespace=3955d1f2eb&subid=&uid=092acba8ab47a9ac&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x600&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCwbpFMJ8VY9ifCK6FjuwPme-B0A-1zfmDV5zfuavlDPAuEAEg9OjxHmCVoqSCsAfIAQmpAtaGF5AWs7A-qAMBqgTiAU_QVPAifO4atcjSb7rB_Hgrt2CIXryivYUO6Cleb0RwMKv6vNU56hYdxjThETODCSSvUgn-7oyxHF_23BsaAZyzERXrVrLrc8kDIrNFfbVnMoQLDx-KQWvN-UZmoCdlgWJ-TPNZ13OiA3vHwO0m1xnpkTHbKIWVXMHD5C4MGj31tHaQamhfBUvPWJ5-67SRHUbelGa1zlWm-YwxadC8TvdblFDuXyFmZ817zm5orPgu4mXKSvxDyYta7DFkysPSUrFiOhdtpGmKiFdGRk6AdnBoRcFRwdzUYqhoIbMbBElxvGPABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgGYCwHICwGADAGwE9yZ6w3QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASJ-Ro8_B7cWK7p2tCawNei3ClfAUtZlIQm6yww7LPqa2Sg6EnWBa04A%26sig%3DAOD64_1JRR1PYdBj6dsqDJXy2UcrPVC_Gg%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-AQVsTntV7A8Af3vO8eAciO_C624j5I2cK_w_0eJgAV9qlcS4Fk_LqvqJ3aKl6cfZHw_3vS0tlZp-YGFWt0tJWNNCTjVHgdw2oAlxpnp2T_EfySkk5OBwkXOkCp61bpexHJ2ztycIppzAh63xaGBaMKAtKIUQ%26cry%3D1%26dbm_d%3DAKAmf-DUUxQSF8jOnZ0GMrU7cvP3MycQHyZFcgwmv2mZxWcqaJLAkThq_VpOfp1-WsJZ6JXpWC5n_s2KRFNzljK5feg3XZxbWC6PfmhAGVFFmSHZzfkG4x88VuYrQuyL1YU_4-_ictB-zP6gJbk5u4JQO8-zdcvFUtBsp5wmeYV3sgLjHmzAGaQ75dKAbKTlYgRI-RLufMQRKGwbj_eWe74hrV9CZFyRQeJc6fI_z0SQFCtL4Y9FAIYrafE_8_TDcVq7OO75W4Bt96ioZi-tz7wxco2gFCBGaazK_gPlYun0Ww738WfHkjEZeLy7tOmr4t955lhAcs94iIsiLDbUFXQQLbsiW57Rz_YAcEnD6sEkNQvZAhsk2BdOxrQmC6qYpH_bKdpWxku6Ih2Bwd3mfJG7Meg81GQjEBB1_EXhS0wNIYt1Rsgb6vBFKCqXNu4aSQQbFXRZ48Fk7FoOkHpfCi8w4G64CezAOs6xULWZtlDv4z0-hTb04C_kemNAIKEcDoa6Msbk0vuW8CI_VbKU0C7Xk3DvNqhyrw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.dcard.tw%2F&ancestorOrigins=https%3A%2F%2Fwww.dcard.tw&random=652101580154&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 138.201.84.245 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.245.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a0e8218fef57efa936e6a5a8c71ba3d80fcec672be2be61893fe4d067dbb8563

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:13 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 84984500032917200710624012073025
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1095
Expires: Mon, 05 Sep 2022 08:03:13 +0200

Redirect headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:13 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=ma1tq3l10cm4&nw=20&renderingType=javascript&namespace=3955d1f2eb&subid=&uid=092acba8ab47a9ac&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x600&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCwbpFMJ8VY9ifCK6FjuwPme-B0A-1zfmDV5zfuavlDPAuEAEg9OjxHmCVoqSCsAfIAQmpAtaGF5AWs7A-qAMBqgTiAU_QVPAifO4atcjSb7rB_Hgrt2CIXryivYUO6Cleb0RwMKv6vNU56hYdxjThETODCSSvUgn-7oyxHF_23BsaAZyzERXrVrLrc8kDIrNFfbVnMoQLDx-KQWvN-UZmoCdlgWJ-TPNZ13OiA3vHwO0m1xnpkTHbKIWVXMHD5C4MGj31tHaQamhfBUvPWJ5-67SRHUbelGa1zlWm-YwxadC8TvdblFDuXyFmZ817zm5orPgu4mXKSvxDyYta7DFkysPSUrFiOhdtpGmKiFdGRk6AdnBoRcFRwdzUYqhoIbMbBElxvGPABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgGYCwHICwGADAGwE9yZ6w3QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASJ-Ro8_B7cWK7p2tCawNei3ClfAUtZlIQm6yww7LPqa2Sg6EnWBa04A%26sig%3DAOD64_1JRR1PYdBj6dsqDJXy2UcrPVC_Gg%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-AQVsTntV7A8Af3vO8eAciO_C624j5I2cK_w_0eJgAV9qlcS4Fk_LqvqJ3aKl6cfZHw_3vS0tlZp-YGFWt0tJWNNCTjVHgdw2oAlxpnp2T_EfySkk5OBwkXOkCp61bpexHJ2ztycIppzAh63xaGBaMKAtKIUQ%26cry%3D1%26dbm_d%3DAKAmf-DUUxQSF8jOnZ0GMrU7cvP3MycQHyZFcgwmv2mZxWcqaJLAkThq_VpOfp1-WsJZ6JXpWC5n_s2KRFNzljK5feg3XZxbWC6PfmhAGVFFmSHZzfkG4x88VuYrQuyL1YU_4-_ictB-zP6gJbk5u4JQO8-zdcvFUtBsp5wmeYV3sgLjHmzAGaQ75dKAbKTlYgRI-RLufMQRKGwbj_eWe74hrV9CZFyRQeJc6fI_z0SQFCtL4Y9FAIYrafE_8_TDcVq7OO75W4Bt96ioZi-tz7wxco2gFCBGaazK_gPlYun0Ww738WfHkjEZeLy7tOmr4t955lhAcs94iIsiLDbUFXQQLbsiW57Rz_YAcEnD6sEkNQvZAhsk2BdOxrQmC6qYpH_bKdpWxku6Ih2Bwd3mfJG7Meg81GQjEBB1_EXhS0wNIYt1Rsgb6vBFKCqXNu4aSQQbFXRZ48Fk7FoOkHpfCi8w4G64CezAOs6xULWZtlDv4z0-hTb04C_kemNAIKEcDoa6Msbk0vuW8CI_VbKU0C7Xk3DvNqhyrw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.dcard.tw%2F&ancestorOrigins=https%3A%2F%2Fwww.dcard.tw&random=652101580154&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Mon, 05 Sep 2022 08:03:13 +0200

GET
H/1.1

200
OK

request.php Show response
hal900023.redintelligence.net/ Frame 6927
Redirect Chain

https://hal900023.redintelligence.net/request.php?zone=npoee1nv94vs&nw=20&renderingType=javascript&namespace=a552021801&subid=&uid=12f87d0b6f0af534&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900023.redintelligence.net/request.php?zone=npoee1nv94vs&nw=20&renderingType=javascript&namespace=a552021801&subid=&uid=12f87d0b6f0af534&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

3 KB
2 KB

139ms
86ms

Script
application/x-javascript

78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900023.redintelligence.net/request.php?zone=npoee1nv94vs&nw=20&renderingType=javascript&namespace=a552021801&subid=&uid=12f87d0b6f0af534&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCBZzsMJ8VY8mwCIrp3gPxvLJAtc35g1fM3rmr5QzwLhABIPTo8R5glaKkgrAHyAEJqQLWhheQFrOwPqgDAaoE5gFP0JXbmzE_7aA0gR-syZUKuz3qMfW0KgpaUI5uCMN2HuEW6h1R0kdXy1ajDCTZ4NZ7pJOn6zS1tj8Zo9DxxotDceuJPstEgjInfTPP2cLZXTnENxAw8MKs4yWr7M0E1RFSvVzReG50uOEkCyBFYH-xE8QM9jHximdKk57r6FPETfe6Oq2ToCsK5v9hW5aMMfNu7ZChgDD6JjaQH_W1GotZoIWJPQjE0siVf4yO3z73kVQ8vamw9CqXTLpyesu5pw3hqaw6L_Ua6Nt3O5QCWENoNTquUslWRl86nG9MaWcDV7LcFUIhuMAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIIEgiI4YAQEAEYHTIDqoIBOgKAQIAKAZgLAcgLAYAMAbAT3JnrDdATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASKORoXxQ5YLsfMRyH4FZO4OYXfoFb4RtcdXCujboksDY9nT4TM0CsA38%26sig%3DAOD64_3BCrTozTtHP8eH4lNvHnEMi5XGhw%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-AGYYyzIvvYa7zGPNI47o6e_I9wmwrArUNchMqkrl2N5QM4BLF_r4o0lFZcq2tpvdyYFsneBloOFvsVOZYm3Z3sodFgGXx-53B4vtEB8ALBasmkD_2xXNOs9tIpiGzOknPQXAvmmBt2zSjgmThNAywnz_3CqQ%26cry%3D1%26dbm_d%3DAKAmf-AfAv9FJLlgg9Fe78C28W_BGalVofUtylKdboKjhlXXfZ_ynu5glen0Kk_ii8sLGOkzQLg6LDKuZpXPp9X3966Oj2RtiB8Z73wJnzmHwIhn87_k0_ve6OzyEYkdA7QLDn39M_a7-Y3Y-VNKH4F4JiBoS60KO5cc90GanD2vpwBTF4JZ76wMk2eN2gbjCfTqeuWf7BcEjiKQ0F8BWOPR8kA9gaPfAsXIEyMWcHpA9Vo5-95dxehwIcF7oXi1v8vA6ifwoMb8Yzc-RPxKnTXFP2A0O6anH_NnuhvOSNOOf3gMSRPmvboixf-uV62nYiDXFkQYmbFXMAk_A8OMR8lbjU6iAuu4TNcZnuLYxX-eOj7gOSSsCS-31ZysDiuYrB-kG9zGiAabBH7VUZp3EEUhgZipyBp_B3_t8HsvMImHw6W0b3hq7laRZWv-0n2i6TvDlGeJV3ZXckd9UaPBzdtzX0hdzpLfDXb4D_eMvyJSCx6gouMLMbt8Ebl57IgbtTowonV9lEQ-koKdWu0BviKQvo2tCTX_Fg%26adurl%3D&documentReferer=https%3A%2F%2Fwww.dcard.tw%2F&ancestorOrigins=https%3A%2F%2Fwww.dcard.tw&random=5571712193369&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 5ffb6e571bc17c6e66002a5953dcff3617fe543a4788550aa9de35d70d253f01

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:13 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 89619100035174400710616012073023
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1094
Expires: Mon, 05 Sep 2022 08:03:13 +0200

Redirect headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:13 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=npoee1nv94vs&nw=20&renderingType=javascript&namespace=a552021801&subid=&uid=12f87d0b6f0af534&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCBZzsMJ8VY8mwCIrp3gPxvLJAtc35g1fM3rmr5QzwLhABIPTo8R5glaKkgrAHyAEJqQLWhheQFrOwPqgDAaoE5gFP0JXbmzE_7aA0gR-syZUKuz3qMfW0KgpaUI5uCMN2HuEW6h1R0kdXy1ajDCTZ4NZ7pJOn6zS1tj8Zo9DxxotDceuJPstEgjInfTPP2cLZXTnENxAw8MKs4yWr7M0E1RFSvVzReG50uOEkCyBFYH-xE8QM9jHximdKk57r6FPETfe6Oq2ToCsK5v9hW5aMMfNu7ZChgDD6JjaQH_W1GotZoIWJPQjE0siVf4yO3z73kVQ8vamw9CqXTLpyesu5pw3hqaw6L_Ua6Nt3O5QCWENoNTquUslWRl86nG9MaWcDV7LcFUIhuMAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIIEgiI4YAQEAEYHTIDqoIBOgKAQIAKAZgLAcgLAYAMAbAT3JnrDdATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASKORoXxQ5YLsfMRyH4FZO4OYXfoFb4RtcdXCujboksDY9nT4TM0CsA38%26sig%3DAOD64_3BCrTozTtHP8eH4lNvHnEMi5XGhw%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-AGYYyzIvvYa7zGPNI47o6e_I9wmwrArUNchMqkrl2N5QM4BLF_r4o0lFZcq2tpvdyYFsneBloOFvsVOZYm3Z3sodFgGXx-53B4vtEB8ALBasmkD_2xXNOs9tIpiGzOknPQXAvmmBt2zSjgmThNAywnz_3CqQ%26cry%3D1%26dbm_d%3DAKAmf-AfAv9FJLlgg9Fe78C28W_BGalVofUtylKdboKjhlXXfZ_ynu5glen0Kk_ii8sLGOkzQLg6LDKuZpXPp9X3966Oj2RtiB8Z73wJnzmHwIhn87_k0_ve6OzyEYkdA7QLDn39M_a7-Y3Y-VNKH4F4JiBoS60KO5cc90GanD2vpwBTF4JZ76wMk2eN2gbjCfTqeuWf7BcEjiKQ0F8BWOPR8kA9gaPfAsXIEyMWcHpA9Vo5-95dxehwIcF7oXi1v8vA6ifwoMb8Yzc-RPxKnTXFP2A0O6anH_NnuhvOSNOOf3gMSRPmvboixf-uV62nYiDXFkQYmbFXMAk_A8OMR8lbjU6iAuu4TNcZnuLYxX-eOj7gOSSsCS-31ZysDiuYrB-kG9zGiAabBH7VUZp3EEUhgZipyBp_B3_t8HsvMImHw6W0b3hq7laRZWv-0n2i6TvDlGeJV3ZXckd9UaPBzdtzX0hdzpLfDXb4D_eMvyJSCx6gouMLMbt8Ebl57IgbtTowonV9lEQ-koKdWu0BviKQvo2tCTX_Fg%26adurl%3D&documentReferer=https%3A%2F%2Fwww.dcard.tw%2F&ancestorOrigins=https%3A%2F%2Fwww.dcard.tw&random=5571712193369&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Mon, 05 Sep 2022 08:03:13 +0200

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/10348202853897552806/ Frame 72F9 25 KB
5 KB 63ms
20ms Document
text/html 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10348202853897552806/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd21dc4857ac654a7ec97b8733a6243b907ecdd2b35555575aa31a352da4c577

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 412396
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5321
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 31 Aug 2022 12:29:57 GMT
expires: Thu, 31 Aug 2023 12:29:57 GMT
last-modified: Wed, 18 May 2022 12:27:21 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0575 0
27 B 77ms
67ms Ping
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuCKlZtE04liHG7JDIhIx0JHkTG_ppat8jzUD1NWhtFTKQm6eYEA0AVbugCB-erg2uXw41ux2bMytATXuxJQa4nUjxDHWnZkMvxqTuqpb0XBd4wDrh0TWHkUMBQ_yDaQkN-K9QZ-uFxIOjkc9LrZlWDcvQf4c6sVm11ej-3BvrbJYAZL2NKRrLsJm8WJ4pgQK2l81g4qyZi9ZKc3ptiPLrXMLIW8JYmZcVP9UW-lks6P6TFrRzoqnXQuW5fSVwtRBGLzTtiJquctgLFrK-q0sOUvIWiQv35ssKg0rL7YhfmaNIqzAlP_rn7groliS2ahFFOXuKs2qusZ_spWIp1vo68SNqCcZF3TH1EA4j-S9ll1r9gGzHbrgZTRvcJpaAbfOkbLz373fM2a9jo0Z3DBEgu1lP1HsbKvQp2NIta1Qi7TKkoru7Ze-gqN7iZV0ePWr8r13OQYPDuU3-z23Blsy8geRGjyhFpICyrn_JBYMiVr81P9fAfzuTvAYBHtpjOz7LO2kmbCPlWlvu2955hBWkrPjyOnw4pKFfP2SzjFcR8jw7JuaM_VWhFUv1woL8kzXxAWXOcWnj1eN0Mkw1uQh0YmV9_tTk4DPtKx0_LlUU1i4JNdcGi1qlGwX1GRxcUn5xThxPcJbHnguAyEYhuMSWZo944c7DV2B6E03FVL63LV9wKL4zHDaBCEBasH7jv6hzwd6GZfnjI8lO2STqUkD9gMELOl8pr98HWqTDgflcPHjnf2YwzP6qKDO1OXCoaiQ9F5fm9H-jYlbWP10F5nsU9HIPx2YhJ9q7-XUkswgOxDo1pucK9mGQP2lta39nX8_T1lsNMriLfgLDFVl4mfNNvuHHu0UUD90C_6fkdDPU2QLIuevYWSQXFiXtSdimBZH8_CEkgZGx8rDm8PHZg8OPzATCLOeJRGLi7r3yIr3uMibBBHJpNdj-T2ZZ2ktsinqELJEjWUBdwC0utBh8XsYnQS_UbaGC53G8jJJo_iAp1lLNUWwD_iXHF1U_hn4uUE9LAvPBZJaS96ZGl7CMGIVUDHVc9kVOPQDl_baQTslba0qoVcG66bQQToybxgljt1CR40UxcaskGFbtC5jUGmUsz5d_L_V0Kx0nzOgCOM-gQxEcuTUYPy0mmfXE6x0Lj_V7V6g&sai=AMfl-YRY7hniel59yJ_g7qLcPUwwtOeOD-8s4BFYS8-OP2oVMdG6CT5dLGIgyWbCxTUrKjBra7QXzGIa53-iimeG0W0P5l_7jTH-BF5x1gdgiBy44JG0oUpA9wy_cy2-N20MRHL-VEOJkoygZ62b71pKgfOfCX1ZXNWiJrMya1L_BImfXz9q2b7OxSi7EW1Np-_lJ6ESlRWNzATyKJRaBQ5c_NcHfdATv4_b-w&sig=Cg0ArKJSzAJPmR2SIOdzEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=161&cbvp=1&cstd=158&cisv=r20220831.41223&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.dcard.tw
URL: https://www.dcard.tw/f

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Mon, 05 Sep 2022 07:03:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 88AE 22 KB
8 KB 34ms
23ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 53506
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 04 Sep 2022 16:11:27 GMT
expires: Mon, 04 Sep 2023 16:11:27 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dMUMwKlHRkKFxm324gu_shN2JBGfr2rZRInLP1vMiqM.js Show response
pagead2.googlesyndication.com/bg/ Frame 98C5 36 KB
16 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/dMUMwKlHRkKFxm324gu_shN2JBGfr2rZRInLP1vMiqM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74c50cc0a947464285c66df6e20bbfb2137624119faf6ad94489cb3f5bcc8aa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 20:19:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38636
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15929
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 04 Sep 2023 20:19:17 GMT

GET
H3 200 dMUMwKlHRkKFxm324gu_shN2JBGfr2rZRInLP1vMiqM.js Show response
pagead2.googlesyndication.com/bg/ Frame 1A15 36 KB
16 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/dMUMwKlHRkKFxm324gu_shN2JBGfr2rZRInLP1vMiqM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74c50cc0a947464285c66df6e20bbfb2137624119faf6ad94489cb3f5bcc8aa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 20:19:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38636
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15929
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 04 Sep 2023 20:19:17 GMT

GET
H3 200 dMUMwKlHRkKFxm324gu_shN2JBGfr2rZRInLP1vMiqM.js Show response
pagead2.googlesyndication.com/bg/ Frame 0337 36 KB
16 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/dMUMwKlHRkKFxm324gu_shN2JBGfr2rZRInLP1vMiqM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74c50cc0a947464285c66df6e20bbfb2137624119faf6ad94489cb3f5bcc8aa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 20:19:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38636
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15929
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 04 Sep 2023 20:19:17 GMT

GET
H3 200 dMUMwKlHRkKFxm324gu_shN2JBGfr2rZRInLP1vMiqM.js Show response
pagead2.googlesyndication.com/bg/ Frame E49B 36 KB
16 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/dMUMwKlHRkKFxm324gu_shN2JBGfr2rZRInLP1vMiqM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74c50cc0a947464285c66df6e20bbfb2137624119faf6ad94489cb3f5bcc8aa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 20:19:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38636
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15929
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 04 Sep 2023 20:19:17 GMT

GET
H3 200 55cf990f37ec56e67c14c15188d8cf27.js Show response
s0.2mdn.net/sadbundle/10348202853897552806/ Frame 72F9 79 KB
20 KB 24ms
22ms Script
application/x-javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10348202853897552806/55cf990f37ec56e67c14c15188d8cf27.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10348202853897552806/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

391b9c991f135590863d3144429459bf9e6ee939c6c04abddd0a851d1ed40a57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10348202853897552806/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 12:29:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 412396
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20589
x-xss-protection: 0
last-modified: Wed, 18 May 2022 12:27:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 31 Aug 2023 12:29:57 GMT

GET
H3 200 dMUMwKlHRkKFxm324gu_shN2JBGfr2rZRInLP1vMiqM.js Show response
pagead2.googlesyndication.com/bg/ Frame 88AE 36 KB
16 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/dMUMwKlHRkKFxm324gu_shN2JBGfr2rZRInLP1vMiqM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74c50cc0a947464285c66df6e20bbfb2137624119faf6ad94489cb3f5bcc8aa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 20:19:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38636
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15929
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 04 Sep 2023 20:19:17 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 72F9 4 KB
1 KB 92ms
35ms Stylesheet
text/css 2a00:1450:400e:80d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:500|Roboto:900

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10348202853897552806/55cf990f37ec56e67c14c15188d8cf27.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:80d::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1d352797c9473d7a0f0d88d182633330a8a7058a68cd6c052a8a2e2e6ffba4e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 05 Sep 2022 06:26:16 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 05 Sep 2022 07:03:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 05 Sep 2022 07:03:13 GMT

GET
H3 200 48507dbb3cdc3e767718e6faae052f2e.jpg
s0.2mdn.net/sadbundle/10348202853897552806/media/ Frame 72F9 14 KB
14 KB 24ms
23ms Image
image/jpeg 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10348202853897552806/media/48507dbb3cdc3e767718e6faae052f2e.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10348202853897552806/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a760a765dcb4a84db1a273d6497f9209cb3cacd86c70a5f7f8ac6de4f3929db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10348202853897552806/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 12:30:19 GMT
x-content-type-options: nosniff
age: 412374
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14024
x-xss-protection: 0
last-modified: Wed, 18 May 2022 12:27:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 31 Aug 2023 12:30:19 GMT

GET
H3 200 863ea29cd2fdad8c3d90fa940a661524.png
s0.2mdn.net/sadbundle/10348202853897552806/media/ Frame 72F9 3 KB
3 KB 25ms
24ms Image
image/png 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10348202853897552806/media/863ea29cd2fdad8c3d90fa940a661524.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10348202853897552806/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bba411a353d639297cc89d5125a1fbef9720be48e10153da4a1ca7decca70857

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10348202853897552806/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 12:31:22 GMT
x-content-type-options: nosniff
age: 412311
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2632
x-xss-protection: 0
last-modified: Wed, 18 May 2022 12:27:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 31 Aug 2023 12:31:22 GMT

GET
H3 200 ccc51e81bd2b6bdfb71582fee7056110.png
s0.2mdn.net/sadbundle/10348202853897552806/media/ Frame 72F9 2 KB
2 KB 27ms
27ms Image
image/png 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10348202853897552806/media/ccc51e81bd2b6bdfb71582fee7056110.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10348202853897552806/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e472a110c063c7b4f07df872d461336885657c35e4ea04aa75f1bbb77a04950

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10348202853897552806/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 12:29:57 GMT
x-content-type-options: nosniff
age: 412396
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2220
x-xss-protection: 0
last-modified: Wed, 18 May 2022 12:27:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 31 Aug 2023 12:29:57 GMT

GET
H3 200 6a03fadd1109063234f1a0a84f212569.png
s0.2mdn.net/sadbundle/10348202853897552806/media/ Frame 72F9 3 KB
3 KB 26ms
26ms Image
image/png 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10348202853897552806/media/6a03fadd1109063234f1a0a84f212569.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10348202853897552806/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5edaf59f4df3a21a756e244ee76eacc9f47d3fe370dba4ce9782cea04334ab10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10348202853897552806/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 08:48:18 GMT
x-content-type-options: nosniff
age: 425695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2589
x-xss-protection: 0
last-modified: Wed, 18 May 2022 12:27:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 31 Aug 2023 08:48:18 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame F229 0
10 B 22ms
22ms Image
text/plain 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?kWdlLw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 07:03:13 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 7469
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873830a7df8deda4aa6?subid=89619100035174400710616012073023&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=89619100035174400710616012073023&actionid=981741&produktid=&dt_url=

0
628 B

116ms
39ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=89619100035174400710616012073023&actionid=981741&produktid=&dt_url=

Requested by

Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request.php?zone=npoee1nv94vs&nw=20&renderingType=javascript&namespace=a552021801&subid=&uid=12f87d0b6f0af534&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCBZzsMJ8VY8mwCIrp3gPxvLJAtc35g1fM3rmr5QzwLhABIPTo8R5glaKkgrAHyAEJqQLWhheQFrOwPqgDAaoE5gFP0JXbmzE_7aA0gR-syZUKuz3qMfW0KgpaUI5uCMN2HuEW6h1R0kdXy1ajDCTZ4NZ7pJOn6zS1tj8Zo9DxxotDceuJPstEgjInfTPP2cLZXTnENxAw8MKs4yWr7M0E1RFSvVzReG50uOEkCyBFYH-xE8QM9jHximdKk57r6FPETfe6Oq2ToCsK5v9hW5aMMfNu7ZChgDD6JjaQH_W1GotZoIWJPQjE0siVf4yO3z73kVQ8vamw9CqXTLpyesu5pw3hqaw6L_Ua6Nt3O5QCWENoNTquUslWRl86nG9MaWcDV7LcFUIhuMAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIIEgiI4YAQEAEYHTIDqoIBOgKAQIAKAZgLAcgLAYAMAbAT3JnrDdATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASKORoXxQ5YLsfMRyH4FZO4OYXfoFb4RtcdXCujboksDY9nT4TM0CsA38%26sig%3DAOD64_3BCrTozTtHP8eH4lNvHnEMi5XGhw%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-AGYYyzIvvYa7zGPNI47o6e_I9wmwrArUNchMqkrl2N5QM4BLF_r4o0lFZcq2tpvdyYFsneBloOFvsVOZYm3Z3sodFgGXx-53B4vtEB8ALBasmkD_2xXNOs9tIpiGzOknPQXAvmmBt2zSjgmThNAywnz_3CqQ%26cry%3D1%26dbm_d%3DAKAmf-AfAv9FJLlgg9Fe78C28W_BGalVofUtylKdboKjhlXXfZ_ynu5glen0Kk_ii8sLGOkzQLg6LDKuZpXPp9X3966Oj2RtiB8Z73wJnzmHwIhn87_k0_ve6OzyEYkdA7QLDn39M_a7-Y3Y-VNKH4F4JiBoS60KO5cc90GanD2vpwBTF4JZ76wMk2eN2gbjCfTqeuWf7BcEjiKQ0F8BWOPR8kA9gaPfAsXIEyMWcHpA9Vo5-95dxehwIcF7oXi1v8vA6ifwoMb8Yzc-RPxKnTXFP2A0O6anH_NnuhvOSNOOf3gMSRPmvboixf-uV62nYiDXFkQYmbFXMAk_A8OMR8lbjU6iAuu4TNcZnuLYxX-eOj7gOSSsCS-31ZysDiuYrB-kG9zGiAabBH7VUZp3EEUhgZipyBp_B3_t8HsvMImHw6W0b3hq7laRZWv-0n2i6TvDlGeJV3ZXckd9UaPBzdtzX0hdzpLfDXb4D_eMvyJSCx6gouMLMbt8Ebl57IgbtTowonV9lEQ-koKdWu0BviKQvo2tCTX_Fg%26adurl%3D&documentReferer=https%3A%2F%2Fwww.dcard.tw%2F&ancestorOrigins=https%3A%2F%2Fwww.dcard.tw&random=5571712193369&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 05 Sep 2022 07:03:12 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Mon, 05 Sep 2022 09:03:13 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Content-Length: 0
Content-Type: application/javascript
Date: Mon, 05 Sep 2022 07:03:13 GMT
Host: pv.medialead.de
Keep-Alive: timeout=20
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=89619100035174400710616012073023&actionid=981741&produktid=&dt_url=
Proxy-Host: pv.medialead.de
Server: nginx/1.17.5
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40027
X-IPLB-Request-ID: 5413AFB8:DFFE_91EFC182:01BB_63159F31_8A1081B:2A469

GET
H2 403 / Show response
adv.office-partner.de/ Frame 8501 1 KB
728 B 182ms
38ms Document
text/html 2a0b:4d07:401::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request.php?zone=npoee1nv94vs&nw=20&renderingType=javascript&namespace=a552021801&subid=&uid=12f87d0b6f0af534&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCBZzsMJ8VY8mwCIrp3gPxvLJAtc35g1fM3rmr5QzwLhABIPTo8R5glaKkgrAHyAEJqQLWhheQFrOwPqgDAaoE5gFP0JXbmzE_7aA0gR-syZUKuz3qMfW0KgpaUI5uCMN2HuEW6h1R0kdXy1ajDCTZ4NZ7pJOn6zS1tj8Zo9DxxotDceuJPstEgjInfTPP2cLZXTnENxAw8MKs4yWr7M0E1RFSvVzReG50uOEkCyBFYH-xE8QM9jHximdKk57r6FPETfe6Oq2ToCsK5v9hW5aMMfNu7ZChgDD6JjaQH_W1GotZoIWJPQjE0siVf4yO3z73kVQ8vamw9CqXTLpyesu5pw3hqaw6L_Ua6Nt3O5QCWENoNTquUslWRl86nG9MaWcDV7LcFUIhuMAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIIEgiI4YAQEAEYHTIDqoIBOgKAQIAKAZgLAcgLAYAMAbAT3JnrDdATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASKORoXxQ5YLsfMRyH4FZO4OYXfoFb4RtcdXCujboksDY9nT4TM0CsA38%26sig%3DAOD64_3BCrTozTtHP8eH4lNvHnEMi5XGhw%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-AGYYyzIvvYa7zGPNI47o6e_I9wmwrArUNchMqkrl2N5QM4BLF_r4o0lFZcq2tpvdyYFsneBloOFvsVOZYm3Z3sodFgGXx-53B4vtEB8ALBasmkD_2xXNOs9tIpiGzOknPQXAvmmBt2zSjgmThNAywnz_3CqQ%26cry%3D1%26dbm_d%3DAKAmf-AfAv9FJLlgg9Fe78C28W_BGalVofUtylKdboKjhlXXfZ_ynu5glen0Kk_ii8sLGOkzQLg6LDKuZpXPp9X3966Oj2RtiB8Z73wJnzmHwIhn87_k0_ve6OzyEYkdA7QLDn39M_a7-Y3Y-VNKH4F4JiBoS60KO5cc90GanD2vpwBTF4JZ76wMk2eN2gbjCfTqeuWf7BcEjiKQ0F8BWOPR8kA9gaPfAsXIEyMWcHpA9Vo5-95dxehwIcF7oXi1v8vA6ifwoMb8Yzc-RPxKnTXFP2A0O6anH_NnuhvOSNOOf3gMSRPmvboixf-uV62nYiDXFkQYmbFXMAk_A8OMR8lbjU6iAuu4TNcZnuLYxX-eOj7gOSSsCS-31ZysDiuYrB-kG9zGiAabBH7VUZp3EEUhgZipyBp_B3_t8HsvMImHw6W0b3hq7laRZWv-0n2i6TvDlGeJV3ZXckd9UaPBzdtzX0hdzpLfDXb4D_eMvyJSCx6gouMLMbt8Ebl57IgbtTowonV9lEQ-koKdWu0BviKQvo2tCTX_Fg%26adurl%3D&documentReferer=https%3A%2F%2Fwww.dcard.tw%2F&ancestorOrigins=https%3A%2F%2Fwww.dcard.tw&random=5571712193369&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:401::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 1d2009e4aea51a8e6a0f6404f282d8948f473e26f80e45c7ed9bbb12e470d661

Request headers

Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Mon, 05 Sep 2022 07:03:13 GMT
etag: W/"5ad8a35f-59f"
server: keycdn-engine
x-edge-location: atvi

GET
H2 200 link.html Show response
track.webgains.com/ Frame 6927 2 KB
2 KB 187ms
96ms Script
text/html 18.168.21.195
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=89619100035174400710616012073023&nw=1
Requested by: Host: www.dcard.tw
URL: https://www.dcard.tw/f
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.168.21.195 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-168-21-195.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 3a15c4d385c057b87e2792745f5b66b7490fa17eba6f3aae4a942ae880ee4636

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 07:03:13 GMT
last-modified: Mon, 05 Sep 2022 07:03:13 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Mon, 05 Sep 2022 07:04:13 GMT

GET
H/1.1 200
OK request_content.php Show response
hal900023.redintelligence.net/ Frame 168C 7 KB
2 KB 78ms
26ms Document
text/html 78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900023.redintelligence.net/request_content.php?s=89619100035174400710616012073023&a=89d75bd8
Requested by: Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request.php?zone=npoee1nv94vs&nw=20&renderingType=javascript&namespace=a552021801&subid=&uid=12f87d0b6f0af534&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCBZzsMJ8VY8mwCIrp3gPxvLJAtc35g1fM3rmr5QzwLhABIPTo8R5glaKkgrAHyAEJqQLWhheQFrOwPqgDAaoE5gFP0JXbmzE_7aA0gR-syZUKuz3qMfW0KgpaUI5uCMN2HuEW6h1R0kdXy1ajDCTZ4NZ7pJOn6zS1tj8Zo9DxxotDceuJPstEgjInfTPP2cLZXTnENxAw8MKs4yWr7M0E1RFSvVzReG50uOEkCyBFYH-xE8QM9jHximdKk57r6FPETfe6Oq2ToCsK5v9hW5aMMfNu7ZChgDD6JjaQH_W1GotZoIWJPQjE0siVf4yO3z73kVQ8vamw9CqXTLpyesu5pw3hqaw6L_Ua6Nt3O5QCWENoNTquUslWRl86nG9MaWcDV7LcFUIhuMAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIIEgiI4YAQEAEYHTIDqoIBOgKAQIAKAZgLAcgLAYAMAbAT3JnrDdATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASKORoXxQ5YLsfMRyH4FZO4OYXfoFb4RtcdXCujboksDY9nT4TM0CsA38%26sig%3DAOD64_3BCrTozTtHP8eH4lNvHnEMi5XGhw%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-AGYYyzIvvYa7zGPNI47o6e_I9wmwrArUNchMqkrl2N5QM4BLF_r4o0lFZcq2tpvdyYFsneBloOFvsVOZYm3Z3sodFgGXx-53B4vtEB8ALBasmkD_2xXNOs9tIpiGzOknPQXAvmmBt2zSjgmThNAywnz_3CqQ%26cry%3D1%26dbm_d%3DAKAmf-AfAv9FJLlgg9Fe78C28W_BGalVofUtylKdboKjhlXXfZ_ynu5glen0Kk_ii8sLGOkzQLg6LDKuZpXPp9X3966Oj2RtiB8Z73wJnzmHwIhn87_k0_ve6OzyEYkdA7QLDn39M_a7-Y3Y-VNKH4F4JiBoS60KO5cc90GanD2vpwBTF4JZ76wMk2eN2gbjCfTqeuWf7BcEjiKQ0F8BWOPR8kA9gaPfAsXIEyMWcHpA9Vo5-95dxehwIcF7oXi1v8vA6ifwoMb8Yzc-RPxKnTXFP2A0O6anH_NnuhvOSNOOf3gMSRPmvboixf-uV62nYiDXFkQYmbFXMAk_A8OMR8lbjU6iAuu4TNcZnuLYxX-eOj7gOSSsCS-31ZysDiuYrB-kG9zGiAabBH7VUZp3EEUhgZipyBp_B3_t8HsvMImHw6W0b3hq7laRZWv-0n2i6TvDlGeJV3ZXckd9UaPBzdtzX0hdzpLfDXb4D_eMvyJSCx6gouMLMbt8Ebl57IgbtTowonV9lEQ-koKdWu0BviKQvo2tCTX_Fg%26adurl%3D&documentReferer=https%3A%2F%2Fwww.dcard.tw%2F&ancestorOrigins=https%3A%2F%2Fwww.dcard.tw&random=5571712193369&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 51466efb99f4bcac6c6e196afd5d116d46bdd065c1125ec98acfa30d993d90d5

Request headers

Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2063
Content-Type: text/html; charset=utf-8
Date: Mon, 05 Sep 2022 07:03:13 GMT
Expires: Mon, 05 Sep 2022 08:03:13 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame 6927
Redirect Chain

https://pv.medialead.de/trck/eview/e99aace94e6e5873830a7df8deda4aa6?subid=89619100035174400710616012073023
https://ad-server.eu/wm/pb/native.png

68 B
312 B

244ms
41ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:07:21 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Mon, 05 Sep 2022 07:03:13 GMT
Server: nginx/1.17.5
Host: pv.medialead.de
X-IPLB-Request-ID: 5413AFB8:E00A_91EFC182:01BB_63159F31_8A10824:2A469
X-IPLB-Instance: 40027
Strict-Transport-Security: max-age=15768000
Content-Type: application/go
Location: https://ad-server.eu/wm/pb/native.png
Keep-Alive: timeout=20
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 6927 43 B
702 B 183ms
72ms Image
image/gif 92.123.17.141
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2519595&v=14098&q=379097&r=296283&pref1=89619100035174400710616012073023&pv=1

Requested by

Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.17.141 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-17-141.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:13 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 63AC
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873830a7df8deda4aa6?subid=29812100033687600710616012073013&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=29812100033687600710616012073013&actionid=981741&produktid=&dt_url=

0
201 B

119ms
40ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=29812100033687600710616012073013&actionid=981741&produktid=&dt_url=

Requested by

Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request.php?zone=npoee1nv94vs&nw=20&renderingType=javascript&namespace=c88d04f4bc&subid=&uid=638bf485c91320f0&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCceiqMJ8VY-rJCJTw3gOhpqSYDbXN-YNXzN65q-UM8C4QASD06PEeYJWipIKwB8gBCakC1oYXkBazsD6oAwGqBOIBT9DGCwo-o-LUBpjeoYeZboTJAatf7xqqG5kib3URTv5zS2t9FFKSk3MKgQ-6Ya6t3DTvzJfDrgbS_tE6XdVPkvRmLjpzvghcU4O9XJPp-bSov687XxjkhhFDJnFEyKUxtC8z4zB78meHIq3OdVVbetlhPyHB31Knm4LO6DUaMQyEr8TK1qeP5Fl7q3C6D4vsIhdBYeC-OoDgZ2pkp8RxZiLYMokqKiB_fgdvOJhXZzJ_pNUX5OYUTYD3JguBJBsyUOoAmn55CHbP0akOjTAar4TpprB2Vtmr52e8kIuCFI0lNMAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIIEgiI4YAQEAEYHTIDqoIBOgKAQIAKAZgLAcgLAYAMAbAT3JnrDdATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASJ-Roh-K9Hk_HCdF7Gjx7IBVphU4jQ7Icz10veKHFFnSjff4yk26H8Q%26sig%3DAOD64_36bXtSJ5XJ9kLcXhDtjpr191ZZNg%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-BWOer3_FVLhbKmKSEBDv9gb5seO9-qeB2kMWaMqZ6vhkFnAYaARB8Avsbid3SlCPwg0O7p_cBgU5tS1OPU8JLfDhUAVWEHyuZ6sddYGIGUWLwF8l1m4MFneSgUvcFMfKsbcwenD8yaCjlCjxNVb8KTN-dSUg%26cry%3D1%26dbm_d%3DAKAmf-AzEBg22ky__Hgjhz-nO6DU9x4xH5cOfQF2pAebo1FSPvOBJQ9wCQy15SGuMRiTTpjk1880DoNn_ubykBC0kCkmQjz9hZYlQZU4sJnImZHDJ_TS1BdX5WrDAtJYNiTgu3ZrQ65RCPouZhRLU-fKHrqTGeJbXzQm0I2bTh51FX8wNA1EGs1YJEFYKHP0Y1WSxXQRmOQf1bhL1B-8hjuVrItapz9enaZvqn7umAueZ0MNXEtkOmE8tdfxeCP3Yyw2QB9jqe3z99a0K4-UXEU53k_pivWoNqiCO2lcqNham_Kcose2Ah_eUZQbUizLy69vBMSDGTbuFDTjqZWvZXo21-zs7_wXFavT0sF7DkkC-gy9KNXkx6MlIeBFe9ecn_3zVYlfgioDCybc2jlwnyxTohxd5-VTYuh0BfmXl9Gu-nrN5zkOqjl13__Fw0Z4TwRqWeStitSN6dtIQ1HTV4zc4jGj5cYuYXRQfl7eNyRPULyTvEWDBAD3F-CdJk6jjHmgguLAGu86jR3EQk2vUTeLwq58fEr4PA%26adurl%3D&documentReferer=https%3A%2F%2Fwww.dcard.tw%2F&ancestorOrigins=https%3A%2F%2Fwww.dcard.tw&random=7651394901866&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 05 Sep 2022 07:03:12 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Mon, 05 Sep 2022 09:03:13 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Content-Length: 0
Content-Type: application/javascript
Date: Mon, 05 Sep 2022 07:03:13 GMT
Host: pv.medialead.de
Keep-Alive: timeout=20
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=29812100033687600710616012073013&actionid=981741&produktid=&dt_url=
Proxy-Host: pv.medialead.de
Server: nginx/1.17.5
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40028
X-IPLB-Request-ID: 5413AFB8:DFFC_91EFC182:01BB_63159F31_8A53AE5:1F22C

GET
H2 403 / Show response
adv.office-partner.de/ Frame 4F38 1 KB
727 B 82ms
39ms Document
text/html 2a0b:4d07:401::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request.php?zone=npoee1nv94vs&nw=20&renderingType=javascript&namespace=c88d04f4bc&subid=&uid=638bf485c91320f0&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCceiqMJ8VY-rJCJTw3gOhpqSYDbXN-YNXzN65q-UM8C4QASD06PEeYJWipIKwB8gBCakC1oYXkBazsD6oAwGqBOIBT9DGCwo-o-LUBpjeoYeZboTJAatf7xqqG5kib3URTv5zS2t9FFKSk3MKgQ-6Ya6t3DTvzJfDrgbS_tE6XdVPkvRmLjpzvghcU4O9XJPp-bSov687XxjkhhFDJnFEyKUxtC8z4zB78meHIq3OdVVbetlhPyHB31Knm4LO6DUaMQyEr8TK1qeP5Fl7q3C6D4vsIhdBYeC-OoDgZ2pkp8RxZiLYMokqKiB_fgdvOJhXZzJ_pNUX5OYUTYD3JguBJBsyUOoAmn55CHbP0akOjTAar4TpprB2Vtmr52e8kIuCFI0lNMAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIIEgiI4YAQEAEYHTIDqoIBOgKAQIAKAZgLAcgLAYAMAbAT3JnrDdATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASJ-Roh-K9Hk_HCdF7Gjx7IBVphU4jQ7Icz10veKHFFnSjff4yk26H8Q%26sig%3DAOD64_36bXtSJ5XJ9kLcXhDtjpr191ZZNg%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-BWOer3_FVLhbKmKSEBDv9gb5seO9-qeB2kMWaMqZ6vhkFnAYaARB8Avsbid3SlCPwg0O7p_cBgU5tS1OPU8JLfDhUAVWEHyuZ6sddYGIGUWLwF8l1m4MFneSgUvcFMfKsbcwenD8yaCjlCjxNVb8KTN-dSUg%26cry%3D1%26dbm_d%3DAKAmf-AzEBg22ky__Hgjhz-nO6DU9x4xH5cOfQF2pAebo1FSPvOBJQ9wCQy15SGuMRiTTpjk1880DoNn_ubykBC0kCkmQjz9hZYlQZU4sJnImZHDJ_TS1BdX5WrDAtJYNiTgu3ZrQ65RCPouZhRLU-fKHrqTGeJbXzQm0I2bTh51FX8wNA1EGs1YJEFYKHP0Y1WSxXQRmOQf1bhL1B-8hjuVrItapz9enaZvqn7umAueZ0MNXEtkOmE8tdfxeCP3Yyw2QB9jqe3z99a0K4-UXEU53k_pivWoNqiCO2lcqNham_Kcose2Ah_eUZQbUizLy69vBMSDGTbuFDTjqZWvZXo21-zs7_wXFavT0sF7DkkC-gy9KNXkx6MlIeBFe9ecn_3zVYlfgioDCybc2jlwnyxTohxd5-VTYuh0BfmXl9Gu-nrN5zkOqjl13__Fw0Z4TwRqWeStitSN6dtIQ1HTV4zc4jGj5cYuYXRQfl7eNyRPULyTvEWDBAD3F-CdJk6jjHmgguLAGu86jR3EQk2vUTeLwq58fEr4PA%26adurl%3D&documentReferer=https%3A%2F%2Fwww.dcard.tw%2F&ancestorOrigins=https%3A%2F%2Fwww.dcard.tw&random=7651394901866&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:401::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 1d2009e4aea51a8e6a0f6404f282d8948f473e26f80e45c7ed9bbb12e470d661

Request headers

Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Mon, 05 Sep 2022 07:03:13 GMT
etag: W/"5ad8a35f-59f"
server: keycdn-engine
x-edge-location: atvi

GET
H2 200 link.html Show response
track.webgains.com/ Frame E2C7 2 KB
2 KB 89ms
87ms Script
text/html 18.168.21.195
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=29812100033687600710616012073013&nw=1
Requested by: Host: www.dcard.tw
URL: https://www.dcard.tw/f
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.168.21.195 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-168-21-195.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 0fc095a29832a2051e55940ef59773627eaf1d9f01c0f5cc81520cc4ad70d49e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 07:03:13 GMT
last-modified: Mon, 05 Sep 2022 07:03:13 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Mon, 05 Sep 2022 07:04:13 GMT

GET
H/1.1 200
OK request_content.php Show response
hal900013.redintelligence.net/ Frame 2577 7 KB
2 KB 89ms
34ms Document
text/html 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900013.redintelligence.net/request_content.php?s=29812100033687600710616012073013&a=c88e3d1e
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request.php?zone=npoee1nv94vs&nw=20&renderingType=javascript&namespace=c88d04f4bc&subid=&uid=638bf485c91320f0&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCceiqMJ8VY-rJCJTw3gOhpqSYDbXN-YNXzN65q-UM8C4QASD06PEeYJWipIKwB8gBCakC1oYXkBazsD6oAwGqBOIBT9DGCwo-o-LUBpjeoYeZboTJAatf7xqqG5kib3URTv5zS2t9FFKSk3MKgQ-6Ya6t3DTvzJfDrgbS_tE6XdVPkvRmLjpzvghcU4O9XJPp-bSov687XxjkhhFDJnFEyKUxtC8z4zB78meHIq3OdVVbetlhPyHB31Knm4LO6DUaMQyEr8TK1qeP5Fl7q3C6D4vsIhdBYeC-OoDgZ2pkp8RxZiLYMokqKiB_fgdvOJhXZzJ_pNUX5OYUTYD3JguBJBsyUOoAmn55CHbP0akOjTAar4TpprB2Vtmr52e8kIuCFI0lNMAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIIEgiI4YAQEAEYHTIDqoIBOgKAQIAKAZgLAcgLAYAMAbAT3JnrDdATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASJ-Roh-K9Hk_HCdF7Gjx7IBVphU4jQ7Icz10veKHFFnSjff4yk26H8Q%26sig%3DAOD64_36bXtSJ5XJ9kLcXhDtjpr191ZZNg%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-BWOer3_FVLhbKmKSEBDv9gb5seO9-qeB2kMWaMqZ6vhkFnAYaARB8Avsbid3SlCPwg0O7p_cBgU5tS1OPU8JLfDhUAVWEHyuZ6sddYGIGUWLwF8l1m4MFneSgUvcFMfKsbcwenD8yaCjlCjxNVb8KTN-dSUg%26cry%3D1%26dbm_d%3DAKAmf-AzEBg22ky__Hgjhz-nO6DU9x4xH5cOfQF2pAebo1FSPvOBJQ9wCQy15SGuMRiTTpjk1880DoNn_ubykBC0kCkmQjz9hZYlQZU4sJnImZHDJ_TS1BdX5WrDAtJYNiTgu3ZrQ65RCPouZhRLU-fKHrqTGeJbXzQm0I2bTh51FX8wNA1EGs1YJEFYKHP0Y1WSxXQRmOQf1bhL1B-8hjuVrItapz9enaZvqn7umAueZ0MNXEtkOmE8tdfxeCP3Yyw2QB9jqe3z99a0K4-UXEU53k_pivWoNqiCO2lcqNham_Kcose2Ah_eUZQbUizLy69vBMSDGTbuFDTjqZWvZXo21-zs7_wXFavT0sF7DkkC-gy9KNXkx6MlIeBFe9ecn_3zVYlfgioDCybc2jlwnyxTohxd5-VTYuh0BfmXl9Gu-nrN5zkOqjl13__Fw0Z4TwRqWeStitSN6dtIQ1HTV4zc4jGj5cYuYXRQfl7eNyRPULyTvEWDBAD3F-CdJk6jjHmgguLAGu86jR3EQk2vUTeLwq58fEr4PA%26adurl%3D&documentReferer=https%3A%2F%2Fwww.dcard.tw%2F&ancestorOrigins=https%3A%2F%2Fwww.dcard.tw&random=7651394901866&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: bc251e445ad3a99ce8cf72936c763d9da53689d414f9a1e0d8824ad435426c73

Request headers

Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2063
Content-Type: text/html; charset=utf-8
Date: Mon, 05 Sep 2022 07:03:13 GMT
Expires: Mon, 05 Sep 2022 08:03:13 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame E2C7
Redirect Chain

https://pv.medialead.de/trck/eview/e99aace94e6e5873830a7df8deda4aa6?subid=29812100033687600710616012073013
https://ad-server.eu/wm/pb/native.png

68 B
312 B

245ms
43ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:07:21 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Mon, 05 Sep 2022 07:03:13 GMT
Server: nginx/1.17.5
Host: pv.medialead.de
X-IPLB-Request-ID: 5413AFB8:E00E_91EFC182:01BB_63159F31_8A5DF1D:1F22B
X-IPLB-Instance: 40028
Strict-Transport-Security: max-age=15768000
Content-Type: application/go
Location: https://ad-server.eu/wm/pb/native.png
Keep-Alive: timeout=20
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame E2C7 43 B
702 B 125ms
63ms Image
image/gif 92.123.17.141
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2519595&v=14098&q=379097&r=296283&pref1=29812100033687600710616012073013&pv=1

Requested by

Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.17.141 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-17-141.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:13 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
DATA 200
OK truncated
/ Frame 6927 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 58384145e167c624fa67edaecb362752268dc93529a4ac27a09c9c65cfb4865c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame E2C7 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 83bc4b7593693a3cea2b24b9603ffdfa205611a2aa7e2ed1b2745f26d2b92544

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame B908
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873830a7df8deda4aa6?subid=84984500032917200710624012073025&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=84984500032917200710624012073025&actionid=981741&produktid=&dt_url=

0
202 B

36ms
36ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=84984500032917200710624012073025&actionid=981741&produktid=&dt_url=

Requested by

Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request.php?zone=ma1tq3l10cm4&nw=20&renderingType=javascript&namespace=3955d1f2eb&subid=&uid=092acba8ab47a9ac&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x600&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCwbpFMJ8VY9ifCK6FjuwPme-B0A-1zfmDV5zfuavlDPAuEAEg9OjxHmCVoqSCsAfIAQmpAtaGF5AWs7A-qAMBqgTiAU_QVPAifO4atcjSb7rB_Hgrt2CIXryivYUO6Cleb0RwMKv6vNU56hYdxjThETODCSSvUgn-7oyxHF_23BsaAZyzERXrVrLrc8kDIrNFfbVnMoQLDx-KQWvN-UZmoCdlgWJ-TPNZ13OiA3vHwO0m1xnpkTHbKIWVXMHD5C4MGj31tHaQamhfBUvPWJ5-67SRHUbelGa1zlWm-YwxadC8TvdblFDuXyFmZ817zm5orPgu4mXKSvxDyYta7DFkysPSUrFiOhdtpGmKiFdGRk6AdnBoRcFRwdzUYqhoIbMbBElxvGPABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgGYCwHICwGADAGwE9yZ6w3QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASJ-Ro8_B7cWK7p2tCawNei3ClfAUtZlIQm6yww7LPqa2Sg6EnWBa04A%26sig%3DAOD64_1JRR1PYdBj6dsqDJXy2UcrPVC_Gg%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-AQVsTntV7A8Af3vO8eAciO_C624j5I2cK_w_0eJgAV9qlcS4Fk_LqvqJ3aKl6cfZHw_3vS0tlZp-YGFWt0tJWNNCTjVHgdw2oAlxpnp2T_EfySkk5OBwkXOkCp61bpexHJ2ztycIppzAh63xaGBaMKAtKIUQ%26cry%3D1%26dbm_d%3DAKAmf-DUUxQSF8jOnZ0GMrU7cvP3MycQHyZFcgwmv2mZxWcqaJLAkThq_VpOfp1-WsJZ6JXpWC5n_s2KRFNzljK5feg3XZxbWC6PfmhAGVFFmSHZzfkG4x88VuYrQuyL1YU_4-_ictB-zP6gJbk5u4JQO8-zdcvFUtBsp5wmeYV3sgLjHmzAGaQ75dKAbKTlYgRI-RLufMQRKGwbj_eWe74hrV9CZFyRQeJc6fI_z0SQFCtL4Y9FAIYrafE_8_TDcVq7OO75W4Bt96ioZi-tz7wxco2gFCBGaazK_gPlYun0Ww738WfHkjEZeLy7tOmr4t955lhAcs94iIsiLDbUFXQQLbsiW57Rz_YAcEnD6sEkNQvZAhsk2BdOxrQmC6qYpH_bKdpWxku6Ih2Bwd3mfJG7Meg81GQjEBB1_EXhS0wNIYt1Rsgb6vBFKCqXNu4aSQQbFXRZ48Fk7FoOkHpfCi8w4G64CezAOs6xULWZtlDv4z0-hTb04C_kemNAIKEcDoa6Msbk0vuW8CI_VbKU0C7Xk3DvNqhyrw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.dcard.tw%2F&ancestorOrigins=https%3A%2F%2Fwww.dcard.tw&random=652101580154&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 05 Sep 2022 07:03:12 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Mon, 05 Sep 2022 09:03:13 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Content-Length: 0
Content-Type: application/javascript
Date: Mon, 05 Sep 2022 07:03:13 GMT
Host: pv.medialead.de
Keep-Alive: timeout=20
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=84984500032917200710624012073025&actionid=981741&produktid=&dt_url=
Proxy-Host: pv.medialead.de
Server: nginx/1.17.5
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40028
X-IPLB-Request-ID: 5413AFB8:DFFC_91EFC182:01BB_63159F31_8A53AF6:1F22C

GET
H2 403 / Show response
adv.office-partner.de/ Frame 3EB3 1 KB
727 B 32ms
30ms Document
text/html 2a0b:4d07:401::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request.php?zone=ma1tq3l10cm4&nw=20&renderingType=javascript&namespace=3955d1f2eb&subid=&uid=092acba8ab47a9ac&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x600&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCwbpFMJ8VY9ifCK6FjuwPme-B0A-1zfmDV5zfuavlDPAuEAEg9OjxHmCVoqSCsAfIAQmpAtaGF5AWs7A-qAMBqgTiAU_QVPAifO4atcjSb7rB_Hgrt2CIXryivYUO6Cleb0RwMKv6vNU56hYdxjThETODCSSvUgn-7oyxHF_23BsaAZyzERXrVrLrc8kDIrNFfbVnMoQLDx-KQWvN-UZmoCdlgWJ-TPNZ13OiA3vHwO0m1xnpkTHbKIWVXMHD5C4MGj31tHaQamhfBUvPWJ5-67SRHUbelGa1zlWm-YwxadC8TvdblFDuXyFmZ817zm5orPgu4mXKSvxDyYta7DFkysPSUrFiOhdtpGmKiFdGRk6AdnBoRcFRwdzUYqhoIbMbBElxvGPABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgGYCwHICwGADAGwE9yZ6w3QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASJ-Ro8_B7cWK7p2tCawNei3ClfAUtZlIQm6yww7LPqa2Sg6EnWBa04A%26sig%3DAOD64_1JRR1PYdBj6dsqDJXy2UcrPVC_Gg%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-AQVsTntV7A8Af3vO8eAciO_C624j5I2cK_w_0eJgAV9qlcS4Fk_LqvqJ3aKl6cfZHw_3vS0tlZp-YGFWt0tJWNNCTjVHgdw2oAlxpnp2T_EfySkk5OBwkXOkCp61bpexHJ2ztycIppzAh63xaGBaMKAtKIUQ%26cry%3D1%26dbm_d%3DAKAmf-DUUxQSF8jOnZ0GMrU7cvP3MycQHyZFcgwmv2mZxWcqaJLAkThq_VpOfp1-WsJZ6JXpWC5n_s2KRFNzljK5feg3XZxbWC6PfmhAGVFFmSHZzfkG4x88VuYrQuyL1YU_4-_ictB-zP6gJbk5u4JQO8-zdcvFUtBsp5wmeYV3sgLjHmzAGaQ75dKAbKTlYgRI-RLufMQRKGwbj_eWe74hrV9CZFyRQeJc6fI_z0SQFCtL4Y9FAIYrafE_8_TDcVq7OO75W4Bt96ioZi-tz7wxco2gFCBGaazK_gPlYun0Ww738WfHkjEZeLy7tOmr4t955lhAcs94iIsiLDbUFXQQLbsiW57Rz_YAcEnD6sEkNQvZAhsk2BdOxrQmC6qYpH_bKdpWxku6Ih2Bwd3mfJG7Meg81GQjEBB1_EXhS0wNIYt1Rsgb6vBFKCqXNu4aSQQbFXRZ48Fk7FoOkHpfCi8w4G64CezAOs6xULWZtlDv4z0-hTb04C_kemNAIKEcDoa6Msbk0vuW8CI_VbKU0C7Xk3DvNqhyrw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.dcard.tw%2F&ancestorOrigins=https%3A%2F%2Fwww.dcard.tw&random=652101580154&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:401::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 1d2009e4aea51a8e6a0f6404f282d8948f473e26f80e45c7ed9bbb12e470d661

Request headers

Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Mon, 05 Sep 2022 07:03:13 GMT
etag: W/"5ad8a35f-59f"
server: keycdn-engine
x-edge-location: atvi

GET
H2 200 link.html Show response
track.webgains.com/ Frame D910 2 KB
2 KB 92ms
88ms Script
text/html 18.168.21.195
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=84984500032917200710624012073025&nw=1
Requested by: Host: www.dcard.tw
URL: https://www.dcard.tw/f
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.168.21.195 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-168-21-195.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 6609f381b235dc3773d26a3d2e803cf7e6e04775108db4d3bdbb8dbc0282b4cb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 07:03:13 GMT
last-modified: Mon, 05 Sep 2022 07:03:13 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Mon, 05 Sep 2022 07:04:13 GMT

GET
H/1.1 200
OK request_content.php Show response
hal900025.redintelligence.net/ Frame E9BB 7 KB
2 KB 78ms
27ms Document
text/html 138.201.84.245
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900025.redintelligence.net/request_content.php?s=84984500032917200710624012073025&a=4fc08f62
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request.php?zone=ma1tq3l10cm4&nw=20&renderingType=javascript&namespace=3955d1f2eb&subid=&uid=092acba8ab47a9ac&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x600&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCwbpFMJ8VY9ifCK6FjuwPme-B0A-1zfmDV5zfuavlDPAuEAEg9OjxHmCVoqSCsAfIAQmpAtaGF5AWs7A-qAMBqgTiAU_QVPAifO4atcjSb7rB_Hgrt2CIXryivYUO6Cleb0RwMKv6vNU56hYdxjThETODCSSvUgn-7oyxHF_23BsaAZyzERXrVrLrc8kDIrNFfbVnMoQLDx-KQWvN-UZmoCdlgWJ-TPNZ13OiA3vHwO0m1xnpkTHbKIWVXMHD5C4MGj31tHaQamhfBUvPWJ5-67SRHUbelGa1zlWm-YwxadC8TvdblFDuXyFmZ817zm5orPgu4mXKSvxDyYta7DFkysPSUrFiOhdtpGmKiFdGRk6AdnBoRcFRwdzUYqhoIbMbBElxvGPABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgGYCwHICwGADAGwE9yZ6w3QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASJ-Ro8_B7cWK7p2tCawNei3ClfAUtZlIQm6yww7LPqa2Sg6EnWBa04A%26sig%3DAOD64_1JRR1PYdBj6dsqDJXy2UcrPVC_Gg%26client%3Dca-pub-6491329949356724%26dbm_c%3DAKAmf-AQVsTntV7A8Af3vO8eAciO_C624j5I2cK_w_0eJgAV9qlcS4Fk_LqvqJ3aKl6cfZHw_3vS0tlZp-YGFWt0tJWNNCTjVHgdw2oAlxpnp2T_EfySkk5OBwkXOkCp61bpexHJ2ztycIppzAh63xaGBaMKAtKIUQ%26cry%3D1%26dbm_d%3DAKAmf-DUUxQSF8jOnZ0GMrU7cvP3MycQHyZFcgwmv2mZxWcqaJLAkThq_VpOfp1-WsJZ6JXpWC5n_s2KRFNzljK5feg3XZxbWC6PfmhAGVFFmSHZzfkG4x88VuYrQuyL1YU_4-_ictB-zP6gJbk5u4JQO8-zdcvFUtBsp5wmeYV3sgLjHmzAGaQ75dKAbKTlYgRI-RLufMQRKGwbj_eWe74hrV9CZFyRQeJc6fI_z0SQFCtL4Y9FAIYrafE_8_TDcVq7OO75W4Bt96ioZi-tz7wxco2gFCBGaazK_gPlYun0Ww738WfHkjEZeLy7tOmr4t955lhAcs94iIsiLDbUFXQQLbsiW57Rz_YAcEnD6sEkNQvZAhsk2BdOxrQmC6qYpH_bKdpWxku6Ih2Bwd3mfJG7Meg81GQjEBB1_EXhS0wNIYt1Rsgb6vBFKCqXNu4aSQQbFXRZ48Fk7FoOkHpfCi8w4G64CezAOs6xULWZtlDv4z0-hTb04C_kemNAIKEcDoa6Msbk0vuW8CI_VbKU0C7Xk3DvNqhyrw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.dcard.tw%2F&ancestorOrigins=https%3A%2F%2Fwww.dcard.tw&random=652101580154&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.245 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.245.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 7ce5c58cc8dd2ea2115b9260419063f017eca090ed18e8e6b29074218495a1e8

Request headers

Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2054
Content-Type: text/html; charset=utf-8
Date: Mon, 05 Sep 2022 07:03:13 GMT
Expires: Mon, 05 Sep 2022 08:03:13 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame D910
Redirect Chain

https://pv.medialead.de/trck/eview/e99aace94e6e5873830a7df8deda4aa6?subid=84984500032917200710624012073025
https://ad-server.eu/wm/pb/native.png

68 B
312 B

233ms
43ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:07:21 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Mon, 05 Sep 2022 07:03:13 GMT
Server: nginx/1.17.5
Host: pv.medialead.de
X-IPLB-Request-ID: 5413AFB8:DFFE_91EFC182:01BB_63159F31_8A1082C:2A469
X-IPLB-Instance: 40027
Strict-Transport-Security: max-age=15768000
Content-Type: application/go
Location: https://ad-server.eu/wm/pb/native.png
Keep-Alive: timeout=20
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame D910 43 B
702 B 66ms
63ms Image
image/gif 92.123.17.141
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2519595&v=14098&q=379097&r=296283&pref1=84984500032917200710624012073025&pv=1

Requested by

Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.17.141 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-17-141.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Sep 2022 07:03:13 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H3 404 undefinedpo641w
s0.2mdn.net/sadbundle/10348202853897552806/ Frame 72F9 43 B
64 B 413ms
412ms Image
image/gif 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10348202853897552806/undefinedpo641w

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10348202853897552806/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10348202853897552806/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 07:03:13 GMT
x-content-type-options: nosniff
server: sffe
x-dns-prefetch-control: off
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=0
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
expires: Mon, 05 Sep 2022 07:03:13 GMT

GET
H3 200 c8456be266b85364fb16b2febc050625.png
s0.2mdn.net/sadbundle/10348202853897552806/media/ Frame 72F9 4 KB
4 KB 22ms
21ms Image
image/png 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10348202853897552806/media/c8456be266b85364fb16b2febc050625.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10348202853897552806/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5561b6b71e5180e87fe6f4a9eef9ef2c964387fe8e40f394d430a486e6a1210a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10348202853897552806/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 12:30:01 GMT
x-content-type-options: nosniff
age: 412392
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3631
x-xss-protection: 0
last-modified: Wed, 18 May 2022 12:27:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 31 Aug 2023 12:30:01 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 168C 4 KB
651 B 87ms
33ms Stylesheet
text/css 2a00:1450:400e:80d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request_content.php?s=89619100035174400710616012073023&a=89d75bd8

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:80d::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dfa1ecdb69b9ee93e87159bfcd4ad2b1248a7de0d6346fd42e0b600723ae7b6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900023.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 05 Sep 2022 05:48:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 05 Sep 2022 07:03:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 05 Sep 2022 07:03:13 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 168C 16 KB
16 KB 80ms
27ms Image
image/png 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/pb_goldschmied_1200x627.jpg
Requested by: Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request_content.php?s=89619100035174400710616012073023&a=89d75bd8
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 32c3c0ed28585c40fee8d3ff0656be53d95746dad8a1e1fa28c4d257f4acf61f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900023.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:03:13 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16464
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 168C 16 KB
16 KB 78ms
27ms Image
image/png 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request_content.php?s=89619100035174400710616012073023&a=89d75bd8
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 5b6d27eb0a695956141a1af1b93051b0c66e3ea6720b1137c023db5c0ef89155

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900023.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:03:13 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16530
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 168C 17 KB
17 KB 84ms
28ms Image
image/png 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/3839/creativesup/father_daughter_1200x627.jpg
Requested by: Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request_content.php?s=89619100035174400710616012073023&a=89d75bd8
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 3e2e86a90f3bd342fdd1350baa1aaa36fd5f6279f1ced286b3a63d03a6215d20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900023.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:03:13 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16857
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 72F9 15 KB
15 KB 24ms
23ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:500|Roboto:900

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 08:45:00 GMT
x-content-type-options: nosniff
age: 425893
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15752
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 31 Aug 2023 08:45:00 GMT

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 72F9 16 KB
16 KB 20ms
20ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:500|Roboto:900

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 20:10:25 GMT
x-content-type-options: nosniff
age: 384768
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 31 Aug 2023 20:10:25 GMT

GET
DATA 200
OK truncated
/ Frame D910 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d188b9c1fd60cffdf98583e10c5194b084818a343148ef38aef02ddada71a009

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 2577 4 KB
651 B 34ms
34ms Stylesheet
text/css 2a00:1450:400e:80d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=29812100033687600710616012073013&a=c88e3d1e

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:80d::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dfa1ecdb69b9ee93e87159bfcd4ad2b1248a7de0d6346fd42e0b600723ae7b6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 05 Sep 2022 05:49:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 05 Sep 2022 07:03:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 05 Sep 2022 07:03:13 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2577 16 KB
16 KB 78ms
27ms Image
image/png 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/pb_goldschmied_1200x627.jpg
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=29812100033687600710616012073013&a=c88e3d1e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 32c3c0ed28585c40fee8d3ff0656be53d95746dad8a1e1fa28c4d257f4acf61f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:03:13 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16464
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2577 16 KB
16 KB 80ms
27ms Image
image/png 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=29812100033687600710616012073013&a=c88e3d1e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 5b6d27eb0a695956141a1af1b93051b0c66e3ea6720b1137c023db5c0ef89155

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:03:13 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16530
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 2577 17 KB
17 KB 80ms
27ms Image
image/png 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/3839/creativesup/father_daughter_1200x627.jpg
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=29812100033687600710616012073013&a=c88e3d1e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 3e2e86a90f3bd342fdd1350baa1aaa36fd5f6279f1ced286b3a63d03a6215d20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:03:13 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16857
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 6927 85 KB
85 KB 105ms
26ms Script
text/javascript 18.66.147.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=89619100035174400710616012073023&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-52.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ddf89cdacf98bb3a625393cc6301c0e57d1a40b9aab4e246c21c9a37301580dc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 05:03:58 GMT
via: 1.1 da78abc509aafffb42eec33ca2dc60d4.cloudfront.net (CloudFront)
last-modified: Tue, 23 Aug 2022 13:40:24 GMT
server: AmazonS3
age: 7156
etag: "42f12532a1be9c2d028e26e9b82a99a2"
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-pop: FRA60-P4
content-length: 86537
x-amz-cf-id: 3jz_P9-k29zjrmCcif9Smh8pPrkjvjBrqlBHxzHYas6QdvuJCNnKNg==

GET
H2 200 1x1_0.png
cdn.track.production.webgains.team/7121/ Frame 6927 3 KB
3 KB 118ms
34ms Image
image/png 108.138.233.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1_0.png?Expires=1662361693&Signature=e-8H8ao8H8SPufDKtzsx6rQGF0S8ozaV4C22Y69tjcN95yICAmCoOyJGgyOiSU7Uo8m61YrA5rRX8huy27htl-bxc7FwBr7PXZbwzfEuondbGT1BzF9qsY4bvOTZNZqxWRzMwkJA119yOG8J13WNx-ic7mryM9TPb5QRTUuJiosFEVB~unR2EXFHY9QS7T1VaS8FsX-XSX7AeT-lNEl5NuQrNKzGqGMe3Hmx5ixHalY3xsh1BKe-03~gM4lT0iFRywt6fagWt-iuujixG6PL37-0A~15Ybw81B6WTaa7VfMOE6kZCGne6feNjovwpa83CehCqaqXY-74XQO9AfG2sw__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.233.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-233-68.lhr61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 14:56:58 GMT
via: 1.1 2dfca5f585471c2badcfc3fa18023974.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
age: 57976
etag: "4e57de0506fbdb487ffcd53b450caee1"
x-cache: Hit from cloudfront
x-amz-version-id: null
x-amz-cf-pop: LHR61-P4
accept-ranges: bytes
content-type: image/png
content-length: 2808
x-amz-cf-id: nRrhwqSpNMk4kKqtaNOZBY7vWdaCBVE02kGvgeWI5DwROnDyadtB8Q==

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame E2C7 85 KB
85 KB 142ms
63ms Script
text/javascript 18.66.147.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=29812100033687600710616012073013&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-52.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ddf89cdacf98bb3a625393cc6301c0e57d1a40b9aab4e246c21c9a37301580dc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 05:03:58 GMT
via: 1.1 da78abc509aafffb42eec33ca2dc60d4.cloudfront.net (CloudFront)
last-modified: Tue, 23 Aug 2022 13:40:24 GMT
server: AmazonS3
age: 7156
etag: "42f12532a1be9c2d028e26e9b82a99a2"
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-pop: FRA60-P4
content-length: 86537
x-amz-cf-id: PY1ks9_aGlyK9eLydOlnX3Qdu66OXYmc3CBDRATnjIhXngQgfuQuGg==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame E2C7 85 B
419 B 119ms
35ms Image
image/gif 108.138.233.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1662361693&Signature=mzqyO~fJaZ6JDb9owSuP0GKPRnQl5-aHZCsAS~JvY3XlGGbhtXOQ5EDKW51yLB7zQvTS9NTtV1fEVvevaVVK7OXbkOHF3InITJfJMVBiyls~~xiB7ksLThn~dQ2P-sPXKl5AXBL9vE~hcYxWVe0aTbScHwoLe41kfj76yRvJLmZI7Ph~A7JLxyQYwRzYcrH6hrl5HWUaMIT9apDkjcPlALn6Wnj1Wc7koHV74lMa1Y7fVlzYKTDdpTIGt9wBikviD9tF6Z1CE4MZC-bLkOwBRWxU-T3C1xS4JJxwtxECtnkSneywGHQu1ySSGdduDgHWzEmmM~hCKLbKYzq1zWa-BQ__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.233.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-233-68.lhr61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 20:16:02 GMT
via: 1.1 2dfca5f585471c2badcfc3fa18023974.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
age: 38832
etag: "70af33d70b6810475aae19743c8c435b"
x-cache: Hit from cloudfront
x-amz-version-id: null
x-amz-cf-pop: LHR61-P4
accept-ranges: bytes
content-type: image/gif
content-length: 85
x-amz-cf-id: TjtG9H8c9qz0N2mS4dXUz-glgoKZvQ3tUr8L7-DuWw3GpmYLwUz32g==

GET
H3 200 css
fonts.googleapis.com/ Frame E9BB 4 KB
651 B 34ms
33ms Stylesheet
text/css 2a00:1450:400e:80d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request_content.php?s=84984500032917200710624012073025&a=4fc08f62

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:80d::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dfa1ecdb69b9ee93e87159bfcd4ad2b1248a7de0d6346fd42e0b600723ae7b6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900025.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 05 Sep 2022 06:01:56 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 05 Sep 2022 07:03:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 05 Sep 2022 07:03:13 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame E9BB 74 KB
75 KB 82ms
28ms Image
image/png 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=300&height=150&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/pb_goldschmied_1200x627.jpg
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request_content.php?s=84984500032917200710624012073025&a=4fc08f62
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: d4fb2872a1693ce497fcc5c5d89d1b601265346eb87ef155b0d4c2215aee4085

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900025.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:03:13 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Apache
Connection: close
Transfer-Encoding: chunked
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame E9BB 76 KB
77 KB 82ms
30ms Image
image/png 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=300&height=150&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request_content.php?s=84984500032917200710624012073025&a=4fc08f62
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 8243033afeaa3a04dbd818b347cf68162b953aeafcbe7460c47611848722973e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900025.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:03:13 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Apache
Connection: close
Transfer-Encoding: chunked
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame E9BB 79 KB
79 KB 82ms
28ms Image
image/png 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=300&height=150&url=https://cdn.contentspread.net/24i/advertiser/3839/creativesup/father_daughter_1200x627.jpg
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request_content.php?s=84984500032917200710624012073025&a=4fc08f62
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 1945e2cfd355a0fb79d6356437f91b54063c1a9cf3e31200a1f053e6d46875f8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900025.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:03:13 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Apache
Connection: close
Transfer-Encoding: chunked
Content-Type: image/png

GET
H/1.1 200
OK viewability Show response
hal900023.redintelligence.net/ Frame 168C 0
150 B 76ms
26ms Script
text/html 78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900023.redintelligence.net/viewability?s=89619100035174400710616012073023&a=e53a104f&vb=m
Requested by: Host: hal900023.redintelligence.net
URL: https://hal900023.redintelligence.net/request_content.php?s=89619100035174400710616012073023&a=89d75bd8
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900023.redintelligence.net/request_content.php?s=89619100035174400710616012073023&a=89d75bd8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:03:13 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame D910 85 KB
85 KB 121ms
75ms Script
text/javascript 18.66.147.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=84984500032917200710624012073025&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-52.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ddf89cdacf98bb3a625393cc6301c0e57d1a40b9aab4e246c21c9a37301580dc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 05:03:58 GMT
via: 1.1 da78abc509aafffb42eec33ca2dc60d4.cloudfront.net (CloudFront)
last-modified: Tue, 23 Aug 2022 13:40:24 GMT
server: AmazonS3
age: 7156
etag: "42f12532a1be9c2d028e26e9b82a99a2"
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-pop: FRA60-P4
content-length: 86537
x-amz-cf-id: YlMtRydhHd9gGSH_1KrkcPgM4vHlJe2RDtQUrhzDdtCTGDfmcLGvRw==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame D910 3 KB
3 KB 84ms
34ms Image
image/png 108.138.233.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1662361693&Signature=RRwdW2gg3EDupd~FG31bT5Sde2nkuaDPqj~BPRMy2uVK1uBap0e5YHbPiuTLvZ~gu1xR3E-KSENuHs0nOW~cr7~tyzzjD8gSWzX0Cq4LQB0WBHJ8zDpHK4EaeVJygdBw5JUo8BTlVRaFbS3ysIAEzTkJEtiXxlj1MlEubhBkFChwVCiFDyGAEmQvdwhP3bW89gqXbYH2Mt~ILdu5AKLd9mHFJYq1mvVCfE6RzWxTaY83fhEIxtE1oKrKdaTZm8vkgMLgHoek-Bfv6ikeOrTKdxhqtb8wpC5epizhvLb99AEeeOYrkI-Zqcp5el24VXaztQEWOV~i9uM2GgtuQwch3Q__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.233.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-233-68.lhr61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 11:19:33 GMT
via: 1.1 2dfca5f585471c2badcfc3fa18023974.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
age: 71021
etag: "4e57de0506fbdb487ffcd53b450caee1"
x-cache: Hit from cloudfront
x-amz-version-id: null
x-amz-cf-pop: LHR61-P4
accept-ranges: bytes
content-type: image/png
content-length: 2808
x-amz-cf-id: qPIOJ9QUoh92Jl0w4KjnYsj9BgNX-pBff28JQGzGHy1T1sZGu3LvOw==

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 98C5 0
20 B 56ms
55ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BKKbVMJ8VY_CZH9SYgAfK2ouwBwAAAAA4AeAEAg&bg=!sLOls_fNAAZTikH4c4o7ACkAdvg8WojEZgff0HSDId-c8JproZ0VDZiAM9GbuukxupJ42WbTy88OaQIAAAHvUgAAAAJoAQcKAAZBbs8VCdqZAuaHm8tfnq-6c9Bw9pWqEmy45jYFcUfDCD60_XAcq39BD6GUWrotypYHKvs1Xr_BOpLJ5a-ENxvNFEqqTmeFZmeaI5yvP4X_PZyISP7vSpVyuhd9OleBR5g5scsEsP8wBZXB9sj_7JG4W6a3pXAWApP8QNh9NLByU_igw5Mgtc96todckxUkxwvHgU9MOIeFm73bdVtG0dM3FRR7upQthK7yk6GdD7EFfz0D5DeE0aM2nwVPuXJulB2a31jLwNy07-w7n-ZQGVYAVBbXZcOPP2jE-a6zp82XN9AO5XPPF_a1VN17K_8sawcRQKgdrFChOX5wkuvvHsneCNE5QwmPE9NXJfJlRt-0_p_Mgy7tMl-BQqSa2ZYurTf8d6XwIr8HOk1OBDJ3yGFWaPfTuYfxCgEk5dbX0T8rOLFHIlvMkxBFVMp4Icrznf4Tebgw5yy-2TN0hJFvSFigFgGjMNqbDbbdnn55BkP8JLX5klytx7DIoFh1kgmHYWqqt5SVYllyw01UFOp_qmDl9W5Zj1qdd6Fl7p00ALcco7vdGKgfwkl6zIeVGTJyb6AmsXZnJRKOG2Pv1YOkGF6tntwuCO7aBwJyHFPkd4tyk5OfS_FNiE_7IhINav6kR4-tvYJ68NC6r9d-N1Re0h0SshKuXw744FZphyREFhaL6ZZr5YP7QrunywK5mW7OnbNDWEsk0m7_Bx-SmjHZotFfwqOAHFCr5v2to3LftSkO3yrdLvMFYXlfc2wRNkLgKOw4AZd-lG2OsVQ3o0DVyQAVuEWoMlmJDcOFo4kUbqgTp4AGi2zZSb1iCXGCcyBE4rVzMfCPyUjKcLDAeL0c7P3IN4PYxEZF8KQN1pnDFK5ft-IhR8N3FLMD03RdDCZfYW8w2I3JR8hFmHpuh_TRNYMTe7B2TCwKslrZLKTSbGUlarLdORgoOwriEeyUci8kE-TE07weeHoKISkAKV5DxOHDIPa8AYfHE6LlEz5Gzi50

Requested by

Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1A15 0
20 B 58ms
57ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B7a_0MJ8VY5G7IJfQgQfry53ABAAAAAA4AeAEAg&bg=!GxilGFzNAAZTikH4c4o7ACkAdvg8WqgML3YmVFTp6OexMoI6fTUCv1pdRhJxZBLfU15Tb43WTcnowwIAAAHwUgAAAAJoAQcKADjTlWS_NOLPP5A4h5JVvetZSll0eM23LzwrLfEdf8HSdtaBuLMTgDYZidNHfJDS2vIgc_FHHfHrBJkC38PuQGaXLs2FxWsNk0Dv_uY1kM58vYXG1o3kwr7kjoez_6e3Uffu4fEkLKlFelJ_ipotdYC1d-qXTxbg4DS_jxVmFKc5yYfsoMPW0CLhgj0N780lOP0HfmdzlfESsBBNiaMSn06oqVCHU-N1fhQcofnSTDexCQACWtPjL1ssbGtwwU_swrTM-6HjdaZ_olO6sbn9p1fihW0vqaWWMd7rU_f59lGcdnaHEoPGBrFEWk_E9qvbQkFx6_-bpP7bvsV9fzi19Alc3YhsPaeQ4dPV03EwXbzKD8rWRv0gnbLwQENb4-SANVtlDsdNpmDlBPS4cNBVhHs1M5kgtplwx3EqIlkk6Da2bNdqf-UtdNGJ78fwj-xXLpV--ak3qjtcZabu6NpeMoXN9GG5PQVfoXf4h5lx2QQj3CoZXKP2cXUbbQJD13JODvWFwI6I1jlqX7ue6Uzcwhk8P133bMXHfXy_RdBh3yB64NGevVFmqE_iEt18LvV1ZPKnn75NdZnKhYl0SVnHf05raMdZ4buz7FuCap5m8KraZKG3igZL7OoB4x9dNJ8Oh6B5WT76foGkReDwiKH6KrCLYG9EDn0qmt7_R3tYyQpNT2asFG_dr53pZbrFw77c8vquttvHvvd1nu930XCcEblK8YjNaEEzg2GQzSvIpXSuUvZKfPL7GhLVQl_2tkGPaEqZ0OaZHf2WrgzfpEra3ZPu4EQuGQ_bL4h3ub8-XzpFdfArL-LYUzI4EiCd5vHMOPZeRRY7Es7TnCWNWo18z8tnJ3xAX-dkERBQpzVGL0GR4SwNqUcllAUaBYphggY5RyaWeM5diWuanSkO-tb6ZinlQcdKGIBzvYpvOvr1g0sSPaFDujm2sU0COnIn2pQPY7PJ9Q_0GxSZe3QEWQVgRGVCesWcWsUR_zJghfSaOEWXq9IGMadWWV8GIp_O4QRdEGVg7qNJ-j-FYawmYOiFLUePHpJNdwHsOLDDfg

Requested by

Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal900013.redintelligence.net/ Frame 2577 0
150 B 87ms
32ms Script
text/html 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900013.redintelligence.net/viewability?s=29812100033687600710616012073013&a=550a2d64&vb=m
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=29812100033687600710616012073013&a=c88e3d1e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/request_content.php?s=29812100033687600710616012073013&a=c88e3d1e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:03:13 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 168C 13 KB
13 KB 23ms
23ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900023.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 19:24:52 GMT
x-content-type-options: nosniff
age: 387501
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13052
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:09:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 31 Aug 2023 19:24:52 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 168C 13 KB
13 KB 21ms
20ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900023.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Tue, 30 Aug 2022 16:24:40 GMT
x-content-type-options: nosniff
age: 484713
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 30 Aug 2023 16:24:40 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0337 0
20 B 58ms
58ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BbkGoMJ8VY7TRIOmt9u8PlNWicAAAAAA4AeAEAg&bg=!KSqlKm7NAAZTikH4c4o7ACkAdvg8WqHtbX6q2wGtWDkH9VfOvbcIn170qQbshhjWkKUlTugm2cLYLgIAAAHmUgAAAAJoAQcKALGlnXY_BhzKnC8rF0_rQN7KzGvPD_dJDLmfSEklq_laf8vyVNAeh-d9tfLr0TqDnYWoeWA3W74VyBzpPX5rkI1FEe7gGNdPRaP7ZsvTpHtLyrO6JcbtNZdWCPzFAkSBtihOa4FOUFj9Gnd043MBz5eojUhHYCPzbym8FgLWjqpipyD7uBqTiTWhhaxxGE82wcsR2Kx2k6pzchk-sp2ObLmGLX1Wdx2Oo5io9PdelCO0yYiZAuFYBdeMsjniswMs7CO1yQeYUSfGTo4E8LV7APRZ3uHnVp6nahs6ejuwkyjRBmPDu4L1QS-pPzAMN_dXpxZh6u5Gl_IHG6o_klRDKYxuNvj6LtCLttGtIUjnJJ5zCHAiRwX6E48P1HJFYptk9MWM4nfBICQ8sIoUB-wB67jqZj__yFywIC0CDtyzKcXc1L8t6HE6Mir3urh7Wz7G_-Nq0oMn3bQ9jymZ-zwXIborhdtg4eW5jwAnIiy88ymdJtUyVv9_yYjvLSeLlyHIGBvKF5P1lpT1DgfzSY9cSGQ0kxDVVdoC0fBKNiz2qOUMFmZc9CzqSLh3PFKjWXCiuubeU0H1ASWjg1n4iEM_P6nFnheVx78qEjmr-4VgAEdZpUaCsRHcB9H1Hu2A2E9j2suo0C3G4P1d56RRtSzXIsWWlLOWuTpAamaEYuwj_R_hCeIllUaDRI0qusKsUWsNkQ03o0mXTxM9kL0bD8WBFh-92BzWZrGPSqi2TgJ7alLdozP6rHv424NCBx91WrBTtSkM4YKap7tkRbkbnBjmWeP483HMydboaMSKpYVIfogImuNBRPEj1lEIhK8HIh7Se1ygap-63BpWyQgM-K0FA-SLqpI8qi26vyaVBWCdoXg_DJS5eapsgm3DSLqVgZmhLbaTf-u1BrAndIKRHFrKehq241huvFgK0spzJey_UinFibu02b5uK5WoBOlp3EkOykiimM1cft3AK2kNBDpwMINMUnaIlumv-rWF-gjeRBhieiMrqg8JiVhToDWCQexALLAfWLeIN27gi-Ab_Wnqc-KOVVnilq80Nmk4phRBG_cKd9gR7mJ5fGIRxLVXf4aFFfjXYb1avIyxrSZb59UGgsX3yjU8ymgHlUewo0XtTjbNJCoZFUt_2EuRO_78Tb8CQKvp8UvhdcZRdw2sQxMxcY6SrFa3tOf7lVyypd4QtGv9qUrfFhTlZkRZvUy1izQ2ubR8stHiHw

Requested by

Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E49B 0
20 B 60ms
59ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B61EVMJ8VY5jBILflx_AP8eSD2A8AAAAAOAHgBAI&bg=!c3ClcDTNAAZTikH4c4o7ACkAdvg8WhRYtl3iNY9W36Qka0J-JG0urfsrw3IlEYPnbx-MZHVH89_2TQIAAAHOUgAAAAFoAQcKADhqRe7Jjb8AQkWQxmw-qc3P_VN_ZJorg7WumW0Bq1qUa-xZR5iC44MkZad3Edn78wlDog8Yzk4IRZkC5Gsk9rm0JTygppYBFNPg-Di4pljQLRvKnabSMsp4hlIdojOuN94RBoZAbzF8nLlQjC6jTcdFWt-FFs6eLwXr2dH3X054sVeSKDFBa-opg9iVQXLgQTsgJAL4_juN0XrLoRDTLxlxdRZ8ewsGqisYiprnL5inCL6IJGET8DCbx1qYHsd1aPfI7OcOnexFQyMMxWMw98Noc44yQR-EErnMssQTodXQL_pHS8L16Sf2eRNqz_6Mzz56r2CjfC7DtcodKJhDVtoxOOzctdOdOnZWaenXHoUquM-9QvBJ57T8sEFBPXsMwUAMWoCrNgeFEqLR7jTEDT14MtaKWNXfewDpj5hNy3nfB4uIAVE_eP4N7QcNT_5GdVaZNCjRuWheRh7V6zTjtKMYovm24L-9MXP9G5CYmbK8bcqJ5NlvqQL8DMOPohvVkHLw9IUyOxtKK8SMdSQRV9F2qAamV7jlupDT6c8nAR9z9z7noJlR7dvLx3JJ6ylWGFuI6HYBNJxwcORYr_jf4wqqiX9SAgEummF3jmephHDvLCTXZgo1a8ku1gmjRv0rJdkBsvO9Ds44YrMuh8IB9nRiKLPxEOmRdxJj_3DZ2dasn-hbJZUFinpoankSUNpmWjnEtpA238LEwtBD2lRwlj7hI4GWUOO2TJUrx9bZiwt6qC6InrDzCo9dFRTB8NAipTh7QjuTMwYF_nodOIM6fQx3BRLAT99aZfmpSFZXF7l6zM3sqyT6HmOtsc6Ccim_ZIsP048t6VMekO-1IuWwHB1Sw90RTpR4z9k0b5OPp6-X32lr6e4W6l_btCj3d0TYn3aDRmjC6WVksgSCDnyqL8Nt7uKfznguF1GBU800rjTz5hY14xjfFLs7U0DjrrUJNXElBW3m1v69YsZ5_4Clghlk2kYgl-uqKLzKkoSX9PewKMeyZJUTiTtYACanWmAyszW370IrxAJqWtcbEAg8LycxYTR1EVjBGiKrCZM_JGkR

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal900025.redintelligence.net/ Frame E9BB 0
150 B 75ms
26ms Script
text/html 138.201.84.245
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900025.redintelligence.net/viewability?s=84984500032917200710624012073025&a=84e2a9c7&vb=m
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request_content.php?s=84984500032917200710624012073025&a=4fc08f62
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.245 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.245.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900025.redintelligence.net/request_content.php?s=84984500032917200710624012073025&a=4fc08f62
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Mon, 05 Sep 2022 07:03:13 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 2577 13 KB
13 KB 21ms
20ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900013.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 19:24:52 GMT
x-content-type-options: nosniff
age: 387501
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13052
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:09:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 31 Aug 2023 19:24:52 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 2577 13 KB
13 KB 25ms
24ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900013.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Tue, 30 Aug 2022 16:24:40 GMT
x-content-type-options: nosniff
age: 484713
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 30 Aug 2023 16:24:40 GMT

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame E9BB 13 KB
13 KB 21ms
20ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900025.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 19:24:52 GMT
x-content-type-options: nosniff
age: 387501
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13052
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:09:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 31 Aug 2023 19:24:52 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame E9BB 13 KB
13 KB 26ms
26ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900025.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Tue, 30 Aug 2022 16:24:40 GMT
x-content-type-options: nosniff
age: 484713
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 30 Aug 2023 16:24:40 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 88AE 0
20 B 57ms
56ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BMd4oMJ8VY4OvK_yxx_APg_KUwAkAAAAAOAHgBAI&bg=!-_il-LzNAAZTikH4c4o7ACkAdvg8WljEtnGw3auLv7hJDy0unAxxkGQsprqkvWztCy13vspg4GTHWwIAAAGuUgAAAAJoAQcKAIm7DJ08kCZYtds4aw7M4g7FDBRFrrCB_bAZt40cqR5f7ySGOL2Jjp497fNN7Ckuyzexjk2ciKjRreDN5w4WrM4djs39YAMDFCF27FjRYTKEjtBOCbC29KA5kGp_Wr8YdmS81EVyqG5EaLJc4xboWE5cTq7Z7T8KO5eSG7IDWVJbySKJ0u06eLAvvpkC33AU3oJngyYnitE9M_DnEgaJWasjHkUx9GIKjvybKtJOIol9zuchPCi9nHtDZ19soC4LHA3HKHVzrOw_0czl1gMRtYeNABDCZCYR4rRXnP7e9eRod-M1FQ4bqHyJuVHFWEIKxrG7SxPQtwoAHiLicbnC0brQadly389TDf2KDnWbdB5hLUp0AFN-N0ukYu5l0ezK7U0V601MypdEuW8JXQzwYcJG3kK_2pAh9mqPzgB1YahNsMMO1NwoM7jAJSShUxPrvAuXq8_N9XHNr-keMclRtd-1BvOXddcnb_ngfpeiW7w9nper9OFIpDaFOAb12soVXR7pv2VUu5AKsoMnQMJQrYln6tviTW8Rn30Cq49cZC_mr2CxOqYjrIMaXeJfQ22C4kEYsfsfB-enKzegsKJtXkJRNT1AxXzGVHkbHM7KAA6fboXRf00E1Wt-A4_Yf4OZDbXQ0SSueb-Xns9cFI6nJSiVTeMDBufdOUmy_wZvQ12vaqcu90xGAglnuaxzvYEy1eZDphFsB6owh16OKmhvkD7wK4ZBlQUj7r4ZBTYRa7tCEPFlXg_lf-9oinsX91IU4420ZYqoh7Vq-ttyTGKCfgoKstirHmmqCnJbJj5GHBASZ247al6r6H9LZTz67IMg8m_X9XCOoV03_f3CvAuPgGSjteviMKE9v94456hx_2PA3XyOnatf3n6qdwUp9T4N7i3IN8auPFhZ-YZdm6JP-ZO2f4tWejYMK-IWjd5Us3OB0D7cWwpWkoS8jbQZ6ECVe3d3_MfA94fb1jqkqAaxXH-iVLqViUTuvJhi2t78v3Nf-bvKHzGTRiYV7MSUm9WJCFZ3MJMeP_HpYE70tRxa2vz96qeuTUTZZGEusIU44Xb3TkAuitJK55ke4zIRK7u5-jVB3n1M3IyJOcOWOn8PNV8tM0xpNnsPhOwqyLQTMkBXKUb8t3QeHPnCHiWL15K5LONUjXNvwjY7NuqMIg

Requested by

Host: 0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com
URL: https://0ab7d610a1c5ccf4ccbf33aa29b73bb1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Sep 2022 07:03:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0575 0
26 B 58ms
58ms Ping
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuCKlZtE04liHG7JDIhIx0JHkTG_ppat8jzUD1NWhtFTKQm6eYEA0AVbugCB-erg2uXw41ux2bMytATXuxJQa4nUjxDHWnZkMvxqTuqpb0XBd4wDrh0TWHkUMBQ_yDaQkN-K9QZ-uFxIOjkc9LrZlWDcvQf4c6sVm11ej-3BvrbJYAZL2NKRrLsJm8WJ4pgQK2l81g4qyZi9ZKc3ptiPLrXMLIW8JYmZcVP9UW-lks6P6TFrRzoqnXQuW5fSVwtRBGLzTtiJquctgLFrK-q0sOUvIWiQv35ssKg0rL7YhfmaNIqzAlP_rn7groliS2ahFFOXuKs2qusZ_spWIp1vo68SNqCcZF3TH1EA4j-S9ll1r9gGzHbrgZTRvcJpaAbfOkbLz373fM2a9jo0Z3DBEgu1lP1HsbKvQp2NIta1Qi7TKkoru7Ze-gqN7iZV0ePWr8r13OQYPDuU3-z23Blsy8geRGjyhFpICyrn_JBYMiVr81P9fAfzuTvAYBHtpjOz7LO2kmbCPlWlvu2955hBWkrPjyOnw4pKFfP2SzjFcR8jw7JuaM_VWhFUv1woL8kzXxAWXOcWnj1eN0Mkw1uQh0YmV9_tTk4DPtKx0_LlUU1i4JNdcGi1qlGwX1GRxcUn5xThxPcJbHnguAyEYhuMSWZo944c7DV2B6E03FVL63LV9wKL4zHDaBCEBasH7jv6hzwd6GZfnjI8lO2STqUkD9gMELOl8pr98HWqTDgflcPHjnf2YwzP6qKDO1OXCoaiQ9F5fm9H-jYlbWP10F5nsU9HIPx2YhJ9q7-XUkswgOxDo1pucK9mGQP2lta39nX8_T1lsNMriLfgLDFVl4mfNNvuHHu0UUD90C_6fkdDPU2QLIuevYWSQXFiXtSdimBZH8_CEkgZGx8rDm8PHZg8OPzATCLOeJRGLi7r3yIr3uMibBBHJpNdj-T2ZZ2ktsinqELJEjWUBdwC0utBh8XsYnQS_UbaGC53G8jJJo_iAp1lLNUWwD_iXHF1U_hn4uUE9LAvPBZJaS96ZGl7CMGIVUDHVc9kVOPQDl_baQTslba0qoVcG66bQQToybxgljt1CR40UxcaskGFbtC5jUGmUsz5d_L_V0Kx0nzOgCOM-gQxEcuTUYPy0mmfXE6x0Lj_V7V6g&sai=AMfl-YRY7hniel59yJ_g7qLcPUwwtOeOD-8s4BFYS8-OP2oVMdG6CT5dLGIgyWbCxTUrKjBra7QXzGIa53-iimeG0W0P5l_7jTH-BF5x1gdgiBy44JG0oUpA9wy_cy2-N20MRHL-VEOJkoygZ62b71pKgfOfCX1ZXNWiJrMya1L_BImfXz9q2b7OxSi7EW1Np-_lJ6ESlRWNzATyKJRaBQ5c_NcHfdATv4_b-w&sig=Cg0ArKJSzAJPmR2SIOdzEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1058&vt=11&dtpt=897&dett=3&cstd=158&cisv=r20220831.41223&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.dcard.tw
URL: https://www.dcard.tw/f

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS