www.zdrave.bg Open in urlscan Pro
78.90.206.186 Public Scan

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.zdrave.bg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 Aug 2022 02:28:41 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 1fcbbc9e-0b0b-454d-bdd0-8c2300c2a9ff
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 31 Aug 2022 02:28:41 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 34bef7ad-5e60-47e1-b4e5-3558d947666a
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsbounce%3F%252Fseg%253Fadd%253D9942225
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

204

1dedaf03ba2c1838
pixel.sitescout.com/iap/
Redirect Chain

http://pixel.sitescout.com/iap/1dedaf03ba2c1838
https://pixel.sitescout.com/iap/1dedaf03ba2c1838

0
191 B

112ms
36ms

Image
text/plain

66.155.71.25
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sitescout.com/iap/1dedaf03ba2c1838
Requested by: Host: www.zdrave.bg
URL: http://www.zdrave.bg/
Protocol: H2
Server: 66.155.71.25 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.zdrave.bg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 02:28:40 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires: Tue, 11 Oct 1977 12:34:56 GMT

Redirect headers

location: https://pixel.sitescout.com/iap/1dedaf03ba2c1838
cache-control: no-cache
content-length: 0

GET
H/1.1

200
OK

bounce
ib.adnxs.com/
Redirect Chain

http://ib.adnxs.com/seg?add=9922745
https://ib.adnxs.com/sbounce?%2Fseg%3Fadd%3D9922745
https://ib.adnxs.com/bounce?%2Fsbounce%3F%252Fseg%253Fadd%253D9922745

43 B
1 KB

30ms
30ms

Image
image/gif

185.89.210.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsbounce%3F%252Fseg%253Fadd%253D9922745

Requested by

Host: www.zdrave.bg
URL: http://www.zdrave.bg/

Protocol

HTTP/1.1

Server

185.89.210.153 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.zdrave.bg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 Aug 2022 02:28:41 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: d1f50d88-d180-476b-8e39-fcd90605de9e
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 31 Aug 2022 02:28:41 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 83a01972-5f21-49ee-a831-389e17f89d51
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsbounce%3F%252Fseg%253Fadd%253D9922745
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK alt.php Show response
tas-bg.toboads.com/ Frame 0A79 5 KB
2 KB 51ms
46ms Document
text/html 91.209.18.100
HTTPOOL-NET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://tas-bg.toboads.com/alt.php?rq=e947a445-a410-057f-ce49-d75b8015a22c&vt=51f0f6b6-6676-4276-91ff-392d96e62832&brand=generic&af=300x250&clr_border=FFFFFF&clr_bg=FFFFFF&clr_title=4170a0&clr_link=fac588&clr_text=000000&nw=0&zn=533338dda&
Requested by: Host:
URL: webpack:///../javascript/src/WindowManager.js?
Protocol: HTTP/1.1
Server: 91.209.18.100 , Slovenia, ASN8558 (HTTPOOL-NET-AS, SI),
Reverse DNS: tas.toboads.com
Software: nginx / PHP/7.1.13
Resource Hash: 230bc75ce1507403c0ef91cbefb84b2817c33c3749dfda0c0e9502b65101ac91

Request headers

Referer: http://www.zdrave.bg/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-control: private, max-age: 0
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Wed, 31 Aug 2022 02:28:41 GMT
Server: nginx
Transfer-Encoding: chunked
X-Powered-By: PHP/7.1.13

GET
H3 200 container.html Show response
e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A980 6 KB
3 KB 71ms
29ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022083001.js?cb=31069258

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.zdrave.bg/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 31 Aug 2022 02:28:41 GMT
expires: Thu, 31 Aug 2023 02:28:41 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 67EF 6 KB
3 KB 69ms
31ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022083001.js?cb=31069258

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.zdrave.bg/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 31 Aug 2022 02:28:41 GMT
expires: Thu, 31 Aug 2023 02:28:41 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 05B3 6 KB
3 KB 62ms
34ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022083001.js?cb=31069258

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.zdrave.bg/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 31 Aug 2022 02:28:41 GMT
expires: Thu, 31 Aug 2023 02:28:41 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 fpdata.js Show response
gabg.hit.gemius.pl/ 278 B
509 B 200ms
97ms Script
application/x-javascript 78.128.6.42
TELEPOINT

General

Check archive.org

Show headers Download Go to

Full URL: https://gabg.hit.gemius.pl/fpdata.js?href=www.zdrave.bg
Requested by: Host: gabg.hit.gemius.pl
URL: http://gabg.hit.gemius.pl/xgemius.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 78.128.6.42 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS: ip-6-42.telehouse.bg
Software: GHC /
Resource Hash: ff47e962ab889844078d7575dc5f681ad424b61fcc2a204590107ca18996ce07

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.zdrave.bg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:41 GMT
last-modified: Mon, 16 Jul 2012 10:03:40 GMT
server: GHC
etag: PRIVATE7520710249
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: private, max-age=2592000
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-type: application/x-javascript
content-length: 278
expires: Fri, 30 Sep 2022 02:28:41 GMT

GET
H/1.1 200
OK lsget.html Show response
ls.hit.gemius.pl/ Frame D7F5 5 KB
3 KB 85ms
37ms Document
text/html 146.59.30.104
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://ls.hit.gemius.pl/lsget.html
Requested by: Host: gabg.hit.gemius.pl
URL: http://gabg.hit.gemius.pl/xgemius.js
Protocol: HTTP/1.1
Server: 146.59.30.104 , France, ASN16276 (OVH, FR),
Reverse DNS: ip104.ip-146-59-30.eu
Software: GHC /
Resource Hash: ca8812b4f7a939d9405f6176f2cf71d3960569f5920943fab9eddc4022a03e0a

Request headers

Referer: http://www.zdrave.bg/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: none
Cache-Control: private, max-age=2592000
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 2714
Content-Type: text/html;charset=utf-8
Cross-Origin-Resource-Policy: cross-origin
Date: Wed, 31 Aug 2022 02:28:41 GMT
ETag: PRIVATE7520710249
Expires: Fri, 30 Sep 2022 02:28:41 GMT
Keep-Alive: timeout=10
Last-Modified: Mon, 16 Jul 2012 10:03:40 GMT
P3P: CP="NOI DSP COR NID PSAo OUR IND"
Server: GHC
Vary: Accept-Encoding,Origin,User-Agent

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3B22 624 B
975 B 83ms
35ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnsBxC-xMcCGKf518ABMAE&v=APEucNVi_YjjPYJRqDbG-TTMrzx6H0H150LwgYvGkLUBdTF_XH6NbMHeghDardWQ2Ah4NTo8NZj5bf85zofAc_Lcl7kmadJ0_wY22D_-F_0jeZ5GS19hmlgQUC0eZ1PdPAJ2-t7KHGV3ea-mQsWDvTsO9euo7NR6nxvBPPRVP5LWd_dNOGbb7Mo

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 Aug 2022 02:28:41 GMT
expires: Wed, 31 Aug 2022 02:28:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A980 70 KB
33 KB 153ms
105ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BTMVCELpK7sP3E0I0jkIvCJdtJQIAdeQx-qhwVbDg1Rrk3_1oIK6fry1ch83irO5o8G28YtHuCav1YIPI6LUXOa9rn3Q&cry=1&dbm_d=AKAmf-AG_1Nz7TTr5yvQxViKD90o6TomzrGMPI6RKvl5dPK8ktGjVMVwViau2rUqElyEQ_ySQiWj5WLIP0s9uZAikKdco6Es82EjCJtI7RP-bwFYOKWTuopFoLFXVQ7fb0nBF5Tn9eOIB7q8bgS2q1Tq5zLnPwigpcZll_eZ53H1um3OQUoYwlDiscYd4QHlWE-LSfFJ98BNCvCsjE-OksMQlm8UDn7nxbzURhjgQJNdkq0pZtjjTVuGqPmA2UmZHBOrPKn30q8hzkGkFVS6mxs46TJ-5gonzD_Y8Iz7NUpqy1gukMPoRpCWxUOKNJndtwOsY5VAwq4VyOPgKQoltsFUg50J6VLdf3dJH0pVIQGKHKUtih7l8zZLA0lh4mJKnPUPofdrezWwneAP39HEH9ATLw-q9ZxQOlscWIZKK_i0R8KtBhGjjxWuRjBS9L87Zq5NXqexNz4y0KE6TNV94BzqxRkBuC2wTR5u16X1LFOegACpuO50zPWnp4IXdQG5VdPT4aISFjGT0RLpJccHCB8JZ-ic7NN7s90tCNR1W2y2maAPInyS1JQykK7OUm_8ke80JNpTSm6lZfPZy98LeDF-yfPoRT70BBxPREu3UHc912YLMz1FPYw28HqLCU4t5K8P1r5FYongn1gXU8UwiXAuVENFMP91tIPSVR_H5vv9l3PnfZdzfUptRb8hZRLHZd7_fgbpTa5aDI8LWIGIhNpdbKCdff4rHLMV_D6Koxzs9sMmNmITuc6-I77DNf0baG3wb0cv4O7UY_JLs0H9iS32qx7LHTlK6JUw4l4RWE2HQ5JXbTH9TrDmIa2GPVX4rgAzBsvEkZ1CfEmcbmzrYpQoKZecD5RfApdHvNsXT7zq4Eii5MIcYUpu0oRfCGMAdhmhOkKH6J9THnzmE1HWFZn-OUghfNzk1E4c_N8tqnxR5S009Dz7BMwHD948vaAxfToEPscBSthGcyM5bSgJo2Uzv6swOSk8eqLDvw54FDkVKuFDru4h8RiimoPZRVFUJPQbC2X1xDYK1FsP0I9aWFq4oWCFUcUjeBYXZiODV1u4WIgf-cXv1sKI3pcrHBmlhFs5JDXPUT4s6e_yQiaFputOlkFbSdyPPeymqihZsGdO2PMaxJUhBwObuwib_zvmWGCeRAh-v3NJYMvGvgdtWdBkC-Clraz0mqgzXuUgQI8nNyZ1aRW7uaGWBisOA0P3SDCbi-ETlQ6zHwzWl3slnjTAYu_zPz8NInq323eDw-2Oh_kA-OFAhkucyryFMpj3Bt1M-jXnMeDY84w2g4VH2XcXJ0gwlO_lc3e9Ip3fndGOyaVp-lb_yHIoXBTYda8vR8NuKZXsw0Izf1sfMt8w-cGSQlwYtBoZlv0EVDIWhVAKCvzhYi08Q0c2ARSnI3njNt1KgeC3FYRFvzRORxZuBm7AWNFVDzb4egW-5lsa2zrcGa9LakMvMMUkdYUlCgb4AdaaD0zZc9AAG7aWKs8VbLAbZGL1Cp-vitJDycQLdyucPdMHHtm4VumKfMKMt5YQG04nAOY8EnSZE59f4hMQeQKB1qRcr4CP6W7AdpSok3xx20yxfbxYMtJ0I6eWNQeZsrpHTRQDi_F95TN9w1JQmmHsY71q62gyCwLITTn70nsEBEWTibZtWAhfYDN652-2C8cJxal0_q529xbIfesfCABZaVOztu1BTNBoVGAubxH55dBPW1RxQSw0XSlyCaMq480fY644TAxKK6JiQZrv4bsx7eTWlNUsYLdPA9MS37tk7jfloTn9eLd0mA4yiGcge7pN0rS5WhIQ9_lZbULtx3W1z5OE9POV0-EmRwJuaYqCIBniSlHqOOqcc7K-Lo3l6qWrYC0qZuR4wOmnKAWz58zENKN3_C9Cg3LUL9-wPj0zp5azl3M-icXftkc5T_DYSh_kd6ff3SbqNA3svv2aTkvDumsgfkrmwYwH2K_F1UqOqMutv9BuKH5k5FfDXkZyQ1xjcJZGTCPM2KSqWmzeNM2ay5Yk3McsxIQa42F5hEXhaMbtZNprwni98wPnSM30N-bCVB1qVaNn8mHxnE87R202JQfsEVkzyRX-DHoAWVUbOaxq1sPMtCboxNSezwET33DKB7P1FUgcETnj-y_VCJBsKHJCpjQlHNU2PnokbK5QDECv6PdYebR1afZf6AQsTfOkvUAtj3_sAYLbiyGUKOtG8XUjVLOcQSIALnmeGEUPVEUtETa9gZqYIYn8btUb9dRmDbD1QBAjUHlQOhw9b_bp8lK3XknJfujWK--LGzbstzcZtidV_v4D6xp98U-_qCaLtr2bKZ4aogDk5VqshiqiCzWPTf2PCYRStUHviK2CJ1Q50BUUZBCwBZR-1uXazGxDhXfAPuZ4oLW-5QdlRHn_puXgQro_OAovwoWLN3cnIMHCozlQR8YdeLhwkVb7ct1sw4waixwiaO6ZF0GMlSBXyYlkzCsqNKbbKXdoYduRyeJMs35IbpXcGZnaZp2aOiwbsr01lKjzjify9OK-A42WLjCnMb3-swBqaD_wsfpWic5n0K3f_DYZ4iQU6-_FpgOP9aJ-iqJyNaxuXC6p4RW2MrnJXxFw9NXsa-5OOCv9RpN-Ja3q8x-DR-7c-m_5ToUIfDcHipj2c5YEBb4C26p0z--LcjZmhN4hhDCIpAatCo28vyn7zZVGbUiLBgaQb14WByp74jgI8KvE0p2b_-4q-R7HfDnxcZggUn-qnIlsL594jFEAQ-tBvAcNOBqi7rERJ4f76gzNqk9PpeJvke8pbVVmxneuQFxtxp6_fgbA1f3REyRmL9Dov6mvuaO9pRg-5Hn5bQdpKsu-yN3xD76tqv3aSWLhG7WjCUpNstgisJd6J111FE_FuYDFOXmAU3SLgUHUfXVG2GCVkr-1xsOe1yWRj1v_Oj0b59w9sBMbuYUfG9fIDs_taK_jQq636LrgFM9GWvRfMkZUysJAxtrTaH-GbIICS1b7PgHbWaLL_u5cwTGAqcog_-Th_gIEuoYXpX9wHwvwaCPcelJMkIi2QwwlAYwb7lPz2T9sn-Yz7iNh6Kfi1RU5y9ZNs3isdRDo7ulkczA-galFowrmplEcy5y7VHPZBe0rsXHjrLzwnOT8k2OhGUlI-XIJJIsB4Q7_Vo92wDg2P5C7QanuXzunsWVuvS5hOc3-rNK9ignfXFNuvhUfO2rYpR7PMbya-cOESATvkHiexD-hcyzJmt8n8LiyfOuz9aesgUIhgvJsDuMe_2lCqjBZgyrCSh8c_j-FZRcLdvpv&cid=CAASKORo1mNKOPC8jXED926Ox_7TMoGV-WCZld9xAAmVYug2m2uqDA_3Q94&rfl=1%2Chttp%253A%252F%252Fwww.zdrave.bg%252F%240

Requested by

Host: www.zdrave.bg
URL: http://www.zdrave.bg/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1478ec045dca93d6c4e6a2992963c7f87d809a9a115c341be0d0c6f48842389

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33226
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A980 42 B
107 B 108ms
56ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DJDfsSn8Kh1TZXkCA0bXHMTNdrTqdmVqhizwHiO9RY8cAKF7fCuV_lj9VtrbPqy-9OYsCrYtQEpDaiJ0K3C0LZuw2J1WtB935gDwS735W7x-cSBqk

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220829/r20110914/client/ Frame A980 3 KB
1 KB 94ms
39ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220829/r20110914/client/window_focus_fy2021.js

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 01:58:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1801
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Sep 2022 01:58:40 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220829/r20110914/client/ Frame A980 17 KB
8 KB 74ms
20ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220829/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:04:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1451
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Sep 2022 02:04:30 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame A980 0
0 80ms
29ms Image
text/html 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQQMwTECan8BzfDxo4-JUTio9zUknqU2ZHt00GnFDgrKb8HdL4QX7Mw429KTeyQxsv7PESGpdxdgVLswqNiYzezWmBwBw
Requested by: Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A980 141 KB
44 KB 124ms
83ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d94a91612f816c172c583d17bb06e140969a22fae663e7b8cae7d18d55eb2c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44757
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661773661488070"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 31 Aug 2022 02:28:41 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 01F9 624 B
558 B 85ms
41ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnsBxC-xMcCGK3w18ABMAE&v=APEucNWJSgOskpbqYtIUyLNVI2KP5xgwHsHGbHWKZYJ1-rphrl8G-XcNHVdyAgnTym1MfUlVcxEuI1O4H0sJHC-LyyhsqEEXeh8bDl8LIc0FMM64QtFXsM69zeqyzJRg3SITXE3q5VqVTIfBHN9VWVoFEqekNyhX6VD_VbXIeq72-PklvRZUnfM

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 Aug 2022 02:28:41 GMT
expires: Wed, 31 Aug 2022 02:28:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 67EF 70 KB
33 KB 113ms
69ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cj9Q47Ei18r6wtkhgE6zaj9JJVEJPxAYEpjdxagW8cM4ph7KtYHVza6n_BJvAqAzNQzKAmGFL4fFTz8YfQ0fWb77Ke3w&cry=1&dbm_d=AKAmf-CdScGalQz6KYM0DHzXDlyefh1SiGzRh7vzgq0gR8f_AzKd4_IF-buIlSMasatlIIy3bi1w0FqjLssHEIxj6p_qIhMs9_Ts5Y1u2AUmWUoX9yb-9uQVhQqYrx_DEmj2lpuZA5rnTMDP5Xp0ooZTF4dvVXpp80VERHM3qyaF-FxyeIeBdh1ETIeuoo-ZRlIQLNcsVDzc6CPJLuZrwD61WQtZIpG95QrL7TaUd_w_XEv4jHA0nFrQ6BjEXkPy3dB9J-cZr0s6OrbDht-Ey5twUQnBz_r9HwnVErbL_Vowih2s8eF97cnFhBJTo8at5w_kdiQbtzdZYgVMl1V5gRUh8ihcbFPz4Fa76I4HhR1CQV672nd8sWOVt756bHcCqeji4V7oW8p_bSt9Fqb7VIh-waqrmwTJUikinmoD-eBeD-dnnMPiaI4DwmegEqTGzkGcQQWvWye0ueTpm77vhC1smjJCJiv6qbJLS184QU0qsTZlf0PIQA8jPbMQ1FGRtFiyH7SRNzCgrvp1VUbk59Mj4i5_p-y0WSgLz_85rzBge4kcy5Vf5gsSUo8Zzn3trbpxXRdfZWVqi4Kstvc2bCiE_4mmEpoGd8CeQRhvxb3ErcVtdRxJg7t464MsNEJTPtK0H6zbTazoKz5wig7PtuL5RwF313dm1LchTHNEzgHPGzP1hZhBRSNfXFPxPU5J1nZVNtpDPUESdC4GtzQMcmbLyge8isxw8miLP_OsaT3Yely5yfcTcPQ-xm43Pb1zrTF3Qpt_YYAp0ZHGDcM8oD71t_TBvAqXIBwxkyt5Ju8aXTuRJ4x36ic0_n8csi99mp9oFC1v6ucKbOaerudbBxHWCOUQz7HVka4tRdLHpLZpES-qkJOjYva9CM6GsUdlrsC9GGLJ6YlMNsrzmmM4q4dzKix9imJb1Aju88lxsKcLgKLmBzErCTwi29WeIXGHUdjvfORn0sLBqroGIhcFcZ_rI9fe8a1wiGz-2l7cwDJitWSNNFSDi1WMUALTHZGUk8qOU9ZmCH3nMj9j06uglRlFPy0SfjRbL99esZOU1EihKj17RpOigWCPq9hFYVXL2wbL7aWxaRmc-Bji0j81hn75-y7wWe1s3PNLfj3ObLYjK1YLsbEO1zjlqVMIa067U5u7TNvp5DMXGGel3OhZU7HLd5jJBFtJlnWteRN4e_1hfkPb5BmNAsVlEH9p5uesLT_ADBK3yrkxBuoWa9fFazPo6d1XzqASvXwxbAGESguFEzJEN1EVIJfaIaVCIWjgReXRw5AkAiaalUVbuJAmOa9nqnJk3inVPV_fxfPQlW5ONkgc3Tp7vAVmpJCdE4HRNp6T7AQ6h_T793lxEVcG8_whW6BtWQoBn-xmjKVksCOQMJH0IQP1mD25r6HLZEzGE9fCoGBq91KhHG4pTjVWOnEjIQCRAMZZ-SOkWyc9l4_NLUAomue5-ax_3f4AT7Mhj2IgXvHsYNXgY9P6iBo5BfO3aQEe0vxQMbP2UogJ0W67YdJ4EhMPc7EeZCjXVph1SS7EnFCuYelBf0KotZ3IHhKXcht11i4r2PW22oXYwnO3XfID0ajHf63ll52kFyJCi2_b5rWqKHa85fG98GSBezkDFvNfO2X2rkmecZrEwwpt2T83LYSQZ6K-c6ZlByyLEOBxoOegfVbYk3hXUCpeBs7Ay9k8h8b0oaowVPX_6EdebcXrf0cCExwW-yHhCGOWGKYIVIG6dltPuAlQIOLx5_ykH9tBGjPle0b5P3Hb-UpYlYeruQCCwhc6swVNoUATvFfMMCrCNmyRxvBNdoCrQMvKgmynoXyg67CPBt6QlCgZd36Fn3w-0BKv18feew3OJU6-DHEJ9WRXHBrixZGdvnVKDX4ogukM6L1CuHCczwM53vsJZ_dUTvIo2s0KzKutVddC1wBxIxJpHpsVLBCVoTryq-YaG6gIdqN6Kjktl41-0CKPbwha9vBmn0-FFZ7alLA-Iw4Kc-fcTyyTKyATrxG-3fMR-8ynubPaKrw8MGN384VhJ57Yvr3T_5L4onXapr1f9OSI-vpJhFHcw8FiobSPppslqjcEXGYQb0de4fQHLAzdm2BbznYJ4KuEa7ygz-d21aIWLicMNUr-0hlhZG8qiFq7rSLHih9c_ivO4LrhycDSmQqYuaorCRSy9KhTPVi9_8537qwCRFUZHLF9xEdqBTZmc81nORXg0iOe5gCEgbrQ3UOVVbQAiNH1fvFV6DWK9izWIUeWXn2KNhZQXvrVDih005aYChXsOucF3BZpKBmouKs6HhULZEy2lObcY0cy8DxD8_sYUtZSsB3A6wOmb5DDS9N0jRyaI6XFgQktJUiIzo2-w4qnmhjjL0gDm8NmQxQLjm2NNxeI8rKs_hrehtk_qfp8HU0-IzAwSOXo3EtGL8UQXE-8B0rJK-YkHbHVrq0iBgMmMjQNBWBCachPaLthbMa05aiuWP4rMMUykVEmo8oi3PXeMBey6u759V3RXLqAyrAgoV1-U_F5qIGO55DH_pzNuRCEIEvXnvRXsvroG8xHPCLcs0mFlRz1Rj7xUoYsqhE7jygBOANa6pOCgXrOYmqiJI20_79Gbsmh5rsVcJ9V3UDOPwHw8EqfK_igwAVsJtRc16E4YZ1P23TlpCPfz_hsyNhTII1Y2cj5XJ9OicbDSknFvh0Zqlji3IzgXZYTnXR_rw8qs7NrTpRfmg8A_sClYEUe2yzQnE1hpfAZLOA3bnJ_lNpL-x2C_bg5WjTF8lnqNiwRBIiEJWFVDdwnPdyAfdXpX4P3ZlONlKrrVsmbh6pPDO__jtDtSA1bmfwX4C5mUHpiAIBKFVwTP8BwOk9R31nKzDF0jTtIJ7grlfvVKIEHl-bFtpMZC3SX0WrvUHe_8y8ERQnDeppNBcbAqpN_UU4xr7shz0odb_VYYlTIy5ScRBS4Em6Su7O_CV6u2UxZ4I5bXjYQqtXOLOBV74uan0v5YfiY-fhcyhw1OPjEzxiuxnljERlgWh-g7w3f5nwOaLhc2nIjUJ3XaXnC_tlDX_ABDHtw9k3Co1t5VZc9E07CMXgwPxVb6JvVu9jWNImi3zlPduea3yPyahkBA1KHdJ8N8vhMZqIzKDrzbZ3fkoPIG6AfKhyQvTHRamdm5XxDELIzvGj0rUL32JUfoXtv5nB-GlWPGkCDxnOo4H1bQr2b3QiJYjvvaeumV7AFnQR3Sz4-OmuUJwB_zrAakrNOLqxzNaizrG33qqfEMDUcpmLwbPNl0RaDqT6Sn-hrDLdhMuI6LOAv4AaOMBAoaalIPw&cid=CAASKORoHsPZHzY7GDlwNN05gZ65clzzkyWwfb_L95tCnUiAtCOiGvZCwVQ&rfl=1%2Chttp%253A%252F%252Fwww.zdrave.bg%252F%240

Requested by

Host: www.zdrave.bg
URL: http://www.zdrave.bg/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e4b4c53ce8acf40ac016a46cb67a1abba418b04da0fae24ea8a5b1f09b840a77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33098
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 67EF 42 B
494 B 104ms
55ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AgUxKv8Mc4xY_v8-KOrECjXt3Ye4mAE0nhONRlKwBHlAWeA1EjNe4zOik3Bl5RCEVk8SyF8_BKOVA7yAXLF4dY5p9xjlxiwguE5li-XG-DoTzLmVM

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220829/r20110914/client/ Frame 67EF 3 KB
1 KB 89ms
38ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220829/r20110914/client/window_focus_fy2021.js

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 01:58:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1801
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Sep 2022 01:58:40 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220829/r20110914/client/ Frame 67EF 17 KB
7 KB 73ms
23ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220829/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:04:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1451
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Sep 2022 02:04:30 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 67EF 0
0 77ms
30ms Image
text/html 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSZmlYQi94VbkQkN2k_uWGsJRFRCV9uUGzoaYmMlF7W5dgZVJAH8DG1tYRlHKR6jU5Bey7kGg3RfJv_cHPWjKJLObP_9g
Requested by: Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 67EF 141 KB
44 KB 107ms
69ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d94a91612f816c172c583d17bb06e140969a22fae663e7b8cae7d18d55eb2c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44757
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661773661488070"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 31 Aug 2022 02:28:41 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 05B3 0
0 61ms
60ms Fetch
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=COlp8WMcOY8CuM4a73gP2q6HACMme0rFc1Z2R93DAjbcBEAEgAGCVgoCAsAeCARdjYS1wdWItNzAzMTgzMTU1NzgzMDMzNaAB1bbS6gPIAQmpAnyeUN1bz7A-4AIAqAMBqgTsAU_QcJt9uy_cEdmCdW2dqKi6gGZqRX2HAZ9FF16Xe1ZVcC5wHHgJmNm9WjyQqOAA01ZFbl0fxTFfxWCfStUMg7VKC7flBlnIb5w0gqr7j-GAHIk7Oh7Evk11C_IeSuZzs62V5EKKWKtQspkG1Vc0GFGv2j3EmTRf8VoIIvj5PpH-Q74javS2h3dp2chgf3vbTeKwxEzEmGBivMqJF5Z7hJHZEDqSIRWspTL3UYo4Gr5M4DlySXWg2YLd1uatZpXsMWWpNks7MSngTnyJODUuneq9M2V88AtgTIc7BMMS6Udwmp7qTGpe9QyFi7XA4AQBgAbqu9r5rquukeMBoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEAiI4YAQEAEyA6qCAToCgECACgP6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItNzAzMTgzMTU1NzgzMDMzNRixkxk&sigh=eh0r0xbCG1o&uach_m=[UACH]&cid=CAQSPwCsnQUx4b3fF13rlb9XXN6SzzRFJBggOyF-2hQpvoh6T3hZnEN83DdGrbfrv297EyZmOUh56nSi17JHZE9SdRgB
Requested by: Host: www.zdrave.bg
URL: http://www.zdrave.bg/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame 05B3 0
0 150ms
42ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=kPeeEcg12AVanYNiAgIAAADjfDwl9E6wbhBYxw5j7OwzqvEvoOK3bGAAEgAA&wp=Yw7HWAAM10AKd52GAAhV9rQmekzoS1yvr2Ya7Q

Requested by

Host: www.zdrave.bg
URL: http://www.zdrave.bg/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:40 GMT
server: Kestrel
server-processing-duration-in-ticks: 166933
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 92C7 149 KB
48 KB 232ms
112ms Document
text/html 2a02:2638:1::4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Yw7HWAAM10AKd52GAAhV9rQmekzoS1yvr2Ya7Q&u=%7CT3699gPquUKYmlYUbT%2F4Bt2q7uou%2FA1SBf2UTH42DQI%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNy44cDHK1QYNdJ71gdyCWvw29y1GxtacI6iVoVnLQ5srUOwC-sDBJIjvRCy3Ss-Bi0BVHWXDfmlrvaQg7WPjZv8hM27u8-lMb12pEsAcC7lkk2gIQ5Qyjr-v-lFNYHpw4ObBaW8ElhIgF1Tq4Gzo8E5xwUg6xNyOC9AmkVTcM_YeYDEh4Pn2Cj_CdfqZ9y1VSS0XqRZu54j5gkg69ksJflz0zoLUebcy0JtdCgdJVnpI66Bsr05aCyq5PZ2XUqMrw_CJh8-PG_-eYCQtH1cU6fP5wzMDqfFC9-tTCpWo0A4yMLe1GYlh_KTR-_TJdfCFkyoiKW_RTe7yLa8reKrKWNPow0_-Kn8FlosNecqTCgNHyU0YOr3fTWQzyWec_9q5xjkVDtQ1ao0ktpNINnH8nB5HvHd1t8KkelM3Xz1fCUu_QXFt9f6gZLIAu95y4cNqKaMPL6fJqI99_lJK_VHrBmZ7B-iJlv8FW34CV3EYd-8ZCWUNfT4bKV551xb-9JqVUzlVkQBnoaoaiO87fxQaC9PB1kYsjknO7xCX1vZVBDip1r3hQZSRHr3nrpual98J80b6v1imm0KjRfgG4psCHJRGH_FYswZFe&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCLZWOWMcOY8CuM4a73gP2q6HACMme0rFc1Z2R93DAjbcBEAEgAGCVgoCAsAeCARdjYS1wdWItNzAzMTgzMTU1NzgzMDMzNaAB1bbS6gPIAQmpAnyeUN1bz7A-4AIAqAMBqgTvAU_QcJt9uy_cEdmCdW2dqKi6gGZqRX2HAZ9FF16Xe1ZVcC5wHHgJmNm9WjyQqOAA01ZFbl0fxTFfxWCfStUMg7VKC7flBlnIb5w0gqr7j-GAHIk7Oh7Evk11C_IeSuZzs62V5EKKWKtQspkG1Vc0GFGv2j3EmTRf8VoIIvj5PpH-Q74javS2h3dp2chgf3vbTeKwxEzEmGBivMqJF5Z7hJHZEDqSIRWspTL3UYo4Gr5M4DlySXWg2YLd1uatZpXsMWWpNks7MWvib-4Ot6k9InapkLVBVvNpWI2NDu0Ka_O4pzgY83Ry7YkvD6Z_rQJF4AQBgAbqu9r5rquukeMBoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEAiI4YAQEAEyA6qCAToCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1IINrI_JZ2RXQhVGZquKx7qF0BlQ%26client%3Dca-pub-7031831557830335%26adurl%3D

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

de72fda2f2965bb48ad90256ef3b0f4a2c138178d159997dd2052ea2b52af737

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Wed, 31 Aug 2022 02:28:41 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=JXXbPpuGy57WxuNLqHjGjxgpBu4qYGUBAv90aFiF3IKrbNjVVpsceZmlIoGwADf4t9aEKhGvdRx30xt1CQx5HkP0WDlgSmxagw9zX4amAcJsMSgj5mutvET7oIJ0NOoNKxq2Ky7585BRQ2bw_g3kMFztpPHBZBdxH6WmtVDRYrTcmFUmTv_AwWNVVM_iBGjfiyBbDkOoSTQ5EdSZYvvxjBP5gmy4BGvBOeDwkqFC1FMEGLGSjGxVMqqTz5Oh2kv-0gKjGQ"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 64348131
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220829/r20110914/client/ Frame 05B3 3 KB
1 KB 86ms
40ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220829/r20110914/client/window_focus_fy2021.js

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 01:58:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1801
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Sep 2022 01:58:40 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220829/r20110914/client/ Frame 05B3 17 KB
7 KB 71ms
26ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220829/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57000ea03bfb53734d0858b8fe992e6742226f23f311eb0f9d2177e2a84a5621

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:04:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1451
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7599
x-xss-protection: 0
server: cafe
etag: 9215437806027971270
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Sep 2022 02:04:30 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 05B3 22 KB
7 KB 86ms
41ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Mon, 29 Aug 2022 20:25:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 108163
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 29 Aug 2023 20:25:58 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 05B3 141 KB
44 KB 126ms
93ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d94a91612f816c172c583d17bb06e140969a22fae663e7b8cae7d18d55eb2c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44757
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661773661488070"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 31 Aug 2022 02:28:41 GMT

GET
H2 200 lsget.html Show response
ls.hit.gemius.pl/ Frame 7BD7 5 KB
3 KB 128ms
42ms Document
text/html 146.59.30.104
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://ls.hit.gemius.pl/lsget.html?mode=new
Requested by: Host: ls.hit.gemius.pl
URL: http://ls.hit.gemius.pl/lsget.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 146.59.30.104 , France, ASN16276 (OVH, FR),
Reverse DNS: ip104.ip-146-59-30.eu
Software: GHC /
Resource Hash: 419b5b1e246d571961e01493266b6dabf00b96342ac2342c6901ee75a5d31432

Request headers

Referer: http://ls.hit.gemius.pl/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: none
cache-control: private, max-age=2592000
content-encoding: gzip
content-length: 2717
content-type: text/html;charset=utf-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 Aug 2022 02:28:41 GMT
etag: PRIVATE7520710249
expires: Fri, 30 Sep 2022 02:28:41 GMT
last-modified: Mon, 16 Jul 2012 10:03:40 GMT
p3p: CP="NOI DSP COR NID PSAo OUR IND"
server: GHC
vary: Accept-Encoding,Origin,User-Agent

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 3B22
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENSvdLwINa82Cj8BWVjh2s8&google_cver=1

43 B
912 B

60ms
40ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENSvdLwINa82Cj8BWVjh2s8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnsBxC-xMcCGKf518ABMAE&v=APEucNVi_YjjPYJRqDbG-TTMrzx6H0H150LwgYvGkLUBdTF_XH6NbMHeghDardWQ2Ah4NTo8NZj5bf85zofAc_Lcl7kmadJ0_wY22D_-F_0jeZ5GS19hmlgQUC0eZ1PdPAJ2-t7KHGV3ea-mQsWDvTsO9euo7NR6nxvBPPRVP5LWd_dNOGbb7Mo
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

cf-ray: 7432558f5ff2913c-FRA
pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WM3lhbFcV39%2BKP5hl7B1%2FPwQ4P1ohB4qhQaUcnJtqYUzSPRIMIGMjlKFmiWCv0Iunb4uDxk8sy76FJp%2Btt1yBOliPSEsbAsxBI18T3H%2BoOaRr%2FqPsVYowesoJC2mq5VqWry%2B9K0v7%2Fb5sw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENSvdLwINa82Cj8BWVjh2s8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 3B22
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yw7HWfWsq9H4oIzb0Mj-vwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKas1OhyV08ivEoJuaN13TU&google_cver=1

43 B
910 B

34ms
33ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKas1OhyV08ivEoJuaN13TU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnsBxC-xMcCGKf518ABMAE&v=APEucNVi_YjjPYJRqDbG-TTMrzx6H0H150LwgYvGkLUBdTF_XH6NbMHeghDardWQ2Ah4NTo8NZj5bf85zofAc_Lcl7kmadJ0_wY22D_-F_0jeZ5GS19hmlgQUC0eZ1PdPAJ2-t7KHGV3ea-mQsWDvTsO9euo7NR6nxvBPPRVP5LWd_dNOGbb7Mo
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

cf-ray: 743255903891913c-FRA
pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FRtNj7XLrtKDQb6tvLLkyk37OeZIBNNtQsO%2Fpi%2FJK9m%2FlMLhW1IILnV7iPNTKK7RTV%2BHL%2FxB59sE0Qcfv6bfr5BVbUL8fJxdK4R9sVhMjI4F84g7s0t0Uqlj20eFxV7KnMj0ThJ0WRtJqA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKas1OhyV08ivEoJuaN13TU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3B22
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEDOGec9WMuYGE2TiNoB9WCk&google_cver=1

43 B
1016 B

40ms
40ms

Image
image/gif

185.89.210.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEDOGec9WMuYGE2TiNoB9WCk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnsBxC-xMcCGKf518ABMAE&v=APEucNVi_YjjPYJRqDbG-TTMrzx6H0H150LwgYvGkLUBdTF_XH6NbMHeghDardWQ2Ah4NTo8NZj5bf85zofAc_Lcl7kmadJ0_wY22D_-F_0jeZ5GS19hmlgQUC0eZ1PdPAJ2-t7KHGV3ea-mQsWDvTsO9euo7NR6nxvBPPRVP5LWd_dNOGbb7Mo

Protocol

HTTP/1.1

Server

185.89.210.153 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 Aug 2022 02:28:41 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 4eaa3849-3934-41b6-8f96-cff942ded3d4
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEDOGec9WMuYGE2TiNoB9WCk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 3B22
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzUzMjM0NzU4ODA5NTI1MjY5Nw%3D%3D

170 B
243 B

63ms
32ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzUzMjM0NzU4ODA5NTI1MjY5Nw%3D%3D

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 31 Aug 2022 02:28:41 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: bff16b93-e4e2-4373-961e-de2b93410cfc
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzUzMjM0NzU4ODA5NTI1MjY5Nw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 01F9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENSvdLwINa82Cj8BWVjh2s8&google_cver=1

43 B
910 B

49ms
37ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENSvdLwINa82Cj8BWVjh2s8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnsBxC-xMcCGK3w18ABMAE&v=APEucNWJSgOskpbqYtIUyLNVI2KP5xgwHsHGbHWKZYJ1-rphrl8G-XcNHVdyAgnTym1MfUlVcxEuI1O4H0sJHC-LyyhsqEEXeh8bDl8LIc0FMM64QtFXsM69zeqyzJRg3SITXE3q5VqVTIfBHN9VWVoFEqekNyhX6VD_VbXIeq72-PklvRZUnfM
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

cf-ray: 7432558f5ff1913c-FRA
pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=htQlm4yb0IRI%2BuhtBATDuaK5vBtTRkWgKvMFqu%2F9rR3BP%2FirIyhIOB9OB7Z%2FBr24jebbvHAdunszjlCQ7Mk5uI6EijeAk0huiv4%2FvvxhCNn7sSMVdvmt6nVKfGApAOBa3g5XeEWrQVpmrw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENSvdLwINa82Cj8BWVjh2s8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 01F9
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yw7HWfWsq9H4oIzb0Mj-vwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKas1OhyV08ivEoJuaN13TU&google_cver=1

43 B
911 B

38ms
37ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKas1OhyV08ivEoJuaN13TU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnsBxC-xMcCGK3w18ABMAE&v=APEucNWJSgOskpbqYtIUyLNVI2KP5xgwHsHGbHWKZYJ1-rphrl8G-XcNHVdyAgnTym1MfUlVcxEuI1O4H0sJHC-LyyhsqEEXeh8bDl8LIc0FMM64QtFXsM69zeqyzJRg3SITXE3q5VqVTIfBHN9VWVoFEqekNyhX6VD_VbXIeq72-PklvRZUnfM
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

cf-ray: 743255903892913c-FRA
pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1tiReAQc3HOAuHDI2KkzKMNCX7VwZCMf%2BNyZxyU6I%2Ba0R%2F15I3PSMSVkDZztoaBGdMyhk4zYKq9xtwpmldshJHgU3CLIHkRWsf6MG1KPJiRstBhetEVpZqvV1nTzvlYb46%2F%2Bs2FJ2K7DqA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKas1OhyV08ivEoJuaN13TU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 01F9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEDOGec9WMuYGE2TiNoB9WCk&google_cver=1

43 B
1016 B

30ms
30ms

Image
image/gif

185.89.210.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEDOGec9WMuYGE2TiNoB9WCk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPnsBxC-xMcCGK3w18ABMAE&v=APEucNWJSgOskpbqYtIUyLNVI2KP5xgwHsHGbHWKZYJ1-rphrl8G-XcNHVdyAgnTym1MfUlVcxEuI1O4H0sJHC-LyyhsqEEXeh8bDl8LIc0FMM64QtFXsM69zeqyzJRg3SITXE3q5VqVTIfBHN9VWVoFEqekNyhX6VD_VbXIeq72-PklvRZUnfM

Protocol

HTTP/1.1

Server

185.89.210.153 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 Aug 2022 02:28:41 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 8a09abef-43d3-4b86-b404-923e522c998c
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEDOGec9WMuYGE2TiNoB9WCk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 01F9
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzUzMjM0NzU4ODA5NTI1MjY5Nw%3D%3D

170 B
232 B

60ms
32ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzUzMjM0NzU4ODA5NTI1MjY5Nw%3D%3D

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 31 Aug 2022 02:28:41 GMT
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: af33bf97-56d5-4e47-a557-0f3a8b728722
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzUzMjM0NzU4ODA5NTI1MjY5Nw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 05B3 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a4fa6548998c272e41c6d32bc3468e0aee49021e5d88fc4878e3a5eabed32883

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220829/r20110914/ Frame 67EF 30 KB
12 KB 62ms
20ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220829/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cj9Q47Ei18r6wtkhgE6zaj9JJVEJPxAYEpjdxagW8cM4ph7KtYHVza6n_BJvAqAzNQzKAmGFL4fFTz8YfQ0fWb77Ke3w&cry=1&dbm_d=AKAmf-CdScGalQz6KYM0DHzXDlyefh1SiGzRh7vzgq0gR8f_AzKd4_IF-buIlSMasatlIIy3bi1w0FqjLssHEIxj6p_qIhMs9_Ts5Y1u2AUmWUoX9yb-9uQVhQqYrx_DEmj2lpuZA5rnTMDP5Xp0ooZTF4dvVXpp80VERHM3qyaF-FxyeIeBdh1ETIeuoo-ZRlIQLNcsVDzc6CPJLuZrwD61WQtZIpG95QrL7TaUd_w_XEv4jHA0nFrQ6BjEXkPy3dB9J-cZr0s6OrbDht-Ey5twUQnBz_r9HwnVErbL_Vowih2s8eF97cnFhBJTo8at5w_kdiQbtzdZYgVMl1V5gRUh8ihcbFPz4Fa76I4HhR1CQV672nd8sWOVt756bHcCqeji4V7oW8p_bSt9Fqb7VIh-waqrmwTJUikinmoD-eBeD-dnnMPiaI4DwmegEqTGzkGcQQWvWye0ueTpm77vhC1smjJCJiv6qbJLS184QU0qsTZlf0PIQA8jPbMQ1FGRtFiyH7SRNzCgrvp1VUbk59Mj4i5_p-y0WSgLz_85rzBge4kcy5Vf5gsSUo8Zzn3trbpxXRdfZWVqi4Kstvc2bCiE_4mmEpoGd8CeQRhvxb3ErcVtdRxJg7t464MsNEJTPtK0H6zbTazoKz5wig7PtuL5RwF313dm1LchTHNEzgHPGzP1hZhBRSNfXFPxPU5J1nZVNtpDPUESdC4GtzQMcmbLyge8isxw8miLP_OsaT3Yely5yfcTcPQ-xm43Pb1zrTF3Qpt_YYAp0ZHGDcM8oD71t_TBvAqXIBwxkyt5Ju8aXTuRJ4x36ic0_n8csi99mp9oFC1v6ucKbOaerudbBxHWCOUQz7HVka4tRdLHpLZpES-qkJOjYva9CM6GsUdlrsC9GGLJ6YlMNsrzmmM4q4dzKix9imJb1Aju88lxsKcLgKLmBzErCTwi29WeIXGHUdjvfORn0sLBqroGIhcFcZ_rI9fe8a1wiGz-2l7cwDJitWSNNFSDi1WMUALTHZGUk8qOU9ZmCH3nMj9j06uglRlFPy0SfjRbL99esZOU1EihKj17RpOigWCPq9hFYVXL2wbL7aWxaRmc-Bji0j81hn75-y7wWe1s3PNLfj3ObLYjK1YLsbEO1zjlqVMIa067U5u7TNvp5DMXGGel3OhZU7HLd5jJBFtJlnWteRN4e_1hfkPb5BmNAsVlEH9p5uesLT_ADBK3yrkxBuoWa9fFazPo6d1XzqASvXwxbAGESguFEzJEN1EVIJfaIaVCIWjgReXRw5AkAiaalUVbuJAmOa9nqnJk3inVPV_fxfPQlW5ONkgc3Tp7vAVmpJCdE4HRNp6T7AQ6h_T793lxEVcG8_whW6BtWQoBn-xmjKVksCOQMJH0IQP1mD25r6HLZEzGE9fCoGBq91KhHG4pTjVWOnEjIQCRAMZZ-SOkWyc9l4_NLUAomue5-ax_3f4AT7Mhj2IgXvHsYNXgY9P6iBo5BfO3aQEe0vxQMbP2UogJ0W67YdJ4EhMPc7EeZCjXVph1SS7EnFCuYelBf0KotZ3IHhKXcht11i4r2PW22oXYwnO3XfID0ajHf63ll52kFyJCi2_b5rWqKHa85fG98GSBezkDFvNfO2X2rkmecZrEwwpt2T83LYSQZ6K-c6ZlByyLEOBxoOegfVbYk3hXUCpeBs7Ay9k8h8b0oaowVPX_6EdebcXrf0cCExwW-yHhCGOWGKYIVIG6dltPuAlQIOLx5_ykH9tBGjPle0b5P3Hb-UpYlYeruQCCwhc6swVNoUATvFfMMCrCNmyRxvBNdoCrQMvKgmynoXyg67CPBt6QlCgZd36Fn3w-0BKv18feew3OJU6-DHEJ9WRXHBrixZGdvnVKDX4ogukM6L1CuHCczwM53vsJZ_dUTvIo2s0KzKutVddC1wBxIxJpHpsVLBCVoTryq-YaG6gIdqN6Kjktl41-0CKPbwha9vBmn0-FFZ7alLA-Iw4Kc-fcTyyTKyATrxG-3fMR-8ynubPaKrw8MGN384VhJ57Yvr3T_5L4onXapr1f9OSI-vpJhFHcw8FiobSPppslqjcEXGYQb0de4fQHLAzdm2BbznYJ4KuEa7ygz-d21aIWLicMNUr-0hlhZG8qiFq7rSLHih9c_ivO4LrhycDSmQqYuaorCRSy9KhTPVi9_8537qwCRFUZHLF9xEdqBTZmc81nORXg0iOe5gCEgbrQ3UOVVbQAiNH1fvFV6DWK9izWIUeWXn2KNhZQXvrVDih005aYChXsOucF3BZpKBmouKs6HhULZEy2lObcY0cy8DxD8_sYUtZSsB3A6wOmb5DDS9N0jRyaI6XFgQktJUiIzo2-w4qnmhjjL0gDm8NmQxQLjm2NNxeI8rKs_hrehtk_qfp8HU0-IzAwSOXo3EtGL8UQXE-8B0rJK-YkHbHVrq0iBgMmMjQNBWBCachPaLthbMa05aiuWP4rMMUykVEmo8oi3PXeMBey6u759V3RXLqAyrAgoV1-U_F5qIGO55DH_pzNuRCEIEvXnvRXsvroG8xHPCLcs0mFlRz1Rj7xUoYsqhE7jygBOANa6pOCgXrOYmqiJI20_79Gbsmh5rsVcJ9V3UDOPwHw8EqfK_igwAVsJtRc16E4YZ1P23TlpCPfz_hsyNhTII1Y2cj5XJ9OicbDSknFvh0Zqlji3IzgXZYTnXR_rw8qs7NrTpRfmg8A_sClYEUe2yzQnE1hpfAZLOA3bnJ_lNpL-x2C_bg5WjTF8lnqNiwRBIiEJWFVDdwnPdyAfdXpX4P3ZlONlKrrVsmbh6pPDO__jtDtSA1bmfwX4C5mUHpiAIBKFVwTP8BwOk9R31nKzDF0jTtIJ7grlfvVKIEHl-bFtpMZC3SX0WrvUHe_8y8ERQnDeppNBcbAqpN_UU4xr7shz0odb_VYYlTIy5ScRBS4Em6Su7O_CV6u2UxZ4I5bXjYQqtXOLOBV74uan0v5YfiY-fhcyhw1OPjEzxiuxnljERlgWh-g7w3f5nwOaLhc2nIjUJ3XaXnC_tlDX_ABDHtw9k3Co1t5VZc9E07CMXgwPxVb6JvVu9jWNImi3zlPduea3yPyahkBA1KHdJ8N8vhMZqIzKDrzbZ3fkoPIG6AfKhyQvTHRamdm5XxDELIzvGj0rUL32JUfoXtv5nB-GlWPGkCDxnOo4H1bQr2b3QiJYjvvaeumV7AFnQR3Sz4-OmuUJwB_zrAakrNOLqxzNaizrG33qqfEMDUcpmLwbPNl0RaDqT6Sn-hrDLdhMuI6LOAv4AaOMBAoaalIPw&cid=CAASKORoHsPZHzY7GDlwNN05gZ65clzzkyWwfb_L95tCnUiAtCOiGvZCwVQ&rfl=1%2Chttp%253A%252F%252Fwww.zdrave.bg%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dac404ab5c3fcdc83e30b66349bccf92526406c5fdd63b9c1394acf78348ac52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:06:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1356
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11766
x-xss-protection: 0
server: cafe
etag: 14053427913132020778
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Sep 2022 02:06:05 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220829/r20110914/elements/html/ Frame 67EF 8 KB
3 KB 65ms
24ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220829/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9499ea51a2956fd2c1600591ae117fe9ad81065d625b1b2c593c7720e5b228f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 01:18:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4235
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 18418590997839133011
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Sep 2022 01:18:06 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 67EF 0
64 B 131ms
66ms Ping
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsskfdFjX7gZH8wTwOv_7eoBz-ZSk82zAgmZgCdhD2GLqhfO759MbSx8ZRJw-QmJCJlJUPRt8iBmVhpO1_tpsq0KfaD0k7kx9oXN4Tvv5hYRznwx1xnzn-qreLUVTfRqgWycGnB7AtV9vCoP6drhLhBrW7k0yPGs_cHWXhrsIYnp91vgB5A8sgRl0RPxpAKw7PpdDORitUmCFj2N_vITt5UfKyyXs9lKEyIRjXmRz5JI3BZcZes-LlQP170nQoxxzsGmth6O34T44XUuZpRGQwd2j7YlBihCq79rNUrFQeNw-fWVv7n3JWhVuyjT3ow5WoHyn68PKHq0c_rQMQm-0sDuSUuNrMJN4qpRn_Z-DKZwHhrTMr6awBTrNDXcAumgQAEkhTTG_WVNkDhsJ0FIB4x4W3rwJPnxMfE4wOX2MH68WSh-GDuuKsfZI8hSaIgJ8keoRHkIVJyb97gnwNqTMM19Dv52QbsFgk9bi0whs-H2JL9Q3P7CiufZQYIxqn0fzgve2SQJBzldZHKTiscNg4EwH06XM3AHhK6xZirLpiOTp1ngPclYkCaCGVmadS6gqFBi_JhCYI_4J2d-1uOm-9_IyioBKLRJvqAmjtUMK3lzInsN38nXOasarP_AR0fXESe0TZV9SouWf6KEHhE0ye48gFYCxaQqTRVa8bF93nawiLxM3HxsY8iNjPddNo_9aS0Nqp-cvtlygIz_0SAl6RSovB8Igzo4EWqfqsK9NO55nBuQX0Elroxx-ek4dhJqzGXjq2fpEAUc7asQ5TVWMXUvNxri4SwcIFRCPE_zUAqeV35GkbgEubn8f6UrGxXU4IRQLQO6U5ZG-Ad2unBKgdhi6vC-gyDDch_x02eaeFGoJdZCzU0R0wabdVRfjP_AiStMQF-2j9sNCiugxcEhp5cqY5BthgMfYCvZfsECiXB9WsSx5epg-MRvzXgQgwZDK6tgeqTolObNPT3pA29sF7ZvfSVOIBgVdR93w47PDPCCksdvVfb_9Zm1xXVF59korXhNxXVkz18nP-MhdMnPZVX5fnFMRsok9SpJQM7twK4732XgBHvyVGF-Z-QJuqZf0osJnpdLkU9iy32GwRUINucH1IMenzy8k5-2eruHl_ti4Bo4d8DDisFPi-cYI69kXg1QGVHNorqm35xSq1NuEA8o5FW4ODgDxIJVs9Dg-Py1HI1WK0zd4sXY4hCJ-W4qUD_iROSKJUQkWWvrO0NCAAFuq9N_-os&sai=AMfl-YRZF6CyZ4UfSTflQumT8Zpr4LAwMOJiQv13D9cE-TwFV6wl2yi8N0dFk78wtVhneZn4_qbowpFWueHZpqSIoQcpRNV1vN337GUiqWARuE2FmsDZniGsXHw7IGIwJDeGJvILHAA9xYSz3Nxg1PHAE4VAdO5whzGq9OiAm89UgNT_2bHKrJy67RPKgfLqz1iTIgCmN9vj1wimM9YWVMXahZJOqKg8FOphCg&sig=Cg0ArKJSzIKnG0sWWkxLEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220829.88971&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Wed, 31 Aug 2022 02:28:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 67EF 41 KB
15 KB 65ms
21ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 30 Aug 2022 11:23:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54324
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 30 Aug 2023 11:23:17 GMT

GET
H2 200 2372840045091244501
s0.2mdn.net/simgad/ Frame 67EF 228 KB
229 KB 74ms
23ms Image
image/png 2a00:1450:4001:809::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/2372840045091244501

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

473674d1ab666c1ee561f9d81a765fac0c773cfe04ba29f6b36224a2657f64ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 28 Aug 2022 22:01:06 GMT
x-content-type-options: nosniff
age: 188855
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 233500
x-xss-protection: 0
last-modified: Tue, 02 Aug 2022 11:17:38 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 28 Aug 2023 22:01:06 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220829/r20110914/ Frame A980 30 KB
12 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220829/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BTMVCELpK7sP3E0I0jkIvCJdtJQIAdeQx-qhwVbDg1Rrk3_1oIK6fry1ch83irO5o8G28YtHuCav1YIPI6LUXOa9rn3Q&cry=1&dbm_d=AKAmf-AG_1Nz7TTr5yvQxViKD90o6TomzrGMPI6RKvl5dPK8ktGjVMVwViau2rUqElyEQ_ySQiWj5WLIP0s9uZAikKdco6Es82EjCJtI7RP-bwFYOKWTuopFoLFXVQ7fb0nBF5Tn9eOIB7q8bgS2q1Tq5zLnPwigpcZll_eZ53H1um3OQUoYwlDiscYd4QHlWE-LSfFJ98BNCvCsjE-OksMQlm8UDn7nxbzURhjgQJNdkq0pZtjjTVuGqPmA2UmZHBOrPKn30q8hzkGkFVS6mxs46TJ-5gonzD_Y8Iz7NUpqy1gukMPoRpCWxUOKNJndtwOsY5VAwq4VyOPgKQoltsFUg50J6VLdf3dJH0pVIQGKHKUtih7l8zZLA0lh4mJKnPUPofdrezWwneAP39HEH9ATLw-q9ZxQOlscWIZKK_i0R8KtBhGjjxWuRjBS9L87Zq5NXqexNz4y0KE6TNV94BzqxRkBuC2wTR5u16X1LFOegACpuO50zPWnp4IXdQG5VdPT4aISFjGT0RLpJccHCB8JZ-ic7NN7s90tCNR1W2y2maAPInyS1JQykK7OUm_8ke80JNpTSm6lZfPZy98LeDF-yfPoRT70BBxPREu3UHc912YLMz1FPYw28HqLCU4t5K8P1r5FYongn1gXU8UwiXAuVENFMP91tIPSVR_H5vv9l3PnfZdzfUptRb8hZRLHZd7_fgbpTa5aDI8LWIGIhNpdbKCdff4rHLMV_D6Koxzs9sMmNmITuc6-I77DNf0baG3wb0cv4O7UY_JLs0H9iS32qx7LHTlK6JUw4l4RWE2HQ5JXbTH9TrDmIa2GPVX4rgAzBsvEkZ1CfEmcbmzrYpQoKZecD5RfApdHvNsXT7zq4Eii5MIcYUpu0oRfCGMAdhmhOkKH6J9THnzmE1HWFZn-OUghfNzk1E4c_N8tqnxR5S009Dz7BMwHD948vaAxfToEPscBSthGcyM5bSgJo2Uzv6swOSk8eqLDvw54FDkVKuFDru4h8RiimoPZRVFUJPQbC2X1xDYK1FsP0I9aWFq4oWCFUcUjeBYXZiODV1u4WIgf-cXv1sKI3pcrHBmlhFs5JDXPUT4s6e_yQiaFputOlkFbSdyPPeymqihZsGdO2PMaxJUhBwObuwib_zvmWGCeRAh-v3NJYMvGvgdtWdBkC-Clraz0mqgzXuUgQI8nNyZ1aRW7uaGWBisOA0P3SDCbi-ETlQ6zHwzWl3slnjTAYu_zPz8NInq323eDw-2Oh_kA-OFAhkucyryFMpj3Bt1M-jXnMeDY84w2g4VH2XcXJ0gwlO_lc3e9Ip3fndGOyaVp-lb_yHIoXBTYda8vR8NuKZXsw0Izf1sfMt8w-cGSQlwYtBoZlv0EVDIWhVAKCvzhYi08Q0c2ARSnI3njNt1KgeC3FYRFvzRORxZuBm7AWNFVDzb4egW-5lsa2zrcGa9LakMvMMUkdYUlCgb4AdaaD0zZc9AAG7aWKs8VbLAbZGL1Cp-vitJDycQLdyucPdMHHtm4VumKfMKMt5YQG04nAOY8EnSZE59f4hMQeQKB1qRcr4CP6W7AdpSok3xx20yxfbxYMtJ0I6eWNQeZsrpHTRQDi_F95TN9w1JQmmHsY71q62gyCwLITTn70nsEBEWTibZtWAhfYDN652-2C8cJxal0_q529xbIfesfCABZaVOztu1BTNBoVGAubxH55dBPW1RxQSw0XSlyCaMq480fY644TAxKK6JiQZrv4bsx7eTWlNUsYLdPA9MS37tk7jfloTn9eLd0mA4yiGcge7pN0rS5WhIQ9_lZbULtx3W1z5OE9POV0-EmRwJuaYqCIBniSlHqOOqcc7K-Lo3l6qWrYC0qZuR4wOmnKAWz58zENKN3_C9Cg3LUL9-wPj0zp5azl3M-icXftkc5T_DYSh_kd6ff3SbqNA3svv2aTkvDumsgfkrmwYwH2K_F1UqOqMutv9BuKH5k5FfDXkZyQ1xjcJZGTCPM2KSqWmzeNM2ay5Yk3McsxIQa42F5hEXhaMbtZNprwni98wPnSM30N-bCVB1qVaNn8mHxnE87R202JQfsEVkzyRX-DHoAWVUbOaxq1sPMtCboxNSezwET33DKB7P1FUgcETnj-y_VCJBsKHJCpjQlHNU2PnokbK5QDECv6PdYebR1afZf6AQsTfOkvUAtj3_sAYLbiyGUKOtG8XUjVLOcQSIALnmeGEUPVEUtETa9gZqYIYn8btUb9dRmDbD1QBAjUHlQOhw9b_bp8lK3XknJfujWK--LGzbstzcZtidV_v4D6xp98U-_qCaLtr2bKZ4aogDk5VqshiqiCzWPTf2PCYRStUHviK2CJ1Q50BUUZBCwBZR-1uXazGxDhXfAPuZ4oLW-5QdlRHn_puXgQro_OAovwoWLN3cnIMHCozlQR8YdeLhwkVb7ct1sw4waixwiaO6ZF0GMlSBXyYlkzCsqNKbbKXdoYduRyeJMs35IbpXcGZnaZp2aOiwbsr01lKjzjify9OK-A42WLjCnMb3-swBqaD_wsfpWic5n0K3f_DYZ4iQU6-_FpgOP9aJ-iqJyNaxuXC6p4RW2MrnJXxFw9NXsa-5OOCv9RpN-Ja3q8x-DR-7c-m_5ToUIfDcHipj2c5YEBb4C26p0z--LcjZmhN4hhDCIpAatCo28vyn7zZVGbUiLBgaQb14WByp74jgI8KvE0p2b_-4q-R7HfDnxcZggUn-qnIlsL594jFEAQ-tBvAcNOBqi7rERJ4f76gzNqk9PpeJvke8pbVVmxneuQFxtxp6_fgbA1f3REyRmL9Dov6mvuaO9pRg-5Hn5bQdpKsu-yN3xD76tqv3aSWLhG7WjCUpNstgisJd6J111FE_FuYDFOXmAU3SLgUHUfXVG2GCVkr-1xsOe1yWRj1v_Oj0b59w9sBMbuYUfG9fIDs_taK_jQq636LrgFM9GWvRfMkZUysJAxtrTaH-GbIICS1b7PgHbWaLL_u5cwTGAqcog_-Th_gIEuoYXpX9wHwvwaCPcelJMkIi2QwwlAYwb7lPz2T9sn-Yz7iNh6Kfi1RU5y9ZNs3isdRDo7ulkczA-galFowrmplEcy5y7VHPZBe0rsXHjrLzwnOT8k2OhGUlI-XIJJIsB4Q7_Vo92wDg2P5C7QanuXzunsWVuvS5hOc3-rNK9ignfXFNuvhUfO2rYpR7PMbya-cOESATvkHiexD-hcyzJmt8n8LiyfOuz9aesgUIhgvJsDuMe_2lCqjBZgyrCSh8c_j-FZRcLdvpv&cid=CAASKORo1mNKOPC8jXED926Ox_7TMoGV-WCZld9xAAmVYug2m2uqDA_3Q94&rfl=1%2Chttp%253A%252F%252Fwww.zdrave.bg%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dac404ab5c3fcdc83e30b66349bccf92526406c5fdd63b9c1394acf78348ac52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:06:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1356
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11766
x-xss-protection: 0
server: cafe
etag: 14053427913132020778
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Sep 2022 02:06:05 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220829/r20110914/elements/html/ Frame A980 8 KB
3 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220829/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9499ea51a2956fd2c1600591ae117fe9ad81065d625b1b2c593c7720e5b228f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 01:18:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4235
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 18418590997839133011
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Sep 2022 01:18:06 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame A980 0
622 B 72ms
65ms Ping
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuNSBS5bKaQCunLkBW7zARNszj3HV6cH7dzyKlMlENHiN1zIZQMGVG_okHwjRoc82URCgebmpDUb4u0Of689uzWzPfln_XLxEexByeecOvrtmOtPK6fqlBfVy6ookYGUbPqs1YXyXuzAW9BGOhPebuKlGXNVL_y1O7YxMgJgenPrONHKxPYd3BVfiakHYH5qK6Pr_kir5B6VLDhqRkgxnLJF9Tyy7Bxte7if8t0AOpbXtpGOgP8XE5l7_LsWyilehIH8TmMvk5KmiA5yZJrlE6B3WADBiuTqPCrlqA87RkrVPG718mBPW95H9Yugb5ieIr27WoOmv4RJdsEGCWkheMVpe0uMtqceKzK5C-tTQGulU5xqYBL06aBBgm-P1Slq5zfw03Ku8BvlL-bl5zlNYv3INrIzuvrYTEYtNl6ehSHQzdkwtgIUqtTwSkDVG3CVM73Th9iCVGvSy0Myl-90tphi1szfv10aLGKXAeN5gL6qhGXub_fr1cpQiftJqYKAeLBewbLejWhKCfxrYpfGsTAhIcf9LRtz_gGuE--zt8I-e1Ya9SXKUWRAMWCZUWNH-y5eGMjz4PB3crwa_Iu82hkbts9oig2c-N4tYxBEUlxvyhBHM7ENeNvM9_B2hy3ifzjvv-jZ8PjMNdUdOCEL3LU74clnrv58zJiCENzieuthgtEVqzBKX1Nvr_ARBHPKUcnTNuqTLhlFUVuiqfscK11eCuRZxUhbzOMkwqEprTRAr4BFFC_S2muZsVwvyQUUCShxA1ex8-lSEYsxyKabcRDxYYIy_lAeFTj-2u_R1v3urpl4TFMmPPzXpAeHiteL85AYd5Wc_3wHo36lSwpVkBxrT6ENqUGa0CP-frAEZjoV_1KjhDoV4DgfIerCTjq6nrcYk7cW8oN-MHw4d7RexDJOpMzj34ntbstsStPvEHcQGLD3ST4XrHm1k248MkZp_Cows_6JGPs-sv9NZYFli5vRJJTdIO6NfbxteUWWx4OhT0vqRu8CD7ZuO5HYf2TU3onHhRa888YcHIRqgh260tX3WIVFutr9n1O_c29EI3Uu_6MRYddCcEc1_sK8s3lplpa9IvSNlrou0mM6HUeHUJg82rbeuk9wKCjKx5_ZdDwXpLycrdfpEoFTqTS0FAaXCYhyRKitM5kULrOmfJNFoJ8jnEfJ0nNv2AbBSBINSahGB8DYxqgmX--qiS7U3HMP0BVyFI2tDinZylvaKPw3HE&sai=AMfl-YTmNcgcr39eVFTp_6Gq2SFgYHbNGmIEaSNk4jnwRQ4Tp2OSK9swvc01_EJQADfRq6-LWfEE9ddU8W-rIRoxi7rXGb-x5sxQf16dzZ_BG7fMnOP4FoRiZz0PM_hJaunqXBQld5iJdLMBdhtF9Uc3aN-L3FnaPVbIpbHRGoEasjZ064DdO0_D3qnCyr8z3BuHSqAlKUASNhdF5Md3F8_ZDSApyWsNcX4DEA&sig=Cg0ArKJSzIlY3Nyscle0EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220829.44315&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Wed, 31 Aug 2022 02:28:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A980 41 KB
15 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 30 Aug 2022 11:23:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54324
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 30 Aug 2023 11:23:17 GMT

GET
H2 200 14930904078074304318
s0.2mdn.net/simgad/ Frame A980 147 KB
147 KB 88ms
88ms Image
image/png 2a00:1450:4001:809::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/14930904078074304318

Requested by

Host: e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com
URL: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

00da604d5c7ed210d74447d0e67e98561383e37272bf04d72af90a99e1069bb5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 28 Aug 2022 22:01:02 GMT
x-content-type-options: nosniff
age: 188859
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 150692
x-xss-protection: 0
last-modified: Mon, 08 Aug 2022 15:17:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 28 Aug 2023 22:01:02 GMT

GET
H2

200

rexdot.js Show response
gabg.hit.gemius.pl/__/_1661912921499/
Redirect Chain

https://gabg.hit.gemius.pl/_1661912921499/rexdot.js?l=100&id=ous70LtcMDg4hZBoeTML28UFPzHZvwdNi.i4cwExhdr.Y7&et=view&hsrc=1&initsonar=1&extra=&inner=_ver%3D328&eventid=0&fr=1&tz=0&fv=-&href=http%3A%...
https://gabg.hit.gemius.pl/__/_1661912921499/rexdot.js?l=100&id=ous70LtcMDg4hZBoeTML28UFPzHZvwdNi.i4cwExhdr.Y7&et=view&hsrc=1&initsonar=1&extra=&inner=_ver%3D328&eventid=0&fr=1&tz=0&fv=-&href=http%...

452 B
707 B

131ms
130ms

Script
application/x-javascript

78.128.6.42
TELEPOINT

General

Check archive.org

Show headers Download Go to

Full URL: https://gabg.hit.gemius.pl/__/_1661912921499/rexdot.js?l=100&id=ous70LtcMDg4hZBoeTML28UFPzHZvwdNi.i4cwExhdr.Y7&et=view&hsrc=1&initsonar=1&extra=&inner=_ver%3D328&eventid=0&fr=1&tz=0&fv=-&href=http%3A%2F%2Fwww.zdrave.bg%2F&ref=&screen=1600x1200r1000&col=24&window=1600x1200&vis=1&lsdata=nZtnsh5Hlyn7aJyVA6f9iEPhbn5xH8aGTEnJzsb0nCj.U7h4He4TLSiCuzP9VyxZWwhlu9eFKmfUmuBnZYzio0KErVBU/EiL4Yx.OT_3wt/&ltime=307&fpdata=BKwc5bgFnZmWcv_2QbmcWr4MpsvbUA3668rTTPW9t8H.O7&lsadd=&fpcap=
Requested by: Host: www.zdrave.bg
URL: http://www.zdrave.bg/
Protocol: H2
Server: 78.128.6.42 , Bulgaria, ASN31083 (TELEPOINT, BG),
Reverse DNS: ip-6-42.telehouse.bg
Software: GHC /
Resource Hash: 4924b27ddb4810fe086930625161dc0a1a02cee92f289bcea0d708fd10eaf1d0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.zdrave.bg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-type: application/x-javascript
content-length: 452
expires: Tue, 30 Aug 2022 02:28:41 GMT

Redirect headers

pragma: no-cache
date: Wed, 31 Aug 2022 02:28:41 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: /__/_1661912921499/rexdot.js?l=100&id=ous70LtcMDg4hZBoeTML28UFPzHZvwdNi.i4cwExhdr.Y7&et=view&hsrc=1&initsonar=1&extra=&inner=_ver%3D328&eventid=0&fr=1&tz=0&fv=-&href=http%3A%2F%2Fwww.zdrave.bg%2F&ref=&screen=1600x1200r1000&col=24&window=1600x1200&vis=1&lsdata=nZtnsh5Hlyn7aJyVA6f9iEPhbn5xH8aGTEnJzsb0nCj.U7h4He4TLSiCuzP9VyxZWwhlu9eFKmfUmuBnZYzio0KErVBU/EiL4Yx.OT_3wt/&ltime=307&fpdata=BKwc5bgFnZmWcv_2QbmcWr4MpsvbUA3668rTTPW9t8H.O7&lsadd=&fpcap=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Tue, 30 Aug 2022 02:28:41 GMT

GET
DATA 200
OK truncated
/ Frame 67EF 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 97ab0fbd3f19588183beed5ef384b17357949ed7173ce4e464cf4089e4d4cbaf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 5947 22 KB
8 KB 21ms
20ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 566426
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 13:08:15 GMT
expires: Thu, 24 Aug 2023 13:08:15 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame A980 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 396ea654b08a15610cb0539a66481c27b95f5b802e55ce74d9538880a9c5fc26

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame E833 22 KB
8 KB 21ms
20ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 566426
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 24 Aug 2022 13:08:15 GMT
expires: Thu, 24 Aug 2023 13:08:15 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 92C7 2 KB
1 KB 122ms
39ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yw7HWAAM10AKd52GAAhV9rQmekzoS1yvr2Ya7Q&u=%7CT3699gPquUKYmlYUbT%2F4Bt2q7uou%2FA1SBf2UTH42DQI%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNy44cDHK1QYNdJ71gdyCWvw29y1GxtacI6iVoVnLQ5srUOwC-sDBJIjvRCy3Ss-Bi0BVHWXDfmlrvaQg7WPjZv8hM27u8-lMb12pEsAcC7lkk2gIQ5Qyjr-v-lFNYHpw4ObBaW8ElhIgF1Tq4Gzo8E5xwUg6xNyOC9AmkVTcM_YeYDEh4Pn2Cj_CdfqZ9y1VSS0XqRZu54j5gkg69ksJflz0zoLUebcy0JtdCgdJVnpI66Bsr05aCyq5PZ2XUqMrw_CJh8-PG_-eYCQtH1cU6fP5wzMDqfFC9-tTCpWo0A4yMLe1GYlh_KTR-_TJdfCFkyoiKW_RTe7yLa8reKrKWNPow0_-Kn8FlosNecqTCgNHyU0YOr3fTWQzyWec_9q5xjkVDtQ1ao0ktpNINnH8nB5HvHd1t8KkelM3Xz1fCUu_QXFt9f6gZLIAu95y4cNqKaMPL6fJqI99_lJK_VHrBmZ7B-iJlv8FW34CV3EYd-8ZCWUNfT4bKV551xb-9JqVUzlVkQBnoaoaiO87fxQaC9PB1kYsjknO7xCX1vZVBDip1r3hQZSRHr3nrpual98J80b6v1imm0KjRfgG4psCHJRGH_FYswZFe&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCLZWOWMcOY8CuM4a73gP2q6HACMme0rFc1Z2R93DAjbcBEAEgAGCVgoCAsAeCARdjYS1wdWItNzAzMTgzMTU1NzgzMDMzNaAB1bbS6gPIAQmpAnyeUN1bz7A-4AIAqAMBqgTvAU_QcJt9uy_cEdmCdW2dqKi6gGZqRX2HAZ9FF16Xe1ZVcC5wHHgJmNm9WjyQqOAA01ZFbl0fxTFfxWCfStUMg7VKC7flBlnIb5w0gqr7j-GAHIk7Oh7Evk11C_IeSuZzs62V5EKKWKtQspkG1Vc0GFGv2j3EmTRf8VoIIvj5PpH-Q74javS2h3dp2chgf3vbTeKwxEzEmGBivMqJF5Z7hJHZEDqSIRWspTL3UYo4Gr5M4DlySXWg2YLd1uatZpXsMWWpNks7MWvib-4Ot6k9InapkLVBVvNpWI2NDu0Ka_O4pzgY83Ry7YkvD6Z_rQJF4AQBgAbqu9r5rquukeMBoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEAiI4YAQEAEyA6qCAToCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1IINrI_JZ2RXQhVGZquKx7qF0BlQ%26client%3Dca-pub-7031831557830335%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:41 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 26 Aug 2023 02:28:41 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 92C7 2 KB
1 KB 121ms
37ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:41 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 26 Aug 2023 02:28:41 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 92C7 308 B
637 B 114ms
37ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:41 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sat, 26 Aug 2023 02:28:41 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 92C7 293 B
621 B 116ms
39ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:41 GMT
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sat, 26 Aug 2023 02:28:41 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/delivery/ Frame 92C7 43 B
348 B 110ms
31ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl.eu.criteo.com/delivery/lg.php?cppv=3&cpp=FTZiJg_3eZxV-mzf8JcBPLfY_RP0pW30WwnvxuevVCVotjVzieDYXHlk-gG2PvQpPSG8BSGSLWM-u8v4Hjk_hmUf6G3fNN-3V_GP3KUnr6q98FxjVtBQ_luSRvqriHzpN_25o-OBjFRX1w_bN4-2SNRIFXPnhWxpitg-HcJg2owwf70BFMohL6F5qBCRXANNkUhhE0TefLRIJmznIjC8TnbeiE6YabXNBBcSwkCvtNPGwPHA536YypHkoHZXhzvxH6yKTd_pa8hxTc-BhgeehU6OOitTcMwZkqAoVEqsl-5E7J5MoleEiE_OGp9AspudP_I-9jFIUGjSqMWFUtTMlKtXBt_qCtLv1Gr141WoVre0uSjBo1BDl13VUWsdpU-2jiRyzE_J4tfELS1URDNLBcAlWLqoJltu1yEbLfJaaBvF81ky

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 02:28:40 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2813507
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 92C7 12 KB
5 KB 71ms
25ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:41 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 551264
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NFFDLIoAlN7CRU0KI3oGVudzhAQ%2BuVj3Lx%2FeOM06IEZ6Zw0tvrtBO14tqwL6rfVuspfQ9BTjZofL5TXW%2By%2BicPC%2BMAJAkwkX6bSEHwHJBqqpdVQ9JqL%2Fs2DvwdG%2FxiAluRmtr4DO4NsVOskffscaw%2FYp"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 7432559018399104-FRA
expires: Mon, 21 Aug 2023 02:28:41 GMT

GET
H3 200 ppzs-o_oDTLysEGEkZroIB51IgxzANAUgUjK_Y8VX9I.js Show response
pagead2.googlesyndication.com/bg/ Frame 5947 36 KB
16 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/ppzs-o_oDTLysEGEkZroIB51IgxzANAUgUjK_Y8VX9I.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a69cecfa8fe80d32f2b04184919ae8201e75220c7300d0148148cafd8f155fd2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 30 Aug 2022 18:01:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30440
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15877
x-xss-protection: 0
last-modified: Mon, 22 Aug 2022 11:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 30 Aug 2023 18:01:21 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 67EF 0
26 B 103ms
58ms Ping
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 31 Aug 2022 02:28:41 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 ppzs-o_oDTLysEGEkZroIB51IgxzANAUgUjK_Y8VX9I.js Show response
pagead2.googlesyndication.com/bg/ Frame E833 36 KB
16 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/ppzs-o_oDTLysEGEkZroIB51IgxzANAUgUjK_Y8VX9I.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a69cecfa8fe80d32f2b04184919ae8201e75220c7300d0148148cafd8f155fd2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 30 Aug 2022 18:01:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30440
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15877
x-xss-protection: 0
last-modified: Mon, 22 Aug 2022 11:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 30 Aug 2023 18:01:21 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame A980 0
26 B 95ms
60ms Ping
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e4f6b8bdc440b9d1de5ccd63c0f411ca.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 31 Aug 2022 02:28:41 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 92C7 12 KB
6 KB 68ms
38ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:41 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 26 Aug 2023 02:28:41 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 92C7 12 KB
13 KB 172ms
34ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=176&m=0&partner=2107&q=80&r=0&u=http%3A%2F%2Fstatic.nl.eu.criteo.net%2Fdesign%2Fdt%2F2107%2F190123%2Fc39f7f45f1294c3289a8d648c302479e_logo-wb.png&v=3&w=256&s=_A8Jk6TYK2N5i0BcWz4FHm0D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

25c68e012540081f9adbe2df155ab6a1ea58561496af37a6a85ee1efaeb89455

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:41 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=30496581
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 12547
expires: Sat, 19 Aug 2023 01:45:03 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 92C7 22 KB
22 KB 247ms
110ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2107&q=80&r=0&u=https%3A%2F%2Fi.weltbild.de%2Fp%2Fmit-mir-nicht-meine-herren-129990488.jpg%3Fv%3D2%26wp%3D_merchant&v=3&w=400&s=dXaBiEYDAXlqsja9E7DUn0cd&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

dcb3f3b03bd332cbfa87c76218d713c1fbb1c33294e88301f9087968ee34519b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:41 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=13118349
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 22196
expires: Sun, 29 Jan 2023 22:27:51 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 92C7 24 KB
24 KB 204ms
67ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2107&q=80&r=0&u=https%3A%2F%2Fi.weltbild.de%2Fp%2Fschottland-die-50-schoensten-ziele-fuer-ihre-293331760.jpg%3Fv%3D1%26wp%3D_merchant&v=3&w=400&s=VqxooqFxkKq30LBBXqGEYiKm&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

3fc393d1f237b60e05d4a8e3bfb22a793d379c57ba9c8aebf4b1e6f3b5cbdb24

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:40 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=15322510
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 24102
expires: Fri, 24 Feb 2023 10:43:52 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 92C7 19 KB
20 KB 238ms
101ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2107&q=80&r=0&u=https%3A%2F%2Fi.weltbild.de%2Fp%2Fwanddeko-schmetterling-3er-set-311999148.jpg%3Fv%3D1%26wp%3D_merchant&v=3&w=400&s=gXUQLUKb-FFETk7qvi6VZVBm&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

f8308b0e674b5ead733e8b8547a1a1f26c009c275490389c479d766aba0a96c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:40 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=13414870
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 19954
expires: Thu, 02 Feb 2023 08:49:52 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 92C7 11 KB
12 KB 203ms
66ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2107&q=80&r=0&u=https%3A%2F%2Fi.weltbild.de%2Fp%2Fdie-brennende-tante-290330555.jpg%3Fv%3D1%26wp%3D_merchant&v=3&w=400&s=tjQwwPoQxNwV2q4kdIrheLGL&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

3657b67731c24d4b3a3138ccbbcd771d65e72fe9c212af0cd82bf391fa67c26e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:41 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=15173529
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 11598
expires: Wed, 22 Feb 2023 17:20:50 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 92C7 3 KB
4 KB 272ms
135ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2107&q=80&r=0&u=https%3A%2F%2Fi.weltbild.de%2Fp%2Fvcm-10er-set-stoff-faltbox-klappbox-boxas-10er-set-334941157.jpg%3Fv%3D1%26wp%3D_merchant&v=3&w=400&s=7IV7Doc0pPEFOPOdrRANiVFu&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

c8952262ad4a2314d560255627fc898fccb5a42f60a8d82acd950eb5305f230a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:41 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=13586199
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 3462
expires: Sat, 04 Feb 2023 08:25:21 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 92C7 28 KB
28 KB 106ms
106ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2107&q=80&r=0&u=https%3A%2F%2Fi.weltbild.de%2Fp%2Fdamals-war-ich-siebzehn-311709156.jpg%3Fv%3D1%26wp%3D_merchant&v=3&w=400&s=qxrvbBKEC6MLJe6xJMhRnXPl&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

9dea886a7e44e07ab014e6adfa884b939cfc8243cd4cc3184400138812cf401a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 02:28:41 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=15327021
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 28534
expires: Fri, 24 Feb 2023 11:59:03 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 92C7 13 KB
13 KB 119ms
119ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2107&q=80&r=0&u=https%3A%2F%2Fi.weltbild.de%2Fp%2Fdekostecker-herbst-8er-set-269471574.jpg%3Fv%3D1%26wp%3D_merchant&v=3&w=400&s=E92KteP7Jo0pPf5bkneGLVzP&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS