castles4kids.co.nz Open in urlscan Pro
184.94.213.152 Public Scan

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:30 GMT
AN-X-Request-Uuid: 7cf7be7f-150b-4d85-9fc4-fb056351a385
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 45.141.152.73; 45.141.152.73; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:30 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEEwRwG_mrOPJ1Rvd7IjMG7c&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 8271
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTcyNzk1NDgyMDczOTQyOTkyNQ%3D%3D

170 B
243 B

22ms
19ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTcyNzk1NDgyMDczOTQyOTkyNQ%3D%3D

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 30 Jun 2023 04:27:30 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 45.141.152.73; 45.141.152.73; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 5276d0d4-a053-4b9e-910f-c485789b494e
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTcyNzk1NDgyMDczOTQyOTkyNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8D82
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHrQURTY2CA6G9zP7Reb6dQ&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHrQURTY2CA6G9zP7Reb6dQ&google_cver=1&C=1

43 B
632 B

10ms
9ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHrQURTY2CA6G9zP7Reb6dQ&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGMm4hOkBMAE&v=APEucNWypKFdETnbMxX6I7KxRPt5EjgA06UT3ovcX-1_WUVwjuH5DBTEnDJT0yT70VYHAoN5_J6suLI39Vr83FFGHOrbPJdRgl9hMvmfzrIplPy62VtF66hGerVcAnnMtmzIRI7vC0udIGjJK91YINFuHkcaec92284Ipi_Ndq_7dMr2O7M75bVIDX05GwFacF3ADBgbWbL-9R5xN2qsGYVtIYKWcGqLlQ
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:30 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:30 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEHrQURTY2CA6G9zP7Reb6dQ&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8D82
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJ5ZsvnQTm5e5ZLOFj-4aQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpyFYFDbSJ-Zw0DBs1fPnM&google_cver=1

43 B
632 B

16ms
15ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpyFYFDbSJ-Zw0DBs1fPnM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGMm4hOkBMAE&v=APEucNWypKFdETnbMxX6I7KxRPt5EjgA06UT3ovcX-1_WUVwjuH5DBTEnDJT0yT70VYHAoN5_J6suLI39Vr83FFGHOrbPJdRgl9hMvmfzrIplPy62VtF66hGerVcAnnMtmzIRI7vC0udIGjJK91YINFuHkcaec92284Ipi_Ndq_7dMr2O7M75bVIDX05GwFacF3ADBgbWbL-9R5xN2qsGYVtIYKWcGqLlQ
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:31 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:30 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpyFYFDbSJ-Zw0DBs1fPnM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 8D82
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMtvubrJt0EXguYkvso0Cu0&google_cver=1

43 B
1 KB

42ms
13ms

Image
image/gif

185.89.210.180
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMtvubrJt0EXguYkvso0Cu0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGMm4hOkBMAE&v=APEucNWypKFdETnbMxX6I7KxRPt5EjgA06UT3ovcX-1_WUVwjuH5DBTEnDJT0yT70VYHAoN5_J6suLI39Vr83FFGHOrbPJdRgl9hMvmfzrIplPy62VtF66hGerVcAnnMtmzIRI7vC0udIGjJK91YINFuHkcaec92284Ipi_Ndq_7dMr2O7M75bVIDX05GwFacF3ADBgbWbL-9R5xN2qsGYVtIYKWcGqLlQ

Protocol

HTTP/1.1

Server

185.89.210.180 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:30 GMT
AN-X-Request-Uuid: 5752e36f-337e-4817-bfc4-ac04c8506a55
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 45.141.152.73; 45.141.152.73; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:30 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMtvubrJt0EXguYkvso0Cu0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8D82
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTcyNzk1NDgyMDczOTQyOTkyNQ%3D%3D

170 B
188 B

20ms
19ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTcyNzk1NDgyMDczOTQyOTkyNQ%3D%3D

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 30 Jun 2023 04:27:30 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 45.141.152.73; 45.141.152.73; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 5f94f144-d993-4c5c-b5f8-a5eca6677a8f
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTcyNzk1NDgyMDczOTQyOTkyNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 976F 0
0 41ms
40ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202306270101&jk=2939560906653285&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H3 200 oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js Show response
pagead2.googlesyndication.com/bg/ Frame EA82 37 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01321206a3324299985a9eb636b3a3739bb19d364bc2a846868cab9de0ceb22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 18:10:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 209805
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14631
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 15:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jun 2024 18:10:45 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 766D 0
20 B 42ms
40ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1948560002690&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:30 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 766D 0
20 B 40ms
39ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1948560002690&version=m202301230201&ct=76&x=1&cor=1750149732679893000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:30 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 766D 111 KB
41 KB 67ms
61ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AY1pUgGipt8Mnm1fdpeaxdz74NfEyRULkqHtpDc-0iOaGhhb2AgoFVKd507ixMzZvY5-qlsEX6y-iuj-omdCxQvtMt98A4_11o7R74hHf1g7OqHpiSZjVJGhdW70GCNyQTKOdHCHPRaXaVwZGityLasOzVjy4Qw6sc43D5Na4IzCoDmOE&dbm_d=AKAmf-D3g5kSsy9YUBs9hlkVnSky-a42ynWWjvY0nE_8VLzXEp8SIQg4bd54P76-2tHwoy2kftR7WmyBBnoKebw-9pfdCQsyTtqYQlpeVrmFOTFhIS5Tnyesgh-n3x0Dx_BoyL57FbnAvT3Vy6r1vUoFU4ZR0hg_PEI6dOW7VWsgIFCNzJeHuypOG8je0zPIIW3PIv_gPFAMuVI2oCKfoKBwjFN8ldxf64P0o6v40JwUYKHAJa0AeF2w5cA_za4ACnEdxDwh4Rc0_nIRgnrGVR3_cywDkLv-r9GUP7r3N1uh7zW6Eo5cxN_GESPdLQkk8d1ZGTI7xmRMekz5i1vhW3rjM-F3y1R8WmNOHBQwnVvuLg0mFUHGyvTEV41Y771bqFjAoaL2NkAd3bZiyEwTOd1gZWbuzkTIQpKDP3bfhts97ejwFxnOlImwnI5YAuCXp7sCDFJOGhLiuo_tcl4fCfmrmnTPAmeG71lRGxEWeUFsCZ4VO2uHRMx4Dz4WlEvHqSRXC9_gRJ3DTFeuM09JPbixvvUlpHJ45oR2gf-qF6_VzHo8L7jSqv7jgV64zzFpreFRN_s10Qj1vzBwypm_u2ueXX3Itd9rC6RNrDYNoly8_BBWQPSFPnyMDkh4kusVlMTGGmPcqgJKBsmoQ6Nx448hGIZ6kcDVpeVWnFerJq0YNSJMX6iWkBMSUJY4hAxxxP-dTzBSMR-iIZIzyi2i7o9CuZ61o5pBU7_sMV3UGJYY6_P4nvRPphFvU_549aPJB-jZlsdgTbWivRivstqsQqXrEhdxtPvEIApP8rXJa2XBL0Df3OV0qdXWP2T4AJe_kuuOUr3lT2OAiw8W9kA9c7hoHswcphDwtP2bz_unZ_uyRbBlLQhuej9mMKlB607dvGuIBml-tRwUm1MOv7sH9z2flYl9WLc_950r5eVpBgmOSGS2JYiui5tHv6HUuPuj3rZVekIEopGNeDQSzbKVeOUJhClBs9qNYtgi3X42aRvqay07cB_GeLz1glfkhrl7s7BDdCLjvwuPsRbLzT6K1ZWv1RcxEH3UD_f7PbOJ9rzox9Uh25ZHXwO4kgmd_2-kET3G0kV2PrZMhleuEI8gG9yYN9iIFXtJmRyDB0t4KCDwUUDSxjzUkt3auWKxOFTYkz3J9OnBw1A5V6FkaMi_pY3nwyhMcoOmnHQOIlwIxCIQlsZsNGzYJSgKK7yUzG6SbndaMJ9JkSRF5RdXIpHATK2K4s6EdCTcLbMpKcRRTDpZZCKPvhDFt8kRnJz4w1p4zsVbXGXIjvG2JeMxAa2gSyh_z1I4PYomg0K3FuwvuKS0iPrOkkWONerzkohOBpfiA-oKtRypcWiP5up33HAa3udMcy_NxJo0rl97a_eKjcyn0opIBHt8j62qlJSs_0EzvzySBfgxlfmpE4UwKbDvxBmQaVKeYziUZAlvOilKDMMSlpo_Mt07NZfD_wosk1ku9rWBxxX70Pwh62WWfP9A0VQk5PIfu3OV1Xy226gGaM7AC3DRHbUQl3Ak4uMRd13AHl2lJcXHceus5MDZiGaEw6Qe4ZUgoh-3B4kxVxRSEKJjvde-TEJwrDmf8nOu9J70BZ5a7Yc6pqhYndJ3I3xZ3Co6m5dZToUs_mA4oYzhVuysEgVQjix8Xl8zcE9e5IIC-coZclA9K1rsJcipyBJ831XJZ6iQW4ErQ-Vt90iYMpZq4z2_RB8Aluey4LgNzfTNhOfb-UOg5yvrqwUY-Rc3kQ4yoJoPEDukiAT9Jg2WyXUcSUtmLa0mlE0zurQiynoB-5dy70U-QQep3L7xuNR-Fb5YAGfbPHBr85uSWWL59lWw6wP4lHvb1SZKkV_8sIu7rfInvswpaIlZ3_H1QlChVToCjdemIIBj1xvWs3tCAChSvtHb7NR38t4WGSUQy8mSmde682hPXx586jotsWlbdlFXTWzjA9-rIpFMvtmoURv9JVn4UwhHlV2V_g0yXbiuP1wl4kuJ8I2Nk2Hk3y_T5pVXHzqv1cRGPDpu66DxeBJUjK2hug5l7bjt2EJmmpb2Iqo7PSR8nI3m0JLeX3zRSZnC6U5vWNEgRfvrUlAV3oitX-YCt8MPi871MROYYbJbSlhLOBDpQqx2Fk15OZkhUfAZkGDteI8C6ON-MgvG23IQSV9OBYgbPk4r2qak1xHZ6ufizmC4QPaS4lP4MO2Mvy2eG89c-qd8j0o3cum6D3yPnOSUvphgO7k6LPu9h4tOqZVQpzUOoKvn39YQNK8TNNtUr2AaRQD7RttpYk527VfzTXStBhJonEUemKs9DPDfMTdTuSgZdh8jiYZGsYQQnOFgQeXH6mc6PUJgJ2F_OPu2CJydPQaLWJFEr51hHCxybydyD-sBJ4BlT0RfE7vKbkkhJemVsp-gODZ69Fm2p3VOJUkEUcUjaHZgL2Lm-_Flq2E3SY8lgUKWSHqtjguXKaC42GVvmq7LAaNOZLA63Uod3K92zTfSk6XVD8XT7ly3xWfiQIyu4RS2WhBRNn96cTHz4OzH-gjINmd_DsMN75tgNJQiOSNk5UoIo5pCnM2CsECq84A0QUtVqV2QTm5_Gy6W6ewY6mjH1_CPVr63JhtODY7shCkdLZW1RqfmgU1ZdfIe8ZWTQIS8Hg459-ZWoXea9jBBa6tL9GeGbZ76JiY1YkraN_yLooiG0BnZS0ucYrZVOlLr3cUgvjatDOyblVvRl_PuPlVAgwUfpty0eUTPharOMotllwCYWPZ6BCbZ4ts0zNycyEaVrS7tQdFwjxaue3rJzM8oytlobLxU3YUmhcQQCOUEwbN0aj7UL8WWK6OJB5ass6NdNUe2RNbByF-hMt1BEoe7iTHXgU_O3yUbFHiTbQMScs5vDV54Fwz3pagdfxWc3f91EOEylHT1l-bbi8fEbzNBvtL2kvJBZYvypoAnu8PolikANFitgSctFqKVauHYbgtc__GgnEk94wqAroF9NJ4mAbgNpskIG_SrhvY9iqvMv26naUygsN_X4CXWANH-hce5xKIYYpzrNiNAE0UrvWnIvMQwiD18pnERxJHeNHfTBMhctcb1_qyFaxAz62tws3a1ef9rAsjaaX4OsspXGdZNHN7f8gGsyIZOhnUDcBpiI76DlXjZIdALj8WAU2v2jVEIydAVg0EoEMtGdHy6KclhAwpxUP2LudBOiVJ4fjvQQ5_KbYKepnL1ItPhUzBE4Kc9ZZFQK069pF60GGEUKkyRMe5zYK8MSt6nvYdJHRk2cUEEX1N5xnHS8kz8og-rimk7mc775E7BHOr7Lerf6LOT95yOt7FqxK0SRmOPrzcjeucenKj8Dsw5-Ob-ivYaq_PxKmV1AoIUjNyueStN-0GqpVG3fpouHa-dBGgpFtGEdFJomRXjPrJZOa9ht9Ysk0Os5eOZ-zbztTqphOBqnWXg3ZMuC4UJESDYCVU7tNmz64QObDaTbGi_aACUkKs2vYZsG6KJHwE22e4ToNs7o-sf4nih0c1SuWR6B0OaOnXaMJqbXx-khdF-WtngucfS8S190nVbEHEefJ1i_Ty1yRgVVmwcxRH8DQDSr42utoGiBjrKX3YygibD3UAnqta12b0I&cid=CAQSSwBygQiDsSW_PTiuQu2NjEXL1Pv0V7IJDqvRhDPwuQPWgGh0iZuDGb0_fuQt_4bQzNHLqRsyhqUpx1Org7alRYFmBqaTVyhTt0_YeBgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kids.co.nz%2F&ds=l&xdt=1&iif=1&cor=1750149732679893000&adk=2124396030&idt=89&cac=0&dtd=24

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a20625162986878511eacde3397910c13bc9b372abf79215c79d160d5d7fbeb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:30 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41482
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 760E 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306270101/pubads_impl.js?cb=31075743

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://castles4kids.co.nz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 30 Jun 2023 04:27:29 GMT
expires: Sat, 29 Jun 2024 04:27:29 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
481 B 14ms
13ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?r=castles4kids.co.nz_auto_728x90_sticky_display_bottom&pn=2&sn=3&pc=0.2642098665237427&ds=true&e=wdp&dsReferer=Y2FzdGxlczRraWRzLmNvLm56L2Nhc3RsZXMvbWVnYXNsaWRl
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.0.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nf-request-id: 01H29B4H85WTWRATZQF3W23HPJ
date: Fri, 30 Jun 2023 04:27:30 GMT
cf-cache-status: HIT
age: 1775634
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "184c2b34ff0390c3de60fb1a3213ee4f-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 7df3a83b7f60bbd1-FRA

GET
DATA 200
OK truncated
/ 182 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 476d8d8a5ee6c842a16e5ae6a58cec35ff7649729b77de0319644cdc128340eb

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 834 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0ea842ad92b2cb342a00d74293e6036981ec07854e082223080525efa9c88528

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/svg+xml

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
480 B 15ms
15ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?gl=0.01&b=3&r=castles4kids.co.nz_auto_728x90_sticky_display_bottom&sy=d90817ff-51cf-4658-8cfb-46448b4b03ed&ts=82&cd=2&mlbr=ch&mlos=wi&mlla=en&mlco=us&mldo=castles4kids.co.nz&mlre=undefined&mlin=0&mlsi=728x90&mlbw=4g&mlcs=NaN&mltp=4a76684e-a6bf-4ff2-a067-1836b1c0bdfe&e=lm&dsReferer=Y2FzdGxlczRraWRzLmNvLm56L2Nhc3RsZXMvbWVnYXNsaWRl
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.0.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nf-request-id: 01H29B4H85WTWRATZQF3W23HPJ
date: Fri, 30 Jun 2023 04:27:30 GMT
cf-cache-status: HIT
age: 1775634
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "184c2b34ff0390c3de60fb1a3213ee4f-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 7df3a83b8f6abbd1-FRA

GET
H3 200 container.html Show response
a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7524 6 KB
3 KB 8ms
8ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306270101/pubads_impl.js?cb=31075743

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://castles4kids.co.nz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 30 Jun 2023 04:27:29 GMT
expires: Sat, 29 Jun 2024 04:27:29 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
479 B 15ms
14ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?r=castles4kids.co.nz_fluid_sq_mohamed1&pn=2&sn=3&pc=0.6745415687561036&ds=true&e=wdp&dsReferer=Y2FzdGxlczRraWRzLmNvLm56L2Nhc3RsZXMvbWVnYXNsaWRl
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.0.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nf-request-id: 01H29B4H85WTWRATZQF3W23HPJ
date: Fri, 30 Jun 2023 04:27:30 GMT
cf-cache-status: HIT
age: 1775634
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "184c2b34ff0390c3de60fb1a3213ee4f-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 7df3a83bcf9fbbd1-FRA

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
478 B 24ms
21ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?gl=0.01&b=3&r=castles4kids.co.nz_fluid_sq_mohamed1&sy=d90817ff-51cf-4658-8cfb-46448b4b03ed&ts=82&cd=2&mlbr=ch&mlos=wi&mlla=en&mlco=us&mldo=castles4kids.co.nz&mlre=undefined&mlin=0&mlsi=800x280&mlbw=4g&mlcs=NaN&mltp=4a76684e-a6bf-4ff2-a067-1836b1c0bdfe&e=lm&dsReferer=Y2FzdGxlczRraWRzLmNvLm56L2Nhc3RsZXMvbWVnYXNsaWRl
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.0.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nf-request-id: 01H29B4H85WTWRATZQF3W23HPJ
date: Fri, 30 Jun 2023 04:27:30 GMT
cf-cache-status: HIT
age: 1775634
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "184c2b34ff0390c3de60fb1a3213ee4f-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 7df3a83bdfadbbd1-FRA

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
481 B 23ms
20ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?r=castles4kids.co.nz_auto_interstitial_desktop&e=nai&dsReferer=Y2FzdGxlczRraWRzLmNvLm56L2Nhc3RsZXMvbWVnYXNsaWRl
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.0.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nf-request-id: 01H29B4H85WTWRATZQF3W23HPJ
date: Fri, 30 Jun 2023 04:27:30 GMT
cf-cache-status: HIT
age: 1775634
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "184c2b34ff0390c3de60fb1a3213ee4f-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 7df3a83bdfb2bbd1-FRA

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
16ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=castles4kids.co.nz

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306270101/pubads_impl.js?cb=31075743

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
735 B 405ms
404ms Fetch
text/plain 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2939560906653285&correlator=2117877750564298&eid=31074949%2C31075743%2C31075761%2C31075341%2C31074824&output=ldjh&gdfp_req=1&vrg=202306270101&ptt=17&impl=fif&iu_parts=44890869%3A22866007907%2Cca-pub-3831894559014614-tag%2C3b3ce0d3-eb13-4fc0-99e6-9dceb14af693&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ifi=14&adks=2872034471&didk=2804190544&sfv=1-0-40&ists=1&fas=8&prev_scp=ti%3D4a76684e-a6bf-4ff2-a067-1836b1c0bdfe%26chrand%3Dy%26pof%3D0%26interstitials-bid%3D0.2%26bid-p%3Dgoogle%26bsc%3D82&eri=1&sc=1&cookie=ID%3D4445f85f706ac57a%3AT%3D1688099249%3ART%3D1688099249%3AS%3DALNI_MYM0fa8dr7wxOWOgfr5NZZvPSlp9g&gpic=UID%3D00000c356aeb728d%3AT%3D1688099249%3ART%3D1688099249%3AS%3DALNI_MaUAAv-bUMQXPkFIlnyC6ZgeIOmHg&abxe=1&dt=1688099250542&lmt=1688099250&dlt=1688099248789&idt=709&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=e&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fcastles4kids.co.nz%2Fcastles%2Fmegaslide&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=2137561847.1688099250&ga_sid=1688099250&ga_hid=262064384&ga_fc=false&a3p=EhwKDWNyd2RjbnRybC5uZXQYjbu51JAxSABSAghkEhkKCnB1YmNpZC5vcmcYob251JAxSABSAghqEh0KDmVzcC5jcml0ZW8uY29tGI27udSQMUgAUgIIZBLWAQoIcnRiaG91c2USwAEvSktva04rMXQyWGVITkpTRmtGTHBmS1YwTmxJTncxeVBHZHRIblRZZHdpa0pHcXZLL3NRRythQnF0cWZaTWJIVmVRbGpVbE5iaUk4NnhmeHZESUZpL1A3d1Y3NTltSDF3VDMrL0xVdml3cXRYVFEzbGdRb0JrRU1Mdy82T1ViZ294RXFVNm93a0VPODRiMWpTbnZWb1JGQW1XbndpTVBObWRrdmtMZXNsTFFldzFUTTNnZmVoQ2d5TGlBYzltSUIYiL651JAxSAASGQoKdWlkYXBpLmNvbRiNu7nUkDFIAFICCGQSGwoMaWQ1LXN5bmMuY29tGM69udSQMUgAUgIIag..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306270101/pubads_impl.js?cb=31075743

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b5a07e9b017a45010e235dabb359d0731afe3727acf71961a041120fe65180d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:30 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: true
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 703
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://castles4kids.co.nz
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DAA9 0
20 B 44ms
43ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9625275930705&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:30 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DAA9 0
20 B 43ms
43ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9625275930705&version=m202301230201&ct=76&x=1&cor=16532715870226266000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:30 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame DAA9 111 KB
40 KB 63ms
62ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CaFdMAEX4F5gZ8AaUsw25GT8ZCzCREMwE-t_ZTdSh6WrzsSGw0Fp_H0EzdrzrFhKaa8FjPIKGgFENrLIxH3wgk0TsipfD90NCcq42yCYDlpWgnSb-ciAo_sY4W1HuAMINLVNpPpz69tmPXg9GguQ30Y3gb5jy-iyQMIqrxP0lUdsWAeJs&dbm_d=AKAmf-CxXxaLePgrTobCEEpF4EIWqEljj3G2nvAGIg6p_YxXRy0qvx6uuEcIhfeVBR8y8AbEhkXK_FwsGLobW3t5d4Jgqohlods8OHXpYcxhx0ORNikOeahypex-HcEfVWHY8VSYVBMtkNER5KKTIF5Z3zZwDH38VlNvT_UffHEgMB_iPRtavvPCOQBS0Wk7AKTAz86fuc3I6QWSrLgEKY09smbigmrXDltllSAI-voEvUJq5NKPzRd4D5izYSsAEhJjKHRoU63o4ST4ATQ5I-L4uZw2Da04Vpi9_2bZ4o2UXR6jyFmSPVSLb8D4-ktfR5nGNk5JDHLA9SXrq2o1r6IQUxFc3vzu_ChodaCGVescdQFQ6IEjB-qjsF_5Uw6BIXi5NAf6EZm9xeeSmvPAz4vgZUCk3Zfjxl0ElxbKbHrw61GGBRg-z-PbOcwRQA0beoKLbh71LiTJwUe6fx_bbEGtuEjwPtwLFlz_l0RUZmMtMl2Kxz9oFtFsntcNPYUFoTm-mvWGf3zmjxsBOSisE26f6ZZw6teAbNbgLpY2IrlKh6OGqagdR1GVyiJZSVNXkU-PlWYDXB72TE3lr_KjqqoCiFSi4q5HJbi0CF9TsL_cxAaJ-odo9lkr02eP4aLL-aw-LvdS0qs3dGUP1_qIptMuzaPuxEa3O3ORb10iQxbeAddowuzpzplH_HWyVXZbPIfUuQuDrsaL3pGPdVqOVcaB6zuE9uNtD5-d8MMoSrmsmhdWe8hsbpkSbSz_fOuk4QjsheJNlMr-fuHtmEGIkZ-wVHY_jGO7h_XY99zJp_hEhaxC7B_GfB_5iQzBExulNPD4kLMNRsWIDA31luip57nL2ERvU1WR2Q4nnCKBm8yseEvH39yxw0SX152Q0tYTR80pRqisj9-VlpvbvU2G7iaoI13dNsCMvW4-ljZOkDBHTPLScBAmXfN84Wz2RZg9VXG8Be3-Sl9MQYBzSxeMhrCk-b6SCt6eNymdttPMTicvzXAAT1OAR6DFTWVmEe84Ys30MVTmSKDTWFjE4V81GtM_iC2CT_5FgMvAk7pCm0Qxir46Z_iuM0CCbJkffjDLyuFRjb3dUC9_dW10c505Z7C-cvDhFvSvUj4Zr4ExRFy5DypHqzVTp_2JyObJBQ-hihCjTg5pRAZJEsMl82zFwt2SfolEWdU-vPt3EEJKrc7XvhBw3l0wauCTHi_Vulv01xX4eWPi3udxjunLiWjoUHQQHnLzoTb-Wn4AYbZ1EzNLe1WWZtJRDznsmlxFzSMzSiXEHTa7d4XkdYI76GQPy8lcdWspoj4MV2Wc8pMuZu4FSw-BfnyFHfO_WRSn4zKMsL0uXoo6paROC7tFw8iv2DxF1kZ5j15wJkCaSpfuU6kMjKXkrK3tCWYWIRYT0rUd1QibDpKtlU9M4l9HOIxoiIqErMzWWYRQYBKW6iUaj07VQkloee3XGPtSrNAYYU6Pz82dw-v2DJdvemSlG32A6snF8BUXmtxh_MGZlDohjf62Lb4ZmRk6BKKJ-LDV5CpXbIMWAD2c0HpEAQuBvaAkS09gnv6eXWzGlRfyWu8aFhMKQoKE7fGl7OdhpRgyzduUX2Njf__lsxEZ3WIVRiMDYFpp2AM2mE02xa2sUhv4a6AwQgEul3wuI7RMtviYHu0E1t27Dor9NA7MYMCnZX0RfacJDz-UUtYtiHhAKUmsg-6oDqJO6EfXg-JKvnoRuGCaa37cIr4V41b0owZGoo0mTdjIno1JPyECn7u57J5-FzvBG1cdvZRh_kAd0IXYiedc2Zy4Kl73KHrfzD6r2q2BOaV64Cg3yzLRxZd7RSGhsOX3BJ3qfms_S8YqQXh3ZXrVBggDhGa0CpG8OPpr2QvxKhs_94bRrZQpbTFjvBJ1p6dleNsIdJ6sS4OgoGOoCI_cJRTCgYWfuJysCHuD_rPJKLOyPGJCxPdptrXfHNYg9ZaiSy1un-OlQm03nWDsc64rNJdsXPWNrCSgdQjD3MRSvJYhm6WNc-TWRQKOuuRhnKxrwdtMW28X83QfIScNU939EI_NG6mTsrM56vzIPhu3qHE_CWoJrQyk_obz46BvelmXKkxgtYjlbkHJcJS3zneDGMh1wWi40KRrG14EQ4XPE6dxVcPJVfiWVTwOArpT_LkkMBNOZ1NZG1-IS2mVfW9w_Qtyv3zGVhLAFKXljx8593qgRBuPA6373h3BwVyX9FelJ0nKWJ0bMvpUfTm0UnTss-hm0pSWFs_Jpjb9S0B__OXq0zpagWeui24MMXV5Sy1qsf4BPQ3IiUEmbdOP2W0R_OvRB3xykW9urxtCQvkX7lnmfQ8Vvv_u4tOeTV33uIZwocJZqIaM50jaZDsVKyB54uNCGitlJnlgCLdsOVk09e0FFe6jZcH_-xNd57RgMPUmmj01tSoSFJMnlrYEKxnfUhSLhjWxUaiwD1t_3DVSsfNRHizFV7tkZwQSYY1GF5XFLgOdLZsj1olbwVO42o94vQgc4TFbBceRyGV9CEX0OXISQm13VVoQN5yMoxCre3Vf6mITE37Tx3tm8POW5kM4ZXxeUhTGTpMgPPW1gzcdh097Sn4VVMFmvrwaHFVO1b109JBbTcfDrJg0jpVvWw0WezsO1FpHGgkAE6hwzP1onCGEOu4RFu2sIrzMAASyF7nARK0IjetARqHQIrjilzMQF-QLx0qPD56wlvFUQdWjbZz94jSucJI94qvyBfIzhPPdc38h4KD2uHSEmW48aZdgg9Yht8Ogpof1HvEsvDdrI8GMXyWkcNh5eXfWDVRCxIbC4-r0S3kyQPEXqOIpo_fQ2auDKNHDRRokux-vRHnf67IdRBMD7EM4q2KRjE4vXiAC7-fQrcPfjccjSHsD4VPsYdDtshzvHpsummbQU-gXTIoVzWB6WgEvy2LX9Ej1lR4MUqP6DRk0I4M4NQ1o92c-ZJVIlsyuIJD5DziOxhX8cDTHiGvsipphjg0fBf2GslZZEw9_odgBI9wE-MgXcBaMr9KKukEC1OZ0WEkVBRZq83RQcFTOaVkwWTMj_wX7aiS7hh0Z0oRjKWUVuvt25sWyt0Q6Bx7o6eXwcrALQ7S2dp7KnNpWYsyTQkGAqVdCjH7hJcEj6ZdBjeqb83qjHJl7plbO3DNZrm4WAyQSE-6pN7wIuIcb9o-0oSgeDzKdQWXnpyHU0Z7Gk65fFpUYzDTRj-krQ5CkzQO6AmbdQ-ay_A-MKjs_Eb9isylw4_Pimr9SOftZrXXOlLVp8etq2ju_AfFD87vunBP5ApuYTaUlnfJAd4FqadfzjdFb4jEXNI8fGQx0rLXpKhcM6T3CxpexLduGQnL3XUH-33DTyVItkvEDwLTWZd3tikSMMKb-D9K4otVSiy9pBWMwJMLfhUcj9DBSu1LKpAoBIhayHfxw-8mA11fT7i6FaZCXD__xptjjowM-LIiSOTf4Lgs2TyopOS0KKa-lPqO7Ul-ZOmwv1jdGyW-Qz87zEQVfgQ2AH6TbxA0C8J5NftozkI8PT1u4ZiqTwEURP4evDCuKuCLXvVp6VIMDpaaMwE1NYRP2jlZCc8ia-Q0KQY7b4DYepE2SIq2Uku_JTiNF-cnA0AFEp1c5SgEujWTCKEIxbLMozqLAY3rrQpZnFCE&cid=CAQSSwBygQiD0K_IMm1A_9PTc4fic4ZnUSbvUaycpB2dTEU4ScRuL5bWR43M7PVSIWXhOsm-OI1bRk9f3dY_tMi87vgOBqkab8nGW8h7XRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kids.co.nz%2F&ds=l&xdt=1&iif=1&cor=16532715870226266000&adk=497053795&idt=149&cac=0&dtd=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

43f3311161c126ab9fb5c2f7bbfeb27a2c21f1fb7f05ef305360d86533cb2de0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:30 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41432
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 760E 0
0 52ms
52ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CtWL_slmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoErgJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEF3bFMkZSYe6PQ-drvZjYrWCYmP9YrEgo9bSzRL3LKWLr8a-OOy8-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOoAKA_oLAggBgAwB0BUBgBcBshccChoSFHB1Yi0zODMxODk0NTU5MDE0NjE0GP35Ew&sigh=wMMsS2NDm-k&uach_m=[UACH]&cid=CAQSOwBygQiDLMXmdiVSmtgJfeqdXESsxYhxeqJlIlgen4dyZGV1BkF9b_D4d3lWNNu3C7UOI44JTPxUKcyxGAE
Requested by: Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H2 204 winResponse
prod-rtb.ad4mat.net/ Frame 760E 0
0 55ms
18ms Fetch
image/gif 2600:1901:0:76b9::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-rtb.ad4mat.net/winResponse?a=1gz56h9b77r3jbevc7fmd010sr1m0cc0kb6s3qtrfne1qch8vb7qvrfs0mb74mcjw7shh1xjkc6670qmwtjhxsns6x6sdxk978z2tm6bcf809h3acgx4z0vsfyvthfn0hwxy5nz2t2g04x58m89f18edr9n19y8ddzyd1e3v1xjbj5y00tpt307zh83ad0gxs2aj9yx60qw8ef9mq9p2vxnspgv6pxjfz1b7xg9ek4jxczff8mr72mwhxk825v4v5thddsfn7j3z6n4qaks2j08tqz1sdsa7ybm0samywztgas83e5yg5ch093mg5qksgwhx9eeadn92rbvn7xqzxnaccjhhrhv23vb5yzkdqezaqffp3x4mpaf9en6pa5aa0sr8ncqgazqknxf4&b=ZJ5ZsgADBFAHg4BAAACJw8o87NLrYPpW8IC92g
Requested by: Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:76b9:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 30 Jun 2023 04:27:30 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: image/gif

GET
H2 200 dr Show response
as.ad4m.at/ad/ Frame 4B30 2 KB
3 KB 81ms
34ms Document
text/html 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/dr?ed=1h4c8xvz4ka600821pjs6yvvjxw2h29kkqfarqcaavkmknydjx2x0dsjhp6j8nsmggmdjh58v1fft2zcqy7vz46s6kh3trtzr7znarp6kcbsbvp036q45r6ycyhsgrar7742csp11ryx72hagz91zaf6hfmmdzgt59g1h1wpy670z0sjcs94a887t932rpvry8epkc9qzcta9zq7stztfr79e72cnwakcpgnn980gw114ktr1exxr4dtmy24tzhtny7nd1my79a3mfd3cwnjd27k2q3v8yg8dny1kp2jzz2w6qc7hvv6vxbz8dpcak9kj7cwe0rxhtxxzzabt2m1pcehc5svn07w6fyeqsptd94cxn6r2w6hmwd2z49v62wd196j8z38krh6awpvm5zhgzftk3f9t9w611by2a1b759870q56ybkg860tg0gzk4em49ybfthjm&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%26client%3Dca-pub-3831894559014614%26adurl%3D

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c48c5d1110dddef15c6dabf61ab906012ffcec57ba3cef4a193682180a8f7ceb

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-src ;img-src data:;manifest-src 'none';media-src 'none';object-src 'none';worker-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7df3a83c58ba9048-FRA
content-encoding: br
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-src *;img-src * data:;manifest-src 'none';media-src 'none';object-src 'none';worker-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Fri, 30 Jun 2023 04:27:30 GMT
expires: 0
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
pragma: no-cache
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
server: cloudflare
strict-transport-security: max-age=86400; includeSubDomains; preload
surrogate-control: no-store
vary: accept-encoding
via: 1.1 google
x-content-type-options: nosniff
x-download-options: noopen
x-xss-protection: 1; mode=block

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/ Frame 760E 3 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/window_focus_fy2021.js

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:50:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38231
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:50:19 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9E3F 1 KB
643 B 9ms
7ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 48188
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 29 Jun 2023 15:04:22 GMT
etag: 48472445140208031
expires: Fri, 30 Jun 2023 15:04:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/ Frame 760E 20 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

abaf64de0855592138133fdf15c746a6e47a07d5f7a34a9513a06994c89f91af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:50:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38231
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8312
x-xss-protection: 0
server: cafe
etag: 5477749917372345267
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:50:19 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 760E 0
0 19ms
15ms Image
text/html 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ7eTRl4W3J9HxKI9KfoF7ZHXOUwztv3NfxdyVmYoRj4EtX2fa6n4U2g-c0Uj14qlPg_ewegG1MGM-8lnApf7hqqo1ezA
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 760E 24 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 24 Jun 2023 19:05:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 465721
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 23 Jun 2024 19:05:29 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 760E 179 KB
56 KB 28ms
26ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6914d47718a28ab8055edac273b3aff57e64e5bddccc616c2b7e355fe986f39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57260
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687952195399670"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 30 Jun 2023 04:27:30 GMT

GET
H3 200 container.html Show response
a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7A93 6 KB
3 KB 11ms
8ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306270101/pubads_impl.js?cb=31075743

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://castles4kids.co.nz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 30 Jun 2023 04:27:29 GMT
expires: Sat, 29 Jun 2024 04:27:29 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
480 B 17ms
16ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?r=castles4kids.co.nz_fluid_sq_squareeeemoahmed&pn=2&sn=3&pc=0.35008101463317876&ds=true&e=wdp&dsReferer=Y2FzdGxlczRraWRzLmNvLm56L2Nhc3RsZXMvbWVnYXNsaWRl
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.0.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nf-request-id: 01H29B4H85WTWRATZQF3W23HPJ
date: Fri, 30 Jun 2023 04:27:30 GMT
cf-cache-status: HIT
age: 1775634
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "184c2b34ff0390c3de60fb1a3213ee4f-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 7df3a83c7838bbd1-FRA

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
483 B 79ms
79ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?gl=0.01&b=3&r=castles4kids.co.nz_fluid_sq_squareeeemoahmed&sy=d90817ff-51cf-4658-8cfb-46448b4b03ed&ts=82&cd=2&mlbr=ch&mlos=wi&mlla=en&mlco=us&mldo=castles4kids.co.nz&mlre=undefined&mlin=0&mlsi=800x280&mlbw=4g&mlcs=NaN&mltp=4a76684e-a6bf-4ff2-a067-1836b1c0bdfe&e=lm&dsReferer=Y2FzdGxlczRraWRzLmNvLm56L2Nhc3RsZXMvbWVnYXNsaWRl
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.0.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nf-request-id: 01H29B4H85WTWRATZQF3W23HPJ
date: Fri, 30 Jun 2023 04:27:30 GMT
cf-cache-status: HIT
age: 1775634
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "184c2b34ff0390c3de60fb1a3213ee4f-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 7df3a83c7839bbd1-FRA

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 25B7 624 B
245 B 50ms
49ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COXQcRCu_4SOAhiC0YScATAB&v=APEucNV5lqQM7E7Bliv7MgwRY3_91HZTjYl_0Gn6lBCpP3wDIairFwxkiWzcJyPtWALfb1du7nU-3SXU6BghKrgXGMw0g_Hd-NhPBQMOhKceHMCYPb9E7XyBfZHNISjjr9xjsvLE8MmkLd8diBNo0Jqx2gPRFbl6i_XnjA3lhUhorIn3rUBQf8o7lukA7CuW1_aOef20its7bLGjSfd_jhBK8tbBiZqSgA

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 30 Jun 2023 04:27:30 GMT
expires: Fri, 30 Jun 2023 04:27:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 2DD4 78 KB
27 KB 120ms
119ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:30 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 30 Jun 2023 04:27:30 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame 2DD4 2 KB
1 KB 120ms
18ms Script
application/javascript 2a02:26f0:480:9::210:ee04
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=14526021&cmp=145089&plc=vtnwou&sid=45f3d18e47f96c&DVP_PROG_REP=1&prr=1&DVP_DV_TT=1&DVP_DV_CT=1&DVP_PP_ID=3&DVP_PP_IMP_ID=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&DVP_DBM_1=1861733&DVP_DBM_2=26833064&DVP_DBM_3=16267991022&DVP_DBM_4=327231618&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=1944214853903&turl=https://castles4kids.co.nz/castles/megaslide&DVP_PP_BUNDLE_ID=&dvregion=2&unit=728x90
Requested by: Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:9::210:ee04 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: e189eb8fb761166a6d657a8dbea2c5d73e224e565716f36406ec7f7b68cd78c7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 30 Jun 2023 04:27:30 GMT
Content-Encoding: gzip
Last-Modified: Tue, 10 Jan 2023 11:02:09 GMT
Server: UploadServer
ETag: "87b6182d03ee779aa68e37632f67656e"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 913
Expires: Thu, 01 Jun 2023 12:16:12 GMT

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 2DD4 8 KB
4 KB 119ms
17ms Script
application/javascript 2a02:26f0:480:9::210:ee04
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&advid=3398311&adsrv=0&btreg=&btadsrv=&tagtype=&dvtagver=6.1.src&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_DV_CT=1&DVP_PP_ID=3&DVPX_PP_IMP_ID=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&DVP_DBM_1=1861733&DVP_DBM_2=26833064&DVP_DBM_3=16267991022&DVP_DBM_4=327231618&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=1944214853903&turl=https://castles4kids.co.nz/castles/megaslide&DVP_PP_BUNDLE_ID=
Requested by: Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:9::210:ee04 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 104fe1d096865fb450f1d921b99ea70d85d935d9c8a2e88e980de371e03ea9e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 30 Jun 2023 04:27:30 GMT
Content-Encoding: gzip
Last-Modified: Wed, 28 Jun 2023 12:21:21 GMT
Server: UploadServer
ETag: "4c41482e45017a01683eea2db59c11aa"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3373
Expires: Wed, 28 Jun 2023 12:36:53 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/ Frame 2DD4 3 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/window_focus_fy2021.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:50:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38231
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:50:19 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/ Frame 2DD4 20 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

abaf64de0855592138133fdf15c746a6e47a07d5f7a34a9513a06994c89f91af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:50:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38231
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8312
x-xss-protection: 0
server: cafe
etag: 5477749917372345267
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:50:19 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 2DD4 0
0 15ms
15ms Image
text/html 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ3pBRkWek16bcsIzuwI4YgHFuRahtb2nPaiTrIDZi7WV9IdmqEu_3F7L1XERbS57EuiucJZtwlzUBLrPG-Tw1rKA2aag
Requested by: Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2DD4 179 KB
56 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6914d47718a28ab8055edac273b3aff57e64e5bddccc616c2b7e355fe986f39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57260
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687952195399670"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 30 Jun 2023 04:27:30 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2DD4 42 B
63 B 41ms
40ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Ae8B6pgtlbZ0mQB5vcX7-FjSNwsdAZdu_tNo5-dA4AJiBf7U6wDGiOeOTqZAFG5Sn3CEH9sdeNbH2tE4_mz0PBia3OERF_nWBW1gbOFkkXGuUSEuA

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:30 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2DD4 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=9695775464173662406&x=1&ct=77

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:30 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1468596/71180196/ Frame 766D 244 KB
73 KB 155ms
33ms Script
application/javascript 52.209.191.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1468596/71180196/skeleton.js?ias_dspID=3&ias_campId=1011988055&ias_pubId=pub-3831894559014614&ias_chanId=1&ias_placementId=20070744135&bidurl=https://castles4kids.co.nz/castles/megaslide&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0hMBMoPi0JZSGDZ4Z4OEXCM
Requested by: Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.191.174 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-191-174.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 976f329fa4e7ac8e9550fd65e0e74e20df2052e05d49e4b144e5dbf6fe35073e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:30 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 766D 172 KB
61 KB 50ms
12ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Origin: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 13:52:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52495
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 13:52:35 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/ Frame 766D 11 KB
4 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AY1pUgGipt8Mnm1fdpeaxdz74NfEyRULkqHtpDc-0iOaGhhb2AgoFVKd507ixMzZvY5-qlsEX6y-iuj-omdCxQvtMt98A4_11o7R74hHf1g7OqHpiSZjVJGhdW70GCNyQTKOdHCHPRaXaVwZGityLasOzVjy4Qw6sc43D5Na4IzCoDmOE&dbm_d=AKAmf-D3g5kSsy9YUBs9hlkVnSky-a42ynWWjvY0nE_8VLzXEp8SIQg4bd54P76-2tHwoy2kftR7WmyBBnoKebw-9pfdCQsyTtqYQlpeVrmFOTFhIS5Tnyesgh-n3x0Dx_BoyL57FbnAvT3Vy6r1vUoFU4ZR0hg_PEI6dOW7VWsgIFCNzJeHuypOG8je0zPIIW3PIv_gPFAMuVI2oCKfoKBwjFN8ldxf64P0o6v40JwUYKHAJa0AeF2w5cA_za4ACnEdxDwh4Rc0_nIRgnrGVR3_cywDkLv-r9GUP7r3N1uh7zW6Eo5cxN_GESPdLQkk8d1ZGTI7xmRMekz5i1vhW3rjM-F3y1R8WmNOHBQwnVvuLg0mFUHGyvTEV41Y771bqFjAoaL2NkAd3bZiyEwTOd1gZWbuzkTIQpKDP3bfhts97ejwFxnOlImwnI5YAuCXp7sCDFJOGhLiuo_tcl4fCfmrmnTPAmeG71lRGxEWeUFsCZ4VO2uHRMx4Dz4WlEvHqSRXC9_gRJ3DTFeuM09JPbixvvUlpHJ45oR2gf-qF6_VzHo8L7jSqv7jgV64zzFpreFRN_s10Qj1vzBwypm_u2ueXX3Itd9rC6RNrDYNoly8_BBWQPSFPnyMDkh4kusVlMTGGmPcqgJKBsmoQ6Nx448hGIZ6kcDVpeVWnFerJq0YNSJMX6iWkBMSUJY4hAxxxP-dTzBSMR-iIZIzyi2i7o9CuZ61o5pBU7_sMV3UGJYY6_P4nvRPphFvU_549aPJB-jZlsdgTbWivRivstqsQqXrEhdxtPvEIApP8rXJa2XBL0Df3OV0qdXWP2T4AJe_kuuOUr3lT2OAiw8W9kA9c7hoHswcphDwtP2bz_unZ_uyRbBlLQhuej9mMKlB607dvGuIBml-tRwUm1MOv7sH9z2flYl9WLc_950r5eVpBgmOSGS2JYiui5tHv6HUuPuj3rZVekIEopGNeDQSzbKVeOUJhClBs9qNYtgi3X42aRvqay07cB_GeLz1glfkhrl7s7BDdCLjvwuPsRbLzT6K1ZWv1RcxEH3UD_f7PbOJ9rzox9Uh25ZHXwO4kgmd_2-kET3G0kV2PrZMhleuEI8gG9yYN9iIFXtJmRyDB0t4KCDwUUDSxjzUkt3auWKxOFTYkz3J9OnBw1A5V6FkaMi_pY3nwyhMcoOmnHQOIlwIxCIQlsZsNGzYJSgKK7yUzG6SbndaMJ9JkSRF5RdXIpHATK2K4s6EdCTcLbMpKcRRTDpZZCKPvhDFt8kRnJz4w1p4zsVbXGXIjvG2JeMxAa2gSyh_z1I4PYomg0K3FuwvuKS0iPrOkkWONerzkohOBpfiA-oKtRypcWiP5up33HAa3udMcy_NxJo0rl97a_eKjcyn0opIBHt8j62qlJSs_0EzvzySBfgxlfmpE4UwKbDvxBmQaVKeYziUZAlvOilKDMMSlpo_Mt07NZfD_wosk1ku9rWBxxX70Pwh62WWfP9A0VQk5PIfu3OV1Xy226gGaM7AC3DRHbUQl3Ak4uMRd13AHl2lJcXHceus5MDZiGaEw6Qe4ZUgoh-3B4kxVxRSEKJjvde-TEJwrDmf8nOu9J70BZ5a7Yc6pqhYndJ3I3xZ3Co6m5dZToUs_mA4oYzhVuysEgVQjix8Xl8zcE9e5IIC-coZclA9K1rsJcipyBJ831XJZ6iQW4ErQ-Vt90iYMpZq4z2_RB8Aluey4LgNzfTNhOfb-UOg5yvrqwUY-Rc3kQ4yoJoPEDukiAT9Jg2WyXUcSUtmLa0mlE0zurQiynoB-5dy70U-QQep3L7xuNR-Fb5YAGfbPHBr85uSWWL59lWw6wP4lHvb1SZKkV_8sIu7rfInvswpaIlZ3_H1QlChVToCjdemIIBj1xvWs3tCAChSvtHb7NR38t4WGSUQy8mSmde682hPXx586jotsWlbdlFXTWzjA9-rIpFMvtmoURv9JVn4UwhHlV2V_g0yXbiuP1wl4kuJ8I2Nk2Hk3y_T5pVXHzqv1cRGPDpu66DxeBJUjK2hug5l7bjt2EJmmpb2Iqo7PSR8nI3m0JLeX3zRSZnC6U5vWNEgRfvrUlAV3oitX-YCt8MPi871MROYYbJbSlhLOBDpQqx2Fk15OZkhUfAZkGDteI8C6ON-MgvG23IQSV9OBYgbPk4r2qak1xHZ6ufizmC4QPaS4lP4MO2Mvy2eG89c-qd8j0o3cum6D3yPnOSUvphgO7k6LPu9h4tOqZVQpzUOoKvn39YQNK8TNNtUr2AaRQD7RttpYk527VfzTXStBhJonEUemKs9DPDfMTdTuSgZdh8jiYZGsYQQnOFgQeXH6mc6PUJgJ2F_OPu2CJydPQaLWJFEr51hHCxybydyD-sBJ4BlT0RfE7vKbkkhJemVsp-gODZ69Fm2p3VOJUkEUcUjaHZgL2Lm-_Flq2E3SY8lgUKWSHqtjguXKaC42GVvmq7LAaNOZLA63Uod3K92zTfSk6XVD8XT7ly3xWfiQIyu4RS2WhBRNn96cTHz4OzH-gjINmd_DsMN75tgNJQiOSNk5UoIo5pCnM2CsECq84A0QUtVqV2QTm5_Gy6W6ewY6mjH1_CPVr63JhtODY7shCkdLZW1RqfmgU1ZdfIe8ZWTQIS8Hg459-ZWoXea9jBBa6tL9GeGbZ76JiY1YkraN_yLooiG0BnZS0ucYrZVOlLr3cUgvjatDOyblVvRl_PuPlVAgwUfpty0eUTPharOMotllwCYWPZ6BCbZ4ts0zNycyEaVrS7tQdFwjxaue3rJzM8oytlobLxU3YUmhcQQCOUEwbN0aj7UL8WWK6OJB5ass6NdNUe2RNbByF-hMt1BEoe7iTHXgU_O3yUbFHiTbQMScs5vDV54Fwz3pagdfxWc3f91EOEylHT1l-bbi8fEbzNBvtL2kvJBZYvypoAnu8PolikANFitgSctFqKVauHYbgtc__GgnEk94wqAroF9NJ4mAbgNpskIG_SrhvY9iqvMv26naUygsN_X4CXWANH-hce5xKIYYpzrNiNAE0UrvWnIvMQwiD18pnERxJHeNHfTBMhctcb1_qyFaxAz62tws3a1ef9rAsjaaX4OsspXGdZNHN7f8gGsyIZOhnUDcBpiI76DlXjZIdALj8WAU2v2jVEIydAVg0EoEMtGdHy6KclhAwpxUP2LudBOiVJ4fjvQQ5_KbYKepnL1ItPhUzBE4Kc9ZZFQK069pF60GGEUKkyRMe5zYK8MSt6nvYdJHRk2cUEEX1N5xnHS8kz8og-rimk7mc775E7BHOr7Lerf6LOT95yOt7FqxK0SRmOPrzcjeucenKj8Dsw5-Ob-ivYaq_PxKmV1AoIUjNyueStN-0GqpVG3fpouHa-dBGgpFtGEdFJomRXjPrJZOa9ht9Ysk0Os5eOZ-zbztTqphOBqnWXg3ZMuC4UJESDYCVU7tNmz64QObDaTbGi_aACUkKs2vYZsG6KJHwE22e4ToNs7o-sf4nih0c1SuWR6B0OaOnXaMJqbXx-khdF-WtngucfS8S190nVbEHEefJ1i_Ty1yRgVVmwcxRH8DQDSr42utoGiBjrKX3YygibD3UAnqta12b0I&cid=CAQSSwBygQiDsSW_PTiuQu2NjEXL1Pv0V7IJDqvRhDPwuQPWgGh0iZuDGb0_fuQt_4bQzNHLqRsyhqUpx1Org7alRYFmBqaTVyhTt0_YeBgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kids.co.nz%2F&ds=l&xdt=1&iif=1&cor=1750149732679893000&adk=2124396030&idt=89&cac=0&dtd=24

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37852
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:56:38 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/ Frame 766D 30 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

484eef6459e8a58c19115f287339366d82a7c2beeb7a35c7e16789b592515aec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37852
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11545
x-xss-protection: 0
server: cafe
etag: 12064860844701496540
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:56:38 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 766D 41 KB
13 KB 14ms
10ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 07:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 163081
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jun 2024 07:09:29 GMT

GET
DATA 200
OK truncated
/ Frame 766D 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7e21fbce0fd85ef02c21516ae7de3a8b07a413857be5cf239021da5e954cf998

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 default.css
as.ad4m.at/ad/style/0.1.48/one-ad/ Frame 4B30 114 KB
14 KB 22ms
20ms Stylesheet
text/css 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://as.ad4m.at/ad/style/0.1.48/one-ad/default.css
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1h4c8xvz4ka600821pjs6yvvjxw2h29kkqfarqcaavkmknydjx2x0dsjhp6j8nsmggmdjh58v1fft2zcqy7vz46s6kh3trtzr7znarp6kcbsbvp036q45r6ycyhsgrar7742csp11ryx72hagz91zaf6hfmmdzgt59g1h1wpy670z0sjcs94a887t932rpvry8epkc9qzcta9zq7stztfr79e72cnwakcpgnn980gw114ktr1exxr4dtmy24tzhtny7nd1my79a3mfd3cwnjd27k2q3v8yg8dny1kp2jzz2w6qc7hvv6vxbz8dpcak9kj7cwe0rxhtxxzzabt2m1pcehc5svn07w6fyeqsptd94cxn6r2w6hmwd2z49v62wd196j8z38krh6awpvm5zhgzftk3f9t9w611by2a1b759870q56ybkg860tg0gzk4em49ybfthjm&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%26client%3Dca-pub-3831894559014614%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 032aee61923ef53fb2b9efbb5d55f771f780e9c2fce9c076638b809a9607eee3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/dr?ed=1h4c8xvz4ka600821pjs6yvvjxw2h29kkqfarqcaavkmknydjx2x0dsjhp6j8nsmggmdjh58v1fft2zcqy7vz46s6kh3trtzr7znarp6kcbsbvp036q45r6ycyhsgrar7742csp11ryx72hagz91zaf6hfmmdzgt59g1h1wpy670z0sjcs94a887t932rpvry8epkc9qzcta9zq7stztfr79e72cnwakcpgnn980gw114ktr1exxr4dtmy24tzhtny7nd1my79a3mfd3cwnjd27k2q3v8yg8dny1kp2jzz2w6qc7hvv6vxbz8dpcak9kj7cwe0rxhtxxzzabt2m1pcehc5svn07w6fyeqsptd94cxn6r2w6hmwd2z49v62wd196j8z38krh6awpvm5zhgzftk3f9t9w611by2a1b759870q56ybkg860tg0gzk4em49ybfthjm&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%26client%3Dca-pub-3831894559014614%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:30 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-meta-goog-reserved-file-mtime: 1687950287
age: 148464
cf-polished: origSize=117335
x-guploader-uploadid: ADPycdu7Pb84Y6vCPqpUShyJrQGb98f4yuF1LiyC2B7DeEN9kG_1SbpI2iXm6tsp7d5fI22nNzf0l66mXGhEIUVspATbXw
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 28 Jun 2023 11:05:15 GMT
server: cloudflare
etag: W/"5d49535c2a84a9762127b3d9e77d7e02"
vary: Accept-Encoding
x-goog-generation: 1687950315098833
content-type: text/css
x-goog-hash: crc32c=aWAnwg==, md5=XUlTXCqEqXYhJ7PZ531+Ag==
cache-control: public, max-age=3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rR6CtSGr%2FpnjoreYh%2F84dBGkn8iIojm0SmfhcRuOd1VmSpY9RU1gqaXbE6AVeR75%2B%2BEa7v2jikw%2BKn5uXD%2FGFQs95aQhFcvdBZt7PzP5FQsiMfHeYBFgvzivI1ljGWawF%2BE33%2FdpI94%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 117335
cf-ray: 7df3a83dd9d39048-FRA
expires: Fri, 30 Jun 2023 05:27:30 GMT

GET
H2 200 r62eglto.js Show response
ad4m.at/ Frame 4B30 25 KB
10 KB 36ms
20ms Script
application/javascript 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/r62eglto.js
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1h4c8xvz4ka600821pjs6yvvjxw2h29kkqfarqcaavkmknydjx2x0dsjhp6j8nsmggmdjh58v1fft2zcqy7vz46s6kh3trtzr7znarp6kcbsbvp036q45r6ycyhsgrar7742csp11ryx72hagz91zaf6hfmmdzgt59g1h1wpy670z0sjcs94a887t932rpvry8epkc9qzcta9zq7stztfr79e72cnwakcpgnn980gw114ktr1exxr4dtmy24tzhtny7nd1my79a3mfd3cwnjd27k2q3v8yg8dny1kp2jzz2w6qc7hvv6vxbz8dpcak9kj7cwe0rxhtxxzzabt2m1pcehc5svn07w6fyeqsptd94cxn6r2w6hmwd2z49v62wd196j8z38krh6awpvm5zhgzftk3f9t9w611by2a1b759870q56ybkg860tg0gzk4em49ybfthjm&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%26client%3Dca-pub-3831894559014614%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d5e67a38c9a11424cac19ce192c9fd124a6d74e64d3791a01561dbd3e39c0b4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:30 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 14 Mar 2023 13:45:21 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 194002
etag: W/"fcb2a26b07bd76d9a925cae661d6d94d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IxIhjlEpW6vD260kdlNq2E%2FhEy3JrkLPrsiFqN8Oa9pRnhnaIpyKItcQglHrbiLrIDX%2BqCrpA%2Flv2IrBTIKiAuUqFzvAouFinixy%2B2Z96SEMGnJSZaIaPuww9Iae6QESfNZfDEo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600, must-revalidate, stale-while-revalidate=300
cf-ray: 7df3a83df9e29048-FRA
alt-svc: h3=":443"; ma=86400
expires: Tue, 27 Jun 2023 13:46:21 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012306200257000/ Frame F965 222 KB
61 KB 53ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012306200257000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306270101/pubads_impl.js?cb=31075743

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20f091e39a994eac247abb2db8c48d424cb5f3ea8280cea2194168c2bf5f437e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 26 Jun 2023 17:13:26 GMT
age: 299644
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61862
x-xss-protection: 0
server: sffe
etag: "bf95dc6813023782"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 25 Jun 2024 17:13:26 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012306200257000/v0/ Frame F965 15 KB
5 KB 65ms
20ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012306200257000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306270101/pubads_impl.js?cb=31075743

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db6c8330efd6e6bfd20dbed90de2e76fe0bac473c76abe90aaa91fac7bb067c6

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 26 Jun 2023 17:13:26 GMT
age: 299644
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5232
x-xss-protection: 0
server: sffe
etag: "b6c1e0819a00bf67"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 25 Jun 2024 17:13:26 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012306200257000/v0/ Frame F965 94 KB
28 KB 66ms
21ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012306200257000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306270101/pubads_impl.js?cb=31075743

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8169070527736f2296d9d72e169101428b2f9821205614dc54cd16d3130c70f8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 26 Jun 2023 17:13:26 GMT
age: 299644
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28873
x-xss-protection: 0
server: sffe
etag: "75041cf86819093a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 25 Jun 2024 17:13:26 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012306200257000/v0/ Frame F965 5 KB
2 KB 68ms
23ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012306200257000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306270101/pubads_impl.js?cb=31075743

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e5a28a902c7f1edfc9c082269da365300b36ceb1eed186bf26523d6867ed986

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 26 Jun 2023 17:13:26 GMT
age: 299644
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1911
x-xss-protection: 0
server: sffe
etag: "5f86339daf79d63d"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 25 Jun 2024 17:13:26 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012306200257000/v0/ Frame F965 40 KB
13 KB 81ms
36ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012306200257000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306270101/pubads_impl.js?cb=31075743

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d660119d70fde473f7720a43fb960d95c8ff46768e67d762f9557179709b8942

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 26 Jun 2023 17:13:26 GMT
age: 299644
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12958
x-xss-protection: 0
server: sffe
etag: "bf1167c9eaa58b59"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 25 Jun 2024 17:13:26 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame F965 14 KB
1 KB 17ms
16ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306270101/pubads_impl.js?cb=31075743

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 30 Jun 2023 04:27:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 30 Jun 2023 02:51:19 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 30 Jun 2023 04:27:30 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F965 2 KB
2 KB 9ms
9ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/castles/megaslide

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:39:29 GMT
x-content-type-options: nosniff
server: cafe
age: 64081
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Fri, 30 Jun 2023 10:39:29 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame F965 295 B
319 B 11ms
10ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/castles/megaslide

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 10:39:27 GMT
x-content-type-options: nosniff
server: cafe
age: 64083
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 30 Jun 2023 10:39:27 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame F965 0
0 21ms
21ms Image
text/html 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaShhEvHcoSLv1IFgHQxvzWB_07h8-l-0U0LHW-6mOC5TzrL97Rrv6IaX36TAkH2-DhZzhTgdKffwIC0jJ1EyzlaWcZkpw
Requested by: Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/castles/megaslide
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame F965 0
0 53ms
52ms Image
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C0D4bslmeZJLIDsSWjuwP5pCj2AH-odmacZiE3e_FEKWKq5L_DxABIJWbyiFgleKQgqAHoAHe2fWMKcgBAakCROF616o6sj7gAgCoAwHIAwqqBI8CT9BuqnbpvROxpvgc1dp4iAP1prLn1QjxP0t5T4or4pQ3zsdCmc1Z18njPvnFtvjFdoiA8jVLJi0cGVbj_4TdnQceTgPEvDvzMhbzJxEMqqgKZz6SXxFbuiuq3zIHDqzSonUQkEjbLNBTiTAp21t2_UgBWS3D6GBTFIYo3uh53aDC2HgvsdtZuafSSg2PWTxdDJyDMZFiDFiuZxFHy6jsWe2ocjbfnBRx0AirChM7UYQg2mSWBf-wlRgJiVXY1j63uFuoF7YGZWTeUpLGfmLNIbfQxJaKGaEjq4uVxTGdTni5Ixdv5Hzo94ujxb_hm_b-IveouNwI_6IYsQML1jeHxMNoZNNk1Ngw8wTOQ74GdcAEgJeQ460E4AQBkgUECAQYAZIFBAgFGASAB96RxuwDqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQ9_AF0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA8gLAaIMCCoGCgTDsLEC2BMM0BUBgBcBshceChwIABIUcHViLTc1MDc0MzkyMzM4NjU0MTUY_fkT&sigh=YK6gA_ARI-E&uach_m=[UACH]&cid=CAQSPABygQiDoQsk7BfoApOIQni2iSJVqK33KQGBXHjziWt2u98HIw7Bi5wvWRtb3Z3Hm6vGSMd0m4kVz4emnxgB
Requested by: Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/castles/megaslide
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
481 B 20ms
19ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?r=castles4kids.co.nz_fluid_sq_mohamed1&pn=2&sn=3&pc=0.6745415687561036&ds=true&e=wdp&dsReferer=Y2FzdGxlczRraWRzLmNvLm56L2Nhc3RsZXMvbWVnYXNsaWRl
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.0.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nf-request-id: 01H29B4H85WTWRATZQF3W23HPJ
date: Fri, 30 Jun 2023 04:27:30 GMT
cf-cache-status: HIT
age: 1775634
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "184c2b34ff0390c3de60fb1a3213ee4f-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 7df3a83e0975bbd1-FRA

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
481 B 20ms
20ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?gl=0.01&b=3&r=castles4kids.co.nz_fluid_sq_mohamed1&sy=d90817ff-51cf-4658-8cfb-46448b4b03ed&ts=82&cd=2&mlbr=ch&mlos=wi&mlla=en&mlco=us&mldo=castles4kids.co.nz&mlre=undefined&mlin=0&mlsi=800x280&mlbw=4g&mlcs=NaN&mltp=4a76684e-a6bf-4ff2-a067-1836b1c0bdfe&e=lm&dsReferer=Y2FzdGxlczRraWRzLmNvLm56L2Nhc3RsZXMvbWVnYXNsaWRl
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.0.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nf-request-id: 01H29B4H85WTWRATZQF3W23HPJ
date: Fri, 30 Jun 2023 04:27:30 GMT
cf-cache-status: HIT
age: 1775634
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "184c2b34ff0390c3de60fb1a3213ee4f-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 7df3a83e0977bbd1-FRA

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 25B7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpyFYFDbSJ-Zw0DBs1fPnM&google_cver=1

43 B
632 B

22ms
20ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpyFYFDbSJ-Zw0DBs1fPnM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COXQcRCu_4SOAhiC0YScATAB&v=APEucNV5lqQM7E7Bliv7MgwRY3_91HZTjYl_0Gn6lBCpP3wDIairFwxkiWzcJyPtWALfb1du7nU-3SXU6BghKrgXGMw0g_Hd-NhPBQMOhKceHMCYPb9E7XyBfZHNISjjr9xjsvLE8MmkLd8diBNo0Jqx2gPRFbl6i_XnjA3lhUhorIn3rUBQf8o7lukA7CuW1_aOef20its7bLGjSfd_jhBK8tbBiZqSgA
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:31 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:30 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpyFYFDbSJ-Zw0DBs1fPnM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 25B7
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJ5ZsvnQTm5e5ZLOFj-4aQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpyFYFDbSJ-Zw0DBs1fPnM&google_cver=1

43 B
632 B

21ms
11ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpyFYFDbSJ-Zw0DBs1fPnM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COXQcRCu_4SOAhiC0YScATAB&v=APEucNV5lqQM7E7Bliv7MgwRY3_91HZTjYl_0Gn6lBCpP3wDIairFwxkiWzcJyPtWALfb1du7nU-3SXU6BghKrgXGMw0g_Hd-NhPBQMOhKceHMCYPb9E7XyBfZHNISjjr9xjsvLE8MmkLd8diBNo0Jqx2gPRFbl6i_XnjA3lhUhorIn3rUBQf8o7lukA7CuW1_aOef20its7bLGjSfd_jhBK8tbBiZqSgA
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:31 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpyFYFDbSJ-Zw0DBs1fPnM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 25B7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMtvubrJt0EXguYkvso0Cu0&google_cver=1

43 B
1 KB

30ms
30ms

Image
image/gif

185.89.210.180
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMtvubrJt0EXguYkvso0Cu0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COXQcRCu_4SOAhiC0YScATAB&v=APEucNV5lqQM7E7Bliv7MgwRY3_91HZTjYl_0Gn6lBCpP3wDIairFwxkiWzcJyPtWALfb1du7nU-3SXU6BghKrgXGMw0g_Hd-NhPBQMOhKceHMCYPb9E7XyBfZHNISjjr9xjsvLE8MmkLd8diBNo0Jqx2gPRFbl6i_XnjA3lhUhorIn3rUBQf8o7lukA7CuW1_aOef20its7bLGjSfd_jhBK8tbBiZqSgA

Protocol

HTTP/1.1

Server

185.89.210.180 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:31 GMT
AN-X-Request-Uuid: d0118d63-816d-43f1-85a2-8efde1706e5a
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 45.141.152.73; 45.141.152.73; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMtvubrJt0EXguYkvso0Cu0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 25B7
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTcyNzk1NDgyMDczOTQyOTkyNQ%3D%3D

170 B
188 B

37ms
36ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTcyNzk1NDgyMDczOTQyOTkyNQ%3D%3D

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 30 Jun 2023 04:27:31 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 45.141.152.73; 45.141.152.73; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 1f019ac3-bd5d-4516-bbb4-ab94d1941761
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTcyNzk1NDgyMDczOTQyOTkyNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 container.html Show response
a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D798 6 KB
3 KB 8ms
7ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306270101/pubads_impl.js?cb=31075743

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://castles4kids.co.nz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 30 Jun 2023 04:27:29 GMT
expires: Sat, 29 Jun 2024 04:27:29 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
479 B 96ms
95ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?gl=0.36&b=2&r=castles4kids.co.nz_fluid_sq_mohamed1&sy=d90817ff-51cf-4658-8cfb-46448b4b03ed&ts=82&cd=2&mlbr=ch&mlos=wi&mlla=en&mlco=us&mldo=castles4kids.co.nz&mlre=undefined&mlin=0&mlsi=800x280&mlbw=4g&mlcs=NaN&mltp=4a76684e-a6bf-4ff2-a067-1836b1c0bdfe&e=lm&dsReferer=Y2FzdGxlczRraWRzLmNvLm56L2Nhc3RsZXMvbWVnYXNsaWRl
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.0.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nf-request-id: 01H29B4H85WTWRATZQF3W23HPJ
date: Fri, 30 Jun 2023 04:27:31 GMT
cf-cache-status: HIT
age: 1775635
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "184c2b34ff0390c3de60fb1a3213ee4f-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 7df3a83e79d2bbd1-FRA

GET
DATA 200
OK truncated
/ Frame F965 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f57c00b24b94d147a3c383688301424c4f867af907c02019c31ff9f1d3ddc01e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1468596/71180196/ Frame DAA9 244 KB
73 KB 34ms
34ms Script
application/javascript 52.209.191.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1468596/71180196/skeleton.js?ias_dspID=3&ias_campId=1011988055&ias_pubId=pub-3831894559014614&ias_chanId=1&ias_placementId=20070744135&bidurl=https://castles4kids.co.nz/castles/megaslide&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0hAAS0hhSPdGaRylN1RREaX
Requested by: Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.191.174 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-191-174.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e8d0a1cade77c35c65d9af2e9df8d5572e1ad6933b468aca16a3ef8109632c87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:30 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame DAA9 172 KB
60 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Origin: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 13:52:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52495
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 13:52:35 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/ Frame DAA9 11 KB
4 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CaFdMAEX4F5gZ8AaUsw25GT8ZCzCREMwE-t_ZTdSh6WrzsSGw0Fp_H0EzdrzrFhKaa8FjPIKGgFENrLIxH3wgk0TsipfD90NCcq42yCYDlpWgnSb-ciAo_sY4W1HuAMINLVNpPpz69tmPXg9GguQ30Y3gb5jy-iyQMIqrxP0lUdsWAeJs&dbm_d=AKAmf-CxXxaLePgrTobCEEpF4EIWqEljj3G2nvAGIg6p_YxXRy0qvx6uuEcIhfeVBR8y8AbEhkXK_FwsGLobW3t5d4Jgqohlods8OHXpYcxhx0ORNikOeahypex-HcEfVWHY8VSYVBMtkNER5KKTIF5Z3zZwDH38VlNvT_UffHEgMB_iPRtavvPCOQBS0Wk7AKTAz86fuc3I6QWSrLgEKY09smbigmrXDltllSAI-voEvUJq5NKPzRd4D5izYSsAEhJjKHRoU63o4ST4ATQ5I-L4uZw2Da04Vpi9_2bZ4o2UXR6jyFmSPVSLb8D4-ktfR5nGNk5JDHLA9SXrq2o1r6IQUxFc3vzu_ChodaCGVescdQFQ6IEjB-qjsF_5Uw6BIXi5NAf6EZm9xeeSmvPAz4vgZUCk3Zfjxl0ElxbKbHrw61GGBRg-z-PbOcwRQA0beoKLbh71LiTJwUe6fx_bbEGtuEjwPtwLFlz_l0RUZmMtMl2Kxz9oFtFsntcNPYUFoTm-mvWGf3zmjxsBOSisE26f6ZZw6teAbNbgLpY2IrlKh6OGqagdR1GVyiJZSVNXkU-PlWYDXB72TE3lr_KjqqoCiFSi4q5HJbi0CF9TsL_cxAaJ-odo9lkr02eP4aLL-aw-LvdS0qs3dGUP1_qIptMuzaPuxEa3O3ORb10iQxbeAddowuzpzplH_HWyVXZbPIfUuQuDrsaL3pGPdVqOVcaB6zuE9uNtD5-d8MMoSrmsmhdWe8hsbpkSbSz_fOuk4QjsheJNlMr-fuHtmEGIkZ-wVHY_jGO7h_XY99zJp_hEhaxC7B_GfB_5iQzBExulNPD4kLMNRsWIDA31luip57nL2ERvU1WR2Q4nnCKBm8yseEvH39yxw0SX152Q0tYTR80pRqisj9-VlpvbvU2G7iaoI13dNsCMvW4-ljZOkDBHTPLScBAmXfN84Wz2RZg9VXG8Be3-Sl9MQYBzSxeMhrCk-b6SCt6eNymdttPMTicvzXAAT1OAR6DFTWVmEe84Ys30MVTmSKDTWFjE4V81GtM_iC2CT_5FgMvAk7pCm0Qxir46Z_iuM0CCbJkffjDLyuFRjb3dUC9_dW10c505Z7C-cvDhFvSvUj4Zr4ExRFy5DypHqzVTp_2JyObJBQ-hihCjTg5pRAZJEsMl82zFwt2SfolEWdU-vPt3EEJKrc7XvhBw3l0wauCTHi_Vulv01xX4eWPi3udxjunLiWjoUHQQHnLzoTb-Wn4AYbZ1EzNLe1WWZtJRDznsmlxFzSMzSiXEHTa7d4XkdYI76GQPy8lcdWspoj4MV2Wc8pMuZu4FSw-BfnyFHfO_WRSn4zKMsL0uXoo6paROC7tFw8iv2DxF1kZ5j15wJkCaSpfuU6kMjKXkrK3tCWYWIRYT0rUd1QibDpKtlU9M4l9HOIxoiIqErMzWWYRQYBKW6iUaj07VQkloee3XGPtSrNAYYU6Pz82dw-v2DJdvemSlG32A6snF8BUXmtxh_MGZlDohjf62Lb4ZmRk6BKKJ-LDV5CpXbIMWAD2c0HpEAQuBvaAkS09gnv6eXWzGlRfyWu8aFhMKQoKE7fGl7OdhpRgyzduUX2Njf__lsxEZ3WIVRiMDYFpp2AM2mE02xa2sUhv4a6AwQgEul3wuI7RMtviYHu0E1t27Dor9NA7MYMCnZX0RfacJDz-UUtYtiHhAKUmsg-6oDqJO6EfXg-JKvnoRuGCaa37cIr4V41b0owZGoo0mTdjIno1JPyECn7u57J5-FzvBG1cdvZRh_kAd0IXYiedc2Zy4Kl73KHrfzD6r2q2BOaV64Cg3yzLRxZd7RSGhsOX3BJ3qfms_S8YqQXh3ZXrVBggDhGa0CpG8OPpr2QvxKhs_94bRrZQpbTFjvBJ1p6dleNsIdJ6sS4OgoGOoCI_cJRTCgYWfuJysCHuD_rPJKLOyPGJCxPdptrXfHNYg9ZaiSy1un-OlQm03nWDsc64rNJdsXPWNrCSgdQjD3MRSvJYhm6WNc-TWRQKOuuRhnKxrwdtMW28X83QfIScNU939EI_NG6mTsrM56vzIPhu3qHE_CWoJrQyk_obz46BvelmXKkxgtYjlbkHJcJS3zneDGMh1wWi40KRrG14EQ4XPE6dxVcPJVfiWVTwOArpT_LkkMBNOZ1NZG1-IS2mVfW9w_Qtyv3zGVhLAFKXljx8593qgRBuPA6373h3BwVyX9FelJ0nKWJ0bMvpUfTm0UnTss-hm0pSWFs_Jpjb9S0B__OXq0zpagWeui24MMXV5Sy1qsf4BPQ3IiUEmbdOP2W0R_OvRB3xykW9urxtCQvkX7lnmfQ8Vvv_u4tOeTV33uIZwocJZqIaM50jaZDsVKyB54uNCGitlJnlgCLdsOVk09e0FFe6jZcH_-xNd57RgMPUmmj01tSoSFJMnlrYEKxnfUhSLhjWxUaiwD1t_3DVSsfNRHizFV7tkZwQSYY1GF5XFLgOdLZsj1olbwVO42o94vQgc4TFbBceRyGV9CEX0OXISQm13VVoQN5yMoxCre3Vf6mITE37Tx3tm8POW5kM4ZXxeUhTGTpMgPPW1gzcdh097Sn4VVMFmvrwaHFVO1b109JBbTcfDrJg0jpVvWw0WezsO1FpHGgkAE6hwzP1onCGEOu4RFu2sIrzMAASyF7nARK0IjetARqHQIrjilzMQF-QLx0qPD56wlvFUQdWjbZz94jSucJI94qvyBfIzhPPdc38h4KD2uHSEmW48aZdgg9Yht8Ogpof1HvEsvDdrI8GMXyWkcNh5eXfWDVRCxIbC4-r0S3kyQPEXqOIpo_fQ2auDKNHDRRokux-vRHnf67IdRBMD7EM4q2KRjE4vXiAC7-fQrcPfjccjSHsD4VPsYdDtshzvHpsummbQU-gXTIoVzWB6WgEvy2LX9Ej1lR4MUqP6DRk0I4M4NQ1o92c-ZJVIlsyuIJD5DziOxhX8cDTHiGvsipphjg0fBf2GslZZEw9_odgBI9wE-MgXcBaMr9KKukEC1OZ0WEkVBRZq83RQcFTOaVkwWTMj_wX7aiS7hh0Z0oRjKWUVuvt25sWyt0Q6Bx7o6eXwcrALQ7S2dp7KnNpWYsyTQkGAqVdCjH7hJcEj6ZdBjeqb83qjHJl7plbO3DNZrm4WAyQSE-6pN7wIuIcb9o-0oSgeDzKdQWXnpyHU0Z7Gk65fFpUYzDTRj-krQ5CkzQO6AmbdQ-ay_A-MKjs_Eb9isylw4_Pimr9SOftZrXXOlLVp8etq2ju_AfFD87vunBP5ApuYTaUlnfJAd4FqadfzjdFb4jEXNI8fGQx0rLXpKhcM6T3CxpexLduGQnL3XUH-33DTyVItkvEDwLTWZd3tikSMMKb-D9K4otVSiy9pBWMwJMLfhUcj9DBSu1LKpAoBIhayHfxw-8mA11fT7i6FaZCXD__xptjjowM-LIiSOTf4Lgs2TyopOS0KKa-lPqO7Ul-ZOmwv1jdGyW-Qz87zEQVfgQ2AH6TbxA0C8J5NftozkI8PT1u4ZiqTwEURP4evDCuKuCLXvVp6VIMDpaaMwE1NYRP2jlZCc8ia-Q0KQY7b4DYepE2SIq2Uku_JTiNF-cnA0AFEp1c5SgEujWTCKEIxbLMozqLAY3rrQpZnFCE&cid=CAQSSwBygQiD0K_IMm1A_9PTc4fic4ZnUSbvUaycpB2dTEU4ScRuL5bWR43M7PVSIWXhOsm-OI1bRk9f3dY_tMi87vgOBqkab8nGW8h7XRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kids.co.nz%2F&ds=l&xdt=1&iif=1&cor=16532715870226266000&adk=497053795&idt=149&cac=0&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37852
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:56:38 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/ Frame DAA9 30 KB
11 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

484eef6459e8a58c19115f287339366d82a7c2beeb7a35c7e16789b592515aec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37852
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11545
x-xss-protection: 0
server: cafe
etag: 12064860844701496540
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:56:38 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame DAA9 41 KB
13 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 07:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 163081
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jun 2024 07:09:29 GMT

GET
DATA 200
OK truncated
/ Frame DAA9 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c0bf79dd96b7709cf1e531603387fa2d4ecc279751d8a3a7570bde2fa2c148f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D907 640 B
262 B 89ms
87ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CO_4sqYCELfrruECGJaGxucBMAE&v=APEucNXbsqwDNfrs6KDTJ1GdXGkxHDD01uHMOdxXw4DAVZYSKDnR6M30cQ6bWjhyw9gB4nO3GGBYm6KWrAFRNVbU4o6qePURZtfT_GQwWlG9EpmIdgON9onYh5XzksiwC58It_yHmCKGxSyXCXabv_Zs1_xEpGYUSG3saDm3K2r13IO3vdeHEkGuV5S99Ep6ylcJFC3Y9UyALf5brtfI3Db6WYIXwvabHg

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 30 Jun 2023 04:27:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 0628 78 KB
27 KB 139ms
138ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:31 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 30 Jun 2023 04:27:31 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/ Frame 0628 3 KB
1 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/window_focus_fy2021.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:50:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38232
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:50:19 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/ Frame 0628 20 KB
8 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

abaf64de0855592138133fdf15c746a6e47a07d5f7a34a9513a06994c89f91af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:50:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38232
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8312
x-xss-protection: 0
server: cafe
etag: 5477749917372345267
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:50:19 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0628 179 KB
56 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6914d47718a28ab8055edac273b3aff57e64e5bddccc616c2b7e355fe986f39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57260
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687952195399670"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 30 Jun 2023 04:27:31 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0628 42 B
63 B 71ms
69ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BeraubIVVXhckNIQQmBvHPNDD-zg30E69r0pBhzybJw5JGuT8I4ig0up6JP59LMsPD3Vv1KNPvxZx1fb8suwcwhVMVCgEB4PnCkGToxzy-HH1Gvvg

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0628 0
20 B 70ms
68ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=15124543859093443576&x=1&ct=76

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 9E3F 35 B
464 B 181ms
110ms Image
image/gif 2620:116:800d:21:e365:4988:e8a7:3270
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFsU1kmu7mTUj3aAWhz7r1M&google_cver=1&google_push=ATf1kGOQsZbJeZ9St0SloVVplNYPyofGzfNZ_2Rm38LHFPJFzs73EDchwEPX2uTMB3G2tv4gsb306uiWQcvA8xktTPKJb94ICnlc

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:e365:4988:e8a7:3270 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9E3F
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESEOJO5ycKv-mNbaAVX0P4R3Y&google_cver=1&google_push=ATf1kGMz7V-YNzUPJx-XCfdDi5-dB8T0HT7Tet6UCb1KWDlqnGZIRT_wgA9PJsvsURtqzZUA1gMUL...
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=ATf1kGMz7V-YNzUPJx-XCfdDi5-dB8T0HT7Tet6UCb1KWDlqnGZIRT_wgA9PJsvsURtqzZUA1gMULVP_0x6z4lWRHU3SuZk-PZk

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=ATf1kGMz7V-YNzUPJx-XCfdDi5-dB8T0HT7Tet6UCb1KWDlqnGZIRT_wgA9PJsvsURtqzZUA1gMULVP_0x6z4lWRHU3SuZk-PZk

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 30 Jun 2023 04:27:30 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: CA1EACF1BF854AA59E3F6CC93E1B0D9B Ref B: FRAEDGE1814 Ref C: 2023-06-30T04:27:31Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=ATf1kGMz7V-YNzUPJx-XCfdDi5-dB8T0HT7Tet6UCb1KWDlqnGZIRT_wgA9PJsvsURtqzZUA1gMULVP_0x6z4lWRHU3SuZk-PZk
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX/UTw2gzCJdvRbnFzPYw==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9E3F
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEDKCgPkMCcojW6U1uAQ7uTU&google_cver=1&google_push=ATf1kGM-uQ1w84mOVAqCnxbjJdbqLdS9ygyugOUl0qdqbaIXTpvpkTTEBliwew7tqIqTpRGSdN2tP0_R98WPlKkLLguo...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEDKCgPkMCcojW6U1uAQ7uTU&google_cver=1&google_push=ATf1kGM-uQ1w84mOVAqCnxbjJdbqLdS9ygyugOUl0qdqbaIXTpvpkTTEBliwew7tqIqTpRGSdN2tP0_R98WPlK...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGM-uQ1w84mOVAqCnxbjJdbqLdS9ygyugOUl0qdqbaIXTpvpkTTEBliwew7tqIqTpRGSdN2tP0_R98WPlKkLLguo6B4SXfGP&google_hm=GQ0beHkjQgmxph5-H6GrIw==

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGM-uQ1w84mOVAqCnxbjJdbqLdS9ygyugOUl0qdqbaIXTpvpkTTEBliwew7tqIqTpRGSdN2tP0_R98WPlKkLLguo6B4SXfGP&google_hm=GQ0beHkjQgmxph5-H6GrIw==

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGM-uQ1w84mOVAqCnxbjJdbqLdS9ygyugOUl0qdqbaIXTpvpkTTEBliwew7tqIqTpRGSdN2tP0_R98WPlKkLLguo6B4SXfGP&google_hm=GQ0beHkjQgmxph5-H6GrIw==
date: Fri, 30 Jun 2023 04:27:31 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9E3F
Redirect Chain

https://s.uuidksinc.net/match/47/?remote_uid=CAESEPxYFpijDo56ToUdG2Dbet0&c_param1=ATf1kGNLQUZOBLKMGwCmZ056qMERKUF_LHt0fXed-jCUpBvu6lo2uqKelT7qb1UeLhbnshwPCVoov4LYIhnQ1ChnJJX2Sm5UFtAf&gdpr=%%GDPR%%&...
https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ATf1kGNLQUZOBLKMGwCmZ056qMERKUF_LHt0fXed-jCUpBvu6lo2uqKelT7qb1UeLhbnshwPCVoov4LYIhnQ1ChnJJX2Sm5UFtAf

170 B
188 B

19ms
18ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ATf1kGNLQUZOBLKMGwCmZ056qMERKUF_LHt0fXed-jCUpBvu6lo2uqKelT7qb1UeLhbnshwPCVoov4LYIhnQ1ChnJJX2Sm5UFtAf

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ATf1kGNLQUZOBLKMGwCmZ056qMERKUF_LHt0fXed-jCUpBvu6lo2uqKelT7qb1UeLhbnshwPCVoov4LYIhnQ1ChnJJX2Sm5UFtAf
date: Fri, 30 Jun 2023 04:27:31 GMT
server: nginx/1.23.2
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9E3F
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEMQVB-gD1zlGHJdROi-oQzw&google_cver=1&google_push=ATf1kGNZJ1eSUl8Dk19u_RO08W9C0q19fLHLXO0gb5t_NsFLaTu9GMhmHrYWta78UDwerOsDu97InZ6Hg1ZGeOKi...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGNZJ1eSUl8Dk19u_RO08W9C0q19fLHLXO0gb5t_NsFLaTu9GMhmHrYWta78UDwerOsDu97InZ6Hg1ZGeOKi-JamDWN92jw3

170 B
188 B

30ms
27ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGNZJ1eSUl8Dk19u_RO08W9C0q19fLHLXO0gb5t_NsFLaTu9GMhmHrYWta78UDwerOsDu97InZ6Hg1ZGeOKi-JamDWN92jw3

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 30 Jun 2023 04:27:31 GMT
via: 1.1 82e9051d8d41080bd3028731e0e8677e.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA6-C1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGNZJ1eSUl8Dk19u_RO08W9C0q19fLHLXO0gb5t_NsFLaTu9GMhmHrYWta78UDwerOsDu97InZ6Hg1ZGeOKi-JamDWN92jw3
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: xDJF3tZBRv1FBi-HqvlRn4qKN9M9qPNYomcR2UvKDYSCLVFVmix3iA==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9E3F
Redirect Chain

https://ads.yieldmo.com/exptsync?google_gid=CAESEG2tnNh11MwnTq1dP5uSkUA&google_cver=1&google_push=ATf1kGOYa2sdimg7TenRvH9UZSITY6dF6wgB3bsp3Rw8mgP9nK52TOL8A6Sjekq1_z_LPcsV6j9IZy-iBo1GlqPxcGAGGWGzxLnc
https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ATf1kGOYa2sdimg7TenRvH9UZSITY6dF6wgB3bsp3Rw8mgP9nK52TOL8A6Sjekq1_z_LPcsV6j9IZy-iBo1GlqPxcGAGGWGzxLnc&google_hm=Z2EwNDk0M2RkMWQ5NGY4...

170 B
188 B

18ms
17ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ATf1kGOYa2sdimg7TenRvH9UZSITY6dF6wgB3bsp3Rw8mgP9nK52TOL8A6Sjekq1_z_LPcsV6j9IZy-iBo1GlqPxcGAGGWGzxLnc&google_hm=Z2EwNDk0M2RkMWQ5NGY4ZWMxNzk=

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
location: https://cm.g.doubleclick.net/pixel?google_nid=yieldmo&google_push=ATf1kGOYa2sdimg7TenRvH9UZSITY6dF6wgB3bsp3Rw8mgP9nK52TOL8A6Sjekq1_z_LPcsV6j9IZy-iBo1GlqPxcGAGGWGzxLnc&google_hm=Z2EwNDk0M2RkMWQ5NGY4ZWMxNzk=
access-control-allow-origin: *
access-control-allow-headers: Cache-Control, Pragma, *
content-length: 0

GET
H2 200 sync
ssbsync.smartadserver.com/api/ Frame 9E3F 0
45 B 216ms
30ms Image
text/plain 185.86.139.101
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEH7rQISYzJz995dC_9y7SJ8&google_cver=1&google_push=ATf1kGNnWAjyt8-YJfU9JJHeYrpYby1oWLA_oKO-zUZALlSEnpF_B5bgS4smvOOsMfwebdm589SaztCtWNFznwlY21t_HMADmP7E
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.101 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:31 GMT
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 9E3F 0
12 B 27ms
26ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Lw1gTwZXCd8UebpZvSPWBtuFMXP-hYfO5YjfRNSxX-4ZLpvUhbEpmlzu_7AMh4Uq3BG94i

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:31 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2DD4 0
20 B 51ms
50ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=3748373153797&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2DD4 0
20 B 74ms
73ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=3748373153797&version=m202301230201&ct=77&x=1&cor=9695775464173662000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2DD4 32 KB
18 KB 51ms
50ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CAtOVrV6sqtYaWaLHksoy1cm2GYG0uOWXxJyIC4XSZEuhYz9L1Ug_LM5AXzBDykx1h7Q4vHUlHs18jNv69Ql6KJydp2C5UXkNB0QCxlRi7N2_8nJg38vBk3rceqOiiDx-3v2AtUlzHS4NB3xGnfPCazLKzFEhGCqLd7YUN6JnY1DwZwY0&dbm_d=AKAmf-AkaI36Pr_Wnysmj_oyXBCM7krGpv_IX7o0x8dHpcAKpQOqhi-iWjJa6hPire6OmIbGEfhx9kGC3rWedfg9CNxMyHzexStks5xQQyU3caP7-4yHHLJh5Hx4H-XXFrLWf4Ecj-5uRZG-pNGBjoPHnYBMgd72lOba74jxBqED0BxJ5_Ew10p1mbQrfZUkcfvPhDHHyuylJNuX3zjpSfDwO92UJahE8obJ0eMyopYHpW8zD2EV2tRBS5aUXaAxgKT-GranIdvJlZ23Q_98GsGNHzE53K22eP1Ahp_KX7ydW_AoEcwQ4dYuGXIWgdxticZZhg-E9e1Op0w2LccLb-dGQJcxvdJYrruI17_4MRUNWWtzLJ-6kBq-VSB31lH-GZrXjlkm_N5hVxMRo8Z7yJjv_DdTr7vfGszIoOtajnYqgUjtb-P-4RadkmjqRZIdy16LnjECBFGpoMKfV7pLLeZCXmk97ezv5LDsglmWhhiGHQvFSwrhAOnocBm27PI-ndWA9Kweb78XyTTnuWHBeGDwy5stmH-Pb_BdKW1puCgMadHJQizODxFx-Lg5fi62mHA6gcE1wglOMAtFYIeneLlfhwRBOwj2WyRoVCTeHaKo5QCb4j6XCKMFtx8qqnRCz_e6qGQ4qZHlIyBQWRE5gyW1zv503qCOsU1fQIY1Pb0sV1ErNYNSQuvJc0IbqdKYv7pttoCiY2mtCcC4wWlaibltgRP9Iv8z5HKIM8kzv59L6VDhtjthel63cTan9kNkX-tyAixPzj8O7lZca9KO7WhNNmltsRJXecSpif-mNcneVrGxwcP5jjHWS5GN9xo53BIRav5NAcRe9mGmrx_tliPj6HMikKipZ6E0Hlg82d2H-Cftkmd8qEnJG4ppIFcVLpzXBRflQmGHBPUpa4d__HCF0L6AQ16251hoTRnPxS0F_4h2bqEUFfB0HUIfOPT-o2nsEolccewJdOauWvY4Uekb6WRFyOwjDGhQt72owt1HQx4oJP0LpBxIhuTWCqTWEDkxt_RIakmvq4gyWX57rtGjZIwqSiir1VQ9kK-PmUluVphh0g9HjkUz2Hx7WtGl-YD4mceQ_ouw3MRCh84Ms5P8KC0L3rSIlbFL7EECmGHN-4Le1ClDjUIhEdi73DdlUvZlfo-Ll32BSw7uye7SVcJciaOZN2jpq9kthCI2hyF_p7yfbsyS28YR5_6z4ClwvkmOsmEPhKwcqg4BuJcp25WxZJ6ALZZVz9BZKtAVeHEFSF01VgE-83F6RfN8VymWueTeBZJLhSR9aNVgGYyuhFhwVtUqJo36R64UuYOwfCh_JBliN3i_uGOFg2L7SK9SiuEaGjf45fETeSElAcHw_iedLQosPndIAs48g0OP5lClZxfnvPX-WpZD2UihwmlkRDUCZkPca_F_WSoJ38GOAw9nRA7k3G8e_ctgpn-ttTVsfU0-4kpTWNpORXG3FltCmT8PnZnyebgLGpes9tQqe81wHAVaNNyM7S0_Qzv2eRR-7xAsIDgVaeMD_twHFzHkQskMBjPU8AX8gPDg36mRBjoSCB6qZ-NfGMJkHIYwj0gEXL55XhGVNVla3xs-Z3F8hzwekoFsv6FKlTd039MngzRCfmjQQSOCQwlXT6JVTzt-e0-8FZUtljRbAB5nJSq25ApROmL8tjLoXOOEjFAmXxxEETnMDDCyt0l8GGnyrAoT3S9QbUA-dgoSU6lfAtDcNAo9BrPaetVx70V-z94fOTOMKJT8MDsF2D0zNolqijjh3_7Zz7A_ki36ZEi8b_zq8OidABuDGueqGaENYY_12mkA4A3SS4DR81x6AWQJyTQSlpHZ06uy9rXJxAoLbZau8S6mTatV17pVvTXpEYs5NHvnWdu02ZsXZoP9GmTP5BGxW2h9r0r1hUMM0Id9Gg53gY_29i8sGj1_E3JSABNZGVDwhco4_0s9-xM73gPc1EC7zWcu57vDjlgYcrM0T4Bdt4fM2ibRSipEaLzZmw_gyqWrXk0-HSllsJw1HyfLInQGVesm0WQRPT7CNctHLIv7rbcI48iN1WJlZEy2fVV6AtnzuSaTQBde2cOXAHl6rZSu9LS1NcOO74oHE-EsB8UtqwJcUQAUXUil9lDV2RpjgP3T7nOcYwLyp1VL6YjnBKOV7gl-6JVljw7Wjl0ujtb8R0x9adw9EUdWuczVm5sTXOVp-YgvDA99eubQB-wLipUBPBpPtMEuAeeJ1hG89jrBQg4J49BB7mrc-rMTcpkhbODwmzssZ8zK8H4izhYu6pAeNHF_flRMwcsjtT04zVpokeUBYP7IIW6w_-EMyhMT5d6fKpVoydkmR8bt_r_I9Nix4BHhWofIMAPof9h4noUdyc1tjTlTZKiyeDkoyUaF9FFJCANgNvhESkvcfegTielRAKJpGbvF4JhoGD_6JZOItoCW3UMjKJRan3VJysV05jtmnPajZgnoEwq0LWCUzsREGEwbGzndSgSldfl3Ye8yLbgeWUh2YZroBTPrhyELbn30yZUbWytiWwLtcxhUn4Q7dWfONBw5ILjPtcIbFJam76IVKZsr0c1mq5qpjCSVoKxvSNAlXs6QorNIHq56WgZ8oSKm5mZrx4glivTI-EYXXUrkukwpt1IEocu20nR7iADccBqZalbFOxWB-Z01IkHx344ooZu8kBwHzIzA_cMQedgUZ7_e8FcZ9CJniY1mktoVQVrUEYcioAn56Nf2SlwPQZdpkdpabjkUNmlAcdGYfN_wskzBpCIjY9Ww2m8ZoipaILX8GCNyT4SP0qnysHncL1uTa2-qQZdeVn78b-K6hXgtCQhvZEnc0b7yHw2KFyRvyUny4I2UEL2OWjNtBFeoVbO4ulzzj-KcR88xeAOWqAAhkCDo5ej_KEJGiHp4vzOXhHP7K0DyrE5e1a1BIEb_-Dqxtk7zPYZs98Pvn4Li12YnuuGgBZ1nAKU7Dfa7ECC_3UMDHpfFNK_TyZCR7aQJqPMMKvHAgNqBHnbn_dkTF2BkfvL56WSMHY3-WaEa-sDM0Ey790MSi7xpEYUqIi8qFrD___H-dC9p7S8bPqUYuaNsDYkSHnbfVfiMTGalgnbXj1yqta-4LpbLZP0hHIpTrybV4nBE1VZ6mqIxv4xVloOY5Q40u7NtPq1is6ak0iyeFQmfNqWjj05KkjhhBIUpysEUlerGQqyHyJmQ2FP-aaTyfTCpa1uW29T994rtdXD_PmAJIFVMjgoAHM5w8nVKb7i9dp0XVSjdJyZl_pfOoSo8I3zcAAzDGHfkF0cXA-94R9r0GFO4YXobjwElp5-g5Nw3qaG1dmSL8pJajSIqiPE5BhzGL9D5QFAjaINZxMUpeCZ9yRf5Xix13tBDNXCjYJH5y1ccGPzFxe8tcC-WC8HEmA0YgSOUEZ0ukSBmDZevUMn_Ki2xa_BoPVnqaIBaIAegFCs0yAybtoIwXE69g5tW6X-cI3NkNXSV_9UUB415XM7zze-IosClCbJ4Uo6PZOWwKG5OnsJQ3M0ymrnHZtAWVIEK5BQEugixJ4FYiQ3oMo5u62slPTv1DfbkXjHOuQZNxeV0Awq_ogTa9UrwXawY8JkI8xSa&cid=CAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kids.co.nz%2F&ds=l&xdt=1&iif=1&cor=9695775464173662000&adk=1877897943&idt=125&cac=0&dtd=26

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d5427bfdc48051efe815cb3512e9c2fc6f79a3f773212dbdd1f73d2c1ae05ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18749
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame F965 33 KB
33 KB 33ms
32ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://castles4kids.co.nz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 19:09:17 GMT
x-content-type-options: nosniff
age: 206294
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Jun 2024 19:09:17 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame D907
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPgk1DNBQN0whaMaQq03-Hk&google_cver=1

43 B
114 B

16ms
15ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPgk1DNBQN0whaMaQq03-Hk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO_4sqYCELfrruECGJaGxucBMAE&v=APEucNXbsqwDNfrs6KDTJ1GdXGkxHDD01uHMOdxXw4DAVZYSKDnR6M30cQ6bWjhyw9gB4nO3GGBYm6KWrAFRNVbU4o6qePURZtfT_GQwWlG9EpmIdgON9onYh5XzksiwC58It_yHmCKGxSyXCXabv_Zs1_xEpGYUSG3saDm3K2r13IO3vdeHEkGuV5S99Ep6ylcJFC3Y9UyALf5brtfI3Db6WYIXwvabHg
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPgk1DNBQN0whaMaQq03-Hk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame D907 43 B
304 B 68ms
17ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO_4sqYCELfrruECGJaGxucBMAE&v=APEucNXbsqwDNfrs6KDTJ1GdXGkxHDD01uHMOdxXw4DAVZYSKDnR6M30cQ6bWjhyw9gB4nO3GGBYm6KWrAFRNVbU4o6qePURZtfT_GQwWlG9EpmIdgON9onYh5XzksiwC58It_yHmCKGxSyXCXabv_Zs1_xEpGYUSG3saDm3K2r13IO3vdeHEkGuV5S99Ep6ylcJFC3Y9UyALf5brtfI3Db6WYIXwvabHg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame D907
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEG7zVwicthtrisZTS1Ixp2U&google_cver=1

23 B
163 B

50ms
50ms

Image
image/gif

104.75.89.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEG7zVwicthtrisZTS1Ixp2U&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO_4sqYCELfrruECGJaGxucBMAE&v=APEucNXbsqwDNfrs6KDTJ1GdXGkxHDD01uHMOdxXw4DAVZYSKDnR6M30cQ6bWjhyw9gB4nO3GGBYm6KWrAFRNVbU4o6qePURZtfT_GQwWlG9EpmIdgON9onYh5XzksiwC58It_yHmCKGxSyXCXabv_Zs1_xEpGYUSG3saDm3K2r13IO3vdeHEkGuV5S99Ep6ylcJFC3Y9UyALf5brtfI3Db6WYIXwvabHg
Protocol: H2
Server: 104.75.89.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-89-75.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: Fri, 30 Jun 2023 04:27:31 GMT
pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEG7zVwicthtrisZTS1Ixp2U&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame D907 23 B
163 B 76ms
33ms Image
image/gif 104.75.89.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO_4sqYCELfrruECGJaGxucBMAE&v=APEucNXbsqwDNfrs6KDTJ1GdXGkxHDD01uHMOdxXw4DAVZYSKDnR6M30cQ6bWjhyw9gB4nO3GGBYm6KWrAFRNVbU4o6qePURZtfT_GQwWlG9EpmIdgON9onYh5XzksiwC58It_yHmCKGxSyXCXabv_Zs1_xEpGYUSG3saDm3K2r13IO3vdeHEkGuV5S99Ep6ylcJFC3Y9UyALf5brtfI3Db6WYIXwvabHg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.89.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-89-75.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

expires: Fri, 30 Jun 2023 04:27:31 GMT
pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
480 B 32ms
29ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/e/e.js?r=castles4kids.co.nz_auto_interstitial_desktop&e=nai&dsReferer=Y2FzdGxlczRraWRzLmNvLm56L2Nhc3RsZXMvbWVnYXNsaWRl
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.0.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-nf-request-id: 01H29B4H85WTWRATZQF3W23HPJ
date: Fri, 30 Jun 2023 04:27:31 GMT
cf-cache-status: HIT
age: 1775635
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "184c2b34ff0390c3de60fb1a3213ee4f-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 7df3a8405b2bbbd1-FRA

GET
DATA 200
OK truncated
/ Frame 760E 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 34eeb59111944b07df9d758f09f9805cca5a3f89704742c8914befcbc068516a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A023 624 B
242 B 67ms
55ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CO_4sqYCELfrruECGJaGxucBMAE&v=APEucNUNPAx3bXcV16sJazw_FgUIRkcE7ecacxVHWcq4bALilLy8eKpzsTCQxEN2M0Cku3ML7x8Z0GJhXhma_01V0nxyp1BYdfM_On8UBPE1pkZU_H4DVEalgzadg-KF8CE2W0d7XMolr0PXKW5Hm1C6yotSaS_qVCElovpICCJjcgSBGLyOWNyPiWKQzYicAtQnMbWj7WLRX9sBd39GIc-SBUUa94Zwtg

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 30 Jun 2023 04:27:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame B795 78 KB
27 KB 119ms
119ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:31 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 30 Jun 2023 04:27:31 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/ Frame B795 3 KB
1 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/window_focus_fy2021.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:50:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38232
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:50:19 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/ Frame B795 20 KB
8 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230627/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

abaf64de0855592138133fdf15c746a6e47a07d5f7a34a9513a06994c89f91af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:50:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38232
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8312
x-xss-protection: 0
server: cafe
etag: 5477749917372345267
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:50:19 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B795 179 KB
56 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6914d47718a28ab8055edac273b3aff57e64e5bddccc616c2b7e355fe986f39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57260
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1687952195399670"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 30 Jun 2023 04:27:31 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame B795 42 B
63 B 53ms
52ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CEylh54ACmjyXutdsFs1YOJMB7zf5n54hymTRx3KvM_Vtrg0n6MJEseAHgxHxwVM6Foe4V6TwVUV52qkqNHKiSTgujaqDrH0ro65AKoWBya4zHq3c

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B795 0
20 B 52ms
51ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=5662488014079942450&x=1&ct=76

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame 766D
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1468596/71180196/4.js?ias_dspID=3&ias_campId=1011988055&ias_pubId=pub-3831894559014614&ias_chanId=1&ias_placementId=20070744135&bidurl=https://castles4kids.co....
https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_slmeZOaZHdqz9u8PxdCyyA0&cbFunctionName=goog_wrapCb_slmeZOaZHdqz9u8PxdCyyA0&true_pb=

1 KB
1 KB

6ms
6ms

Script
application/javascript

2600:9000:223f:ea00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_slmeZOaZHdqz9u8PxdCyyA0&cbFunctionName=goog_wrapCb_slmeZOaZHdqz9u8PxdCyyA0&true_pb=
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:223f:ea00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 17:26:18 GMT
x-amz-version-id: c567TBReTKM9m7VfCfOmpAHbFN80zD8c
content-encoding: gzip
via: 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 298874
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Mon, 26 Jun 2023 17:26:15 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: QtoBP5cg-4VhefVEMYB4dpaYEtdUvvCTP-pzEL3bu7yKnGaLCoLOLQ==

Redirect headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
server: nginx
x-server-name: app07.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_slmeZOaZHdqz9u8PxdCyyA0&cbFunctionName=goog_wrapCb_slmeZOaZHdqz9u8PxdCyyA0&true_pb=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame D8FD 91 KB
23 KB 41ms
7ms Script
application/javascript 2600:9000:223f:ea00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:ea00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 24324675
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: XlzB9X3zgpSkKZopoTM65W6K6mq5uc7nlspnfocBk_4HRlHd1qIR9Q==

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/ Frame 2DD4 30 KB
11 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CAtOVrV6sqtYaWaLHksoy1cm2GYG0uOWXxJyIC4XSZEuhYz9L1Ug_LM5AXzBDykx1h7Q4vHUlHs18jNv69Ql6KJydp2C5UXkNB0QCxlRi7N2_8nJg38vBk3rceqOiiDx-3v2AtUlzHS4NB3xGnfPCazLKzFEhGCqLd7YUN6JnY1DwZwY0&dbm_d=AKAmf-AkaI36Pr_Wnysmj_oyXBCM7krGpv_IX7o0x8dHpcAKpQOqhi-iWjJa6hPire6OmIbGEfhx9kGC3rWedfg9CNxMyHzexStks5xQQyU3caP7-4yHHLJh5Hx4H-XXFrLWf4Ecj-5uRZG-pNGBjoPHnYBMgd72lOba74jxBqED0BxJ5_Ew10p1mbQrfZUkcfvPhDHHyuylJNuX3zjpSfDwO92UJahE8obJ0eMyopYHpW8zD2EV2tRBS5aUXaAxgKT-GranIdvJlZ23Q_98GsGNHzE53K22eP1Ahp_KX7ydW_AoEcwQ4dYuGXIWgdxticZZhg-E9e1Op0w2LccLb-dGQJcxvdJYrruI17_4MRUNWWtzLJ-6kBq-VSB31lH-GZrXjlkm_N5hVxMRo8Z7yJjv_DdTr7vfGszIoOtajnYqgUjtb-P-4RadkmjqRZIdy16LnjECBFGpoMKfV7pLLeZCXmk97ezv5LDsglmWhhiGHQvFSwrhAOnocBm27PI-ndWA9Kweb78XyTTnuWHBeGDwy5stmH-Pb_BdKW1puCgMadHJQizODxFx-Lg5fi62mHA6gcE1wglOMAtFYIeneLlfhwRBOwj2WyRoVCTeHaKo5QCb4j6XCKMFtx8qqnRCz_e6qGQ4qZHlIyBQWRE5gyW1zv503qCOsU1fQIY1Pb0sV1ErNYNSQuvJc0IbqdKYv7pttoCiY2mtCcC4wWlaibltgRP9Iv8z5HKIM8kzv59L6VDhtjthel63cTan9kNkX-tyAixPzj8O7lZca9KO7WhNNmltsRJXecSpif-mNcneVrGxwcP5jjHWS5GN9xo53BIRav5NAcRe9mGmrx_tliPj6HMikKipZ6E0Hlg82d2H-Cftkmd8qEnJG4ppIFcVLpzXBRflQmGHBPUpa4d__HCF0L6AQ16251hoTRnPxS0F_4h2bqEUFfB0HUIfOPT-o2nsEolccewJdOauWvY4Uekb6WRFyOwjDGhQt72owt1HQx4oJP0LpBxIhuTWCqTWEDkxt_RIakmvq4gyWX57rtGjZIwqSiir1VQ9kK-PmUluVphh0g9HjkUz2Hx7WtGl-YD4mceQ_ouw3MRCh84Ms5P8KC0L3rSIlbFL7EECmGHN-4Le1ClDjUIhEdi73DdlUvZlfo-Ll32BSw7uye7SVcJciaOZN2jpq9kthCI2hyF_p7yfbsyS28YR5_6z4ClwvkmOsmEPhKwcqg4BuJcp25WxZJ6ALZZVz9BZKtAVeHEFSF01VgE-83F6RfN8VymWueTeBZJLhSR9aNVgGYyuhFhwVtUqJo36R64UuYOwfCh_JBliN3i_uGOFg2L7SK9SiuEaGjf45fETeSElAcHw_iedLQosPndIAs48g0OP5lClZxfnvPX-WpZD2UihwmlkRDUCZkPca_F_WSoJ38GOAw9nRA7k3G8e_ctgpn-ttTVsfU0-4kpTWNpORXG3FltCmT8PnZnyebgLGpes9tQqe81wHAVaNNyM7S0_Qzv2eRR-7xAsIDgVaeMD_twHFzHkQskMBjPU8AX8gPDg36mRBjoSCB6qZ-NfGMJkHIYwj0gEXL55XhGVNVla3xs-Z3F8hzwekoFsv6FKlTd039MngzRCfmjQQSOCQwlXT6JVTzt-e0-8FZUtljRbAB5nJSq25ApROmL8tjLoXOOEjFAmXxxEETnMDDCyt0l8GGnyrAoT3S9QbUA-dgoSU6lfAtDcNAo9BrPaetVx70V-z94fOTOMKJT8MDsF2D0zNolqijjh3_7Zz7A_ki36ZEi8b_zq8OidABuDGueqGaENYY_12mkA4A3SS4DR81x6AWQJyTQSlpHZ06uy9rXJxAoLbZau8S6mTatV17pVvTXpEYs5NHvnWdu02ZsXZoP9GmTP5BGxW2h9r0r1hUMM0Id9Gg53gY_29i8sGj1_E3JSABNZGVDwhco4_0s9-xM73gPc1EC7zWcu57vDjlgYcrM0T4Bdt4fM2ibRSipEaLzZmw_gyqWrXk0-HSllsJw1HyfLInQGVesm0WQRPT7CNctHLIv7rbcI48iN1WJlZEy2fVV6AtnzuSaTQBde2cOXAHl6rZSu9LS1NcOO74oHE-EsB8UtqwJcUQAUXUil9lDV2RpjgP3T7nOcYwLyp1VL6YjnBKOV7gl-6JVljw7Wjl0ujtb8R0x9adw9EUdWuczVm5sTXOVp-YgvDA99eubQB-wLipUBPBpPtMEuAeeJ1hG89jrBQg4J49BB7mrc-rMTcpkhbODwmzssZ8zK8H4izhYu6pAeNHF_flRMwcsjtT04zVpokeUBYP7IIW6w_-EMyhMT5d6fKpVoydkmR8bt_r_I9Nix4BHhWofIMAPof9h4noUdyc1tjTlTZKiyeDkoyUaF9FFJCANgNvhESkvcfegTielRAKJpGbvF4JhoGD_6JZOItoCW3UMjKJRan3VJysV05jtmnPajZgnoEwq0LWCUzsREGEwbGzndSgSldfl3Ye8yLbgeWUh2YZroBTPrhyELbn30yZUbWytiWwLtcxhUn4Q7dWfONBw5ILjPtcIbFJam76IVKZsr0c1mq5qpjCSVoKxvSNAlXs6QorNIHq56WgZ8oSKm5mZrx4glivTI-EYXXUrkukwpt1IEocu20nR7iADccBqZalbFOxWB-Z01IkHx344ooZu8kBwHzIzA_cMQedgUZ7_e8FcZ9CJniY1mktoVQVrUEYcioAn56Nf2SlwPQZdpkdpabjkUNmlAcdGYfN_wskzBpCIjY9Ww2m8ZoipaILX8GCNyT4SP0qnysHncL1uTa2-qQZdeVn78b-K6hXgtCQhvZEnc0b7yHw2KFyRvyUny4I2UEL2OWjNtBFeoVbO4ulzzj-KcR88xeAOWqAAhkCDo5ej_KEJGiHp4vzOXhHP7K0DyrE5e1a1BIEb_-Dqxtk7zPYZs98Pvn4Li12YnuuGgBZ1nAKU7Dfa7ECC_3UMDHpfFNK_TyZCR7aQJqPMMKvHAgNqBHnbn_dkTF2BkfvL56WSMHY3-WaEa-sDM0Ey790MSi7xpEYUqIi8qFrD___H-dC9p7S8bPqUYuaNsDYkSHnbfVfiMTGalgnbXj1yqta-4LpbLZP0hHIpTrybV4nBE1VZ6mqIxv4xVloOY5Q40u7NtPq1is6ak0iyeFQmfNqWjj05KkjhhBIUpysEUlerGQqyHyJmQ2FP-aaTyfTCpa1uW29T994rtdXD_PmAJIFVMjgoAHM5w8nVKb7i9dp0XVSjdJyZl_pfOoSo8I3zcAAzDGHfkF0cXA-94R9r0GFO4YXobjwElp5-g5Nw3qaG1dmSL8pJajSIqiPE5BhzGL9D5QFAjaINZxMUpeCZ9yRf5Xix13tBDNXCjYJH5y1ccGPzFxe8tcC-WC8HEmA0YgSOUEZ0ukSBmDZevUMn_Ki2xa_BoPVnqaIBaIAegFCs0yAybtoIwXE69g5tW6X-cI3NkNXSV_9UUB415XM7zze-IosClCbJ4Uo6PZOWwKG5OnsJQ3M0ymrnHZtAWVIEK5BQEugixJ4FYiQ3oMo5u62slPTv1DfbkXjHOuQZNxeV0Awq_ogTa9UrwXawY8JkI8xSa&cid=CAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kids.co.nz%2F&ds=l&xdt=1&iif=1&cor=9695775464173662000&adk=1877897943&idt=125&cac=0&dtd=26

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

484eef6459e8a58c19115f287339366d82a7c2beeb7a35c7e16789b592515aec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37853
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11545
x-xss-protection: 0
server: cafe
etag: 12064860844701496540
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:56:38 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2DD4 41 KB
13 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 07:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 163082
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jun 2024 07:09:29 GMT

GET
H/1.1 200 /
d.agkn.com/pixel/10690/ Frame 2DD4 43 B
621 B 101ms
8ms Image
image/gif 3.72.196.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.agkn.com/pixel/10690/?che=1491396748&cmid=24712142&sid=4128031&pid=293334414&cgid=486689445&cid=144545649&aid=9533159&gdpr=&gdpr_consent=
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.72.196.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-72-196-231.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:31 GMT
Content-Type: image/gif
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK dvbs_src_internal117.js Show response
cdn.doubleverify.com/ Frame 2DD4 57 KB
19 KB 17ms
16ms Script
application/javascript 2a02:26f0:480:9::210:ee04
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal117.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=14526021&cmp=145089&plc=vtnwou&sid=45f3d18e47f96c&DVP_PROG_REP=1&prr=1&DVP_DV_TT=1&DVP_DV_CT=1&DVP_PP_ID=3&DVP_PP_IMP_ID=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&DVP_DBM_1=1861733&DVP_DBM_2=26833064&DVP_DBM_3=16267991022&DVP_DBM_4=327231618&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=1944214853903&turl=https://castles4kids.co.nz/castles/megaslide&DVP_PP_BUNDLE_ID=&dvregion=2&unit=728x90
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:9::210:ee04 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: c74d4c8be63fda641c0e0255ad3c7416862f17e31442a1a0ddd7645bc2d69d3c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 30 Jun 2023 04:27:31 GMT
Content-Encoding: gzip
Last-Modified: Tue, 10 Jan 2023 11:02:11 GMT
Server: UploadServer
ETag: "d07704704b2ea7cfd4b9f2d78f0c7dbb"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 18861
Expires: Thu, 30 May 2024 12:10:19 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0628 0
20 B 45ms
43ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9141959002047&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0628 0
20 B 45ms
44ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9141959002047&version=m202301230201&ct=76&x=1&cor=15124543859093443000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0628 102 KB
39 KB 55ms
55ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AmAkX4TvD7Uf-B3HTSU3O0rDjxtx72K_VOyAVH5KgiO6wpqipH_QeCZ1pL2oanb1RuykfVtVFE5-L_ffAUQh-muY-XNco7SCg3e1UWQOMLW4XdSGefcOAh4Ln9NWFrhJ8OzBcPOiXP3TZg8TcSd1v5wu12GwaEmyNHwnOTC91GZ8Hs_kY&dbm_d=AKAmf-De-PKtaz_0-Phir69f3C_Iux-UH0H5Bk7T246suamQPpdx20QUNd6goOR-Iww8tS0TWSj9MksxdG6fSMgM3RFg1PEApvdoTgcO2iO52cWTp5sIQWhQIAMKVaGDFJgKfNo_rWBshmaVTyYrn_c0SU8OdmC3Do-YjhNQ8_5EVx91rCRigUm61-CixSG8hdFwChPtk0NfXXrQHia4d60KsECJFpfnF3qFFNYH4-BW_MRj70Qa_VUIz6tFqmjCL4YK5voQtSJvfokFLHmGOGgt-QXsez6SjW4GX8ASEUqbdirU4U6diKdPt73YlBHXZuG350tBXEXXXyXqusWxGaln4c2qOZ2U35_g9QT1H0lEqEnI4G4_RCBEREBa_i7TxOKx2qbVORmB8g5M3R1MzW_kR4hFzjpZWZe43NUXCI3F-b-NosxSSZE9FSHPobfJvzu0fWb54fAajDxE5rS8HMu1sdhPV4vJRubrGE4NQOiZ4-TLwwKX5A7sIMzBW266ghPSh9jKGBMqKtBj4H9SgYIXcQ9AbwFKpdAPrdFyoSQWm7UBWHkZ6EV91H69vgjO9fkPQEvqJ-2Dry-iCgkMPcFQVTHbjRXS0qj_mOToqEaXqo9D4hRaXgmvvTMp7VzmI6VRDQzEgco54T90JO_ymCur_OohI8VQluaGyX5zGV5xigP7uwQAedw5ajDb7H3GOsOqShpIM1FtX2dNG-yCW2Hs20GQ7iP9lqrRHnidet6mUZQ4QcKsTVDLfh6my4demBrRuzmGVIdV9OF26sArXF2zfviFOp6d9x3uxp01sQk2sd7fS818YR1SUyvbp8UZz63cuAex22Og21ixHCXO-IOCACvsr3Wt6YQCJChy8GEAmqz4mi_5KRp2azBzbTcU1vHrb5dtLr6sNhj5HqTA7MIRme1MPBIeGDdKTixkhkVGsADZodxmMO89Bvb9LpdwGbap60WfpjtFC4-xRlfZ6MHpURDUjibycfsvJGbRY8fcznkbgkXRHHpXZdLQ0kIoKrvzNNNAze-wYZ8spaJmBmvSf7ir-HgHXq5OmqCXdGv3Ep-KxIk0HhuRgc4n3xFeS0dcUF95drXzuF0SOA7oNf_wX7s6BLmQKu9cBTHeY_tg85QuWQUxZ76s5CmprZVsTvspYevITZmZrfJEDkJOxm3Y1171opuvfcUFgcpSicZRobvaF8T3lshEcb9LgNfm1XxmPiiV07DeWSgKBfR6AGQ64bwrm3dZR3Wqv2nVRsGA9VYyymNQ0Laruy0h65iYu3eAm_RN398SvYOyLp6TcNGm1R0ORCqp9_OZH88CCRhC1hMiEZyRSftx11VjdrlvxKmmXMJTKP5KOUeEQPJFK_4Ac5ke0IJBlo2Vn7o8keGykfSPCzQ5xaBZbb5MJpxaYmQSvg6vmbvPKUBD6qxDE_rbFS2RTC6kEZQZkQtyAofvlMH8BKGRfWqju2dCxQ6zq1PD7WT8tem0EMLXMBnpHl33FrLTGcYPMlmN8QPyd1XJjBSkAI54cE0S45AplU1_5Yu5AKCMOhfTpeeez1RPAW59nzlKTTWl0TqdaXpeo-MPFlTE01NFE5XUjI-VvwJnC0BleL7GsvBMPDfu_Jo8OgiubXWqy8xWde2lTRTz--ARfD1aPvhF016HdAMdN2DtsPSNWLKYFlJ-dHuLF7jtP9ib-rxJA3FQMm0OpVHAbnqcex3r-W3YAKk9I5ZgS7ICS1zKY_q9lpFAv9fFRaP5fuINy3vdMKDtZ1rr6LV6uwGRwuvJkbZEnyHTk52ZPx916qRtTADjENuHwbBuS-YFIouHHVjEdMysUlP9lDermj1EraZQiu92c1ZyCgpUw0cI7zp88fcWTmXuGS1yfi9bq1S4qS9jAkSBv1JrwWpf_vu7oullsryHPYyZtqz4kBZ1LQN0U4RjjMTYmAI-ex9e5hJTUEN3GtdkzvpwWqcZhPMBot88wzJ9OconhnlekDWcXyVeqb1XX5HoCA8NxN7e6-rSWT_Up-70VLwhnQnoxozPJvlk3DP1DRbMpWBp9qMhT4qvmrXxJQ6KxGHgt8NguYEN7Fx6geRX31_N3mzk7hLX7BokL-qTAwLCnmBlseYUY_9qyQBmPZ11zIxZBXaJACSIOVVbtB7KFkkUfzY4oAx_mmDWFRnRHDaMue_sYbrr2Cjne_T8T0TUQv8vYe2gNkE5YcNC9QHMTZmWCKd6J-LFWttwfIAgdRiBWCFiCEh624CIaDiqoPvQWPnUzs4V8iTHpBZ4-EM9HWT3O1VxRe7q1NX3rdvkAiEHx0G2h3826pKjXjLGChUlwxAeBWIh1jnt_Gx0mfcRnCVhu6zRKLyHdMo9_jAFs_Vbr8T_nnlwYE6wt66JmkMhz40wmkEOH165gHmjONF14qx7FWIYrffRtC-IIIJVNdKR0hWG3x9O2tuHzHewugyojyW-ac59zaJ5qGwI1dUDPbJiCunJG7yi5VULx8pF8o_A6wfLxruIvPpnLGdfhyoktzimHuHLF2f4nyV_nXXZn32lXbEzSMJcv3PVoS9xPleO5uUx7_SegLnYuWSCOCA61CSA7oSa2R6x249hGy5d595HLfWDkmG1ChZqDcvECFdaNrr1VL9Gl1_5t04Zcfv9TbDBEGlkVb-yO6FQtBRAa3j65LE5aHx-vyZPMD6R0e9NspG6PLF5NSIkIG2W8LUbXS_YtWER8O0a-v774eYaeuCzzXbWcfToazpctoZEKQQYISN4gNywU6st1_Zxmyi1ibXriFvtB0nRpv_XZcdPXFRb2DDEHXIpEu_LCx51digjPIcy8XAelkNHHv4NiiqDn1JYVedlX6BsbrAYJ2LA_HbvTyGICFXyssYG6N2NAcAijn4_j2OtYOXhambQbuJhMNmHcWTyCsB5LGCLcXeKmFLtCIU-WIwgXcFm4dwzgFqgbqEK43JTdvKiRh_dDu02-1rxJEXzo-ceVT3YzgJBigiJZ3GOIgyTnXxeyqxZkfLvbNBkCjB3MLUOo0geip9D6elGLjRO1BlzKKy0nWYUHn3edS_fY6n_KPqID2zPpqnWIlLiY_KnPDNRVYM2tTmRzQVTFnfx-Cauoqs0VAk_1KsZJ2Gf3ritzmAb1FzpF7gk-gqoLJ4EMr1zi-NEaxAoE4FAVzLiwfgyvFwzk2VsS6E9n9MgdbaUAnSgugpzMA3JVtWN64jgSd6QF1Re8_JC6jS4KkaWVd3h4hWMYnW_MGnD-fN0eB6LO3xpzMfDvsCWl-s37q-PD8bWFag8-izDkRhbcUycHHAV2Km6LXQxxUGpZpVQyJkEyQtxjUCJWyyJj1AK6Qr18uh-IVmOUFdIN3KMxYZ4v9i0rYHEKi4GK2R7w9DCbcHTQ05ALEOPFmKFSTIEiMi4y_kMpNaOynaZ8hq56l5wzj_ZqFST8EAOOFux7lzI9JSZcXWkJm8nymYc0awCxIrfOtD-uwrXCW6TCbYcSq1VHfqphwn54-Ncn8iMJ6YPP3vvTfYE7IE0cT-MmlsQQCfVVgsY-vXw8FWX38WegQ-YCn-sg5AH5Po2wZIHOj1htIJtrExN73yg00IM5SbUlunQhtr09ftvIbHHn743KFey6p7YOnOfDB68d2NvNumxTcFd-Kabfm4vQo8wNaBkfrZGk_2XAjoZVdQn&cid=CAQSOwBygQiD8DVjUqqlwIdi19mM66bRVIZyk-amOq3Z6PTX9rM8GgQzgsabggCzxe7Zx02XuLKmqzYeaxFzGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kids.co.nz%2F&ds=l&xdt=1&iif=1&cor=15124543859093443000&adk=929882891&idt=205&cac=0&dtd=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

613e85c365198bf2ba8560a5cbc956af5456752e8f2f0365999f54306025cdac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39892
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adchoices_default.png
static-de.ad4mat.net/ads/img/ad_markers_folder/ Frame 4B30 3 KB
4 KB 59ms
19ms Image
image/png 2606:4700:20::ac43:444e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static-de.ad4mat.net/ads/img/ad_markers_folder/adchoices_default.png
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/style/0.1.48/one-ad/default.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:444e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 159
x-guploader-uploadid: ADPycdu_bETbAO3L7E3ZwmLe8QxiVBASGCjfRAxwlm_tkXJYko3jNEaJxZb3LISJ1TPqVw-ds5Su5eyQQRqdQCYhbG3a5A
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
content-length: 3262
last-modified: Tue, 21 Jun 2022 12:31:17 GMT
server: cloudflare
etag: "794c84d30e213ec6a144d64215f07551"
vary: Accept-Encoding
x-goog-generation: 1655814677405990
content-type: image/png
content-language: en
x-goog-hash: crc32c=v7nNsg==, md5=eUyE0w4hPsahRNZCFfB1UQ==
cache-control: public, max-age=7200
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fkLI36inI2znPaIH5%2BSB8K%2FKlKYrNu1JJZeD249Y1ryxRV5JBY5G1auKt0Tcq8H%2Fe8a3Eh67I1ZdPsIX4coXauxJtTPVPGjLg8RThM8npvgfU%2Fv0Ws%2Fx%2FRyU3GzJRcKQqITDe%2FKmECAWUoR9mV6OXyzz"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 3262
accept-ranges: bytes
cf-ray: 7df3a84278cc18db-FRA
expires: Fri, 30 Jun 2023 05:15:00 GMT

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame DAA9
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1468596/71180196/4.js?ias_dspID=3&ias_campId=1011988055&ias_pubId=pub-3831894559014614&ias_chanId=1&ias_placementId=20070744135&bidurl=https://castles4kids.co....
https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_slmeZOqQI6Cl9u8PtNGO-A8&cbFunctionName=goog_wrapCb_slmeZOqQI6Cl9u8PtNGO-A8&true_pb=

1 KB
1 KB

6ms
6ms

Script
application/javascript

2600:9000:223f:ea00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_slmeZOqQI6Cl9u8PtNGO-A8&cbFunctionName=goog_wrapCb_slmeZOqQI6Cl9u8PtNGO-A8&true_pb=
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:223f:ea00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 17:26:18 GMT
x-amz-version-id: c567TBReTKM9m7VfCfOmpAHbFN80zD8c
content-encoding: gzip
via: 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 298874
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Mon, 26 Jun 2023 17:26:15 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: _asGFvqswIWTkX1Q968YGMFEXfPUldU3ypf6Fh_8FA22v8PMdGdS4g==

Redirect headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
server: nginx
x-server-name: app01.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?adContainerId=brand_safety_slmeZOqQI6Cl9u8PtNGO-A8&cbFunctionName=goog_wrapCb_slmeZOqQI6Cl9u8PtNGO-A8&true_pb=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame DCEE 91 KB
23 KB 8ms
7ms Script
application/javascript 2600:9000:223f:ea00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:ea00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 24324675
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: E_RD-NsN178b5gzD7R9rJ8aS8QHrqTh3LNAaF-asyOGbwmPrkF6hTQ==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 766D 43 B
215 B 595ms
178ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1468596&asId=3e39a8c2-4ca0-83a1-f9da-3ba6fe947178&tv=%7Bc:gZzXpb,pingTime:-3,time:297,type:v,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:43%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:297,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:43,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B287~0%5D,as:%5B287~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tIDqqjO+11%7C12%7C131*.1468596-71180196%7C1311%7C1411%7C151%7C16%7C171%7C172%7C1811%7C1911%7C1a%7C1b11,idMap:131*,rmeas:1,rend:0,renddet:svg.us,siq:46%7D&br=c
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
server: nginx
x-server-name: dt06.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 766D 43 B
215 B 592ms
180ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1468596&asId=3e39a8c2-4ca0-83a1-f9da-3ba6fe947178&tv=%7Bc:gZzXpd,pingTime:-6,time:299,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:299,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:43,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B289~0%5D,as:%5B289~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tIDqqjO+11%7C12%7C131*.1468596-71180196%7C1311%7C1411%7C151%7C16%7C171%7C172%7C1811%7C1911%7C1a%7C1b11,idMap:131*,rmeas:1,rend:0,renddet:svg.us,siq:46%7D&tpiLookup=ao:castles4kids.co.nz*%2Ca25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com*&br=c
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
server: nginx
x-server-name: dt05.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A023
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpyFYFDbSJ-Zw0DBs1fPnM&google_cver=1

43 B
632 B

10ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpyFYFDbSJ-Zw0DBs1fPnM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO_4sqYCELfrruECGJaGxucBMAE&v=APEucNUNPAx3bXcV16sJazw_FgUIRkcE7ecacxVHWcq4bALilLy8eKpzsTCQxEN2M0Cku3ML7x8Z0GJhXhma_01V0nxyp1BYdfM_On8UBPE1pkZU_H4DVEalgzadg-KF8CE2W0d7XMolr0PXKW5Hm1C6yotSaS_qVCElovpICCJjcgSBGLyOWNyPiWKQzYicAtQnMbWj7WLRX9sBd39GIc-SBUUa94Zwtg
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:31 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=494
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpyFYFDbSJ-Zw0DBs1fPnM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A023
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJ5ZsvnQTm5e5ZLOFj-4aQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpyFYFDbSJ-Zw0DBs1fPnM&google_cver=1

43 B
632 B

8ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpyFYFDbSJ-Zw0DBs1fPnM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO_4sqYCELfrruECGJaGxucBMAE&v=APEucNUNPAx3bXcV16sJazw_FgUIRkcE7ecacxVHWcq4bALilLy8eKpzsTCQxEN2M0Cku3ML7x8Z0GJhXhma_01V0nxyp1BYdfM_On8UBPE1pkZU_H4DVEalgzadg-KF8CE2W0d7XMolr0PXKW5Hm1C6yotSaS_qVCElovpICCJjcgSBGLyOWNyPiWKQzYicAtQnMbWj7WLRX9sBd39GIc-SBUUa94Zwtg
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:32 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=493
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJpyFYFDbSJ-Zw0DBs1fPnM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame A023
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMtvubrJt0EXguYkvso0Cu0&google_cver=1

43 B
1 KB

34ms
34ms

Image
image/gif

185.89.210.180
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMtvubrJt0EXguYkvso0Cu0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO_4sqYCELfrruECGJaGxucBMAE&v=APEucNUNPAx3bXcV16sJazw_FgUIRkcE7ecacxVHWcq4bALilLy8eKpzsTCQxEN2M0Cku3ML7x8Z0GJhXhma_01V0nxyp1BYdfM_On8UBPE1pkZU_H4DVEalgzadg-KF8CE2W0d7XMolr0PXKW5Hm1C6yotSaS_qVCElovpICCJjcgSBGLyOWNyPiWKQzYicAtQnMbWj7WLRX9sBd39GIc-SBUUa94Zwtg

Protocol

HTTP/1.1

Server

185.89.210.180 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:32 GMT
AN-X-Request-Uuid: f4c5c614-5234-454e-a80f-0a9fea8da368
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 45.141.152.73; 45.141.152.73; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMtvubrJt0EXguYkvso0Cu0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A023
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTcyNzk1NDgyMDczOTQyOTkyNQ%3D%3D

170 B
188 B

21ms
20ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTcyNzk1NDgyMDczOTQyOTkyNQ%3D%3D

Requested by

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 30 Jun 2023 04:27:31 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 45.141.152.73; 45.141.152.73; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 7f546d33-4a85-4ec4-8d0a-f5e8e89a51be
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTcyNzk1NDgyMDczOTQyOTkyNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 4CAE 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 163018
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 Jun 2023 07:10:33 GMT
expires: Thu, 27 Jun 2024 07:10:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame 622F 15 KB
4 KB 33ms
15ms Document
text/html 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

21586b9479aa457ab39c7a2e8966c893a71c824de9e9bc6d9eecf26b4bcb6b0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3799
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 30 Jun 2023 04:27:31 GMT
expires: Sat, 29 Jun 2024 04:27:31 GMT
last-modified: Mon, 15 May 2023 10:28:15 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 766D 0
0 134ms
65ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuqwcHcz8BePNxduWnjPfl1WHBQDXvbyLXemD_fcx0i8pWjHE1lXg5Le6sYa8eYfwKZa0BQD4QMonFJho-UT3m1t76gRFQmjTMB0g-E57hazffVx1xpYsVDXA6lwvqkOehJ1f70K0fBescuvlpV2OJ0kMUOW-L52f-g7iZWN3P6cIXSwxxfDIAl6iVfLJ_SjodXVpLiFsuCAGKZ7AqwwNkRcKkUeI57XJDM7VIupKQ4pe1ATCf2VkB35j7og6czCe5ZZ96VxbB0UGIr5351FIAl59qBQFRXJPzWR-c8NRyREvocQr2c76hV2aCHnQ4rdlgb_7PFwhowTqJIfo6zgbKB6qKcXDKK9kJUUvMt2VelH-kUkataKWaA0aEwdozSmhJB0gyCHO8V-o3xNEVcQkfK6o3Glv_S_tUeEo6atMsTCLrBeQktUOAH7VwC7OjD4e3J-BievJ7bqjm6G5e_fruT40qM1Ijq8CSOq-eCUVRLI4B93YbnUpWPUzm-CJxNW1MOtOqBYkXNZJ_IamGyv7QZ5x7hUr-UPFYNYeO9OvjAUqARrrx3hnXVXbc5vH2fSNmZe-frMgnyEu8etCO3APRc0PmK18J08CFLMQOLPhCodjpgVTy4dNQMPjity_nGpsMnUd6orcehYZPkwi2cwLMu4igk3QLOf80jf8c8a2_iBJflXntl5xxh34YraRhaQrD-h9wpxQMp8RqpxRXQnoplMFy_CEG8DPNz8XBdmh5akpDh0oXjwb5tn6Dqm08NCmvSPSnYjLYgdRS7mnXkrmRcfl94xcNyaB5w8Psg5xAAJ4-orlA1JpjesHmhXQLHpzCysUPhYq-W_NS_xuFcQROm66Fu6-gUn6EwXt3S_BMu9Dzx9iNjZ4zvHTh_XoAi2F9KtuzRyTqsdFfzS93ZO1kgRNsEB3QhanlubTSqpCeSelr8FL016ggRvmAYRrq0CSHSNUuxXHFeUDimuNrEEbldJ_5Vk3-fq1IGKQsH89ua-kQP8SXgLGMCwHS4w1AUToWZ8gGBQKt6saWOjzx5jsPCYPTkZv4khuA6GRNWvnP5ENhtv0kkY5ljwK7CQKpDZQSAq8uQctddTIs1hp3KlCbg9xSV54gAvv0KsZcvnOXCuumH8YTMAVUU8qmuW23oRYvKT8fhXCnyR_mpkLYrSqcTP1N9cAsgySZIfkKTjZ7pa54VhXBKGPDzvP-wEGR7lQYKhYvAJCyjL7diEjUqX5a3saGvDqLh62l2EAP3Nfr-iv-14Nn7QqCGfSCeMepkj5uURPdjrYK2uAVHshdbKLMob2VQGg&sai=AMfl-YRDbFglAh8pdSLkQX2yi8PF5LUEH8rXyMe9_n-wCzIVDyBLjnVy1GbUmnD9cE7Rt0dUS-W2XCSDr72xVt4wshqgsiYYjP0eSRzEiLR41ukjOwiCCTDGvT9kPtDZnrWEYUawf49rybmMpo1w7gHSX7-KOJaC4NZzQQIJmcbQhuNwQC7ieUuHS383ZuzjpLnTgjQb2ZjQSWBFfa68tYCGesyWxQb3iAONsIYQ16VbKK3uhpa66pCdBunT_ReaZmTO6IMdHfNGlTAtJ6U2YO9_Un5hh6nv1vSO&sig=Cg0ArKJSzDPJ8Ek0yCmHEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1003&cbvp=1&cstd=987&cisv=r20230627.92867&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 30 Jun 2023 04:27:31 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 30 Jun 2023 04:27:31 GMT

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame F965
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

28ms
28ms

Image
text/html

2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/castles/megaslide
Protocol: H3
Server: 2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Redirect headers

date: Fri, 30 Jun 2023 04:27:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DAA9 43 B
216 B 477ms
177ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1468596&asId=544a237b-fefe-ee38-95ac-6ddcb389d2ce&tv=%7Bc:gZzXr3,pingTime:-3,time:207,type:v,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:28%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:208,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:28,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B199~0%5D,as:%5B199~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tIDqqjO+11%7C12%7C131.1468596-71180196%7C1311%7C1312%7C141*.1468596-71180196%7C1411%7C151%7C16%7C171%7C172%7C1811%7C1911%7C1a%7C1b11,idMap:141*,rmeas:1,rend:0,renddet:svg.us,siq:31%7D&br=c
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
server: nginx
x-server-name: dt08.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DAA9 43 B
215 B 474ms
179ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1468596&asId=544a237b-fefe-ee38-95ac-6ddcb389d2ce&tv=%7Bc:gZzXr5,pingTime:-6,time:209,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:209,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:28,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B201~0%5D,as:%5B201~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tIDqqjO+11%7C12%7C131.1468596-71180196%7C1311%7C1312%7C141*.1468596-71180196%7C1411%7C151%7C16%7C171%7C172%7C1811%7C1911%7C1a%7C1b11,idMap:141*,rmeas:1,rend:0,renddet:svg.us,siq:31%7D&tpiLookup=ao:castles4kids.co.nz*%2Ca25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com*&br=c
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
server: nginx
x-server-name: dt21.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 766D 43 B
215 B 611ms
347ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1468596&asId=3e39a8c2-4ca0-83a1-f9da-3ba6fe947178&tv=%7Bc:gZzXrE,pingTime:-2,time:450,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:1050,beZ:1052,mfA:1055,cmA:1057,inA:1057,inZ:1063,prA:1063,prZ:1084,si:1095,poA:1097,poZ:1144,cmZ:1144,mfZ:1144,loA:1348,loZ:1354,ltA:1500,ltZ:1500%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:100.100,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:43%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:450,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:43,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B440~0%5D,as:%5B440~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tIDqqjO+11%7C12%7C131*.1468596-71180196%7C1311%7C141.1468596-71180196%7C1411%7C151%7C16%7C171%7C172%7C1811%7C1911%7C1a%7C1b11,idMap:131*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:svg.us,siq:46,sinceFw:402,readyFired:true%7D&br=c
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
server: nginx
x-server-name: dt20.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 frame.html Show response
ad4m.at/ Frame 05BE 2 KB
1 KB 19ms
18ms Document
text/html 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/frame.html
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d485f783c7cc440cba21bb750ce67e191bce0783bfc6cff5f98e236e401b7ab

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 753699
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=3600
cf-cache-status: HIT
cf-ray: 7df3a843d86b9b98-FRA
content-encoding: br
content-language: en
content-type: text/html; charset=utf-8
date: Fri, 30 Jun 2023 04:27:31 GMT
expires: Thu, 08 Jun 2023 00:41:56 GMT
last-modified: Thu, 25 Aug 2022 14:12:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rUdzOBOeIQpat%2BdfK6RMa4rovpF0Zd%2FAW0NIRJGeMVhMWBG9XXn%2FHk%2Bi%2FnYx%2B3I0Dw7DNQWFmkGNrOBcktLcJPloDXjvQWnZUZGT8J%2FqWKYaFau1%2FOBtnLZervmrSpZmTsyqBJ4%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B795 0
20 B 42ms
42ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=423099571648&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B795 0
20 B 43ms
42ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=423099571648&version=m202301230201&ct=76&x=1&cor=5662488014079943000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame B795 102 KB
39 KB 52ms
51ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CjvaaLNVTYqPAG3hplF-oYcXWybptKKqb3GEmpdfz8Qg8tIgqueMD6BXohWaqMfKPKi4JH7OsNmD6u-LFRwVzvu2EM1tqaCRmEF2LmGkUAWPIk_XNLO0QY_95mbtDIHCgw_PcL70k0L-I6QnYYgJm-DIYkvqgpQtviRkFb3DA08utRQOo&dbm_d=AKAmf-CtoqnY_C4FDpmktVmti-AlTo8NgNUWwlVp5RyMnWluXVRQGugGoZf-yN4m39qCrqSNsvtX2m3ieZt0JJN4YjtNEFSQ24AuqHLeEu7fhtQFIvh0uOgYcQfgVhFrsD1w3aiOCeYGiPXK2tDfc0nczeAtoc3Rnl-gZU_l0SvVAqEE1xxXxwfFuwnWtTiFAH3NP2hYt5Hi7xHOi3_8qvXw1KSVIQxujMHwOEFrL05QWbPgjBppOhOWh5y5ATebzCPpek51j99WLPZLiig2uhWJnNRZfyAfMd3FBrBsKC_QJp795dGSlqdZ0NyPmZH48-qIU2VsI8yJgjYqd5TwZ1bha6ilamTxHtmwQ98gj9gdqT6aUcnHBbtkmNlx_hhD2iTdgQ_gJ_OXaAAnL0lDxLLbKYrb8AI2Nbt5SVll0WJ6uGFDG2MijJixxNRmMgVQ7cgH9lkhH5cnfI2Bvyu5owDnWTFEma-x8RrqwEmaOWVr_jwDJe0hKNa2B_lCmfj0mJeaDx7Mpk0PULPnAjxkLuifb2gKCdstdUZmIdzwpQUZLkihF8byueT_kE5-sJzDS7PrbOEkJHi0HszoCtqw7Bx1CIAJWoVeQUhKN-X_xTNAfLsb248FLOiWAttvW3nQfE6PegPZnB02Nt9KDXPLiB4LxQKPrFuXmOkNIfrfn12teOMCIwDT4XKvScU4nQXnylBBjHi0L4YgZpd3cE8ZfXx5b7RM0_Pah2IIr8tmuNgmB9WFNIKt7jLOmsU0KrHwt_wTOz5YGqt-88ebqt0aN_XTItJIPrmwRF8b_m7cqOde918ZmbUzzDIdaWKEsz5zE4WhrP4gJGOkh7TiaN6df1BcFpgALFw17BUQGhMbhozfn3aFvz8aMiRvjK64lx8EC4cEEoTc3UuHXfdDkQd7JCPD6_gH3DiGWXqnC2MH6OMhL33BpS4EVeByrag3K9WhvSxgVwuvcyc2eC-hKer0u2y2VyPLBcRRxJLO8tzI4nZ4WaxWw4G-qjFGFFt0pfFoxop8rdslg5kjdDnIbhxb0OAnyItRaP-PsOPaEcrnoYIOWV_3F6mya2kf_qIRxIteoGwiWcg-OCQ7_b38DYHoyhX1NMYJWtBdJmVHMkcGJ2sGu3p-YrHzRiC3shd7NMdD-dgIVCVbcVrqslnIXesizJfEw3Y4OB_WpialcsR7qM86PEfwMNQaAuS8RQlB5ZCrxuSSIOAblurV_9RUyBWy_e5Bimt8sA_yKAIB8PI-K2GAgmXJraPzuyBEbwLMfacRVi7WUvFgEsYol2LkvV1TLZBV3RjaTBZw2wCrUPqpMy_KVKkeAMUvujJ-ylEvgmXkYxdkCCZg5gfsqSrKU-oW9v1F4SJgGy4RAhe023UyZYWGSWvmvn587xQM0yvjuU16OiV4S-2Te6irEqZY3wn2PA9HwgB_tQDtjna4hHBSskentXtJFoTt3WJBh4w9Z41OKX4WY1wDKdyPhMeJHku_-GMCWRf2Oh-0niZW4ped9qgTmiin7yn0I440cnHIK-67EwWFbv0AOFepS5OSz1FYOlAekv9iPRLVtuUjIlGZA9jzvP3WBO4-o2UtEqoht-j_N8MEM-3895NjVLxZO_8lZhlnb1ufpJI9fVuixmjLVzop_S2u3xB8R19JYpPsfe0m5DZWgeH1-QOemmkeDb5vJHFfSyzNggCk4XN2_-8dUbf767uIyFsCiwkdooPmvnw3-hJdInBxen-yVlugS8g-LV6xUPAgTEpTdufTuXt1Qf5qH88kyEgrGdLpxw8q7MSxLmElXBx-NrAbSCrVie8Avlj8tlfjAKxNDB9MYsWF2mUdBqviwBlse6Kjto_tPWZ2WkG3zP4-SVyA0UnyFlWJfGylO-gUxAest0I0ga6-Q_UUqdNfMErGHOZm9j3Hm1xw3e9mU_nF1gVoeMR3992FWpgyNqaH27rtWsOqH07X18xEAOQwpbcaQ3BBrKn0cj8px9PRDR_ZKtTWHYJb9FP8bK0uMpj_Uw32X9SvlVFHE7rSJmgHT18v9-XlCX_Rei2-8fIaNhHPayClh1rCETcDpCLJg0Fi9Lh5FfnYjfFdWhKl7rDKx6PPoBknE-_LPexO11dl9zNukwUhOmVvnICFlyTw0Dy52XQjcG5GefSooEKrYTpnD54T6w4GHyLuUIr1nhmfEwmv20lHWPhlnnHqsFggTqrmdRfnwDvfwxqLZizbZjriMVWvinizF5Mkk8kPXljNxHs0GX88wZbuEuE_eHMKlWWIcHrmRTabsvrxR0ayIePHGfxBJC_O9eidWXGLwweUnuiyL-L-BPQlCyKBWEYVV4Xmwo_3T0xl0G-4DxPu8VQeWDfBhQJU6CCuhwwyRe7O2jFRSbLzzQMbHmd4vlnY-nGAgEUf5QaGVzK2vWn_R4HzxKA7Y5fLzIk3CQC_Tfyds5v07pIr1-V3wj0LRP1cJFb8j1G_bMaOJ1Lxt_fdR5S9kL9KLO6qHsdA6fqm0PSozb1S7L5WK7_dWHHaTMd8N90AS4Xxte-3jrifKZqel579H9wnad6__dRXWuUMQkzTRjTE-qQtSmvp0nE_z2AUm1gCOE73L7iuXBX9P_jDk1pNT06iiIseq5pVnOOsSrSCImRQq1DX9BCddQDdCZgYvPZfCclMkHzVQlb8mw7K2D5piNz4_t5AvDhY_b8MBtBwgdU61nbrdiFD4JZkS6puF_YPv2NU5Az4Za6AlYLSUfb4QyiRp1OgpH6GzrRh-3zojnHV06CAxULbQvk5ArupNIfdNa8DRwtgW3k19NlWjRuNigDWXRW2axF0_5hTfzLP_Jn06ZthEeTE-EhmVnFx-3U9VqIdcogd-QSiXEJTFoN0F1h65f8PzPySWrPrBKF2dE_T0MwaqvJBIeNUhEAV8VeVbAvcMYdy2SukAsV4bWvfb5xKAdgeaRsUqIj2yZGpxkJhIeZjXjtZMyGRD_RVDjXWembg0IGKWJ9vLsfixRK-PjndBz9l4IU78UL9AmZyCK87Nou87K91Xbw59xiduTxRPPcm3N0EWPvUdbbsLbYGXXT87TD6ufOjgK8je2mJCX780ri1e58xP_o_sOiAk1lsMnMv7UcPLIiXOq3qAwABWn_4UQuT_O6mycEovPGTv192cBVXXF2R3RB9cVpB6iMJlkIM6fcwNZuORgbk5nBZ9CebIqwrsX6HRcxwtVpCUXu-qJwpZZFNwMGsbEYvIIrwcJlAUJwu2xW0Xozn0fUx_pSZEeiQomXpX-_D6u8IWiJBz1Rs7UmlsE5L2vDpWIQDDr8i7mUJ5xhApxsOn4Vw_IxEfPqTNkv7UaOxQi-PQ5nYn6DYYfZc5h3SGNMCfc2ttuwNBMotLwq6R34xodkDjdY1VwCHpCTpNTkDW_MCa0ZXM8w57nFdPZ2bikcD3GGFMaQyAgmBuwPPU8wZqrnuQPK55gU40szFK4SVHs8KacLGv9AiEBzjN79B_k52HX9o1PNgxY2FOuvB6G-_gCVfbV-foEy02A_QNAn_uhta9tj2iyx32FGxM8w-b3ugGMqsdmylCSmdbips6RB3W7rc6Wh_Ix5ao1SnCsW4aTzekwAUGvfDYIWg66JkXi7jhjS6pqQI5QKGgNeVW-z3cJaG5W6oIWDp1bVwAGcqGHUWWwHXle5eZnk7S4YO2LM8QMmI9EQ69GRyqFMUl3gbK6HlFcTPScYYW_5xIgkvyZImn_4wfDW8&cid=CAQSSwBygQiD4b08GqMZA4SxUgBRUQzof4sjl_h6Xa76rffhgkKo8Bp5s-3oA5JukAt4_zc7WjSwKh87OvItVSJnH7mW9l_ovT9BAc4dVRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kids.co.nz%2F&ds=l&xdt=1&iif=1&cor=5662488014079943000&adk=2935317967&idt=125&cac=0&dtd=22

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a04492c15d8326dd3030d3fc164ce99fa93735541ecc2a98af19d716e42c2156

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39921
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adlib.css
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame 622F 5 KB
2 KB 9ms
8ms Stylesheet
text/css 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adlib.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7ac0a8d8faf26b8a5ab31b9a5dcb8778adb98efcea5b4d2e38197e0a06e765c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 308280
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1887
x-xss-protection: 0
last-modified: Mon, 15 May 2023 10:28:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 25 Jun 2024 14:49:31 GMT

GET
H3 200 adStyle.css
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame 622F 5 KB
993 B 11ms
10ms Stylesheet
text/css 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adStyle.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c5a94dc9d267ecdbadd37d2686b89a11401e6d1ff923b67b75656be829d015fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 23:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 105912
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 964
x-xss-protection: 0
last-modified: Mon, 15 May 2023 10:28:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 27 Jun 2024 23:02:19 GMT

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 622F 120 KB
41 KB 12ms
10ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 13:53:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52468
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 13:53:03 GMT

GET
H3 200 gsap_3.2.4_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 622F 57 KB
23 KB 17ms
15ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.2.4_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8403779d45a9590b43c0ecf984ebe11e75fd2982630d658390a6001a6768770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23276
x-xss-protection: 0
last-modified: Thu, 05 Mar 2020 03:53:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 04:27:31 GMT

GET
H3 200 gradient.png
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame 622F 27 KB
27 KB 10ms
9ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/gradient.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

957c1ac0eed6de8543a60acc479ec5ae04cced9456268743204fcc1e7dadfa2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:24 GMT
x-content-type-options: nosniff
age: 308288
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27676
x-xss-protection: 0
last-modified: Mon, 15 May 2023 10:28:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 25 Jun 2024 14:49:24 GMT

GET
H3 200 footerBg.png
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame 622F 930 B
957 B 8ms
8ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/footerBg.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ededf917350ba2702cfb9dbc85857d6222a3d22fb8325470a47f7da8ac8ba3ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 05:25:00 GMT
x-content-type-options: nosniff
age: 601352
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 930
x-xss-protection: 0
last-modified: Mon, 15 May 2023 10:28:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 05:25:00 GMT

GET
H3 200 adlibUtils-v3.js Show response
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame 622F 25 KB
10 KB 7ms
7ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adlibUtils-v3.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c174f18c959fbffa947126f9616beced32034df6c2f5425d35ffec4a57c37d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 308281
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10694
x-xss-protection: 0
last-modified: Mon, 15 May 2023 10:28:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 25 Jun 2024 14:49:31 GMT

GET
H3 200 animation.js Show response
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame 622F 4 KB
1 KB 7ms
7ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/animation.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

56a983a05e55e29cf1acc5d4dd10e965ecd76ad50fcd465b4fbc04f4d8a2f8a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 308281
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1218
x-xss-protection: 0
last-modified: Mon, 15 May 2023 10:28:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 25 Jun 2024 14:49:31 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame A640 15 KB
4 KB 16ms
15ms Document
text/html 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

21586b9479aa457ab39c7a2e8966c893a71c824de9e9bc6d9eecf26b4bcb6b0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3799
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 30 Jun 2023 04:27:31 GMT
expires: Sat, 29 Jun 2024 04:27:31 GMT
last-modified: Mon, 15 May 2023 10:28:15 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame DAA9 0
0 59ms
58ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuDak9FtS-6K-yz2gT3O58V39pAi7eXG0qK2kyNKmIpSpMDZKKvY3njLqiInJWbM0j5Lh1d9xX-1nsTYZCfs1C_aOcnS41HOWplocIn6c_Mr1HNSJqgW2nwB0eaThMC8di7b91xaGzAGYevmJ0OyhyupqvyCFU_CWKH1iycCB4Mes6mj8VeMnE16rGYDNZdac9_hSQEacFkrGgEqu0_jBx4LrBL69beZ6hb9mbp5Q03CLB3pdDj3WTrbB0kp5kulB-Vr2ezFsiBo9kpITxPOvADdK7EVx3I9RK4az1J3kagFdMZVk1pZVAtF5PxbeI5mDTxK8YL6kGQ94ipeWpksO3iR6OXrIDgTd82h2tG48AT5veiK7LK8BXWzZwnFwgQYiPMWNVQffLW3ZrUVmBLRD0bLBm-B86_u6O9iPTIp-9tfdQUz_S5UMfP1uZMEWJ_wgAEx1TUvxNFMDF7ax0hwOrFGtua9LHJlBWVUB8BE-jtURUf5AZIc8FcJckOqmzjXsCoar0mEaFCDoECFQHzUpPwpPcZwyy0_IJm6OPmGuQAQBbSvninAgd9dyBAaRJqVDZSuilWMQEtwL0Vdea1bzsf0F9sH_4hfIHHZbeiCvRqGD0k4SfwVIlNymHGj-SitN1dZ3K5bUJKjEUpqfq2rrODBWR4T2FTnGC3HXbSuNaUw1n__aU8trsPqhE3ZPidlxRgB7qM6Nw4xHoMn4zrs5zNV77mujjRue-xQIHeTURKBpWa17cCL3u1Zex8d9qqnHDX4aanYW2l4s0Vx7nz0t72Do35Nar1xDxlP92Tb9u2O5wCGBJcRiqSerI0BVQc4LrqWQl1Tg5keDFbb1QfwETUzE0YuqM-ZT7q9EZQxLOEr5IXJHioj9LjbHeh08Gy2bvkSH2FYroTDWBOUA6ZayCIY2ksFzsFemnorh0Qe38EPonkzHVqIz1rZ5CoTWDlE89U4PfHq_tUbbS3H8mMj-6uphiyf5XamTpilOQWYwHuahq5_7izPQxab8neoHy_nczhGMlCQ8l1rREMtZWKvg2o9Itktol1iSXfcBuUszvSyhD-9g_NjD-9SUByaIR29E4Rvw5krZRGdhhq03WTYtR-lVatC_NWeEBdLcuGbC631RI6FJGY8zw5wTXeDiC5R2-kHXr3z2mHD7pixDsUSMS7tywIjsWrfd9-cZrU4PRkvxWborv41C5NUsnNAt7OknwsnK3rP_eC9EuT6mMpz58-TdkmzudoZMCYV_wjwLPH6vfCRa9XjH90TYdwniL1k27prnMtUBXyR7Rcvh3urqcuBADyvj1ynprZy5W6OxhJuKKI&sai=AMfl-YRWEcKhwlJbby-_QQXdPXSIMbMXIK3B9CFWas9jPSpsgH8-n4x9gVt8i2WxS3xeEkJrS1uWgwkKNVJIPUPh0Ol_FMKnjql8_OI22aGK7q8VIFMeIVFaZLVnwgi0WNcp9-crCJKCS8pYiPSJmWei1sc-BwLWFAY7OHAtjObcqqXBWerRoevMGDUMTkEGUv9Pdv5aSoOCxDl94mf1ozP5yiYdxG4GDYc2BB68HPmpXQJrSwPn5nXGXR3ZZq_SKPFMe1w_9N2HzbhATjxcNosjNF72sNHM05X2&sig=Cg0ArKJSzErdUGmo7GVCEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=912&cbvp=1&cstd=900&cisv=r20230627.58624&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 30 Jun 2023 04:27:31 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 30 Jun 2023 04:27:31 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame F936 22 KB
8 KB 12ms
10ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 163018
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 Jun 2023 07:10:33 GMT
expires: Thu, 27 Jun 2024 07:10:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DAA9 43 B
215 B 316ms
180ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1468596&asId=544a237b-fefe-ee38-95ac-6ddcb389d2ce&tv=%7Bc:gZzXtH,pingTime:-2,time:371,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:1232,beZ:1234,mfA:1237,cmA:1238,inA:1239,inZ:1244,prA:1245,prZ:1253,si:1262,poA:1264,poZ:1312,cmZ:1312,mfZ:1312,loA:1442,loZ:1446,ltA:1603,ltZ:1603%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:100.100,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:28%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:371,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:28,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B362~0%5D,as:%5B362~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tIDqqjO+11%7C12%7C131.1468596-71180196%7C1311%7C1312%7C141*.1468596-71180196%7C1411%7C151%7C16%7C171%7C172%7C1811%7C1911%7C1a%7C1b11,idMap:141*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:svg.us,siq:31,sinceFw:338,readyFired:true%7D&br=c
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
server: nginx
x-server-name: dt19.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1431402/70901270/ Frame 0628 244 KB
74 KB 57ms
35ms Script
application/javascript 52.209.191.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1431402/70901270/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1011798148&ias_pubId=pub-3831894559014614&ias_chanId=1&ias_placementId=20014135396&bidurl=https://castles4kids.co.nz/castles/megaslide&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0iXg9QPKg5ldqCBINwX8V9X
Requested by: Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.191.174 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-191-174.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 9ed8195194c9b00f7af956fc874b60c2efdf1030c722e5561b55df1cc111d764

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:31 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 0628 111 KB
39 KB 42ms
22ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Origin: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 13:52:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52477
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 13:52:54 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/ Frame 0628 11 KB
4 KB 39ms
20ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AmAkX4TvD7Uf-B3HTSU3O0rDjxtx72K_VOyAVH5KgiO6wpqipH_QeCZ1pL2oanb1RuykfVtVFE5-L_ffAUQh-muY-XNco7SCg3e1UWQOMLW4XdSGefcOAh4Ln9NWFrhJ8OzBcPOiXP3TZg8TcSd1v5wu12GwaEmyNHwnOTC91GZ8Hs_kY&dbm_d=AKAmf-De-PKtaz_0-Phir69f3C_Iux-UH0H5Bk7T246suamQPpdx20QUNd6goOR-Iww8tS0TWSj9MksxdG6fSMgM3RFg1PEApvdoTgcO2iO52cWTp5sIQWhQIAMKVaGDFJgKfNo_rWBshmaVTyYrn_c0SU8OdmC3Do-YjhNQ8_5EVx91rCRigUm61-CixSG8hdFwChPtk0NfXXrQHia4d60KsECJFpfnF3qFFNYH4-BW_MRj70Qa_VUIz6tFqmjCL4YK5voQtSJvfokFLHmGOGgt-QXsez6SjW4GX8ASEUqbdirU4U6diKdPt73YlBHXZuG350tBXEXXXyXqusWxGaln4c2qOZ2U35_g9QT1H0lEqEnI4G4_RCBEREBa_i7TxOKx2qbVORmB8g5M3R1MzW_kR4hFzjpZWZe43NUXCI3F-b-NosxSSZE9FSHPobfJvzu0fWb54fAajDxE5rS8HMu1sdhPV4vJRubrGE4NQOiZ4-TLwwKX5A7sIMzBW266ghPSh9jKGBMqKtBj4H9SgYIXcQ9AbwFKpdAPrdFyoSQWm7UBWHkZ6EV91H69vgjO9fkPQEvqJ-2Dry-iCgkMPcFQVTHbjRXS0qj_mOToqEaXqo9D4hRaXgmvvTMp7VzmI6VRDQzEgco54T90JO_ymCur_OohI8VQluaGyX5zGV5xigP7uwQAedw5ajDb7H3GOsOqShpIM1FtX2dNG-yCW2Hs20GQ7iP9lqrRHnidet6mUZQ4QcKsTVDLfh6my4demBrRuzmGVIdV9OF26sArXF2zfviFOp6d9x3uxp01sQk2sd7fS818YR1SUyvbp8UZz63cuAex22Og21ixHCXO-IOCACvsr3Wt6YQCJChy8GEAmqz4mi_5KRp2azBzbTcU1vHrb5dtLr6sNhj5HqTA7MIRme1MPBIeGDdKTixkhkVGsADZodxmMO89Bvb9LpdwGbap60WfpjtFC4-xRlfZ6MHpURDUjibycfsvJGbRY8fcznkbgkXRHHpXZdLQ0kIoKrvzNNNAze-wYZ8spaJmBmvSf7ir-HgHXq5OmqCXdGv3Ep-KxIk0HhuRgc4n3xFeS0dcUF95drXzuF0SOA7oNf_wX7s6BLmQKu9cBTHeY_tg85QuWQUxZ76s5CmprZVsTvspYevITZmZrfJEDkJOxm3Y1171opuvfcUFgcpSicZRobvaF8T3lshEcb9LgNfm1XxmPiiV07DeWSgKBfR6AGQ64bwrm3dZR3Wqv2nVRsGA9VYyymNQ0Laruy0h65iYu3eAm_RN398SvYOyLp6TcNGm1R0ORCqp9_OZH88CCRhC1hMiEZyRSftx11VjdrlvxKmmXMJTKP5KOUeEQPJFK_4Ac5ke0IJBlo2Vn7o8keGykfSPCzQ5xaBZbb5MJpxaYmQSvg6vmbvPKUBD6qxDE_rbFS2RTC6kEZQZkQtyAofvlMH8BKGRfWqju2dCxQ6zq1PD7WT8tem0EMLXMBnpHl33FrLTGcYPMlmN8QPyd1XJjBSkAI54cE0S45AplU1_5Yu5AKCMOhfTpeeez1RPAW59nzlKTTWl0TqdaXpeo-MPFlTE01NFE5XUjI-VvwJnC0BleL7GsvBMPDfu_Jo8OgiubXWqy8xWde2lTRTz--ARfD1aPvhF016HdAMdN2DtsPSNWLKYFlJ-dHuLF7jtP9ib-rxJA3FQMm0OpVHAbnqcex3r-W3YAKk9I5ZgS7ICS1zKY_q9lpFAv9fFRaP5fuINy3vdMKDtZ1rr6LV6uwGRwuvJkbZEnyHTk52ZPx916qRtTADjENuHwbBuS-YFIouHHVjEdMysUlP9lDermj1EraZQiu92c1ZyCgpUw0cI7zp88fcWTmXuGS1yfi9bq1S4qS9jAkSBv1JrwWpf_vu7oullsryHPYyZtqz4kBZ1LQN0U4RjjMTYmAI-ex9e5hJTUEN3GtdkzvpwWqcZhPMBot88wzJ9OconhnlekDWcXyVeqb1XX5HoCA8NxN7e6-rSWT_Up-70VLwhnQnoxozPJvlk3DP1DRbMpWBp9qMhT4qvmrXxJQ6KxGHgt8NguYEN7Fx6geRX31_N3mzk7hLX7BokL-qTAwLCnmBlseYUY_9qyQBmPZ11zIxZBXaJACSIOVVbtB7KFkkUfzY4oAx_mmDWFRnRHDaMue_sYbrr2Cjne_T8T0TUQv8vYe2gNkE5YcNC9QHMTZmWCKd6J-LFWttwfIAgdRiBWCFiCEh624CIaDiqoPvQWPnUzs4V8iTHpBZ4-EM9HWT3O1VxRe7q1NX3rdvkAiEHx0G2h3826pKjXjLGChUlwxAeBWIh1jnt_Gx0mfcRnCVhu6zRKLyHdMo9_jAFs_Vbr8T_nnlwYE6wt66JmkMhz40wmkEOH165gHmjONF14qx7FWIYrffRtC-IIIJVNdKR0hWG3x9O2tuHzHewugyojyW-ac59zaJ5qGwI1dUDPbJiCunJG7yi5VULx8pF8o_A6wfLxruIvPpnLGdfhyoktzimHuHLF2f4nyV_nXXZn32lXbEzSMJcv3PVoS9xPleO5uUx7_SegLnYuWSCOCA61CSA7oSa2R6x249hGy5d595HLfWDkmG1ChZqDcvECFdaNrr1VL9Gl1_5t04Zcfv9TbDBEGlkVb-yO6FQtBRAa3j65LE5aHx-vyZPMD6R0e9NspG6PLF5NSIkIG2W8LUbXS_YtWER8O0a-v774eYaeuCzzXbWcfToazpctoZEKQQYISN4gNywU6st1_Zxmyi1ibXriFvtB0nRpv_XZcdPXFRb2DDEHXIpEu_LCx51digjPIcy8XAelkNHHv4NiiqDn1JYVedlX6BsbrAYJ2LA_HbvTyGICFXyssYG6N2NAcAijn4_j2OtYOXhambQbuJhMNmHcWTyCsB5LGCLcXeKmFLtCIU-WIwgXcFm4dwzgFqgbqEK43JTdvKiRh_dDu02-1rxJEXzo-ceVT3YzgJBigiJZ3GOIgyTnXxeyqxZkfLvbNBkCjB3MLUOo0geip9D6elGLjRO1BlzKKy0nWYUHn3edS_fY6n_KPqID2zPpqnWIlLiY_KnPDNRVYM2tTmRzQVTFnfx-Cauoqs0VAk_1KsZJ2Gf3ritzmAb1FzpF7gk-gqoLJ4EMr1zi-NEaxAoE4FAVzLiwfgyvFwzk2VsS6E9n9MgdbaUAnSgugpzMA3JVtWN64jgSd6QF1Re8_JC6jS4KkaWVd3h4hWMYnW_MGnD-fN0eB6LO3xpzMfDvsCWl-s37q-PD8bWFag8-izDkRhbcUycHHAV2Km6LXQxxUGpZpVQyJkEyQtxjUCJWyyJj1AK6Qr18uh-IVmOUFdIN3KMxYZ4v9i0rYHEKi4GK2R7w9DCbcHTQ05ALEOPFmKFSTIEiMi4y_kMpNaOynaZ8hq56l5wzj_ZqFST8EAOOFux7lzI9JSZcXWkJm8nymYc0awCxIrfOtD-uwrXCW6TCbYcSq1VHfqphwn54-Ncn8iMJ6YPP3vvTfYE7IE0cT-MmlsQQCfVVgsY-vXw8FWX38WegQ-YCn-sg5AH5Po2wZIHOj1htIJtrExN73yg00IM5SbUlunQhtr09ftvIbHHn743KFey6p7YOnOfDB68d2NvNumxTcFd-Kabfm4vQo8wNaBkfrZGk_2XAjoZVdQn&cid=CAQSOwBygQiD8DVjUqqlwIdi19mM66bRVIZyk-amOq3Z6PTX9rM8GgQzgsabggCzxe7Zx02XuLKmqzYeaxFzGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kids.co.nz%2F&ds=l&xdt=1&iif=1&cor=15124543859093443000&adk=929882891&idt=205&cac=0&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37853
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:56:38 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/ Frame 0628 30 KB
11 KB 36ms
20ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

484eef6459e8a58c19115f287339366d82a7c2beeb7a35c7e16789b592515aec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37853
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11545
x-xss-protection: 0
server: cafe
etag: 12064860844701496540
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:56:38 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 0628 41 KB
13 KB 39ms
23ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 07:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 163082
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jun 2024 07:09:29 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 27B7 1 KB
643 B 30ms
20ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 48189
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 29 Jun 2023 15:04:22 GMT
etag: 48472445140208031
expires: Fri, 30 Jun 2023 15:04:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 0628 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4bf73b32abf899c52cb7cfa757dfb1264f7384e08f466d26e0bd2068e98d3e40

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 766D 42 B
174 B 52ms
49ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstC17AaLCnTQUoE8DtRsUaDvqEoiNgr6ZrRWryr-c5AarqwBH3lw25tPpnYaM9wm-BH0aCOG-6_QCArxBYUVx5stRq8_Jm_PCXESw2ZYw1i6bfDBI7qAQHNyc9S2CSJPp5PtaHIT1uH90c3&sai=AMfl-YTaBehoDYvz5i_1gkyIYZ5oWrGbuyfSkUEgN_Xn4gIayYOhQx8JpxCOaAybgEwweU_uJ90LNnQ49jLvAFCap9_IvJjM9n12Ita0zzlFPG-QpKukSiPufd1dDs28lpplTGqLtjWwKzo7jdHi&sig=Cg0ArKJSzMtGbep98wi5EAE&cid=CAQSSwBygQiDsSW_PTiuQu2NjEXL1Pv0V7IJDqvRhDPwuQPWgGh0iZuDGb0_fuQt_4bQzNHLqRsyhqUpx1Org7alRYFmBqaTVyhTt0_YeBgB&id=lidar2&mcvt=1232&p=0,0,250,300&mtos=1232,1232,1232,1232,1232&tos=1232,0,0,0,0&v=20230628&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1326928259&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1688099250299&rpt=501&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adlib.css
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame A640 5 KB
2 KB 37ms
9ms Stylesheet
text/css 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adlib.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7ac0a8d8faf26b8a5ab31b9a5dcb8778adb98efcea5b4d2e38197e0a06e765c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 308281
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1887
x-xss-protection: 0
last-modified: Mon, 15 May 2023 10:28:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 25 Jun 2024 14:49:31 GMT

GET
H3 200 adStyle.css
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame A640 5 KB
993 B 39ms
11ms Stylesheet
text/css 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adStyle.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c5a94dc9d267ecdbadd37d2686b89a11401e6d1ff923b67b75656be829d015fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 23:02:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 105913
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 964
x-xss-protection: 0
last-modified: Mon, 15 May 2023 10:28:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 27 Jun 2024 23:02:19 GMT

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame A640 120 KB
41 KB 40ms
12ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 13:53:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52469
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 13:53:03 GMT

GET
H3 200 gsap_3.2.4_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame A640 57 KB
23 KB 46ms
18ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.2.4_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8403779d45a9590b43c0ecf984ebe11e75fd2982630d658390a6001a6768770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23276
x-xss-protection: 0
last-modified: Thu, 05 Mar 2020 03:53:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 04:27:32 GMT

GET
H3 200 gradient.png
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame A640 27 KB
27 KB 17ms
10ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/gradient.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

957c1ac0eed6de8543a60acc479ec5ae04cced9456268743204fcc1e7dadfa2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:24 GMT
x-content-type-options: nosniff
age: 308288
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27676
x-xss-protection: 0
last-modified: Mon, 15 May 2023 10:28:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 25 Jun 2024 14:49:24 GMT

GET
H3 200 footerBg.png
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame A640 930 B
957 B 16ms
11ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/footerBg.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ededf917350ba2702cfb9dbc85857d6222a3d22fb8325470a47f7da8ac8ba3ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 05:25:00 GMT
x-content-type-options: nosniff
age: 601352
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 930
x-xss-protection: 0
last-modified: Mon, 15 May 2023 10:28:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 05:25:00 GMT

GET
H3 200 adlibUtils-v3.js Show response
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame A640 25 KB
10 KB 7ms
7ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adlibUtils-v3.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c174f18c959fbffa947126f9616beced32034df6c2f5425d35ffec4a57c37d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 308281
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10694
x-xss-protection: 0
last-modified: Mon, 15 May 2023 10:28:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 25 Jun 2024 14:49:31 GMT

GET
H3 200 animation.js Show response
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame A640 4 KB
1 KB 9ms
8ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/animation.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

56a983a05e55e29cf1acc5d4dd10e965ecd76ad50fcd465b4fbc04f4d8a2f8a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 308281
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1218
x-xss-protection: 0
last-modified: Mon, 15 May 2023 10:28:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 25 Jun 2024 14:49:31 GMT

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 2DD4 8 KB
4 KB 234ms
26ms Script
text/javascript 130.211.44.5
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?flvr=0&jsCallback=__verify_callback_298706107276&jsTagObjCallback=__tagObject_callback_298706107276&num=6&ctx=14526021&cmp=145089&plc=vtnwou&sid=45f3d18e47f96c&advid=&adsrv=&unit=728x90&isdvvid=&uid=298706107276&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&nav_pltfrm=Win32&dvp_strhd=0.80&dvpx_strhd=0.80&brid=3&brver=114&bridua=3&dup=null&turl=https://castles4kids.co.nz/castles/megaslide&chro=1&hist=3&winh=280&winw=800&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=2&htmlmsging=1&tstype=128&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_DV_CT=1&DVP_PP_ID=3&DVP_PP_IMP_ID=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&DVP_DBM_1=1861733&DVP_DBM_2=26833064&DVP_DBM_3=16267991022&DVP_DBM_4=327231618&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=1944214853903&DVP_PP_BUNDLE_ID=&prr=1&aUrlD=-1&m1=13&noc=4&fcifrms=11&brh=3&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=165&eparams=DC4FC%3Dl9EEADTbpTauTau42DE%3D6Dc%3C%3A5D%5D4%40%5D%3FKTauU2%3F4r92%3A%3Fl9EEADTbpTauTau42DE%3D6Dc%3C%3A5D%5D4%40%5D%3FKTar9EEADTbpTauTau2ad62e677c_36365dg2b4b43b4d___hf%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3ETar9EEADTbpTauTau2ad62e677c_36365dg2b4b43b4d___hf%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTau42DE%3D6Dc%3C%3A5D%5D4%40%5D%3FKTau42DE%3D6DTau%3E682D%3D%3A56&dvp_exetime=11.80&callbackName=__verify_callback_298706107276
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal117.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.44.5 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 5.44.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 2c92e7deb3e693308543d3b1f6f83c089f00b439a7f7f388877385ef599b519b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:32 GMT
Content-Encoding: br
X-DV-Response: 0
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: keep-alive
Timing-Allow-Origin: *
Expires: 06/29/2023 04:27:32

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1431402/70901270/ Frame B795 244 KB
74 KB 35ms
32ms Script
application/javascript 52.209.191.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1431402/70901270/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1011798148&ias_pubId=pub-3831894559014614&ias_chanId=1&ias_placementId=20006130870&bidurl=https://castles4kids.co.nz/castles/megaslide&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0hxQud5LSJ8qvOb9FtqsyPf
Requested by: Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.191.174 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-191-174.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 1c113e01f3c637d176cb25abc7c00537afbe49cf669242b418a83c20d5cbecf5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame B795 111 KB
39 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Origin: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 13:52:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52478
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 30 Jun 2023 13:52:54 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/ Frame B795 11 KB
4 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CjvaaLNVTYqPAG3hplF-oYcXWybptKKqb3GEmpdfz8Qg8tIgqueMD6BXohWaqMfKPKi4JH7OsNmD6u-LFRwVzvu2EM1tqaCRmEF2LmGkUAWPIk_XNLO0QY_95mbtDIHCgw_PcL70k0L-I6QnYYgJm-DIYkvqgpQtviRkFb3DA08utRQOo&dbm_d=AKAmf-CtoqnY_C4FDpmktVmti-AlTo8NgNUWwlVp5RyMnWluXVRQGugGoZf-yN4m39qCrqSNsvtX2m3ieZt0JJN4YjtNEFSQ24AuqHLeEu7fhtQFIvh0uOgYcQfgVhFrsD1w3aiOCeYGiPXK2tDfc0nczeAtoc3Rnl-gZU_l0SvVAqEE1xxXxwfFuwnWtTiFAH3NP2hYt5Hi7xHOi3_8qvXw1KSVIQxujMHwOEFrL05QWbPgjBppOhOWh5y5ATebzCPpek51j99WLPZLiig2uhWJnNRZfyAfMd3FBrBsKC_QJp795dGSlqdZ0NyPmZH48-qIU2VsI8yJgjYqd5TwZ1bha6ilamTxHtmwQ98gj9gdqT6aUcnHBbtkmNlx_hhD2iTdgQ_gJ_OXaAAnL0lDxLLbKYrb8AI2Nbt5SVll0WJ6uGFDG2MijJixxNRmMgVQ7cgH9lkhH5cnfI2Bvyu5owDnWTFEma-x8RrqwEmaOWVr_jwDJe0hKNa2B_lCmfj0mJeaDx7Mpk0PULPnAjxkLuifb2gKCdstdUZmIdzwpQUZLkihF8byueT_kE5-sJzDS7PrbOEkJHi0HszoCtqw7Bx1CIAJWoVeQUhKN-X_xTNAfLsb248FLOiWAttvW3nQfE6PegPZnB02Nt9KDXPLiB4LxQKPrFuXmOkNIfrfn12teOMCIwDT4XKvScU4nQXnylBBjHi0L4YgZpd3cE8ZfXx5b7RM0_Pah2IIr8tmuNgmB9WFNIKt7jLOmsU0KrHwt_wTOz5YGqt-88ebqt0aN_XTItJIPrmwRF8b_m7cqOde918ZmbUzzDIdaWKEsz5zE4WhrP4gJGOkh7TiaN6df1BcFpgALFw17BUQGhMbhozfn3aFvz8aMiRvjK64lx8EC4cEEoTc3UuHXfdDkQd7JCPD6_gH3DiGWXqnC2MH6OMhL33BpS4EVeByrag3K9WhvSxgVwuvcyc2eC-hKer0u2y2VyPLBcRRxJLO8tzI4nZ4WaxWw4G-qjFGFFt0pfFoxop8rdslg5kjdDnIbhxb0OAnyItRaP-PsOPaEcrnoYIOWV_3F6mya2kf_qIRxIteoGwiWcg-OCQ7_b38DYHoyhX1NMYJWtBdJmVHMkcGJ2sGu3p-YrHzRiC3shd7NMdD-dgIVCVbcVrqslnIXesizJfEw3Y4OB_WpialcsR7qM86PEfwMNQaAuS8RQlB5ZCrxuSSIOAblurV_9RUyBWy_e5Bimt8sA_yKAIB8PI-K2GAgmXJraPzuyBEbwLMfacRVi7WUvFgEsYol2LkvV1TLZBV3RjaTBZw2wCrUPqpMy_KVKkeAMUvujJ-ylEvgmXkYxdkCCZg5gfsqSrKU-oW9v1F4SJgGy4RAhe023UyZYWGSWvmvn587xQM0yvjuU16OiV4S-2Te6irEqZY3wn2PA9HwgB_tQDtjna4hHBSskentXtJFoTt3WJBh4w9Z41OKX4WY1wDKdyPhMeJHku_-GMCWRf2Oh-0niZW4ped9qgTmiin7yn0I440cnHIK-67EwWFbv0AOFepS5OSz1FYOlAekv9iPRLVtuUjIlGZA9jzvP3WBO4-o2UtEqoht-j_N8MEM-3895NjVLxZO_8lZhlnb1ufpJI9fVuixmjLVzop_S2u3xB8R19JYpPsfe0m5DZWgeH1-QOemmkeDb5vJHFfSyzNggCk4XN2_-8dUbf767uIyFsCiwkdooPmvnw3-hJdInBxen-yVlugS8g-LV6xUPAgTEpTdufTuXt1Qf5qH88kyEgrGdLpxw8q7MSxLmElXBx-NrAbSCrVie8Avlj8tlfjAKxNDB9MYsWF2mUdBqviwBlse6Kjto_tPWZ2WkG3zP4-SVyA0UnyFlWJfGylO-gUxAest0I0ga6-Q_UUqdNfMErGHOZm9j3Hm1xw3e9mU_nF1gVoeMR3992FWpgyNqaH27rtWsOqH07X18xEAOQwpbcaQ3BBrKn0cj8px9PRDR_ZKtTWHYJb9FP8bK0uMpj_Uw32X9SvlVFHE7rSJmgHT18v9-XlCX_Rei2-8fIaNhHPayClh1rCETcDpCLJg0Fi9Lh5FfnYjfFdWhKl7rDKx6PPoBknE-_LPexO11dl9zNukwUhOmVvnICFlyTw0Dy52XQjcG5GefSooEKrYTpnD54T6w4GHyLuUIr1nhmfEwmv20lHWPhlnnHqsFggTqrmdRfnwDvfwxqLZizbZjriMVWvinizF5Mkk8kPXljNxHs0GX88wZbuEuE_eHMKlWWIcHrmRTabsvrxR0ayIePHGfxBJC_O9eidWXGLwweUnuiyL-L-BPQlCyKBWEYVV4Xmwo_3T0xl0G-4DxPu8VQeWDfBhQJU6CCuhwwyRe7O2jFRSbLzzQMbHmd4vlnY-nGAgEUf5QaGVzK2vWn_R4HzxKA7Y5fLzIk3CQC_Tfyds5v07pIr1-V3wj0LRP1cJFb8j1G_bMaOJ1Lxt_fdR5S9kL9KLO6qHsdA6fqm0PSozb1S7L5WK7_dWHHaTMd8N90AS4Xxte-3jrifKZqel579H9wnad6__dRXWuUMQkzTRjTE-qQtSmvp0nE_z2AUm1gCOE73L7iuXBX9P_jDk1pNT06iiIseq5pVnOOsSrSCImRQq1DX9BCddQDdCZgYvPZfCclMkHzVQlb8mw7K2D5piNz4_t5AvDhY_b8MBtBwgdU61nbrdiFD4JZkS6puF_YPv2NU5Az4Za6AlYLSUfb4QyiRp1OgpH6GzrRh-3zojnHV06CAxULbQvk5ArupNIfdNa8DRwtgW3k19NlWjRuNigDWXRW2axF0_5hTfzLP_Jn06ZthEeTE-EhmVnFx-3U9VqIdcogd-QSiXEJTFoN0F1h65f8PzPySWrPrBKF2dE_T0MwaqvJBIeNUhEAV8VeVbAvcMYdy2SukAsV4bWvfb5xKAdgeaRsUqIj2yZGpxkJhIeZjXjtZMyGRD_RVDjXWembg0IGKWJ9vLsfixRK-PjndBz9l4IU78UL9AmZyCK87Nou87K91Xbw59xiduTxRPPcm3N0EWPvUdbbsLbYGXXT87TD6ufOjgK8je2mJCX780ri1e58xP_o_sOiAk1lsMnMv7UcPLIiXOq3qAwABWn_4UQuT_O6mycEovPGTv192cBVXXF2R3RB9cVpB6iMJlkIM6fcwNZuORgbk5nBZ9CebIqwrsX6HRcxwtVpCUXu-qJwpZZFNwMGsbEYvIIrwcJlAUJwu2xW0Xozn0fUx_pSZEeiQomXpX-_D6u8IWiJBz1Rs7UmlsE5L2vDpWIQDDr8i7mUJ5xhApxsOn4Vw_IxEfPqTNkv7UaOxQi-PQ5nYn6DYYfZc5h3SGNMCfc2ttuwNBMotLwq6R34xodkDjdY1VwCHpCTpNTkDW_MCa0ZXM8w57nFdPZ2bikcD3GGFMaQyAgmBuwPPU8wZqrnuQPK55gU40szFK4SVHs8KacLGv9AiEBzjN79B_k52HX9o1PNgxY2FOuvB6G-_gCVfbV-foEy02A_QNAn_uhta9tj2iyx32FGxM8w-b3ugGMqsdmylCSmdbips6RB3W7rc6Wh_Ix5ao1SnCsW4aTzekwAUGvfDYIWg66JkXi7jhjS6pqQI5QKGgNeVW-z3cJaG5W6oIWDp1bVwAGcqGHUWWwHXle5eZnk7S4YO2LM8QMmI9EQ69GRyqFMUl3gbK6HlFcTPScYYW_5xIgkvyZImn_4wfDW8&cid=CAQSSwBygQiD4b08GqMZA4SxUgBRUQzof4sjl_h6Xa76rffhgkKo8Bp5s-3oA5JukAt4_zc7WjSwKh87OvItVSJnH7mW9l_ovT9BAc4dVRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcastles4kids.co.nz%2F&ds=l&xdt=1&iif=1&cor=5662488014079943000&adk=2935317967&idt=125&cac=0&dtd=22

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37854
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:56:38 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/ Frame B795 30 KB
11 KB 11ms
8ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230627/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

484eef6459e8a58c19115f287339366d82a7c2beeb7a35c7e16789b592515aec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 17:56:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37854
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11545
x-xss-protection: 0
server: cafe
etag: 12064860844701496540
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 13 Jul 2023 17:56:38 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame B795 41 KB
13 KB 12ms
9ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 07:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 163083
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Jun 2024 07:09:29 GMT

GET
DATA 200
OK truncated
/ Frame B795 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d71248caa343745a1d03433f2e8f2ce1fb5440f4ec6b3971c368e74c20dfb521

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DAA9 42 B
64 B 46ms
45ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstPUKZb3Ohx1ACyPiwbx34MeJIBgyb351SHk8XmpXBnUC0oxbOYKivBnZIWINdoNgwc8sDhKvFuWcssQ756zPtddP8YyL2T2GhHwrXVUneHMLrNlPfkYAG9Pj-UBb5oSlVVlEPnDNaGnN66&sai=AMfl-YRQudaXZR-eZWjY2BbZNLD3T47UkPYeFnXTLRR1-efKnK_tjkT6sTUfhZNylnUXejYrlLyW5yVeNbUwnMgETbAbQblEZ8Kx4kEVFhqa_w3i_FBH4Iub9MXkEsBuByeg8Zl2S_sKiWIKSZ94&sig=Cg0ArKJSzLjGcsfS-xhIEAE&cid=CAQSSwBygQiD0K_IMm1A_9PTc4fic4ZnUSbvUaycpB2dTEU4ScRuL5bWR43M7PVSIWXhOsm-OI1bRk9f3dY_tMi87vgOBqkab8nGW8h7XRgB&id=lidar2&mcvt=1198&p=0,0,250,300&mtos=1198,1198,1198,1198,1198&tos=1198,0,0,0,0&v=20230628&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2115215929&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1688099250323&rpt=708&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DAA9 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=pvtw&eid=slmeZOqQI6Cl9u8PtNGO-A8&p=ias&bl=0&twt=1352&st=666

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js Show response
pagead2.googlesyndication.com/bg/ Frame 4CAE 37 KB
14 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01321206a3324299985a9eb636b3a3739bb19d364bc2a846868cab9de0ceb22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 18:10:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 209807
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14631
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 15:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jun 2024 18:10:45 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame D2B8 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 163019
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 Jun 2023 07:10:33 GMT
expires: Thu, 27 Jun 2024 07:10:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 760E 42 B
64 B 43ms
42ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuoqIqG2cyZCS9JIp-GqWZZt-DnrBu7_WVP2ZzkSiyR--bXklvE9_ltUgi2lgkSD6RTQ4agytfoYRybVqs3P2T3bjrZ&sig=Cg0ArKJSzJVuNZpx1dxWEAE&id=lidar2&mcvt=1077&p=1110,436,1200,1164&mtos=1077,1077,1077,1077,1077&tos=1077,0,0,0,0&v=20230628&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2696186399&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1688099250468&rpt=811&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame 0628
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1431402/70901270/4.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1011798148&ias_pubId=pub-3831894559014614&ias_chanId=1&ias_placementId=20014135396&bidurl=ht...
https://static.adsafeprotected.com/4.js?bundleId=${BUNDLE_ID}&adContainerId=brand_safety_s1meZJWxIvSTjuwPhbOMiAE&cbFunctionName=goog_wrapCb_s1meZJWxIvSTjuwPhbOMiAE&true_pb=https%3A%2F%2Fstatic.adsa...

1 KB
1 KB

7ms
6ms

Script
application/javascript

2600:9000:223f:ea00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?bundleId=${BUNDLE_ID}&adContainerId=brand_safety_s1meZJWxIvSTjuwPhbOMiAE&cbFunctionName=goog_wrapCb_s1meZJWxIvSTjuwPhbOMiAE&true_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2Fpassback_728x90.js
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:223f:ea00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 17:26:18 GMT
x-amz-version-id: c567TBReTKM9m7VfCfOmpAHbFN80zD8c
content-encoding: gzip
via: 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 298875
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Mon, 26 Jun 2023 17:26:15 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: mJE3549ZtavIcjJ7y6h_iVg1Csrm_Ukm0PS7xF3z0Zerg_31zOEblQ==

Redirect headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
server: nginx
x-server-name: app08.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?bundleId=${BUNDLE_ID}&adContainerId=brand_safety_s1meZJWxIvSTjuwPhbOMiAE&cbFunctionName=goog_wrapCb_s1meZJWxIvSTjuwPhbOMiAE&true_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2Fpassback_728x90.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame F66E 91 KB
23 KB 7ms
6ms Script
application/javascript 2600:9000:223f:ea00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:ea00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 24324676
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: rvANCMxUFY2zCPoyD7D8oUfInnQfvrN3lqfgiKBGJsagvlKAub8E4A==

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 27B7 0
104 B 82ms
24ms Image
text/plain 2a02:fa8:8806:16::1370
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEIJ3reGAIrePvnYEig08Sl4&google_cver=1&google_push=AaAOQGHZ38fznq0pe2hznvgpD16azlgajPqJQ1RBiqwEavrikxNGMxZa0tAfq2uCUT7iFyei6YscW9p0JelC96bVC8KOQXEfBLk
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:16::1370 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 27B7
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEHT5UV1TrL1hpTT3-SToDXA&google_cver=1&google_push=AaAOQGGlc56YE-Tg7JEq_OAcqQMjGMv2PGDTZmdAgfPgfZAXd79bMlQPQYJswXf0HO3dVBgfQ4MlLJqJQ-YuHGka...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AaAOQGGlc56YE-Tg7JEq_OAcqQMjGMv2PGDTZmdAgfPgfZAXd79bMlQPQYJswXf0HO3dVBgfQ4MlLJqJQ-YuHGkaD5I0i4sNNe5i

170 B
188 B

27ms
24ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AaAOQGGlc56YE-Tg7JEq_OAcqQMjGMv2PGDTZmdAgfPgfZAXd79bMlQPQYJswXf0HO3dVBgfQ4MlLJqJQ-YuHGkaD5I0i4sNNe5i

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 30 Jun 2023 04:27:32 GMT
Server: MT3 933 7933424 master cdg-pixel-x32 config_version:"1438"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AaAOQGGlc56YE-Tg7JEq_OAcqQMjGMv2PGDTZmdAgfPgfZAXd79bMlQPQYJswXf0HO3dVBgfQ4MlLJqJQ-YuHGkaD5I0i4sNNe5i
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 30 Jun 2023 04:27:31 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 27B7
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESECs4k03fx2P-CoXEUecqcHA&google_cver=1&google_push=AaAOQGHIvNaZ8tC2Z8qh3ox55Km0vu_7uQybsQ9_cH0-_SKXg2DS20CK4HA89cHo9otmNeFt4zGbQT5heQ1buBWDL8MspWI3w_c5
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=CD2F00270F9040F69E7E070C77705FA5&google_push=AaAOQGHIvNaZ8tC2Z8qh3ox55Km0vu_7uQybsQ9_cH0-_SKXg2DS20CK4HA89cHo9otmNeFt4zGbQT5heQ1buBW...

170 B
188 B

25ms
25ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=CD2F00270F9040F69E7E070C77705FA5&google_push=AaAOQGHIvNaZ8tC2Z8qh3ox55Km0vu_7uQybsQ9_cH0-_SKXg2DS20CK4HA89cHo9otmNeFt4zGbQT5heQ1buBWDL8MspWI3w_c5

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 30 Jun 2023 04:27:32 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=CD2F00270F9040F69E7E070C77705FA5&google_push=AaAOQGHIvNaZ8tC2Z8qh3ox55Km0vu_7uQybsQ9_cH0-_SKXg2DS20CK4HA89cHo9otmNeFt4zGbQT5heQ1buBWDL8MspWI3w_c5
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Thu, 29 Jun 2023 04:27:32 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 27B7
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEJ...
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=AaAOQGFyZnVR992SrPj9KS62bL3mk3Son8NkZ4uH9sgy7-zXZeSDmBEHz90Y9bRXuhFCzt7r4jIJ8K6xtyIDKf_pIUHcTnJmIxys&redir=https%3A%2F%2Fcm.g.doubl...
https://sync.targeting.unrulymedia.com/csync/RX-960e35df-07f5-4563-880a-c7fc39325e77-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAaAOQGFyZnVR992SrPj9KS62b...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AaAOQGFyZnVR992SrPj9KS62bL3mk3Son8NkZ4uH9sgy7-zXZeSDmBEHz90Y9bRXuhFCzt7r4jIJ8K6xtyIDKf_pIUHcTnJmIxys&google_hm=A5YONd8H9UVjiArH_DkyXnc

170 B
188 B

27ms
26ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AaAOQGFyZnVR992SrPj9KS62bL3mk3Son8NkZ4uH9sgy7-zXZeSDmBEHz90Y9bRXuhFCzt7r4jIJ8K6xtyIDKf_pIUHcTnJmIxys&google_hm=A5YONd8H9UVjiArH_DkyXnc

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AaAOQGFyZnVR992SrPj9KS62bL3mk3Son8NkZ4uH9sgy7-zXZeSDmBEHz90Y9bRXuhFCzt7r4jIJ8K6xtyIDKf_pIUHcTnJmIxys&google_hm=A5YONd8H9UVjiArH_DkyXnc
date: Fri, 30 Jun 2023 04:27:33 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX960e35df07f54563880ac7fc39325e77003
content-type: text/html

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame 27B7 0
44 B 1088ms
570ms Image
text/plain 54.178.244.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEDgYsdJq31L5SjqbyfOcfwQ&google_cver=1&google_push=AaAOQGGcT5mE9CV4qQcsahmr_AZftvWCa9kEfHhoTQyi0AjDeUehYc5vSkxq0KoYBAavWtU25OG-vd5J7pv0CwxPLEjcJAlcAakW
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.178.244.106 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-178-244-106.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:33 GMT
server: awselb/2.0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 27B7
Redirect Chain

https://im.bluevoox.com/pixel?s1=2&s2=203601&s3=m52eksbsgbowze8o&cm=1&rd=1&google_gid=CAESEGq4csduVCA8hi5Uel2JTvc&google_cver=1&google_push=AaAOQGFTOhEBhVv6utSzaT-tH4rw1ONrkHFH5BQ231PpFDHQOvSqNAiV7...
https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=AaAOQGFTOhEBhVv6utSzaT-tH4rw1ONrkHFH5BQ231PpFDHQOvSqNAiV7-fIis1v5IpqYl3DNN0hSm-tevwqZhVB1oJba3adYPJOHA&google_hm=QlMuNzY3Mi0zZGMw...

170 B
188 B

31ms
30ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=AaAOQGFTOhEBhVv6utSzaT-tH4rw1ONrkHFH5BQ231PpFDHQOvSqNAiV7-fIis1v5IpqYl3DNN0hSm-tevwqZhVB1oJba3adYPJOHA&google_hm=QlMuNzY3Mi0zZGMwLTRiNzItYTVjNg==

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=do_global&google_push=AaAOQGFTOhEBhVv6utSzaT-tH4rw1ONrkHFH5BQ231PpFDHQOvSqNAiV7-fIis1v5IpqYl3DNN0hSm-tevwqZhVB1oJba3adYPJOHA&google_hm=QlMuNzY3Mi0zZGMwLTRiNzItYTVjNg==
Date: Fri, 30 Jun 2023 04:27:32 GMT
Server: openresty
Connection: close
Content-Length: 142
Content-Type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 27B7
Redirect Chain

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEHnySaymIza7iXsznaBMzbY&google_cver=1&google_push=AaAOQGFkDdrGb4WT33PKpsIwUj-23NokwzvMlsX3lv_MbSEMfRAx0CagzZMNk6u6LafWSY9ncz3Pw9Te4_jHgOeUKlq94w4...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AaAOQGFkDdrGb4WT33PKpsIwUj-23NokwzvMlsX3lv_MbSEMfRAx0CagzZMNk6u6LafWSY9ncz3Pw9Te4_jHgOeUKlq94w4uuroXHw&google_hm=MjM1MjQxN...

170 B
188 B

27ms
23ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AaAOQGFkDdrGb4WT33PKpsIwUj-23NokwzvMlsX3lv_MbSEMfRAx0CagzZMNk6u6LafWSY9ncz3Pw9Te4_jHgOeUKlq94w4uuroXHw&google_hm=MjM1MjQxNzgyMTQ5NjI1MDE1

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AaAOQGFkDdrGb4WT33PKpsIwUj-23NokwzvMlsX3lv_MbSEMfRAx0CagzZMNk6u6LafWSY9ncz3Pw9Te4_jHgOeUKlq94w4uuroXHw&google_hm=MjM1MjQxNzgyMTQ5NjI1MDE1
Date: Fri, 30 Jun 2023 04:27:32 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 27B7 0
12 B 16ms
15ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K2JehtlLXB7akDjeDqFnwu0_VhVZnHxlFEQBeurWcEZfgJgocsFmdin64WoPBOTh9iRVWMkpY

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:32 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js Show response
pagead2.googlesyndication.com/bg/ Frame F936 37 KB
14 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01321206a3324299985a9eb636b3a3739bb19d364bc2a846868cab9de0ceb22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 18:10:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 209807
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14631
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 15:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jun 2024 18:10:45 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0628 43 B
215 B 179ms
179ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1431402&asId=83af6268-d088-841e-ee51-04fca590ae64&tv=%7Bc:gZzXEO,pingTime:-3,time:221,type:v,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:42%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:221,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:42,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B210~0%5D,as:%5B210~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tIDqqAG+11%7C12%7C1311%7C1312%7C1313%7C1314%7C1411%7C1412%7C1413%7C1414%7C151%7C16%7C1711%7C172%7C1811%7C1812%7C191*.1431402-70901270%7C1911%7C1912%7C1a%7C1b11,idMap:191*,rmeas:1,rend:0,renddet:svg.us,siq:44%7D&br=c
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
server: nginx
x-server-name: dt10.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0628 43 B
215 B 180ms
180ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1431402&asId=83af6268-d088-841e-ee51-04fca590ae64&tv=%7Bc:gZzXER,pingTime:-6,time:223,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:223,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:42,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B213~0%5D,as:%5B213~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tIDqqAG+11%7C12%7C1311%7C1312%7C1313%7C1314%7C1411%7C1412%7C1413%7C1414%7C151%7C16%7C1711%7C172%7C1811%7C1812%7C191*.1431402-70901270%7C1911%7C1912%7C1a%7C1b11,idMap:191*,rmeas:1,rend:0,renddet:svg.us,siq:44%7D&tpiLookup=ao:castles4kids.co.nz*%2Ca25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com*&br=c
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
server: nginx
x-server-name: dt07.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame B795
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1431402/70901270/4.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1011798148&ias_pubId=pub-3831894559014614&ias_chanId=1&ias_placementId=20006130870&bidurl=ht...
https://static.adsafeprotected.com/4.js?bundleId=${BUNDLE_ID}&adContainerId=brand_safety_s1meZP7INJ3Cx_APm5WxkA4&cbFunctionName=goog_wrapCb_s1meZP7INJ3Cx_APm5WxkA4&true_pb=https%3A%2F%2Fstatic.adsa...

1 KB
1 KB

6ms
6ms

Script
application/javascript

2600:9000:223f:ea00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?bundleId=${BUNDLE_ID}&adContainerId=brand_safety_s1meZP7INJ3Cx_APm5WxkA4&cbFunctionName=goog_wrapCb_s1meZP7INJ3Cx_APm5WxkA4&true_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2Fpassback_728x90.js
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:223f:ea00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 17:26:18 GMT
x-amz-version-id: c567TBReTKM9m7VfCfOmpAHbFN80zD8c
content-encoding: gzip
via: 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 298875
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Mon, 26 Jun 2023 17:26:15 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: 6zWZSl3Kzp-HytpFi8LmMJ0S2W2UUTxmrIct_Q_Dff58CsZNoiZ6RA==

Redirect headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
server: nginx
x-server-name: app08.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?bundleId=${BUNDLE_ID}&adContainerId=brand_safety_s1meZP7INJ3Cx_APm5WxkA4&cbFunctionName=goog_wrapCb_s1meZP7INJ3Cx_APm5WxkA4&true_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2Fpassback_728x90.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 825D 91 KB
23 KB 10ms
9ms Script
application/javascript 2600:9000:223f:ea00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:ea00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 24324676
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: sQB4jCvR2rBURHlfFATyHtYhetrTjDLU59n6me4iBbUTIV30KC9uKw==

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 28E0 22 KB
8 KB 10ms
9ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 163019
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 Jun 2023 07:10:33 GMT
expires: Thu, 27 Jun 2024 07:10:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/12674666151258344264/CbV_EX90_DE_728x90/ Frame DA74 5 KB
2 KB 29ms
28ms Document
text/html 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12674666151258344264/CbV_EX90_DE_728x90/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a9ba3c8dadc286bb57aef08c3f513c674074f27d2d982a9576b6bc3fd5f0b6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 582466
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1769
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 23 Jun 2023 10:39:46 GMT
expires: Sat, 22 Jun 2024 10:39:46 GMT
last-modified: Thu, 20 Apr 2023 13:50:20 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0628 0
0 57ms
57ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu3ygIYFH0YDrhPAXGksFgkOodfJYl0AtfIOZPgEvmLxTQBGHXzViZXeNUX76b7H92HOYoO4jtE5GC8rxOmE4XjdGL2FfwFTTIVPCFlDurpxpT7_AYo-v8DV7wizjCfWBaGMWZ-XNJMlh39isX73OqIWXze45KyISCuV08eh8xveuZGhtoRqfPtxyxIkp1HosrdHGP43JFAXIxM9qYODewiV4UTIpY8m3qtqdGvXgA94NvyRIT72vNUHsNhYFiDpl-xT1fe8YU8w4t-YVsQwfS0PvA85qY4JR3eUVoIXU0dc00Gp9nQynQmX-3u1c95r45Vc8le2Wq2MEYNT1lT39Ev2mRLpyP8keHtui4S7ONnQpvoCd9yXloJa6ZVs21wmLwqOpn_J6lk94lUBC5BFrFZNOee00uxwz_Yjp4YGGBebvKIGvH4E1juan0dL0-bujGVpkWOT1YLmD1BHUbIEBlA11Y2jIzHCX5VNFbPFvuBIhF89mLi06muxETsRQ_Fes8dlzY61gQseVntHEE7BCTTOWdXg5NKtLI9MLEIHPVIFPsrmwji22PuMPigg1kxD982h4oHXJQ8ml_YYdUv-i841dfmBE3mMjbtjtAPjeh-zJS32cQPb-3UsnJY1Jtag1caOM9Q-LweZ12mEtXkbtRYLt3B2Xqaa7J-Bcfp3dP-04UFnv1eN4gTsrR6C1-qHp086YWWDEOeZiEz2kD7zFOgPJexWUqIdXFOMxK0SqTpmnT4wyGtn7Kl5MdrfS5jLiaEF3JdlenZlTgZeFR0vkLFeixpGKKBm71CEMpDnkoQbHATCDLrWBFkZ46HPDKTPkdaVEyhHefJKA2B5KY54dsk1Q4-aZPxPpDktvJdHffJegCP3TaPSs3v80-pFWG82KQViAB0zjzVqsMKrO4G91fma-Z7zvvIw1OD4jkv00nMM2JnbIrHjE8uLmAgXOjrDbNJTT4fiIX7UJvNoFQq_Hx0BHd1gy8pp6N-5l1WPkeTcRK8KikqP0RkuCQg9YLdIgXXXqOjLl9vknLy2J9Wc5DET6md0EKMB4CfkmPn_ljabfYIJX_npXhYmEGGZjxPJ5dovGG-o6CVsSURA9AzBJgLLnhq7hY5Xh4XS3Ml22trE3o9sZ0EcDuspGf3Muh3In9eIEJjAW3al7liRrtT_ko_w7dtx7SvN3bENVjZl-N3xti7iU2o7E63Ti6UH4x_jBLUIpTubWL0gNh0GbwfhAuwCWzEXXW4wR8lG4PKFMyjT9i1umPWq_QvWOLxnQ3neXt1UQdmTeQYN6ypBOWGSBCWdYdxgl0MCpV365LdBmaFUgoAZ7GK2bI4lAtfiE65jxE&sai=AMfl-YSD4-jdggw8usJ9UKEl90TyplN3TedSIv6nn-oduBZH1gGr4IkUKBpBRILnLjXylOd4qjksT-IdChWAjjasBIYvd5VPvrxPKqh7pwmlruVXZLr3DKHWKo_i4WqaTVbQKUwysvHEEbywt5sDqswAN7b3ObQxizpjXtVo_zifwIYrMWgp2-Mm-zHpMT3IA8y9tDEiPfqQiM1SiqxWJ7i8FBGkXTO_CUJJ2X5IAqDl198THgqfMppnV58eTu3J91JVJ-li&sig=Cg0ArKJSzHk4cZcqZ1gOEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=858&cbvp=1&cstd=849&cisv=r20230627.58618&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 30 Jun 2023 04:27:32 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 30 Jun 2023 04:27:32 GMT

POST
H/1.1 204
No Content bsevent.gif
rtbc-ew1.doubleverify.com/ Frame 2DD4 0
234 B 61ms
25ms Ping
text/plain 130.211.44.5
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtbc-ew1.doubleverify.com/bsevent.gif?flvr=0&impid=e786e3a371c44e7f90cd78e05618bf73&dvp_ac_version=0810&dvp_acibv=&bsigr=19860147274240&cbust=1688099252829113
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal117.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.44.5 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 5.44.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:32 GMT
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Expires: 06/29/2023 04:27:32

GET
H/1.1 200
OK unit_renderer.php Show response
as.jivox.com/unit/ Frame 2DD4 108 KB
29 KB 738ms
419ms Script
application/javascript 35.153.32.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://as.jivox.com/unit/unit_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal117.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.153.32.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-153-32-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 4532ee6a023d57ac62f15ea5d2c4d0c1059954a9afa2efb4ad64fbff304f3846

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:33 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/javascript
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 29221

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0628 43 B
215 B 180ms
177ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1431402&asId=83af6268-d088-841e-ee51-04fca590ae64&tv=%7Bc:gZzXIo,pingTime:-2,time:442,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:1354,beZ:1356,mfA:1359,cmA:1361,inA:1361,inZ:1367,prA:1367,prZ:1388,si:1397,poA:1398,poZ:1441,cmZ:1441,mfZ:1441,loA:1576,loZ:1581,ltA:1794,ltZ:1794%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:100.100,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:42%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:442,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:42,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B431~0%5D,as:%5B431~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tIDqqjO+11%7C12%7C131.1468596-71180196%7C1311%7C1312%7C1313%7C1314%7C141.1468596-71180196%7C1411%7C1412%7C1413%7C1414%7C151%7C16%7C1711%7C172%7C1811%7C1812%7C191*.1431402-70901270%7C1911%7C1912%7C1a%7C1b11,idMap:191*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:svg.us,siq:44,sinceFw:396,readyFired:true%7D&br=c
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:32 GMT
server: nginx
x-server-name: dt11.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame B795 43 B
215 B 183ms
177ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1431402&asId=88bf59be-685c-63e7-74f2-23eeee5d3fe4&tv=%7Bc:gZzXJK,pingTime:-3,time:229,type:v,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:38%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:230,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:37,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B220~0%5D,as:%5B220~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tIDqqFt+11%7C12%7C1311%7C1312%7C1313%7C1314%7C1411%7C1412%7C1413%7C1414%7C151%7C16%7C1711%7C172%7C1811%7C1812%7C1911%7C1912%7C1913%7C1a%7C1b1*.1431402-70901270%7C1b11,idMap:1b1*,rmeas:1,rend:0,renddet:svg.us,siq:40%7D&br=c
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:33 GMT
server: nginx
x-server-name: dt03.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame B795 43 B
215 B 183ms
182ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1431402&asId=88bf59be-685c-63e7-74f2-23eeee5d3fe4&tv=%7Bc:gZzXJR,pingTime:-6,time:236,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:236,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:37,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B226~0%5D,as:%5B226~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tIDqqFt+11%7C12%7C1311%7C1312%7C1313%7C1314%7C1411%7C1412%7C1413%7C1414%7C151%7C16%7C1711%7C172%7C1811%7C1812%7C1911%7C1912%7C1913%7C1a%7C1b1*.1431402-70901270%7C1b11,idMap:1b1*,rmeas:1,rend:0,renddet:svg.us,siq:40%7D&tpiLookup=ao:castles4kids.co.nz*%2Ca25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com*&br=c
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:33 GMT
server: nginx
x-server-name: dt19.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 lottie.min.js Show response
cdnjs.cloudflare.com/ajax/libs/bodymovin/5.7.6/ Frame DA74 256 KB
54 KB 46ms
27ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/bodymovin/5.7.6/lottie.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12674666151258344264/CbV_EX90_DE_728x90/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4db144321efbe62d33923077d356ee2fdc097848ebba3f1e1396027122b2d48

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5133576
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54976
last-modified: Sun, 17 Jan 2021 03:02:21 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "6003a8bd-3ffb4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SSIpipoK3oeA4AF%2BTitNuKK0zcs2x%2F3r0pFvrh25%2B%2BxZEOLMqL1NxBBElxhM%2BtTWuelCl4rcu%2FaUgHGLzXQkAU%2F3WJKl5oSBIwvjN%2Bi%2BFenQqlrappfCGmsqsNJGho0LNzgvUt%2F9wz2M5aXewzlNljK9"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7df3a84b2bac3a4a-FRA
expires: Wed, 19 Jun 2024 04:27:32 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame EA82 0
10 B 30ms
28ms Image
text/plain 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?D7p1Cw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:32 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 622F 7 KB
6 KB 59ms
49ms XHR
application/json 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

44b41883c9c2a242b654c8a502a46c2b2867cbd7e28b6aef01d848b580004151

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:33 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5773
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/11028377016436278051/CbV_MY24_XC60_DE_Banner_728x90/ Frame 075F 5 KB
2 KB 25ms
17ms Document
text/html 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11028377016436278051/CbV_MY24_XC60_DE_Banner_728x90/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aadf8d2bac969e516f6c9510dff014b44ad1f03fb39cd6b0bb079f067ce1d4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 582618
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1782
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 23 Jun 2023 10:37:15 GMT
expires: Sat, 22 Jun 2024 10:37:15 GMT
last-modified: Thu, 20 Apr 2023 13:50:13 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame B795 0
0 66ms
61ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstBwaCfohPlufGwkQiT6T5OBe9sfPHFSgcBcaUMGNBtWhjQSeJJoRm87WfEncmSXvQQHRJbbJQN80RfLUTjT7STxr0I9dOPvvO98d9iBfH0LFrUhyIFCC7RT3E0i_Vub42Wd-IHkZulsvUH23T-8F9RZu062kvmTRGGVk6GyfurHRVRsLTeDQiMZR0TL1tVApUoH5LW1XM9CG22bGXWqDkS6KMo_eg5ZgPzMRH2g_0UM4htz8lS6FIkItrtij0pSNZBvIYk_8j5WCPy2yJ-mAnhUA0Isj2QN3VSkJ4xqGC8dfPtZPA9NrRupOzGH-giMWB9M2yDm2ePEriVjJa3NmbdJ94-S0hsRsjsUPFKPqyUrfY6Zl-PvwcQ2CbpoSp9eMhYHaEPWiqrjnsAQBJ9KD4mnrQgwAIQFwzqlalgc2shrdRvSHPpO5IZn9eCy4Ibl0BsmFu5n_HtqHAIOd3l88bnjAzY3QQobzty_7IBjSvKW2CgOu7A3ms4SDnDDIc6APEN2iAVCRjPfDaIzdw8RfVZugjuPgFc_8ECuj4bwm1vSKoySqJbd8avKyCU_6YuqlVcAA1H73_xDT94Lwvy_30k631EGCqqwMBDjMObRP08JyF0LVd0al2Swtu1sr3kRwTRAP0bPm5R_Nwl2amKdKCXLGnL6HDZE3Qyu3tqpTr8L3pj7o-LFiTi1CKwVFrFXLhnBVnOIv-cEGZY0UiSyjbGeB1Nl5vNP5ibd7TuM0oTaOR_M5qwVG8Q5e2dOc6Fut8tlSKubEggRkYIu5d2a1VydTfWG5ey2a5ndqkyoLxAuND4kZQM-aMNXEUrE281oyu_RDpY-AUI4QJ3dIHF37JXhXtZ4zbkPIJuQl05Na1vR5aqDclA7rQZnNibgghv9ItUDqad2RivoM0ShMDHdBTWnvGSNppZEv_1IfXgtoqTC7kdoyCDxkEDcdjmIruB5w4BaNtj03vLu_Ez4eOv0I_T1JaJa1pVNnFqWO447EVwlI00IB-_J2HZN9fsqGv6QVpaFTfJUjn_mGvfd0kxhjOBzVdKIjB_y4Xkw4JzyUySodZW6MnDcZHQsLEye6qJBiwt83acnlbh5HV5YSH35NMcUwTLQH31E3t9bsI_npujHBQL_IBCfeNIKmd5MxFQF_SgXbXzvUkOYs2xvD7u-Ives3JUIiijZ5IWTMqdhYcJNvTdTbJASWNywFGkXNiqKcJWo4i3O9ZP7XyVZ5xGNwoFT_9MzKbriiHo9dQx4W2TpSCc1mAl10Kkg_AQ-MlFvhqdeilZi7b5hurTyfcIZxQUhFAk5Juri6k&sai=AMfl-YRFCdANprAcVHpwhGLHcIwO2wVWpT7McpHHijx72X1MnbhWJ5628i3z0vao4WTJZ5Ldu88rNt_Ps4nXvYwB_gpcih0p08iQDJRvlwwskOEcwqW2uXCQ2jbfjW2BaPtgc8-N4e0ky0zZjgoGbB9EqdhJpZdCiXXqgctVUwdO2d8ZJW_XkZxGutrFr-TVjDkgtjNKuUnmL9-UPoW4geNKDpmMLXfTvlWBmDrQ-yf8yNVgcENpAdVKevn71Z0oDkUqVRFJ2V5WRJKvnOtMDkmss4Wvlo3Fz43i&sig=Cg0ArKJSzJe1l0ExlSwKEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=818&cbvp=1&cstd=815&cisv=r20230627.48841&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 30 Jun 2023 04:27:33 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 30 Jun 2023 04:27:33 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 2DEB 22 KB
8 KB 27ms
12ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 163020
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 Jun 2023 07:10:33 GMT
expires: Thu, 27 Jun 2024 07:10:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js Show response
pagead2.googlesyndication.com/bg/ Frame D2B8 37 KB
14 KB 28ms
12ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01321206a3324299985a9eb636b3a3739bb19d364bc2a846868cab9de0ceb22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 18:10:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 209808
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14631
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 15:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jun 2024 18:10:45 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame B795 43 B
215 B 199ms
182ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1431402&asId=88bf59be-685c-63e7-74f2-23eeee5d3fe4&tv=%7Bc:gZzXLA,pingTime:-2,time:343,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:1377,beZ:1379,mfA:1381,cmA:1383,inA:1384,inZ:1391,prA:1391,prZ:1407,si:1416,poA:1418,poZ:1456,cmZ:1456,mfZ:1456,loA:1613,loZ:1618,ltA:1720,ltZ:1720%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:100.100,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:38%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:343,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:37,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B333~0%5D,as:%5B333~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tIDqqjO+11%7C12%7C131.1468596-71180196%7C1311%7C1312%7C1313%7C1314%7C141.1468596-71180196%7C1411%7C1412%7C1413%7C1414%7C151%7C16%7C1711%7C172%7C1811%7C1812%7C191.1431402-70901270%7C1911%7C1912%7C1913%7C1a%7C1b1*.1431402-70901270%7C1b11,idMap:1b1*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:svg.us,siq:40,sinceFw:302,readyFired:true%7D&br=c
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:33 GMT
server: nginx
x-server-name: dt02.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DAA9 43 B
215 B 202ms
201ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1468596&asId=544a237b-fefe-ee38-95ac-6ddcb389d2ce&tv=%7Bc:gZzXML,pingTime:-10,time:1553,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE0LjAuNTczNS4xOTggU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1688099253107%7C%7C2f71f7269d6677f2f609ad6b53b8d4bf%7C%7Cdc0a08e416cd7f8471c71ad711523ca3%7C%7C97acbf936e7e0ab1ef05bbba904398c2%7C%7C46f296a6ef3663850cf8503580d5e98d%7C%7Cae8aecff3e94e061d22b72edfd64115a%7C%7C9ebca9cc35f7dbdc8b9bf7142ba16c93%7C%7C7324d5b3c2501cbc707954dc4ec2fc64%7C%7C1663701684%7D
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:33 GMT
server: nginx
x-server-name: dt20.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 766D 43 B
215 B 658ms
657ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1468596&asId=3e39a8c2-4ca0-83a1-f9da-3ba6fe947178&tv=%7Bc:gZzXNs,pingTime:-10,time:1802,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE0LjAuNTczNS4xOTggU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1688099253150%7C%7Ccdacd744843bc7146bc3581454e06ba3%7C%7Cdc0a08e416cd7f8471c71ad711523ca3%7C%7Cda402e9de67d1910d8551b93ea0960f7%7C%7C53c25eec5c8aee58c0e0505ab02bdd37%7C%7Ce7d9c3d78deddfcf92b7980faa3789e9%7C%7Cab1aee41f1dffffd2bbb38c13f4421a1%7C%7Cd6c2f21eeb86dc80db06544eceb36ba1%7C%7C1663701684%7D
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:33 GMT
server: nginx
x-server-name: dt17.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame A640 8 KB
6 KB 58ms
58ms XHR
application/json 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2e8c74b88596077fa8646447517da49bd8045771bca1196640ed5cbb5930359

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:33 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5935
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 766D 0
0 55ms
54ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuqwcHcz8BePNxduWnjPfl1WHBQDXvbyLXemD_fcx0i8pWjHE1lXg5Le6sYa8eYfwKZa0BQD4QMonFJho-UT3m1t76gRFQmjTMB0g-E57hazffVx1xpYsVDXA6lwvqkOehJ1f70K0fBescuvlpV2OJ0kMUOW-L52f-g7iZWN3P6cIXSwxxfDIAl6iVfLJ_SjodXVpLiFsuCAGKZ7AqwwNkRcKkUeI57XJDM7VIupKQ4pe1ATCf2VkB35j7og6czCe5ZZ96VxbB0UGIr5351FIAl59qBQFRXJPzWR-c8NRyREvocQr2c76hV2aCHnQ4rdlgb_7PFwhowTqJIfo6zgbKB6qKcXDKK9kJUUvMt2VelH-kUkataKWaA0aEwdozSmhJB0gyCHO8V-o3xNEVcQkfK6o3Glv_S_tUeEo6atMsTCLrBeQktUOAH7VwC7OjD4e3J-BievJ7bqjm6G5e_fruT40qM1Ijq8CSOq-eCUVRLI4B93YbnUpWPUzm-CJxNW1MOtOqBYkXNZJ_IamGyv7QZ5x7hUr-UPFYNYeO9OvjAUqARrrx3hnXVXbc5vH2fSNmZe-frMgnyEu8etCO3APRc0PmK18J08CFLMQOLPhCodjpgVTy4dNQMPjity_nGpsMnUd6orcehYZPkwi2cwLMu4igk3QLOf80jf8c8a2_iBJflXntl5xxh34YraRhaQrD-h9wpxQMp8RqpxRXQnoplMFy_CEG8DPNz8XBdmh5akpDh0oXjwb5tn6Dqm08NCmvSPSnYjLYgdRS7mnXkrmRcfl94xcNyaB5w8Psg5xAAJ4-orlA1JpjesHmhXQLHpzCysUPhYq-W_NS_xuFcQROm66Fu6-gUn6EwXt3S_BMu9Dzx9iNjZ4zvHTh_XoAi2F9KtuzRyTqsdFfzS93ZO1kgRNsEB3QhanlubTSqpCeSelr8FL016ggRvmAYRrq0CSHSNUuxXHFeUDimuNrEEbldJ_5Vk3-fq1IGKQsH89ua-kQP8SXgLGMCwHS4w1AUToWZ8gGBQKt6saWOjzx5jsPCYPTkZv4khuA6GRNWvnP5ENhtv0kkY5ljwK7CQKpDZQSAq8uQctddTIs1hp3KlCbg9xSV54gAvv0KsZcvnOXCuumH8YTMAVUU8qmuW23oRYvKT8fhXCnyR_mpkLYrSqcTP1N9cAsgySZIfkKTjZ7pa54VhXBKGPDzvP-wEGR7lQYKhYvAJCyjL7diEjUqX5a3saGvDqLh62l2EAP3Nfr-iv-14Nn7QqCGfSCeMepkj5uURPdjrYK2uAVHshdbKLMob2VQGg&sai=AMfl-YRDbFglAh8pdSLkQX2yi8PF5LUEH8rXyMe9_n-wCzIVDyBLjnVy1GbUmnD9cE7Rt0dUS-W2XCSDr72xVt4wshqgsiYYjP0eSRzEiLR41ukjOwiCCTDGvT9kPtDZnrWEYUawf49rybmMpo1w7gHSX7-KOJaC4NZzQQIJmcbQhuNwQC7ieUuHS383ZuzjpLnTgjQb2ZjQSWBFfa68tYCGesyWxQb3iAONsIYQ16VbKK3uhpa66pCdBunT_ReaZmTO6IMdHfNGlTAtJ6U2YO9_Un5hh6nv1vSO&sig=Cg0ArKJSzDPJ8Ek0yCmHEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2561&vt=11&dtpt=1558&dett=3&cstd=987&cisv=r20230627.92867&vwbs=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:33 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 30 Jun 2023 04:27:33 GMT

GET
H2 200 lottie.min.js Show response
cdnjs.cloudflare.com/ajax/libs/bodymovin/5.7.6/ Frame 075F 256 KB
54 KB 28ms
26ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/bodymovin/5.7.6/lottie.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11028377016436278051/CbV_MY24_XC60_DE_Banner_728x90/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4db144321efbe62d33923077d356ee2fdc097848ebba3f1e1396027122b2d48

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:33 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5133577
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54976
last-modified: Sun, 17 Jan 2021 03:02:21 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "6003a8bd-3ffb4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vsCu23F%2FsNzPVfP69GRgg8HSTyCnvt7CMoKpPUlHRywacX3T3Zssx4HY5%2B%2BL8CF8P3KbMmj1V2ORC10NVa5miB0TBfwM6wSs0QBoNoZ0hAQkBt99I8bQwVvyb%2BPWlNN9wvjguNORIgzd5wheMx3Z75tH"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7df3a84d0d2c3a4a-FRA
expires: Wed, 19 Jun 2024 04:27:33 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 622F 17 KB
6 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 30 Jun 2023 04:27:33 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame A640 17 KB
6 KB 46ms
44ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 30 Jun 2023 04:27:33 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame DAA9 0
0 50ms
47ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuDak9FtS-6K-yz2gT3O58V39pAi7eXG0qK2kyNKmIpSpMDZKKvY3njLqiInJWbM0j5Lh1d9xX-1nsTYZCfs1C_aOcnS41HOWplocIn6c_Mr1HNSJqgW2nwB0eaThMC8di7b91xaGzAGYevmJ0OyhyupqvyCFU_CWKH1iycCB4Mes6mj8VeMnE16rGYDNZdac9_hSQEacFkrGgEqu0_jBx4LrBL69beZ6hb9mbp5Q03CLB3pdDj3WTrbB0kp5kulB-Vr2ezFsiBo9kpITxPOvADdK7EVx3I9RK4az1J3kagFdMZVk1pZVAtF5PxbeI5mDTxK8YL6kGQ94ipeWpksO3iR6OXrIDgTd82h2tG48AT5veiK7LK8BXWzZwnFwgQYiPMWNVQffLW3ZrUVmBLRD0bLBm-B86_u6O9iPTIp-9tfdQUz_S5UMfP1uZMEWJ_wgAEx1TUvxNFMDF7ax0hwOrFGtua9LHJlBWVUB8BE-jtURUf5AZIc8FcJckOqmzjXsCoar0mEaFCDoECFQHzUpPwpPcZwyy0_IJm6OPmGuQAQBbSvninAgd9dyBAaRJqVDZSuilWMQEtwL0Vdea1bzsf0F9sH_4hfIHHZbeiCvRqGD0k4SfwVIlNymHGj-SitN1dZ3K5bUJKjEUpqfq2rrODBWR4T2FTnGC3HXbSuNaUw1n__aU8trsPqhE3ZPidlxRgB7qM6Nw4xHoMn4zrs5zNV77mujjRue-xQIHeTURKBpWa17cCL3u1Zex8d9qqnHDX4aanYW2l4s0Vx7nz0t72Do35Nar1xDxlP92Tb9u2O5wCGBJcRiqSerI0BVQc4LrqWQl1Tg5keDFbb1QfwETUzE0YuqM-ZT7q9EZQxLOEr5IXJHioj9LjbHeh08Gy2bvkSH2FYroTDWBOUA6ZayCIY2ksFzsFemnorh0Qe38EPonkzHVqIz1rZ5CoTWDlE89U4PfHq_tUbbS3H8mMj-6uphiyf5XamTpilOQWYwHuahq5_7izPQxab8neoHy_nczhGMlCQ8l1rREMtZWKvg2o9Itktol1iSXfcBuUszvSyhD-9g_NjD-9SUByaIR29E4Rvw5krZRGdhhq03WTYtR-lVatC_NWeEBdLcuGbC631RI6FJGY8zw5wTXeDiC5R2-kHXr3z2mHD7pixDsUSMS7tywIjsWrfd9-cZrU4PRkvxWborv41C5NUsnNAt7OknwsnK3rP_eC9EuT6mMpz58-TdkmzudoZMCYV_wjwLPH6vfCRa9XjH90TYdwniL1k27prnMtUBXyR7Rcvh3urqcuBADyvj1ynprZy5W6OxhJuKKI&sai=AMfl-YRWEcKhwlJbby-_QQXdPXSIMbMXIK3B9CFWas9jPSpsgH8-n4x9gVt8i2WxS3xeEkJrS1uWgwkKNVJIPUPh0Ol_FMKnjql8_OI22aGK7q8VIFMeIVFaZLVnwgi0WNcp9-crCJKCS8pYiPSJmWei1sc-BwLWFAY7OHAtjObcqqXBWerRoevMGDUMTkEGUv9Pdv5aSoOCxDl94mf1ozP5yiYdxG4GDYc2BB68HPmpXQJrSwPn5nXGXR3ZZq_SKPFMe1w_9N2HzbhATjxcNosjNF72sNHM05X2&sig=Cg0ArKJSzErdUGmo7GVCEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2407&vt=11&dtpt=1495&dett=3&cstd=900&cisv=r20230627.58624&vwbs=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:33 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 30 Jun 2023 04:27:33 GMT

GET
H3 200 oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js Show response
pagead2.googlesyndication.com/bg/ Frame 28E0 37 KB
14 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01321206a3324299985a9eb636b3a3739bb19d364bc2a846868cab9de0ceb22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 18:10:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 209808
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14631
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 15:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jun 2024 18:10:45 GMT

POST
H3 200 rs Show response
ad4m.at/ Frame 4B30 2 KB
2 KB 59ms
49ms XHR
text/plain 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 15a794e777cb20c078d83a0354bd7945ebc623a3402a3a15e7d2ccca9140a210

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 30 Jun 2023 04:27:33 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9lScfbArGoEH4KUIpn3NXPQqDyF8cAbMc4xX9UH7wmop3yP%2B7QRVNX4TQqYYwhe554g2ZMGxk07dLaWYolNWiapKlqUujljeMezxZrXNUUm7QjnEUgJJh%2Bbj073eBI5nwoiGdZg%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain
access-control-allow-origin: https://as.ad4m.at
access-control-allow-credentials: true
cf-ray: 7df3a84e5cc7377c-FRA
x-backend-server: aa-reachservice-group-europe-west1-c7hs
alt-svc: h3=":443"; ma=86400

OPTIONS
H3 200 rs
ad4m.at/ Frame 0
0 45ms
31ms Preflight
text/plain 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://as.ad4m.at
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,PATCH,POST,OPTIONS,DELETE
access-control-allow-origin: https://as.ad4m.at
access-control-max-age: 1800
allow: HEAD,POST,GET,OPTIONS
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7df3a84e0c99377c-FRA
content-length: 24
content-type: text/plain
date: Fri, 30 Jun 2023 04:27:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=opYWKxuME8eGnnt07wavi9dfh6vbvNE9IpBRhBl0DFVLuTHE0FLn9DbeXT5pLibvhPvyHfXqMXOcGfvRGeZUNn2p9M6Z1HcSPg3TZfWmIiGZmGclw7clQ2IFDa0Ozae5%2FklkKnA%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
via: 1.1 google
x-backend-server: aa-reachservice-group-europe-west1-c7hs

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0628 43 B
215 B 361ms
361ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1431402&asId=83af6268-d088-841e-ee51-04fca590ae64&tv=%7Bc:gZzXSf,pingTime:-10,time:1053,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE0LjAuNTczNS4xOTggU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1688099253447%7C%7C59e5fd25dfe2f2c82facdc62ac59f52b%7C%7Cdc0a08e416cd7f8471c71ad711523ca3%7C%7Cccfffe90ea01f300dfb8e698e12c9a5e%7C%7Cd9ae675ece979a13bd67c145a8660bcb%7C%7C78f844e2df05df9fa50a59d00193a548%7C%7C95195bb8821e114ad9b83d3c9a35785f%7C%7Caeed26717cc8490be75db01acc35c5d5%7C%7C1663701684%7D
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:33 GMT
server: nginx
x-server-name: dt10.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 300x250_TP09_Day_EN_WithMom.png_1683728977483_300x250_TP09_Day_EN_WithMom.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame 622F 344 KB
344 KB 18ms
14ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/300x250_TP09_Day_EN_WithMom.png_1683728977483_300x250_TP09_Day_EN_WithMom.png

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbc770713f73a46bca6d2601dc7c3e5a9b62dfc6552484bffe5c40b11f6fa5e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:50:27 GMT
x-content-type-options: nosniff
age: 308226
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 352518
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Jun 2024 14:50:27 GMT

GET
H3 200 imgPollution_PH.png_1683728977483_imgPollution_PH.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame 622F 128 KB
128 KB 16ms
12ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/imgPollution_PH.png_1683728977483_imgPollution_PH.png

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8de5bedbd946a2962c5a0e4e94966ab21229de8b4cd02db792bde1dca80c3940

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:34 GMT
x-content-type-options: nosniff
age: 308279
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 131281
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Jun 2024 14:49:34 GMT

GET
H3 200 imgDirtBalls_PH.png_1683728977483_imgDirtBalls_PH.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame 622F 29 KB
29 KB 17ms
13ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/imgDirtBalls_PH.png_1683728977483_imgDirtBalls_PH.png

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e331ea538486ea96d3286b8fe763044110d65135db81cc01f5db4739423b96c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:34 GMT
x-content-type-options: nosniff
age: 308279
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29602
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Jun 2024 14:49:34 GMT

GET
H3 200 300x250_TP09_Night_EN.png_1683728977483_300x250_TP09_Night_EN.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame 622F 479 KB
479 KB 25ms
21ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/300x250_TP09_Night_EN.png_1683728977483_300x250_TP09_Night_EN.png

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b6a36a367482591dc8f769c565f438d6787617e9c630f3a4918fefaf1d221a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:50:27 GMT
x-content-type-options: nosniff
age: 308226
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 490566
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Jun 2024 14:50:27 GMT

GET
H3 200 logoDyson.png_1683728977483_logoDyson.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame 622F 5 KB
5 KB 29ms
25ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/logoDyson.png_1683728977483_logoDyson.png

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e6c11b7a237fb60558e874b3cc33a98448878addc8cb1454f43cda7eda4ee81b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:31 GMT
x-content-type-options: nosniff
age: 308282
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5217
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Jun 2024 14:49:31 GMT

GET
H3 200 logoDyson2.png_1683728977483_logoDyson2.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame 622F 5 KB
5 KB 36ms
32ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f6ae8795bb213cb7a9e97a0c572855c80c136a6e6dbc8dba138a4861a5b6f3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 19:00:39 GMT
x-content-type-options: nosniff
age: 206814
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4878
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:49 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jun 2024 19:00:39 GMT

GET
H3 200 ctaArrowWhite.png_1683728977483_ctaArrowWhite.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame 622F 1 KB
1 KB 30ms
26ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4823adc5d708b7e2d6e4887b0ff8e01a88621c4491f040498b2849921258f13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:31 GMT
x-content-type-options: nosniff
age: 308282
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1414
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Jun 2024 14:49:31 GMT

GET
H3 200 rtbIcon.png_1683728977483_rtbIcon.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame 622F 1 KB
2 KB 40ms
36ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/rtbIcon.png_1683728977483_rtbIcon.png

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

575a47049513df4a114006cfe90375175424d0fc629b74c30c83589aa929f424

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 04:48:17 GMT
x-content-type-options: nosniff
age: 171556
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1530
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 27 Jun 2024 04:48:17 GMT

GET
H3 200 rtbIcon2.png_1683728977483_rtbIcon2.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame 622F 1 KB
1 KB 40ms
36ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/rtbIcon2.png_1683728977483_rtbIcon2.png

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8eb605b7b30da1bd71984174e2b2fc4206eb9d70ee7c5f15a216fee82843d338

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=TbF3N41iFo&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:31 GMT
x-content-type-options: nosniff
age: 308282
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1087
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Jun 2024 14:49:31 GMT

GET
H3 200 CbV_EX90_DE_728x90.json Show response
s0.2mdn.net/sadbundle/12674666151258344264/CbV_EX90_DE_728x90/ Frame DA74 460 KB
217 KB 28ms
23ms XHR
application/json 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12674666151258344264/CbV_EX90_DE_728x90/CbV_EX90_DE_728x90.json

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/bodymovin/5.7.6/lottie.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

00928e55583d2d1122eff6efbe62c14172e345910d4b0426319ed05bbd31f637

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12674666151258344264/CbV_EX90_DE_728x90/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 24 Jun 2023 06:20:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 511621
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 222397
x-xss-protection: 0
last-modified: Thu, 20 Apr 2023 13:50:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 23 Jun 2024 06:20:32 GMT

GET
H3 200 DysonFutura-Medium.woff
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame 622F 43 KB
43 KB 20ms
9ms Font
font/woff 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/DysonFutura-Medium.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adStyle.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ffa5f20f56cc860e65adbf0993f3e1ee077e2f412939a867e51ca841f215c539

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adStyle.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:51 GMT
x-content-type-options: nosniff
age: 308262
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43552
x-xss-protection: 0
last-modified: Mon, 15 May 2023 10:28:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 25 Jun 2024 14:49:51 GMT

GET
H3 200 DysonFutura-Book.woff
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame 622F 43 KB
43 KB 21ms
9ms Font
font/woff 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/DysonFutura-Book.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adStyle.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

01a79ec06028ab62a3eb62557310a2f3b28660d773e10f2fc51932c9e57e0b3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adStyle.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 23:13:56 GMT
x-content-type-options: nosniff
age: 537217
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44424
x-xss-protection: 0
last-modified: Mon, 15 May 2023 10:28:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 23:13:56 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame F965 42 B
64 B 77ms
54ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstET1WMiL4B9HdaWP1H6zHoHJCRzkkw46Tm1KZz5yGR2rJ3jMhserTT7xbuw4howhXRP8yIvkdb4YdS-D_IUM0EkkeyRsc52xstTCk_I45B_z-xkQt06qKDjxbAINwXunPdS0gI0pEhX_7q&sai=AMfl-YSdSBEDFhNh7DjNl-cSGjx9KkGJI6vSPYud2h4sx7PCgqil904xOj3yZiNw5AYbYvSUVQhiBB5JxXCt4mAEg3mrXowOZeOq6iXG7gC4Ql9g3Dh2GDj5XFvPpzB5&sig=Cg0ArKJSzLGLDk03hdniEAE&cid=CAQSPABygQiDoQsk7BfoApOIQni2iSJVqK33KQGBXHjziWt2u98HIw7Bi5wvWRtb3Z3Hm6vGSMd0m4kVz4emnxgB&id=ampim&o=400,3&d=800,280&ss=1600,1200&bs=1600,1200&mcvt=1092&mtos=0,0,1092,1092,1092&tos=0,0,1092,0,0&tfs=1501&tls=2593&g=100&h=100&tt=2593&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0628 0
0 66ms
53ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu3ygIYFH0YDrhPAXGksFgkOodfJYl0AtfIOZPgEvmLxTQBGHXzViZXeNUX76b7H92HOYoO4jtE5GC8rxOmE4XjdGL2FfwFTTIVPCFlDurpxpT7_AYo-v8DV7wizjCfWBaGMWZ-XNJMlh39isX73OqIWXze45KyISCuV08eh8xveuZGhtoRqfPtxyxIkp1HosrdHGP43JFAXIxM9qYODewiV4UTIpY8m3qtqdGvXgA94NvyRIT72vNUHsNhYFiDpl-xT1fe8YU8w4t-YVsQwfS0PvA85qY4JR3eUVoIXU0dc00Gp9nQynQmX-3u1c95r45Vc8le2Wq2MEYNT1lT39Ev2mRLpyP8keHtui4S7ONnQpvoCd9yXloJa6ZVs21wmLwqOpn_J6lk94lUBC5BFrFZNOee00uxwz_Yjp4YGGBebvKIGvH4E1juan0dL0-bujGVpkWOT1YLmD1BHUbIEBlA11Y2jIzHCX5VNFbPFvuBIhF89mLi06muxETsRQ_Fes8dlzY61gQseVntHEE7BCTTOWdXg5NKtLI9MLEIHPVIFPsrmwji22PuMPigg1kxD982h4oHXJQ8ml_YYdUv-i841dfmBE3mMjbtjtAPjeh-zJS32cQPb-3UsnJY1Jtag1caOM9Q-LweZ12mEtXkbtRYLt3B2Xqaa7J-Bcfp3dP-04UFnv1eN4gTsrR6C1-qHp086YWWDEOeZiEz2kD7zFOgPJexWUqIdXFOMxK0SqTpmnT4wyGtn7Kl5MdrfS5jLiaEF3JdlenZlTgZeFR0vkLFeixpGKKBm71CEMpDnkoQbHATCDLrWBFkZ46HPDKTPkdaVEyhHefJKA2B5KY54dsk1Q4-aZPxPpDktvJdHffJegCP3TaPSs3v80-pFWG82KQViAB0zjzVqsMKrO4G91fma-Z7zvvIw1OD4jkv00nMM2JnbIrHjE8uLmAgXOjrDbNJTT4fiIX7UJvNoFQq_Hx0BHd1gy8pp6N-5l1WPkeTcRK8KikqP0RkuCQg9YLdIgXXXqOjLl9vknLy2J9Wc5DET6md0EKMB4CfkmPn_ljabfYIJX_npXhYmEGGZjxPJ5dovGG-o6CVsSURA9AzBJgLLnhq7hY5Xh4XS3Ml22trE3o9sZ0EcDuspGf3Muh3In9eIEJjAW3al7liRrtT_ko_w7dtx7SvN3bENVjZl-N3xti7iU2o7E63Ti6UH4x_jBLUIpTubWL0gNh0GbwfhAuwCWzEXXW4wR8lG4PKFMyjT9i1umPWq_QvWOLxnQ3neXt1UQdmTeQYN6ypBOWGSBCWdYdxgl0MCpV365LdBmaFUgoAZ7GK2bI4lAtfiE65jxE&sai=AMfl-YSD4-jdggw8usJ9UKEl90TyplN3TedSIv6nn-oduBZH1gGr4IkUKBpBRILnLjXylOd4qjksT-IdChWAjjasBIYvd5VPvrxPKqh7pwmlruVXZLr3DKHWKo_i4WqaTVbQKUwysvHEEbywt5sDqswAN7b3ObQxizpjXtVo_zifwIYrMWgp2-Mm-zHpMT3IA8y9tDEiPfqQiM1SiqxWJ7i8FBGkXTO_CUJJ2X5IAqDl198THgqfMppnV58eTu3J91JVJ-li&sig=Cg0ArKJSzHk4cZcqZ1gOEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1614&vt=11&dtpt=756&dett=3&cstd=849&cisv=r20230627.58618&vwbs=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a92-123-148-9.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:33 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 30 Jun 2023 04:27:33 GMT

GET
H3 200 oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js Show response
pagead2.googlesyndication.com/bg/ Frame 2DEB 37 KB
14 KB 21ms
7ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01321206a3324299985a9eb636b3a3739bb19d364bc2a846868cab9de0ceb22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 18:10:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 209808
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14631
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 15:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jun 2024 18:10:45 GMT

GET
H3 200 300x250_TP09_Day_EN_WithMom.png_1683728977483_300x250_TP09_Day_EN_WithMom.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame A640 344 KB
344 KB 26ms
15ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adlibUtils-v3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbc770713f73a46bca6d2601dc7c3e5a9b62dfc6552484bffe5c40b11f6fa5e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:50:27 GMT
x-content-type-options: nosniff
age: 308226
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 352518
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Jun 2024 14:50:27 GMT

GET
H3 200 imgPollution_PH.png_1683728977483_imgPollution_PH.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame A640 128 KB
128 KB 36ms
25ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/imgPollution_PH.png_1683728977483_imgPollution_PH.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adlibUtils-v3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8de5bedbd946a2962c5a0e4e94966ab21229de8b4cd02db792bde1dca80c3940

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:34 GMT
x-content-type-options: nosniff
age: 308279
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 131281
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Jun 2024 14:49:34 GMT

GET
H3 200 imgDirtBalls_PH.png_1683728977483_imgDirtBalls_PH.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame A640 29 KB
29 KB 37ms
27ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/imgDirtBalls_PH.png_1683728977483_imgDirtBalls_PH.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adlibUtils-v3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e331ea538486ea96d3286b8fe763044110d65135db81cc01f5db4739423b96c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:34 GMT
x-content-type-options: nosniff
age: 308279
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29602
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Jun 2024 14:49:34 GMT

GET
H3 200 300x250_TP09_Night_EN.png_1683728977483_300x250_TP09_Night_EN.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame A640 479 KB
479 KB 39ms
29ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/300x250_TP09_Night_EN.png_1683728977483_300x250_TP09_Night_EN.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adlibUtils-v3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b6a36a367482591dc8f769c565f438d6787617e9c630f3a4918fefaf1d221a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:50:27 GMT
x-content-type-options: nosniff
age: 308226
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 490566
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Jun 2024 14:50:27 GMT

GET
H3 200 logoDyson.png_1683728977483_logoDyson.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame A640 5 KB
5 KB 40ms
29ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/logoDyson.png_1683728977483_logoDyson.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adlibUtils-v3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e6c11b7a237fb60558e874b3cc33a98448878addc8cb1454f43cda7eda4ee81b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:31 GMT
x-content-type-options: nosniff
age: 308282
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5217
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Jun 2024 14:49:31 GMT

GET
H3 200 logoDyson2.png_1683728977483_logoDyson2.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame A640 5 KB
5 KB 40ms
30ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adlibUtils-v3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f6ae8795bb213cb7a9e97a0c572855c80c136a6e6dbc8dba138a4861a5b6f3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 19:00:39 GMT
x-content-type-options: nosniff
age: 206814
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4878
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:49 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jun 2024 19:00:39 GMT

GET
H3 200 ctaArrowWhite.png_1683728977483_ctaArrowWhite.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame A640 1 KB
1 KB 40ms
30ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adlibUtils-v3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4823adc5d708b7e2d6e4887b0ff8e01a88621c4491f040498b2849921258f13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:31 GMT
x-content-type-options: nosniff
age: 308282
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1414
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Jun 2024 14:49:31 GMT

GET
H3 200 rtbIcon.png_1683728977483_rtbIcon.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame A640 1 KB
2 KB 41ms
31ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/rtbIcon.png_1683728977483_rtbIcon.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adlibUtils-v3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

575a47049513df4a114006cfe90375175424d0fc629b74c30c83589aa929f424

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 04:48:17 GMT
x-content-type-options: nosniff
age: 171556
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1530
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 27 Jun 2024 04:48:17 GMT

GET
H3 200 rtbIcon2.png_1683728977483_rtbIcon2.png
s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/ Frame A640 1 KB
1 KB 41ms
31ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11075695/cdn.ad-lib.io/v2/partners/5c5329a69c0269e89882f109/campaigns/644bbb4381d20ee61686fe64/assets/300x250-DysonHeatwaveTemp/rtbIcon2.png_1683728977483_rtbIcon2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adlibUtils-v3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8eb605b7b30da1bd71984174e2b2fc4206eb9d70ee7c5f15a216fee82843d338

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/index.html?e=69&leftOffset=0&topOffset=0&c=ZoqaNZBjz8&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:31 GMT
x-content-type-options: nosniff
age: 308282
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1087
x-xss-protection: 0
last-modified: Wed, 10 May 2023 14:29:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Jun 2024 14:49:31 GMT

GET
DATA 200
OK truncated
/ Frame DA74 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b52ea1b48e4258df3377131b9e34ad8689fd020e4db528a1ff46c74d6c569764

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 815c49bd4755baaedadbd1fe924bc5c973ab6c23377de815dc8ac6d33d83fb86

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7bbc83b21bc5cc339469c4be5e78189acbc4c81ea9b3aa3887e068138e8b4e4e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e8eb2d4151ca070f4079a5d3a9a3bb0361972de65baa592c120d485ecebacacf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eade249c49e3d6b8c7f05883b1dfb3fa0a68b123efa0d67988e91548ac020554

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3f5806c6b9d3f139cc9677c296dc17b9f31f963e5e7bc6337cfa5a8a4a75fca0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3e92f4208e2499614e843d4da544f604c6e5c70e71e14d30f1b8e3ff53f13f96

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2307527caa75b99a492d7cd4f1aba3ce00f86f35aaf9b3aa4bc7538ffc5098f2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0b5256b339d5e85f1686570073f66b07584878ca1c3ed852f479d167525aa8ab

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6a0bec47a530f1732520dcc187f622f369e9499c169b7dcc64883381689b476e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f417e2a44cfb09105ec834fa11dfb7a403d8eb6b76eb7e1a610de7d855e04278

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5ded8e5efcdb3218505f91f8e2f3b67cd1f0e0144c552d7cdafe1e01b88dd9b7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: da62f23b675fba5c54572e804e26e556c1402355e7ef31c24fdcfa082ad7f65e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6828629c71917fd6a779be9bb55cef9b8d9baaf3214aa437b88ddf17fbe5433d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 552b898f48e2f2b166139414450d8d83aa6de2e968a769ab27e8cf9f2f5cc87f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7e65fd8f3a62fb7dc9dfe93a384af96b69dec14833f6013cf9cb1635fc3738ae

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a0a0dd145aca0d65f73cb2551cae4de75bd171f55c8828d47eda137b03aa4f6d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4a7822251c53e8e9687547d1c929b6a51ec100d7d9ea72bb47ff72ff7b5b2f77

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f0c6f572259ba7bc2da499539e16f5f97d49724c09d76b559f0884d8e1eb83b0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 50ac9bde184967b1ce4aefd380b3c099f91a8e5d25536af5fe6b113ba8d95755

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: abbdf3ee06881419a470e5e12f1dca59fbe36d1aa0c277f3667535954a113229

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d9a5330c178b89f744e12dc63155031d12fba59afb4f99c17e03c9d6470492b1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 7 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 93c0b75fd3c58ef49f9f2e77ffa74637a383198db28cafcabaab1d16bb139967

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 7 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cf68736507b05fcab44becb4e5d97745f193fd582ddb0f0ce97c4b3d9a56aeac

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c100cae99b32ecea1154e1c3f7a3114598ec902959adbde83399ccb26189a307

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bc6c1f70762f2558a6d2ad0036a453bb470e43aeea081060b63919db534dc351

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a4578b6eb60d2ee82bbf667e543623ca6858638f4cc0384f15cde09bbadebcf2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8023a98e6787ca767f1cbd822b1f2a6e79847e03f312ff4f9e9aac0d8bfbfbbd

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 52c0b180a246a31ad16492ee571e4bd1429bcbbee7e08a1163d846d58fb575a7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4e5d356cd0f1e0f88c73085d009fb0030f14f894865f94c589b4a8c0ebb7e4c6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 15dbd2853035f312cde65601c8cb77556ec1c4fd5268e8a111a14d08286187f1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6e72f2e1d4d6b0e6579e7cd339a8543185b0c9112326b95dc55f1c447caae8ce

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3e88f0126df37c0a1defd3f13747863042ae98dc108f87e1f0689b8962b52c28

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5d22a12dd1780d862cd11c77498c04d6a53d9a85a9e7787c1e52c014878c76e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 59f8e4be8f7468ed580fedf96a14da94ad84bf77c270aecbf9aa4e0028f7f732

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6d7c3674a5cb4242b98b879f6204f508dbecef79993501f128c4b497bb0f3d71

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8af986b91b88374e03825cdaec35a6b89bda024ab3b67f95fe216d4ab4913aee

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7247da75888f67a5da64f0565975b818da547063fa7ceea49e606b4c942209b4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 54030c63f8bcd5fa8d75e2abc3b7e80004190959f3b5547bdff19e59f070a968

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43caf75433a66cfc45cbaf6b8c9f1cfeb4ccbac3b66de9189ffe4106dcdbd13f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ae13104a956e5859857c643ac7c45382338579e4454ff2a4a347eff5029357bb

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 21e529d1f8a28760ded58b1672f0f745cbd3851358cf24c4a83d966d41c13f68

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1d6858c27020d50d7980be3815c3ba409c1923ae24ff0fbcad74b32b88ebbbf5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ab9d82f0dc887480d105f5a77b4681987586ec9a717b4ec1a6ecd83d27e26e59

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8bc145705b64db2c106285892c24d6a571cca5c75a7b80003f20c092cc2c8522

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame DA74 8 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 85a551b8751f62846f651970a2815982d155d808aec9c17f3779c39dadb729a5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H3 200 DysonFutura-Medium.woff
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame A640 43 KB
43 KB 18ms
10ms Font
font/woff 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/DysonFutura-Medium.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adStyle.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ffa5f20f56cc860e65adbf0993f3e1ee077e2f412939a867e51ca841f215c539

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adStyle.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Mon, 26 Jun 2023 14:49:51 GMT
x-content-type-options: nosniff
age: 308262
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43552
x-xss-protection: 0
last-modified: Mon, 15 May 2023 10:28:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 25 Jun 2024 14:49:51 GMT

GET
H3 200 DysonFutura-Book.woff
s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/ Frame A640 43 KB
43 KB 37ms
27ms Font
font/woff 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/DysonFutura-Book.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adStyle.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

01a79ec06028ab62a3eb62557310a2f3b28660d773e10f2fc51932c9e57e0b3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17177325508610752512/300x250-DysonHeatwaveTemp/adStyle.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 23 Jun 2023 23:13:56 GMT
x-content-type-options: nosniff
age: 537217
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44424
x-xss-protection: 0
last-modified: Mon, 15 May 2023 10:28:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 22 Jun 2024 23:13:56 GMT

GET
H3 200 rar Show response
as.ad4m.at/ad/ Frame 07A9 11 KB
4 KB 41ms
37ms Document
text/html 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=728&d=90&e=&g=d2a0cd969d48271e2534b2f8bbbd3bac%2F1725913142246912061&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1688099253508&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1k7hn51rf4kck953k3cjm4q728eghrvmn3ezk8v15ht2yebtetkh54084c8qtj3hh73k1qh2q4g6tffgq80gp4cnegxhh0a1ptxstn1qg4hb5qn9498yw6c74nnz1e55603bx2aaq1w97583ycqp9z3ppfrawt7ewy614rzr2rr88cn1s7eek3s68yddf5wadj74hz3pwhvt03n7tgt9khcrcvreckre472h2tchjemnbg14v6rrjeh64zxc0e6b1rat7symw79g4jz4z9mz19jg7w%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%2526client%253Dca-pub-3831894559014614%2526adurl%253D&y=1&s=&z=0

Requested by

Host: ad4m.at
URL: https://ad4m.at/r62eglto.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5aeb5fc5402ac9fe3aba34d0068ae4660e299f78cc2e497daeee7bea789b08f

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-src ;img-src data:;manifest-src 'none';media-src 'none';object-src 'none';worker-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://as.ad4m.at/ad/dr?ed=1h4c8xvz4ka600821pjs6yvvjxw2h29kkqfarqcaavkmknydjx2x0dsjhp6j8nsmggmdjh58v1fft2zcqy7vz46s6kh3trtzr7znarp6kcbsbvp036q45r6ycyhsgrar7742csp11ryx72hagz91zaf6hfmmdzgt59g1h1wpy670z0sjcs94a887t932rpvry8epkc9qzcta9zq7stztfr79e72cnwakcpgnn980gw114ktr1exxr4dtmy24tzhtny7nd1my79a3mfd3cwnjd27k2q3v8yg8dny1kp2jzz2w6qc7hvv6vxbz8dpcak9kj7cwe0rxhtxxzzabt2m1pcehc5svn07w6fyeqsptd94cxn6r2w6hmwd2z49v62wd196j8z38krh6awpvm5zhgzftk3f9t9w611by2a1b759870q56ybkg860tg0gzk4em49ybfthjm&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%26client%3Dca-pub-3831894559014614%26adurl%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7df3a84fea689b98-FRA
content-encoding: br
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-src *;img-src * data:;manifest-src 'none';media-src 'none';object-src 'none';worker-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Fri, 30 Jun 2023 04:27:33 GMT
expires: 0
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
pragma: no-cache
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
server: cloudflare
strict-transport-security: max-age=86400; includeSubDomains; preload
surrogate-control: no-store
vary: accept-encoding
via: 1.1 google
x-content-type-options: nosniff
x-download-options: noopen
x-xss-protection: 1; mode=block

GET
H3 200 oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js Show response
pagead2.googlesyndication.com/bg/ Frame 1516 37 KB
14 KB 16ms
8ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01321206a3324299985a9eb636b3a3739bb19d364bc2a846868cab9de0ceb22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 18:10:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 209808
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14631
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 15:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jun 2024 18:10:45 GMT

GET
H3 200 oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js Show response
pagead2.googlesyndication.com/bg/ Frame AEE5 37 KB
14 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oBMhIGozJCmZhanrY2s6Nzm7GdNkvCqEaGjKud4M6yI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01321206a3324299985a9eb636b3a3739bb19d364bc2a846868cab9de0ceb22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 27 Jun 2023 18:10:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 209808
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14631
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 15:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 26 Jun 2024 18:10:45 GMT

GET
H3 200 default.css
as.ad4m.at/ad/style/0.1.48/one-ad/ Frame 07A9 114 KB
14 KB 43ms
42ms Stylesheet
text/css 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://as.ad4m.at/ad/style/0.1.48/one-ad/default.css
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=728&d=90&e=&g=d2a0cd969d48271e2534b2f8bbbd3bac%2F1725913142246912061&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1688099253508&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1k7hn51rf4kck953k3cjm4q728eghrvmn3ezk8v15ht2yebtetkh54084c8qtj3hh73k1qh2q4g6tffgq80gp4cnegxhh0a1ptxstn1qg4hb5qn9498yw6c74nnz1e55603bx2aaq1w97583ycqp9z3ppfrawt7ewy614rzr2rr88cn1s7eek3s68yddf5wadj74hz3pwhvt03n7tgt9khcrcvreckre472h2tchjemnbg14v6rrjeh64zxc0e6b1rat7symw79g4jz4z9mz19jg7w%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%2526client%253Dca-pub-3831894559014614%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 032aee61923ef53fb2b9efbb5d55f771f780e9c2fce9c076638b809a9607eee3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=728&d=90&e=&g=d2a0cd969d48271e2534b2f8bbbd3bac%2F1725913142246912061&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1688099253508&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1k7hn51rf4kck953k3cjm4q728eghrvmn3ezk8v15ht2yebtetkh54084c8qtj3hh73k1qh2q4g6tffgq80gp4cnegxhh0a1ptxstn1qg4hb5qn9498yw6c74nnz1e55603bx2aaq1w97583ycqp9z3ppfrawt7ewy614rzr2rr88cn1s7eek3s68yddf5wadj74hz3pwhvt03n7tgt9khcrcvreckre472h2tchjemnbg14v6rrjeh64zxc0e6b1rat7symw79g4jz4z9mz19jg7w%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%2526client%253Dca-pub-3831894559014614%2526adurl%253D&y=1&s=&z=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:33 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-meta-goog-reserved-file-mtime: 1687950287
age: 148467
cf-polished: origSize=117335
x-guploader-uploadid: ADPycdu7Pb84Y6vCPqpUShyJrQGb98f4yuF1LiyC2B7DeEN9kG_1SbpI2iXm6tsp7d5fI22nNzf0l66mXGhEIUVspATbXw
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 28 Jun 2023 11:05:15 GMT
server: cloudflare
etag: W/"5d49535c2a84a9762127b3d9e77d7e02"
vary: Accept-Encoding
x-goog-generation: 1687950315098833
content-type: text/css
x-goog-hash: crc32c=aWAnwg==, md5=XUlTXCqEqXYhJ7PZ531+Ag==
cache-control: public, max-age=3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SMwFtjRAGIw4ref%2Fl8MFVWWX3lo18SR8rzzoxJoyZL%2FHMupA4PRl3me9lgN%2FsGbZbxK9onvUeGvxogbr5qQ%2Fns5I4iOteLA808V27AETBeXx7cnsZdlrtGsvG4ZKR%2FkibMutUwNizY4%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 117335
cf-ray: 7df3a8511b769b98-FRA
expires: Fri, 30 Jun 2023 05:27:33 GMT

GET
H2 200 C3FCB3AB04505A8F1D79D1D5953F5207FE6F49EF4C517E920A79B423A52F9E2DCCD658FDD21E3D8209A640CEE47D02AAD52D272924710EAE6BAB80FD9B483022
assets.ad4m.at/logo/ Frame 07A9 5 KB
5 KB 43ms
35ms Image
image/webp 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/C3FCB3AB04505A8F1D79D1D5953F5207FE6F49EF4C517E920A79B423A52F9E2DCCD658FDD21E3D8209A640CEE47D02AAD52D272924710EAE6BAB80FD9B483022
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=728&d=90&e=&g=d2a0cd969d48271e2534b2f8bbbd3bac%2F1725913142246912061&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1688099253508&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1k7hn51rf4kck953k3cjm4q728eghrvmn3ezk8v15ht2yebtetkh54084c8qtj3hh73k1qh2q4g6tffgq80gp4cnegxhh0a1ptxstn1qg4hb5qn9498yw6c74nnz1e55603bx2aaq1w97583ycqp9z3ppfrawt7ewy614rzr2rr88cn1s7eek3s68yddf5wadj74hz3pwhvt03n7tgt9khcrcvreckre472h2tchjemnbg14v6rrjeh64zxc0e6b1rat7symw79g4jz4z9mz19jg7w%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%2526client%253Dca-pub-3831894559014614%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c63890b7f3f2e513fa085cd7b198f9ab91721a9e8aa7180806ff4aa7b4089a4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:33 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 604282
cf-polished: origFmt=png, origSize=10283
alt-svc: h3=":443"; ma=86400
content-length: 4736
cf-bgj: imgq:85,h2pri
last-modified: Thu, 06 Apr 2023 12:21:02 GMT
server: cloudflare
etag: "b90d04a587c2a1ab6749e51d8bb195d1"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SzRBtz0HV2ZJzP1oOi0UL%2Bq426OuoxwGu9GsDxQb%2BuIlRsVfy%2Foo37cEDW7PexOSXqIlQZYBch16iBKFkTCGLyuDrlVkqL6p1X9VKKqyVLkAupIBVIRJlupr1lzzNNlv%2Bn2Rqrtf7GCJ1lOB"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7df3a8512d999048-FRA
expires: Sat, 01 Jul 2023 04:27:33 GMT

GET
H3 200 A36DAD0D440985CF6ABFA23492945CE5BC6D94350A66B19418CB771AFE823AD9B48ADE8E2F007546F0A50A710172EEFC2CAC1468E38852CE2028C22592AAFB75
assets.ad4m.at/product_image/ Frame 07A9 91 KB
91 KB 42ms
34ms Image
image/png 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/A36DAD0D440985CF6ABFA23492945CE5BC6D94350A66B19418CB771AFE823AD9B48ADE8E2F007546F0A50A710172EEFC2CAC1468E38852CE2028C22592AAFB75
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=728&d=90&e=&g=d2a0cd969d48271e2534b2f8bbbd3bac%2F1725913142246912061&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1688099253508&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1k7hn51rf4kck953k3cjm4q728eghrvmn3ezk8v15ht2yebtetkh54084c8qtj3hh73k1qh2q4g6tffgq80gp4cnegxhh0a1ptxstn1qg4hb5qn9498yw6c74nnz1e55603bx2aaq1w97583ycqp9z3ppfrawt7ewy614rzr2rr88cn1s7eek3s68yddf5wadj74hz3pwhvt03n7tgt9khcrcvreckre472h2tchjemnbg14v6rrjeh64zxc0e6b1rat7symw79g4jz4z9mz19jg7w%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%2526client%253Dca-pub-3831894559014614%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c3222903b284496abdef15963fa04202511e222f17463bcd9d756e26e1effa08

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:34 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1761793
cf-polished: origSize=105738, status=vary_header_present
alt-svc: h3=":443"; ma=86400
content-length: 92686
cf-bgj: imgq:85,h2pri
last-modified: Mon, 04 Jul 2022 08:55:40 GMT
server: cloudflare
etag: "147be38db57f89c69c9e65b05983ff0e"
vary: X-Goog-Allowed-Resources, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z%2FMVugHOco5SqB1G0oOl6RzQKZyOYupTx3OyOADqwn41vbEZcx1zoVKPvPlF7almXPWFxLyUSedDtZdW4u02wbfyh%2F1RB2UkqTHZ2ttAfBk4FUikp8DLYNZZeueyb8NpcfiP7HU%2FldzCbheC"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7df3a8526ca39b98-FRA
expires: Sat, 01 Jul 2023 04:27:34 GMT

GET
H3 200 A0843E9156C9D7335C02FDBAB8781B4AFFEEE9E59ABD085E1EDF62037D970710A817E95DBBFD727CE4E28B26524C9A8F4A33EB1E826BD3A7B2541F094E39D266
assets.ad4m.at/logo/ Frame 07A9 2 KB
3 KB 33ms
24ms Image
image/webp 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/A0843E9156C9D7335C02FDBAB8781B4AFFEEE9E59ABD085E1EDF62037D970710A817E95DBBFD727CE4E28B26524C9A8F4A33EB1E826BD3A7B2541F094E39D266
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=728&d=90&e=&g=d2a0cd969d48271e2534b2f8bbbd3bac%2F1725913142246912061&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1688099253508&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1k7hn51rf4kck953k3cjm4q728eghrvmn3ezk8v15ht2yebtetkh54084c8qtj3hh73k1qh2q4g6tffgq80gp4cnegxhh0a1ptxstn1qg4hb5qn9498yw6c74nnz1e55603bx2aaq1w97583ycqp9z3ppfrawt7ewy614rzr2rr88cn1s7eek3s68yddf5wadj74hz3pwhvt03n7tgt9khcrcvreckre472h2tchjemnbg14v6rrjeh64zxc0e6b1rat7symw79g4jz4z9mz19jg7w%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%2526client%253Dca-pub-3831894559014614%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af7a66542220ecfb2b8fa0286b60ffa95c1c8047df094654a90e1ff75f848ef5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:34 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 443272
cf-polished: origFmt=png, origSize=9357
alt-svc: h3=":443"; ma=86400
content-length: 2330
cf-bgj: imgq:85,h2pri
last-modified: Thu, 08 Apr 2021 14:26:03 GMT
server: cloudflare
etag: "8cc161b392f5744da5319a4da549b763"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RgdxKvrlID0Ntcz94oBNWgSk0GXZo12MzUY1Q1T1L%2B7TUEp4nQ%2BsG9ddGntDUsSAonj%2FAplTqxbczCj1AAKxbfyr%2BbcoRXdqBJJek91Z%2BVcGZcwi%2BbCR8uygu8KJYlUzMWKf%2BV5CPBMxXHSk"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7df3a8526ca49b98-FRA
expires: Sat, 01 Jul 2023 04:27:34 GMT

GET
H3 200 B4A4D4AE24A1FC5067FA06DB00E21DA5A143F663CF3153C1D2812B519806D793E1E07140C733352966C6C7C037FF39882FAEB141999BF28A93837E2C21DB35B1
assets.ad4m.at/ Frame 07A9 253 KB
254 KB 51ms
42ms Image
image/webp 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/B4A4D4AE24A1FC5067FA06DB00E21DA5A143F663CF3153C1D2812B519806D793E1E07140C733352966C6C7C037FF39882FAEB141999BF28A93837E2C21DB35B1
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=728&d=90&e=&g=d2a0cd969d48271e2534b2f8bbbd3bac%2F1725913142246912061&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1688099253508&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1k7hn51rf4kck953k3cjm4q728eghrvmn3ezk8v15ht2yebtetkh54084c8qtj3hh73k1qh2q4g6tffgq80gp4cnegxhh0a1ptxstn1qg4hb5qn9498yw6c74nnz1e55603bx2aaq1w97583ycqp9z3ppfrawt7ewy614rzr2rr88cn1s7eek3s68yddf5wadj74hz3pwhvt03n7tgt9khcrcvreckre472h2tchjemnbg14v6rrjeh64zxc0e6b1rat7symw79g4jz4z9mz19jg7w%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%2526client%253Dca-pub-3831894559014614%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2754d47be946d2394bce4008332826d0491b510a2a624ae6609d042b143732d1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:34 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 634983
cf-polished: origFmt=png, origSize=431531
alt-svc: h3=":443"; ma=86400
content-length: 259252
cf-bgj: imgq:85,h2pri
last-modified: Fri, 16 Jun 2023 10:20:07 GMT
server: cloudflare
etag: "16f7fe8ce7119ba0f513f8179ecb2d3a"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B1AbjW8EFHBc81%2Bj1A1llBEIlQ4qzcG9kM9ZXcGLg%2FmU3KlyROk9PYwQeMu9syMQnRyvt8F%2Fcpyf8d1wuFa9LAsVg90Twl5Sa1wahKA2%2F0mSp%2BcNRdZJMaIwMBfe6Y59SiaJL5OvKbDf52zW"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7df3a8526ca69b98-FRA
expires: Sat, 01 Jul 2023 04:27:34 GMT

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 07A9 43 B
702 B 126ms
64ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2904924&v=20044&q=415363&r=412871&pv=1&pref3=oneidk7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6oneid__suite_Netmix_Reach128_WEBGAINSMOSTLY&gdpr_consent=&gdpr=0&gdpr_pd=0

Requested by

Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=728&d=90&e=&g=d2a0cd969d48271e2534b2f8bbbd3bac%2F1725913142246912061&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1688099253508&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1k7hn51rf4kck953k3cjm4q728eghrvmn3ezk8v15ht2yebtetkh54084c8qtj3hh73k1qh2q4g6tffgq80gp4cnegxhh0a1ptxstn1qg4hb5qn9498yw6c74nnz1e55603bx2aaq1w97583ycqp9z3ppfrawt7ewy614rzr2rr88cn1s7eek3s68yddf5wadj74hz3pwhvt03n7tgt9khcrcvreckre472h2tchjemnbg14v6rrjeh64zxc0e6b1rat7symw79g4jz4z9mz19jg7w%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%2526client%253Dca-pub-3831894559014614%2526adurl%253D&y=1&s=&z=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:34 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 90E11D2E4CFB32857DB7C2E1317DD53401EA4F6F6F9CD68E6E871CA9D0C876402E8B3C561F20D09E5FFCF6D6F6634B28F60F47276020F60158747BE09B58F826
assets.ad4m.at/logo/ Frame 07A9 36 KB
36 KB 33ms
24ms Image
image/webp 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/90E11D2E4CFB32857DB7C2E1317DD53401EA4F6F6F9CD68E6E871CA9D0C876402E8B3C561F20D09E5FFCF6D6F6634B28F60F47276020F60158747BE09B58F826
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=728&d=90&e=&g=d2a0cd969d48271e2534b2f8bbbd3bac%2F1725913142246912061&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1688099253508&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1k7hn51rf4kck953k3cjm4q728eghrvmn3ezk8v15ht2yebtetkh54084c8qtj3hh73k1qh2q4g6tffgq80gp4cnegxhh0a1ptxstn1qg4hb5qn9498yw6c74nnz1e55603bx2aaq1w97583ycqp9z3ppfrawt7ewy614rzr2rr88cn1s7eek3s68yddf5wadj74hz3pwhvt03n7tgt9khcrcvreckre472h2tchjemnbg14v6rrjeh64zxc0e6b1rat7symw79g4jz4z9mz19jg7w%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%2526client%253Dca-pub-3831894559014614%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2b9eefee68fa18c6be3c3bbe11d769b5affc01b84ea94c7ec68ae4ffacd858a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:34 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2620205
cf-polished: origFmt=png, origSize=62828
alt-svc: h3=":443"; ma=86400
content-length: 36446
cf-bgj: imgq:85,h2pri
last-modified: Tue, 18 Oct 2022 15:02:47 GMT
server: cloudflare
etag: "e12c1a9f1887c09d377658838eaaa06d"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BLft3rzIsYjia4fuFy%2Fu1d3R5DDnZGqvkFDWFpHvp01QI4yuBZhR07jeSus9NF7iiq6pH5NY6hWb1a5XjvYE%2BbXBQoic6VHjEKGwn112dDb1yDxscJMy8dMKVXN3CAMwGHTLRJ6hNkC%2BcGm7"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7df3a8526ca89b98-FRA
expires: Sat, 01 Jul 2023 04:27:34 GMT

GET
H3 200 287435BEDBEF5210566F91ED2E6D57494D1CBA241E887A111712FB8ADF6747B3B44CBC7EE390AD74BB6985CDD69339A9B2EDEE7334ACD70F503D0812F8C7EBF1
assets.ad4m.at/ Frame 07A9 28 KB
29 KB 38ms
29ms Image
image/webp 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/287435BEDBEF5210566F91ED2E6D57494D1CBA241E887A111712FB8ADF6747B3B44CBC7EE390AD74BB6985CDD69339A9B2EDEE7334ACD70F503D0812F8C7EBF1
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=728&d=90&e=&g=d2a0cd969d48271e2534b2f8bbbd3bac%2F1725913142246912061&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1688099253508&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1k7hn51rf4kck953k3cjm4q728eghrvmn3ezk8v15ht2yebtetkh54084c8qtj3hh73k1qh2q4g6tffgq80gp4cnegxhh0a1ptxstn1qg4hb5qn9498yw6c74nnz1e55603bx2aaq1w97583ycqp9z3ppfrawt7ewy614rzr2rr88cn1s7eek3s68yddf5wadj74hz3pwhvt03n7tgt9khcrcvreckre472h2tchjemnbg14v6rrjeh64zxc0e6b1rat7symw79g4jz4z9mz19jg7w%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%2526client%253Dca-pub-3831894559014614%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e944aa2add7d89134400d6d51b9b0954ad0e988edd934eccff8907ab90e1c853

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:34 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1156200
cf-polished: qual=85, origFmt=jpeg, origSize=133780
alt-svc: h3=":443"; ma=86400
content-length: 28740
cf-bgj: imgq:85,h2pri
last-modified: Tue, 18 Feb 2020 10:22:01 GMT
server: cloudflare
etag: "d061ca155f758f490340e147604dc3ee"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Te7ISqnHX1zcAIzm%2FkU4WT%2BXvXQW1WMOO%2B%2B0CqACsxghMG2RTWj676rc7V5nXOGC3F0%2BKoOvvhxHGdx4FR26fKvdsolArDwkLwWZYE5yfT8ox0pCSKIwLtxYmFiWHPAjsXp6lyaJBRscR0op"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7df3a8526ca99b98-FRA
expires: Sat, 01 Jul 2023 04:27:34 GMT

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 07A9 43 B
702 B 126ms
65ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2531885&v=14702&q=365825&r=412871&pv=1&pref3=oneidppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkroneid__suite_Netmix_Reach128_WEBGAINSMOSTLY&gdpr_consent=&gdpr=0&gdpr_pd=0

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-148-9.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:34 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 CbV_MY24_XC60_DE_Banner_728x90.json Show response
s0.2mdn.net/sadbundle/11028377016436278051/CbV_MY24_XC60_DE_Banner_728x90/ Frame 075F 346 KB
142 KB 44ms
43ms XHR
application/json 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11028377016436278051/CbV_MY24_XC60_DE_Banner_728x90/CbV_MY24_XC60_DE_Banner_728x90.json

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/bodymovin/5.7.6/lottie.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e190690a85e55e934f39c1a24a72a84c33f9313326bdcadac529e1caca3b1967

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11028377016436278051/CbV_MY24_XC60_DE_Banner_728x90/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 24 Jun 2023 10:58:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 494971
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 145289
x-xss-protection: 0
last-modified: Thu, 20 Apr 2023 13:50:13 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 23 Jun 2024 10:58:02 GMT

GET
H/1.1 200
OK resolveDynamicData.php Show response
traffick.jivox.com/jivox/serverAPIs/ Frame 2DD4 47 B
267 B 447ms
108ms Script
application/json 52.205.83.180
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://traffick.jivox.com/jivox/serverAPIs/resolveDynamicData.php?var=geo:geo.country&ap_gdpr=0&callback=callPlatformFn
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/unit_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.83.180 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-83-180.compute-1.amazonaws.com
Software: Jetty(9.4.39.v20210325) /
Resource Hash: b4f99f592e04a26d8019940d56cf4ac37477ea9a5fa565596050a2da7b18a5c4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 30 Jun 2023 04:27:34 GMT
Content-Encoding: gzip
Server: Jetty(9.4.39.v20210325)
Connection: keep-alive
Content-Length: 64
Content-Type: application/json;charset=utf-8

GET
H/1.1 200
OK dv-measurements4050.js Show response
cdn.doubleverify.com/ Frame 8E47 543 KB
103 KB 23ms
16ms Script
application/javascript 2a02:26f0:480:9::210:ee04
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements4050.js
Requested by: Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:9::210:ee04 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: e1d64dcce03bbb7c2bd033767a73cd36fd3d14f2f9f1424e1a184f37038938b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 30 Jun 2023 04:27:34 GMT
Content-Encoding: gzip
Last-Modified: Wed, 28 Jun 2023 08:54:41 GMT
Server: UploadServer
ETag: "5a377c6b590ab29192c9d6aaadc2c413"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 105238
Expires: Thu, 27 Jun 2024 08:54:46 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D61E 1 KB
643 B 25ms
14ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 48192
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 29 Jun 2023 15:04:22 GMT
etag: 48472445140208031
expires: Fri, 30 Jun 2023 15:04:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 2DD4 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0abb68730559af29aa60930de79b65a14230e5cf8d709399463b68675b5406ca

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame B795 0
0 58ms
56ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstBwaCfohPlufGwkQiT6T5OBe9sfPHFSgcBcaUMGNBtWhjQSeJJoRm87WfEncmSXvQQHRJbbJQN80RfLUTjT7STxr0I9dOPvvO98d9iBfH0LFrUhyIFCC7RT3E0i_Vub42Wd-IHkZulsvUH23T-8F9RZu062kvmTRGGVk6GyfurHRVRsLTeDQiMZR0TL1tVApUoH5LW1XM9CG22bGXWqDkS6KMo_eg5ZgPzMRH2g_0UM4htz8lS6FIkItrtij0pSNZBvIYk_8j5WCPy2yJ-mAnhUA0Isj2QN3VSkJ4xqGC8dfPtZPA9NrRupOzGH-giMWB9M2yDm2ePEriVjJa3NmbdJ94-S0hsRsjsUPFKPqyUrfY6Zl-PvwcQ2CbpoSp9eMhYHaEPWiqrjnsAQBJ9KD4mnrQgwAIQFwzqlalgc2shrdRvSHPpO5IZn9eCy4Ibl0BsmFu5n_HtqHAIOd3l88bnjAzY3QQobzty_7IBjSvKW2CgOu7A3ms4SDnDDIc6APEN2iAVCRjPfDaIzdw8RfVZugjuPgFc_8ECuj4bwm1vSKoySqJbd8avKyCU_6YuqlVcAA1H73_xDT94Lwvy_30k631EGCqqwMBDjMObRP08JyF0LVd0al2Swtu1sr3kRwTRAP0bPm5R_Nwl2amKdKCXLGnL6HDZE3Qyu3tqpTr8L3pj7o-LFiTi1CKwVFrFXLhnBVnOIv-cEGZY0UiSyjbGeB1Nl5vNP5ibd7TuM0oTaOR_M5qwVG8Q5e2dOc6Fut8tlSKubEggRkYIu5d2a1VydTfWG5ey2a5ndqkyoLxAuND4kZQM-aMNXEUrE281oyu_RDpY-AUI4QJ3dIHF37JXhXtZ4zbkPIJuQl05Na1vR5aqDclA7rQZnNibgghv9ItUDqad2RivoM0ShMDHdBTWnvGSNppZEv_1IfXgtoqTC7kdoyCDxkEDcdjmIruB5w4BaNtj03vLu_Ez4eOv0I_T1JaJa1pVNnFqWO447EVwlI00IB-_J2HZN9fsqGv6QVpaFTfJUjn_mGvfd0kxhjOBzVdKIjB_y4Xkw4JzyUySodZW6MnDcZHQsLEye6qJBiwt83acnlbh5HV5YSH35NMcUwTLQH31E3t9bsI_npujHBQL_IBCfeNIKmd5MxFQF_SgXbXzvUkOYs2xvD7u-Ives3JUIiijZ5IWTMqdhYcJNvTdTbJASWNywFGkXNiqKcJWo4i3O9ZP7XyVZ5xGNwoFT_9MzKbriiHo9dQx4W2TpSCc1mAl10Kkg_AQ-MlFvhqdeilZi7b5hurTyfcIZxQUhFAk5Juri6k&sai=AMfl-YRFCdANprAcVHpwhGLHcIwO2wVWpT7McpHHijx72X1MnbhWJ5628i3z0vao4WTJZ5Ldu88rNt_Ps4nXvYwB_gpcih0p08iQDJRvlwwskOEcwqW2uXCQ2jbfjW2BaPtgc8-N4e0ky0zZjgoGbB9EqdhJpZdCiXXqgctVUwdO2d8ZJW_XkZxGutrFr-TVjDkgtjNKuUnmL9-UPoW4geNKDpmMLXfTvlWBmDrQ-yf8yNVgcENpAdVKevn71Z0oDkUqVRFJ2V5WRJKvnOtMDkmss4Wvlo3Fz43i&sig=Cg0ArKJSzJe1l0ExlSwKEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1930&vt=11&dtpt=1112&dett=3&cstd=815&cisv=r20230627.48841&vwbs=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:34 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 30 Jun 2023 04:27:34 GMT

GET
DATA 200
OK truncated
/ Frame 075F 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ad3c008ffe1d6ee338cd653dab842f7a2eced53f412799eda51d53193df6ec5e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60c44ae951c1faa3f9648efb0632bb79e57b4132a8a366dd1aa008e6ac736ead

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 75aacdbc85948e2a31806e419a6f993287b5151516e7c033f7a27fc6ad288177

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 3 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 59495090eb25f9eda12cba9744abfb7bfdd336b66e2bdc557b121a620cb1858e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef621ec7514ea5151cadb8cede667f467208b26efa9b01162e00494e7373046e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b8913383f0560f37a154e4697377db07bbee6432f40979463d0f5acec04576a9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d41bf9bb58d39fcd415c957fa8e5f093608e59b13eff9e0eae33b6e703bcfc06

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a37827dad5e3e5cb0e09bff758014d6fdb05c096f5f5345361228a641d754bf7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 11a031649b56e9d45735dfaa3b6926909d1f292f42102ff01ca7163473a3bde4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 14f84cb1c9b353bd091ff133eb75d1c0c9db98c5e00dfab553a7aa6e1512ffc9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a9dffd9a24fa3f91c72267ed195de302db57bf078d7024d0592f6115598e4961

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f729b44cf34f7b9afa40cc5ab400d0878a514351119487bb901d3a013073ff0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 65ab47237c06bb3c7725baac44a06adebb952d1b7459b9fec6f3684abf891a36

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 478d7ed391546ef6fd29f65c232016f4769023b709825313411aba5aca5ba25b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 883b8be4d4b4509e1d8eecbeb5d0078eb1eb45e06be070f96b0cc26e3e7071d8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b75dbd6a78984fa37a4abcfedb1bc8dc1df49f7ad1babee4217b6cac3ff17bcc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d6307c3290f9c667a69f24e21a70f60f8242c52b21686fbc52699fc2de199058

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c81a7c4498a86ed545b681f58caceae69da472e6cb9e3fef84d6aae64d9843e0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: af6e549ea6c20371475407d444a695b877bb34357a41803ec442aaeb8ca1ee33

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5698b16f42999c617ddb7fff38b99067958c38b243de70129b7e8969da4193fb

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 197f2ebbee4b4e13937834a968361a64823f986d6a063603646b28dbf7dfa3e5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 705d21b24aa7dd93011d9cffddae391345419e2497683bcfda477762ad6d4db7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d33894a92825ca009e4ff9387bad4757affff26d05237a05b8e6106ef75633a2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1422413ea3ca39d3ad41f5fbd51b420421b1fe55ac818e26295f905c7bd678d7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ec461e056b6063abb5d1db6935de11f23657df6eea4f13d9d3f9635991d043b4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dc7f42b66311d1bbdff52f81b645214a464622fbb63979931a33544f6ee6c71e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dce3a551c4c348b6708a3126e58b8714763419737202e5bf374166d98431a273

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e8fc8c991f21f923847a607aa430dd4374868f0824440d196ea3d142aa65459d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6ded35637a9462a7f071a85d1250be62ff2bb1af8070fd6fedb97be3bb9928a0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3ceb75a84f1e650b1f55c575586c3dd5844c670fc7dc82958d5aeed960ea3f04

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 520d1bf0e3e299dd78324d5bf4639d456f9c30a32ba571d49816e3393cbdd2e6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6a7fd09182b24efd666ca8fa6ca6b9a352301c0149b4f1fce962c2b5f0386c26

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d8efa6c83bf4bbccac61df86508885434b1df644013fa915a58378944ec52ed7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8eb62dfb396f95b451c3034a0a92df933a75cb62765fcc1756857bf411cbf899

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a652fb8fa620f3e7ea09c6ce121bf4c04bbac8f98f839d5e14a6a3d41b4e1841

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 03edaa49aa56ec0c85cfd7fae0f8875c1b5f95b9e3193a7893c913433debe8f8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3d9dcbb9da508ab1c06b6672669966addcbf4f7d99ff67a1cb32ab0f701dc14

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ca3c931af8779410a264080c35311b8083ee951eff563d07fc088745ceccdf5a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cf0bb582250157faaa246965a7835a68e4b22b417352fcb7da4d1b1acd386c1e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 938481b6e8bd58af75d60c49251ea835487aacb6ce77524f9265492808fb36f3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c4402042d2d61ba45e1a61d47b87911a1b469f984cf4fbc56d57714b2e7462c1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 146ce30a02d95fcf6b02107131b65ed21e0b62eb45fe481ce884cf6ac6af1c3e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cfb8f203af938fbe1e6196e59e87d6ebe9130d9aca40a6726a368d6b2405808f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 303871b850522e9d3aebbcdeb0544f4178cfc559444c2ad527039bf663059060

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7e20667a138b758774e691b8cc0034237914bba60ff78122f76075a444043f09

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 075F 6 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 56d14e515952a246a8a8e4a240fca50af57de4f40479436c9de3adb112ef6bf9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H2 200 dt
dt.adsafeprotected.com/ Frame B795 43 B
215 B 185ms
180ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1431402&asId=88bf59be-685c-63e7-74f2-23eeee5d3fe4&tv=%7Bc:gZzY7d,pingTime:-10,time:1684,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE0LjAuNTczNS4xOTggU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1688099254375%7C%7Ca949b1bbcf03afa4a6b3e311b7705724%7C%7Cdc0a08e416cd7f8471c71ad711523ca3%7C%7Cee9d31c43106f92c990d1ba441f1aac4%7C%7Ccae54b190aa43eb72394bcf430ff4e76%7C%7Cc0a8161092d278d742f343547b4d1d64%7C%7Cbc7b4fa9ca4a0597ced2ec6141349c94%7C%7C403ee0ec57e677f8cd020d1275a07307%7C%7C1663701684,im:%7Bpci:%7Btdr:1416%7D%7D%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:34 GMT
server: nginx
x-server-name: dt11.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 link.html Show response
track.webgains.com/ Frame 07A9 2 KB
2 KB 147ms
83ms Script
text/html 13.42.188.208
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=3641431&wgcampaignid=1384975&js=1&nw=1&wgtarget=https%3A%2F%2Fas.ad4m.at%2Fad%2Frct%3Fed%3D1ghk1xbwb0h1xkeqxhtyw519xrdx78aka6jxgbyqhge8kz1th100gg1wgmhh97zz7ybw9bjbmdkssngkhcfmk7jadnk8f01mgnb7ne31k6vt77vsq2n212s8gv9k65gydjt3tc3pd27wze8npxew7pjzty4t70gj2egnxv653466ktc3q20rp98e9pbsdcef8yhf8fzt9hengbb0adnew1xcjvhakp1a9zg5gwe6dxgnfckamedfp92r4emqtyjv2dm0%26a%3Dhttps%253A%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1k7hn51rf4kck953k3cjm4q728eghrvmn3ezk8v15ht2yebtetkh54084c8qtj3hh73k1qh2q4g6tffgq80gp4cnegxhh0a1ptxstn1qg4hb5qn9498yw6c74nnz1e55603bx2aaq1w97583ycqp9z3ppfrawt7ewy614rzr2rr88cn1s7eek3s68yddf5wadj74hz3pwhvt03n7tgt9khcrcvreckre472h2tchjemnbg14v6rrjeh64zxc0e6b1rat7symw79g4jz4z9mz19jg7w%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%252526client%25253Dca-pub-3831894559014614%252526adurl%25253D&clickref=oneidDXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjWoneid__suite_Netmix_Reach128_WEBGAINSMOSTLY&viewref=oneideYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpboneid__suite_Netmix_Reach128_WEBGAINSMOSTLY
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=728&d=90&e=&g=d2a0cd969d48271e2534b2f8bbbd3bac%2F1725913142246912061&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1688099253508&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1k7hn51rf4kck953k3cjm4q728eghrvmn3ezk8v15ht2yebtetkh54084c8qtj3hh73k1qh2q4g6tffgq80gp4cnegxhh0a1ptxstn1qg4hb5qn9498yw6c74nnz1e55603bx2aaq1w97583ycqp9z3ppfrawt7ewy614rzr2rr88cn1s7eek3s68yddf5wadj74hz3pwhvt03n7tgt9khcrcvreckre472h2tchjemnbg14v6rrjeh64zxc0e6b1rat7symw79g4jz4z9mz19jg7w%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%2526client%253Dca-pub-3831894559014614%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.42.188.208 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-42-188-208.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 5083251ccaf255c1114b06febe5ca9ca9dad52f3aff02d7b306227c5bc754943

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:34 GMT
last-modified: Fri, 30 Jun 2023 04:27:34 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Fri, 30 Jun 2023 04:28:34 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 766D 43 B
215 B 178ms
177ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1468596&asId=3e39a8c2-4ca0-83a1-f9da-3ba6fe947178&tv=%7Bc:gZzYal,pingTime:1,time:3221,type:p,im:%7Bpci:%7Btdr:1887%7D%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:43%7D,%7Br:r,w:300,h:250,t:760%7D,%7Bpiv:100,vs:i,r:,t:1979%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1243,o:1978,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:43,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1969~0,3~100%5D,as:%5B750~0.0,1222~300.250%5D%7D%7D,%7Bsl:i,t:1978,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1239~100%5D,as:%5B1239~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:1153,fm:tIDqqjO+11%7C12%7C131*.1468596-71180196%7C1311%7C141.1468596-71180196%7C1411%7C151%7C16%7C171%7C172%7C1811%7C191.1431402-70901270%7C1911%7C1a%7C1b1.1431402-70901270%7C1b11,idMap:131*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:46,sis:818%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:34 GMT
server: nginx
x-server-name: dt08.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 766D 43 B
215 B 177ms
176ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1468596&asId=3e39a8c2-4ca0-83a1-f9da-3ba6fe947178&tv=%7Bc:gZzYal,pingTime:1,time:3221,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:43%7D,%7Br:r,w:300,h:250,t:760%7D,%7Bpiv:100,vs:i,r:,t:1979%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1243,o:1978,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:43,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1969~0,3~100%5D,as:%5B750~0.0,1222~300.250%5D%7D%7D,%7Bsl:i,t:1978,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1239~100%5D,as:%5B1239~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:1153,fm:tIDqqjO+11%7C12%7C131*.1468596-71180196%7C1311%7C141.1468596-71180196%7C1411%7C151%7C16%7C171%7C172%7C1811%7C191.1431402-70901270%7C1911%7C1a%7C1b1.1431402-70901270%7C1b11,idMap:131*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:46,sis:818%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:34 GMT
server: nginx
x-server-name: dt21.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DAA9 0
20 B 51ms
50ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9625275930705&version=m202301230201&ct=76&x=1&cor=16532715870226266000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame 8E47 8 KB
4 KB 151ms
24ms Script
text/javascript 130.211.44.5
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=817&ttfrms=104&brid=3&brver=114.0.5735.198&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTau42DE%3D6Dc%3C%3A5D%5D4%40%5D%3FKTauU2%3F4r92%3A%3Fl9EEADTbpTauTau42DE%3D6Dc%3C%3A5D%5D4%40%5D%3FKTar9EEADTbpTauTau2ad62e677c_36365dg2b4b43b4d___hf%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3ETar9EEADTbpTauTau2ad62e677c_36365dg2b4b43b4d___hf%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTau42DE%3D6Dc%3C%3A5D%5D4%40%5D%3FKTau42DE%3D6DTau%3E682D%3D%3A56&srcurlD=0&aUrlD=-1&ssl=https:&uid=1688099254864250&jsCallback=dvCallback_1688099254864569&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.198%20Safari%2F537.36&htmlmsging=1&chro=1&hist=3&winh=90&winw=728&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=4050&tgjsver=4050&lvvn=28&m1=13&refD=2&referrer=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&fcifrms=11&brh=3&sdf=2&dvp_epl=424&noc=4&nav_pltfrm=Win32&ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&adsrv=0&advid=3398311&turl=https://castles4kids.co.nz/castles/megaslide&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_DV_CT=1&DVP_PP_ID=3&DVPX_PP_IMP_ID=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&DVP_DBM_1=1861733&DVP_DBM_2=26833064&DVP_DBM_3=16267991022&DVP_DBM_4=327231618&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=1944214853903&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=42444999.25875716&dvp_tukv=1344844189.5347114&dvp_strhd=0.6999988555908203&dvpx_strhd=0.6999988555908203&dvp_tuid=1133118585320&jurtd=270396297
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements4050.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.44.5 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 5.44.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 224d68d37e5ea831ecb6824fc3f4bb221efa79aba0bd9b9e4b27273baf96c51f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:35 GMT
Content-Encoding: br
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: keep-alive
Timing-Allow-Origin: *
Expires: 06/29/2023 04:27:35

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D61E
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEJFJejXDqTvzmnVJEySG4jk&google_cver=1&google_push=ATf1kGMd3SCYzHWu9yqSjVHOCYOe9ALRjUYuaCJMbyQk8t_VCnBXJuVE5Qf4a7nl7TO7jaoqzghXguA8YHhjksvD3Aab...
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=google&bsw_custom_parameter=190d1b78-7923-4209-b1a6-1e7e1fa1ab23&gdpr=&gdpr_consent=
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=google&bsw_custom_parameter=190d1b78-7923-4209-b1a6-1e7e1fa1ab23&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=4&user_id=c5077cbd-583a-42e2-8259-fb22ec9517f4&ssp=google&expires=30&user_group=5&bsw_param=190d1b78-7923-4209-b1a6-1e7e1fa1ab23
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGMd3SCYzHWu9yqSjVHOCYOe9ALRjUYuaCJMbyQk8t_VCnBXJuVE5Qf4a7nl7TO7jaoqzghXguA8YHhjksvD3AabrlstVSA&google_hm=GQ0beHkjQgmxph5-H6GrIw==

170 B
188 B

32ms
28ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGMd3SCYzHWu9yqSjVHOCYOe9ALRjUYuaCJMbyQk8t_VCnBXJuVE5Qf4a7nl7TO7jaoqzghXguA8YHhjksvD3AabrlstVSA&google_hm=GQ0beHkjQgmxph5-H6GrIw==

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGMd3SCYzHWu9yqSjVHOCYOe9ALRjUYuaCJMbyQk8t_VCnBXJuVE5Qf4a7nl7TO7jaoqzghXguA8YHhjksvD3AabrlstVSA&google_hm=GQ0beHkjQgmxph5-H6GrIw==
date: Fri, 30 Jun 2023 04:27:35 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D61E
Redirect Chain

https://s.uuidksinc.net/match/47/?remote_uid=CAESELNiQhsN9PHFFfHixjAtHBQ&c_param1=ATf1kGPTi86GoRqDzzVFlm_AkKS95uIdzCrLWRN9LICl4j2SC-KWYeFOkvNdOMgZf-SUoLUDOD2LiLNvuzGYbZMDsPe1toqRqEMt&gdpr=%%GDPR%%&...
https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ATf1kGPTi86GoRqDzzVFlm_AkKS95uIdzCrLWRN9LICl4j2SC-KWYeFOkvNdOMgZf-SUoLUDOD2LiLNvuzGYbZMDsPe1toqRqEMt

170 B
188 B

35ms
33ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ATf1kGPTi86GoRqDzzVFlm_AkKS95uIdzCrLWRN9LICl4j2SC-KWYeFOkvNdOMgZf-SUoLUDOD2LiLNvuzGYbZMDsPe1toqRqEMt

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ATf1kGPTi86GoRqDzzVFlm_AkKS95uIdzCrLWRN9LICl4j2SC-KWYeFOkvNdOMgZf-SUoLUDOD2LiLNvuzGYbZMDsPe1toqRqEMt
date: Fri, 30 Jun 2023 04:27:35 GMT
server: nginx/1.23.2
content-length: 0

GET
H2 200 sync
ssbsync.smartadserver.com/api/ Frame D61E 0
44 B 28ms
26ms Image
text/plain 185.86.139.101
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEB64PdMCVTqtw3fRhQCB_GU&google_cver=1&google_push=ATf1kGPPdAH1-Jci3FtRu8ObpHXfu2sgz3ftyxJ6I8SsEiI7o_qdX2LAvA6_YY5VHYGSneaqHByyTMZdke-cCzwaplLshtW10cQ
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.101 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:35 GMT
content-length: 0

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame D61E 0
43 B 242ms
240ms Image
text/plain 54.178.244.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEB7Z_lQUgfQ2cjXWyMJmJRE&google_cver=1&google_push=ATf1kGMDGFkfbJkotjRzxzwU1vnf91Gejabus22d2n4g1XBnKo7X-8O5IFmthkl0Asd0azr6yi2zu9MkyFSt9hRTREDOhudeZIwS
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.178.244.106 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-178-244-106.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:35 GMT
server: awselb/2.0

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58281/ Frame D61E 0
125 B 46ms
11ms Image
text/plain 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEDnxAtixMv45KCihjM8T1ik&google_cver=1&google_push=ATf1kGMhfbdaPCuJ6ZTvO_CGRw76tN2tXilFgA__-nhpShprJ45kRh2CF2A30uFmAKh5cX9Cjm6tjzRard0ykn5HSuAC35JLmTox7w

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.57 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:35 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D61E
Redirect Chain

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEAUM8iKcDVA9bgwMzFxinMs&google_cver=1&google_push=ATf1kGOAhAHT1J2Ap_AjmnpFLowHttGmYVbvJV2vu4IgRSXixnxLL1MwfB0YLv_k-7HQtgTxBkp8jNsfuflXNHfSouIcaNE...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGOAhAHT1J2Ap_AjmnpFLowHttGmYVbvJV2vu4IgRSXixnxLL1MwfB0YLv_k-7HQtgTxBkp8jNsfuflXNHfSouIcaNEBLixS&google_hm=MjM1MjQxNzg...

170 B
188 B

34ms
33ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGOAhAHT1J2Ap_AjmnpFLowHttGmYVbvJV2vu4IgRSXixnxLL1MwfB0YLv_k-7HQtgTxBkp8jNsfuflXNHfSouIcaNEBLixS&google_hm=MjM1MjQxNzgyMTQ5NjI1MDE1

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGOAhAHT1J2Ap_AjmnpFLowHttGmYVbvJV2vu4IgRSXixnxLL1MwfB0YLv_k-7HQtgTxBkp8jNsfuflXNHfSouIcaNEBLixS&google_hm=MjM1MjQxNzgyMTQ5NjI1MDE1
Date: Fri, 30 Jun 2023 04:27:35 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D61E
Redirect Chain

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEA2WMm-Xv2lkBjKcEy9u7Ys&google_cver=1&google_push=ATf1kGMNH1hFFMLzM...
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=NTcyNzk1NDgyMDczOTQyOTkyNQ%3D%3D&google_gid=CAESEA2WMm-Xv2lkBjKcEy9u7Ys&google_cver=1&google_push=ATf1kGMNH1hFFMLzMy6n-5NLpBnWHMsK0Y...

170 B
188 B

26ms
23ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=NTcyNzk1NDgyMDczOTQyOTkyNQ%3D%3D&google_gid=CAESEA2WMm-Xv2lkBjKcEy9u7Ys&google_cver=1&google_push=ATf1kGMNH1hFFMLzMy6n-5NLpBnWHMsK0YC-a9qoWdXf62MuSVz0xOxSXCcfx1ApaDQel7ZvtgdXO8Fyco25LMwNaCsoFK3zPwFa

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 30 Jun 2023 04:27:35 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 45.141.152.73; 45.141.152.73; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 25f5e2d6-ede8-481c-b42c-2045621f6e55
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=NTcyNzk1NDgyMDczOTQyOTkyNQ%3D%3D&google_gid=CAESEA2WMm-Xv2lkBjKcEy9u7Ys&google_cver=1&google_push=ATf1kGMNH1hFFMLzMy6n-5NLpBnWHMsK0YC-a9qoWdXf62MuSVz0xOxSXCcfx1ApaDQel7ZvtgdXO8Fyco25LMwNaCsoFK3zPwFa
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame D61E 0
12 B 17ms
15ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KIPOHjsLJbZexBoYJw3TpDMYBfqeVoJlW23Tk6Rz32YznFplvT4x_ZifWYbmHQZG9X_Y3GA8IZ

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-56-247-104.eu-west-2.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:27:35 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2DD4 42 B
64 B 69ms
61ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu7WQD-g-witFWR4ByfafopP6cYlCt3hfCVHafrQy-Iwj5iwusJgzN78sGttzLfq3C_1MYLaMpmsVE7vxZ2JcJHb4EnxdNDz8jsq1NUI840y5q6Ax1J7izFV1b0JFwe8912d0CPFYAqewkP&sai=AMfl-YQDcZMLUgAsAUOiL-fJ_7X0P40KTfAhaa53WoYjKt4Nmxk3-VXy4CJeySC6BjjIjKUvTEWrmGl4GDIEWOPyxo98IokJP0VhfUzp-c--yu6nwNfFvem36MOLRjrh&sig=Cg0ArKJSzFbxAImHPDRAEAE&cid=CAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB&id=lidar2&mcvt=1253&p=0,0,90,728&mtos=1253,1253,1253,1253,1253&tos=1253,0,0,0,0&v=20230628&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3517930930&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1688099250661&rpt=3385&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B795 0
20 B 62ms
57ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=423099571648&version=m202301230201&ct=76&x=1&cor=5662488014079943000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 44ms
43ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202306270101&jk=2939560906653285&bg=!YmGlYTXNAAb90kgr3dI7ADkAdvg8Wm1a21T5mfdzaTwuRwVhCtawiwYOMHNi4UlBCZLv2077mYaTz7vhe3XaDZmTgPu489mdGxYCAAALSFIAAAFBaAEHCgAVeI9vQhiXgwVJIbM6BGdPWAoMqFvmmQKn8EoeCndDNgmKPZwi2ZtY5ITYVlm8xlh2FaVy3wFa30zxlWU3jYgIF0gkE4_JXxo6JMsbKdlRamFeyNeK5xBBYKpDu4q25wq03v1Hd3Tff6ErQgzlfWJkokExgCi6jRaO8LkWq1zOwE6QfH-Muydk1HWVNZHuFpnnVHYCDw6W8NWt5qFSUOgFPIGzgE2hFzq88nd60f4YUEN-sb3upZOdROZzFtJxmeVrsrXGTblZ1aEy3y1dpeVvchoiUDKe0mgtjvEAHJ-Ga27NdmO07-SeWMwLo4KHdZHyw24S1fFNaeYj_SSYa1SdZqPltYSTdkka1ILghJRfoFPcWNAv0o33Vsl2ga-Bm8uE5ms_ZtcbDxKQU88wo5-LoBDAryLNi38mxvuJH7H_7O55zvBQoARSOiQSC63p-yd6h54jPxJm-L2EeZdxQetJWvHmTbbxQSixiQDKzF1CaLNYkt17OQCdSMBJ5XHsl-VHJ7TP-kxMR5oewooXjf36j_2ZB4sUdeP5wfgv0gqrUQeJ_hitFQ27Zr8ZvLu_Jo-b0qmff546FFosrFB8O7URVuOECE0xWEurebzwsDzOBeCH9w6GhVkWcbIuQY76ZMo4q6rTsBwAfJDWQtqsB6J5YArDYce4frD4nzDLQOkWA1Fx2W3awxN5LrdBEa9rsMFl_RTHHF7VOzWctfhL_sMY3sdptaed_cXMpyn20QRqq9j4PB5oF3fwYOS5x_E0z-qHg3r2Gy0EH8kSs9cC6kKEFyas7We5xjjrUuNkCGo8AEX19u6K3wCSd1j5eMJ2n70xq3RnRMe2zT8pLzfB_UhZ3rd-x8Y59okfgBTcWtnRhBStNsHOoYaeMp2IHT9i6oEThAer319hYjxmvDHlXc_-TDWXD7hubC_wpXlFxchJGA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://castles4kids.co.nz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

GET
H/1.1 200
OK layout_renderer.php Show response
as.jivox.com/unit/ Frame F8D9 320 KB
51 KB 249ms
248ms Document
text/html 35.153.32.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://as.jivox.com/unit/layout_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545&objectName=jvx_649e59b5313d3&adUnitId=1800&jvxSessionId=1688099253.5434&base=1&creativeResolveBeginTime=1688099253000&omid=0&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&localTimeOffset=0&pageURL=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/unit_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.153.32.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-153-32-160.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 94bae5b22c6328d2b68eef78485c9bdb944427270792f8bcb34f7d8cae9c56c2

Request headers

Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 52134
Content-Type: text/html; charset=UTF-8
Date: Fri, 30 Jun 2023 04:27:35 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 766D 0
20 B 40ms
39ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1948560002690&version=m202301230201&ct=76&x=1&cor=1750149732679893000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0628 0
20 B 40ms
40ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9141959002047&version=m202301230201&ct=76&x=1&cor=15124543859093443000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 07A9 85 KB
31 KB 185ms
13ms Script
text/javascript 18.66.147.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=3641431&wgcampaignid=1384975&js=1&nw=1&wgtarget=https%3A%2F%2Fas.ad4m.at%2Fad%2Frct%3Fed%3D1ghk1xbwb0h1xkeqxhtyw519xrdx78aka6jxgbyqhge8kz1th100gg1wgmhh97zz7ybw9bjbmdkssngkhcfmk7jadnk8f01mgnb7ne31k6vt77vsq2n212s8gv9k65gydjt3tc3pd27wze8npxew7pjzty4t70gj2egnxv653466ktc3q20rp98e9pbsdcef8yhf8fzt9hengbb0adnew1xcjvhakp1a9zg5gwe6dxgnfckamedfp92r4emqtyjv2dm0%26a%3Dhttps%253A%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1k7hn51rf4kck953k3cjm4q728eghrvmn3ezk8v15ht2yebtetkh54084c8qtj3hh73k1qh2q4g6tffgq80gp4cnegxhh0a1ptxstn1qg4hb5qn9498yw6c74nnz1e55603bx2aaq1w97583ycqp9z3ppfrawt7ewy614rzr2rr88cn1s7eek3s68yddf5wadj74hz3pwhvt03n7tgt9khcrcvreckre472h2tchjemnbg14v6rrjeh64zxc0e6b1rat7symw79g4jz4z9mz19jg7w%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%252526num%25253D1%252526sig%25253DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%252526client%25253Dca-pub-3831894559014614%252526adurl%25253D&clickref=oneidDXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjWoneid__suite_Netmix_Reach128_WEBGAINSMOSTLY&viewref=oneideYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpboneid__suite_Netmix_Reach128_WEBGAINSMOSTLY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 00c5621a3f56c052959f8f0591b65e893f132b49b1447fde20767966cacbfbfe

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 12:41:10 GMT
content-encoding: gzip
via: 1.1 e65c822edea04e16936bdb4537763dd4.cloudfront.net (CloudFront)
last-modified: Wed, 15 Mar 2023 17:26:29 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 56786
etag: W/"876c293e6c37046ecb0c11ce2e276942"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: vTHZk-3ADV-vuOeskY2Y2f9gxLjjYDyLEzGolMvI6Icc_SSVI5W3BA==

GET
H2 200 1619604937_fPkEZHu3MNy3GC7XuV3lA1s9E5XlSAcF.png
cdn.track.production.webgains.team/286305/ Frame 07A9 15 KB
15 KB 183ms
12ms Image
image/png 99.86.4.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/286305/1619604937_fPkEZHu3MNy3GC7XuV3lA1s9E5XlSAcF.png?Expires=1688099554&Signature=McooiacO3c7rPonYD3O3yw5Y2pORkI1Ve4eMKu~LfAZ~Rqohbvz3qoGv27o8Rr6a6MyOSRocovU0frLPPUrYVyJOJPFzWwNmtVdpVCIngY7icth-mPMBBYcPMeimLNm7DAGvIgwBh3A6hiK-oJFaaFtThU4gHmpONhu8llNv8n78zEBoyqzx7eB0l9Z4dsWHTE7Zvta67hoazC4fb9btxmNsJEbZI4Ph32xEGDO8ck-GBwgGFVFqtLMRutQEU14G3-isU-wcBskVZxl1MLcVNbUaOa9ZLwJqflxEYq1CZqZO2z4jIS1ro-~xdBErqlvLCX11enRvOk9j2a0CV1mPFQ__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862%2C117569%2C19769&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb%2Ck7Vh5f3fD2kYa4HwHetBtxPrtZSjTm3baj7m6%2CppXa1fgfpAwfkH4HmtztQJjt9SRT8WwUAQkr&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW%2CzR7CRfYfk3KMFpHBHMtJC9dGtVSwTQ2GCrp6Y%2CJgKFzf5fqjZhBH6H7tqCpKbTxSgT4MetAmKM&c=728&d=90&e=&g=d2a0cd969d48271e2534b2f8bbbd3bac%2F1725913142246912061&i=71725%2C29981%2C21630&j=21%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1688099253508&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1k7hn51rf4kck953k3cjm4q728eghrvmn3ezk8v15ht2yebtetkh54084c8qtj3hh73k1qh2q4g6tffgq80gp4cnegxhh0a1ptxstn1qg4hb5qn9498yw6c74nnz1e55603bx2aaq1w97583ycqp9z3ppfrawt7ewy614rzr2rr88cn1s7eek3s68yddf5wadj74hz3pwhvt03n7tgt9khcrcvreckre472h2tchjemnbg14v6rrjeh64zxc0e6b1rat7symw79g4jz4z9mz19jg7w%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCAlqvslmeZNCIDMCAjuwPw5OCyAOQ4YGEXLaoworwAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zODMxODk0NTU5MDE0NjE0yAEJqQJza4O_6zqyPuACAKgDAcgDAqoEsQJP0Jt2Oc4XqMFa6yZoOmh8bpA7KJBrPhhnr7CNqyFpHR0fi1P2UAFaHpvsh5Re6LYIBswSlKobylQ9Uv03KX72uUpiH9C7tLkuLXDlJCfWVoWQn7X6qDaKxtFtz6j_zbRcveWpQwfDZzMwBmxun6KPrH-IIiLvUXS_WswYAls1iXV3_ut6LTNab1ogndWNh2wePemVlRM0UOiZj-TNnAGSqxTZrFInS4BxMGoljWlxtKDAw3wBtYK7v6Fb4VmScCz2vVWUidC7YkaUlG8ltTg49qJvLpTuJpbTNvVew3SZtangD4BD0ZPMjTchhbBX6WN8YeWlcP0NA0-5NagMfx6AFL4e42suQEE1bnK2st-ZqDy5Pi0DxBgkMJ2FWIDqmlLbiX3ZJCaIAqfPJHzyO51JZ-AEAYAGxNGe9MiAzrylAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_0rCiOPo46XOf9xJzTka9lIIlhc4Q%2526client%253Dca-pub-3831894559014614%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-53.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 60bf02832688d14251ec1c7b8acfda233a91f927f26c7202bdaba781a1f0fcdf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 29 Jun 2023 07:07:56 GMT
via: 1.1 507b5edb20d0e1a0b73c8687f53defa8.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 10:41:35 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 76780
etag: "d4e8f970f24f6d19b53aa92b1907c1ef"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 15054
x-amz-cf-id: zVLMOQWEUAkXI3jpk-10BRcsab5DnjM4UyVeNwVla6udZPj45cNNDA==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DAA9 43 B
215 B 185ms
185ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1468596&asId=544a237b-fefe-ee38-95ac-6ddcb389d2ce&tv=%7Bc:gZzYqi,time:4004,type:e,im:%7Bpci:%7Btdr:1813%7D%7D,env:%7Bnr_p:1%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:991,o:3013,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:28,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B3004~0,0~100%5D,as:%5B632~0.0,2372~300.250%5D%7D%7D,%7Bsl:i,t:3013,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B991~100%5D,as:%5B991~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:402,fm:tIDqqjO+11%7C12%7C131.1468596-71180196%7C1311%7C1312%7C141*.1468596-71180196%7C1411%7C151%7C16%7C171%7C172%7C1811%7C191.1431402-70901270%7C1911%7C1a%7C1b1.1431402-70901270%7C1b11,idMap:141*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:31,sis:767%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:35 GMT
server: nginx
x-server-name: dt19.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DAA9 43 B
215 B 258ms
178ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1468596&asId=544a237b-fefe-ee38-95ac-6ddcb389d2ce&tv=%7Bc:gZzYrI,pingTime:1,time:4092,type:p,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:28%7D,%7Br:r,w:300,h:250,t:641%7D,%7Bpiv:100,vs:i,r:,t:3013%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1079,o:3013,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:28,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B3004~0,0~100%5D,as:%5B632~0.0,2372~300.250%5D%7D%7D,%7Bsl:i,t:3013,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1079~100%5D,as:%5B1079~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:402,fm:tIDqqjO+11%7C12%7C131.1468596-71180196%7C1311%7C1312%7C141*.1468596-71180196%7C1411%7C151%7C16%7C171%7C172%7C1811%7C191.1431402-70901270%7C1911%7C1a%7C1b1.1431402-70901270%7C1b11,idMap:141*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:31,sis:767%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:35 GMT
server: nginx
x-server-name: dt19.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DAA9 43 B
215 B 259ms
179ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1468596&asId=544a237b-fefe-ee38-95ac-6ddcb389d2ce&tv=%7Bc:gZzYrI,pingTime:1,time:4092,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:28%7D,%7Br:r,w:300,h:250,t:641%7D,%7Bpiv:100,vs:i,r:,t:3013%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1079,o:3013,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:28,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B3004~0,0~100%5D,as:%5B632~0.0,2372~300.250%5D%7D%7D,%7Bsl:i,t:3013,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1079~100%5D,as:%5B1079~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:402,fm:tIDqqjO+11%7C12%7C131.1468596-71180196%7C1311%7C1312%7C141*.1468596-71180196%7C1411%7C151%7C16%7C171%7C172%7C1811%7C191.1431402-70901270%7C1911%7C1a%7C1b1.1431402-70901270%7C1b11,idMap:141*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:31,sis:767%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:35 GMT
server: nginx
x-server-name: dt18.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 jquery-2.1.0.min.js Show response
playercdn.jivox.com/1682338336/unit/js/gz/ Frame F8D9 82 KB
29 KB 68ms
6ms Script
application/x-javascript 108.138.7.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://playercdn.jivox.com/1682338336/unit/js/gz/jquery-2.1.0.min.js
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/layout_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545&objectName=jvx_649e59b5313d3&adUnitId=1800&jvxSessionId=1688099253.5434&base=1&creativeResolveBeginTime=1688099253000&omid=0&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&localTimeOffset=0&pageURL=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.7.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-7-120.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f284353a7cc4d97f6fe20a5155131bd43587a0f1c98a56eeaf52cff72910f47d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 18:22:14 GMT
content-encoding: gzip
via: 1.1 002af2e4f72157b8b4bd2de012b5b57c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
age: 36322
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 29294
last-modified: Mon, 24 Apr 2023 12:20:25 GMT
server: AmazonS3
etag: "84642ab523899a6150af1489287de4de"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=86400, s-maxage=86400
accept-ranges: bytes
x-amz-cf-id: iptGxX_PxDeo1clX8Q7e4A6ddrn2h4R0RhdbNfB_8JAEB4AsTyHYNw==

GET
H2 200 velocity-raf-disabled.min.js Show response
playercdn.jivox.com/1682338336/unit/js/gz/ Frame F8D9 34 KB
13 KB 76ms
15ms Script
application/x-javascript 108.138.7.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://playercdn.jivox.com/1682338336/unit/js/gz/velocity-raf-disabled.min.js
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/layout_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545&objectName=jvx_649e59b5313d3&adUnitId=1800&jvxSessionId=1688099253.5434&base=1&creativeResolveBeginTime=1688099253000&omid=0&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&localTimeOffset=0&pageURL=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.7.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-7-120.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fa85a4366200f608a99ecf4b1b933babdd9c5662cbe5d518b3daa57e53dbd85b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 15:48:58 GMT
content-encoding: gzip
via: 1.1 002af2e4f72157b8b4bd2de012b5b57c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
age: 45518
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 12405
last-modified: Mon, 24 Apr 2023 12:20:39 GMT
server: AmazonS3
etag: "6db08f58b76a3c4459a454a7acf752ca"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=86400, s-maxage=86400
accept-ranges: bytes
x-amz-cf-id: uWFhzkyfyGBfHr-v0dibp64h4vHrleDFNj6qndF9V4C-iXkZOtchVA==

GET
H2 200 jivoxWidgetApiV2.min.js Show response
playercdn.jivox.com/1682338336/widgets/jivoxWidgetApi/gz/ Frame F8D9 29 KB
6 KB 73ms
16ms Script
application/x-javascript 108.138.7.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://playercdn.jivox.com/1682338336/widgets/jivoxWidgetApi/gz/jivoxWidgetApiV2.min.js
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/layout_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545&objectName=jvx_649e59b5313d3&adUnitId=1800&jvxSessionId=1688099253.5434&base=1&creativeResolveBeginTime=1688099253000&omid=0&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&localTimeOffset=0&pageURL=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.7.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-7-120.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f6c84a15873bbae73ff06857139327b85a6869fa0e21d36666aa2bb5d9bbb19b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 20:45:08 GMT
content-encoding: gzip
via: 1.1 002af2e4f72157b8b4bd2de012b5b57c.cloudfront.net (CloudFront)
last-modified: Mon, 24 Apr 2023 12:21:43 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
age: 27748
etag: "2a0e0abd8f7f11fb012a534ea115a29a"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400, s-maxage=86400
accept-ranges: bytes
content-length: 5987
x-amz-cf-id: kAfPktdzTzSRxOYsodcuNdP-Sc99IsSwP-K2WK_jMDPe7ltIXghb6A==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0628 43 B
215 B 180ms
177ms Image
image/gif 2600:1f13:800:7781:1172:d4f8:179f:23b5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1431402&asId=83af6268-d088-841e-ee51-04fca590ae64&tv=%7Bc:gZzYtR,time:3385,type:e,im:%7Bpci:%7Btdr:1135%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:3385,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:42,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B3374~0%5D,as:%5B1458~0.0,1916~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:858,fm:tIDqqjO+11%7C12%7C131.1468596-71180196%7C1311%7C1312%7C1313%7C1314%7C141.1468596-71180196%7C1411%7C1412%7C1413%7C1414%7C151%7C16%7C1711%7C172%7C1811%7C1812%7C191*.1431402-70901270%7C1911%7C1912%7C1a%7C1b1.1431402-70901270%7C1b11,idMap:191*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:44,sis:745%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:1172:d4f8:179f:23b5 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:35 GMT
server: nginx
x-server-name: dt11.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dv_nike.js Show response
cdn.jivox.com/files/46220/Nike_DV/ Frame F8D9 4 KB
2 KB 58ms
8ms Script
application/x-javascript 18.66.97.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jivox.com/files/46220/Nike_DV/dv_nike.js
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/layout_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545&objectName=jvx_649e59b5313d3&adUnitId=1800&jvxSessionId=1688099253.5434&base=1&creativeResolveBeginTime=1688099253000&omid=0&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&localTimeOffset=0&pageURL=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-117.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 00f4fcd177393f1aeee696e9cbb8ae43dfaa600d5fc635bb353e14556419d6b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 12:48:20 GMT
content-encoding: br
via: 1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
last-modified: Wed, 28 Jul 2021 15:13:35 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P2
age: 56356
etag: W/"0470e403c7976eb8d77e92ae356d5f8d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400, s-maxage=86400
x-amz-cf-id: Xt1gvYHu5p_lMSzGnC4PRxKYqeIG4Z4utLSxY9JD-X8OLlorLCAUpQ==

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4CAE 0
20 B 61ms
53ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bb8qdslmeZOaZHdqz9u8PxdCyyA0AAAAAOAHgBAI&bg=!OzilOGzNAAb90kgr3dI7ADkAdvg8WuuZhjCZNtG8rsfY6SXoa19jvbPf4_q021fGQ0CquFoMiqjNT-_wD291TfpGj7lhw2x1Pm0CAAALNlIAAAAEaAEHCgAnE2u0Xj1qD6vvibcIK6AbvDxnYfGCydnfEsyGwKCXKrd0IyDTB-d7mQMvBIkulsVPg5PHRmtbutKiylv6QKKC2VYz0ls5Mb_p5ucWOB3IL4gNfiW6Ybi1McmTRs36NXBEEKxQanFBGBcoF46-BFHpZ_0l3uM_F83dsBWAKysntBcQdXyMx1L32LSV60YRScV3EbGcAO0aPIFMHgqcgY4cE8smECJ_Hr4KpjhGIWnx2rqBfarfHWrXe0qbuJJNeSfUAxP_nxvpgputQLhNjKwKOSglV6PfbhwQvMt6NWCYesNohxbMIej1HMHZCLDJq2pfwZ09CrMDblrljKCW3H7QWgk9LuwNAhHGb44Av2Htie41WtOzNdpYWu5dKV2dmHLDHHjfOtlKL_72CkuHx634vhV0I0t2HCCvnX-C89UYkol0XY3ZQd7-gqHQwhdbH2sEXxZbfag43qrm_kRzvNHBdUYRSBBV2RpzdFoVO6csSX4-QYyYUbi9xKQ2mywT9BBrbJoHcGzSJWz_7SxaHCBi-Cd-CWRyDhpcH4v2sVhv0gHanH9ipTuOi1ropcQrzxS_QMvYitQgeXiwB-9l25UYZVNmZBZ--Ul4iVskN-z_MczgYUhS7eU_-YJ-6v46vFvSSTibfj8DS7x0SXs3PAgpWnd9qPTl-Lraedaf_xTsWEBDieWWG0KO2YfygbB0LEojwkr1NntLQfXriN3sDmRKFiZBhxG4rWFs3tpgU37YZ-kdA5XwAzz6ifq5ZTH0Xz6oCbLPlkAGzb0GiX-wu1MBLWkS8XdfKZwlJ-DzRgEt_h047zLeWtuvvoSxi5Srhxz-F3ZRhzE0-GWg5je7dt3UeFlRHUZygaFdSh-N_tBNCxzgVkKnbMpN5bLvydIxYnv0Cqo1lUFlbnpc6n-_Ur3UxOn8wl0V2OWTnft0QTctQQyd0JHfWrnhOEjU0Eyb4cbc778BcjMx2lD2TlFA3M4JMW7oGq-1Bbh4v2Xa0A16sjGOPNEfzeHbW1pZ1oklldKgGPbg37g48KcjHHtgz4mlaAzLF4apGUENpUT5BGIlnZnLZuuOV5xmUV8x4BrXXmJaoXhQigeLolmKt4EEkGMh2rbj7hebY17JKgC1ncBird7yG5pxRIIyNTE

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 index.html Show response
assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/ Frame F8D9 15 KB
1 KB 49ms
8ms XHR
text/html 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/index.html?externalWg=1&adUnitType=18&campaignId=145089&base=1&creativeUnitType=18&adUnitId=1800&isDynamic=1&objectName=jvx_649e59b5313d3&serverURL=https://as.jivox.com&placementId=vtnwou&reportingURL=https://evs.jivox.com&jvxSessionId=1688099253.5434&siteId=45f3d18e47f96c&isCampaign=1&es_pId=vtnwou&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&jvxUUId=tIDqqNIZtw97&es_cgName=2950fd17a9af4f93839f039dd8aab1289af793df9d816d3a239d7d4d9d72ddcf993943f89551eec8ba5a58a1f71d3328a5eee0dfef6f90a68b34c130717ce8a6&es_segName=Prospecting_EOSS_1&assetID=asset1419&isMobile=&externalStartEventId=141700
Requested by: Host: playercdn.jivox.com
URL: https://playercdn.jivox.com/1682338336/unit/js/gz/jquery-2.1.0.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dbc6fa6e8cf3e1b0f6d9da90ea7dc6c39576f14163374a9fe4cc5a577b98dacb

Request headers

Accept: */*
Referer: https://as.jivox.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 12:41:37 GMT
content-encoding: br
via: 1.1 1d087f24771eb6834b16162f1bb01660.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 56768
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 13 Jun 2023 11:47:50 GMT
server: AmazonS3
etag: W/"554b72e8e449b6dd404c03695c178781"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/html
access-control-allow-origin: *
cache-control: max-age=86400, s-maxage=86400
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-amz-cf-id: 1RNA5PofIfCoYMhigqaCXxa4H9sAQIqvjGjW0_Pg0J90dSC-a_8MXQ==

GET
H2 200 jivoxWidgetApiV2.min.js Show response
playercdn.jivox.com/1682338336/widgets/jivoxWidgetApi/gz/ Frame 3069 29 KB
6 KB 7ms
6ms Script
application/x-javascript 108.138.7.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://playercdn.jivox.com/1682338336/widgets/jivoxWidgetApi/gz/jivoxWidgetApiV2.min.js
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/layout_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545&objectName=jvx_649e59b5313d3&adUnitId=1800&jvxSessionId=1688099253.5434&base=1&creativeResolveBeginTime=1688099253000&omid=0&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&localTimeOffset=0&pageURL=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.7.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-7-120.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f6c84a15873bbae73ff06857139327b85a6869fa0e21d36666aa2bb5d9bbb19b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 20:45:08 GMT
content-encoding: gzip
via: 1.1 002af2e4f72157b8b4bd2de012b5b57c.cloudfront.net (CloudFront)
last-modified: Mon, 24 Apr 2023 12:21:43 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
age: 27749
etag: "2a0e0abd8f7f11fb012a534ea115a29a"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400, s-maxage=86400
accept-ranges: bytes
content-length: 5987
x-amz-cf-id: nq5hfD7yokSiPyV9K0z78RBXnJ3L9LfQGfKPUAhXkpTqmy-qb2MCYA==

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F936 0
20 B 52ms
48ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Ba0VpslmeZOqQI6Cl9u8PtNGO-A8AAAAAOAHgBAI&bg=!DA-lD1vNAAb90kgr3dI7ADkAdvg8WurO0n8X-JojCGKVGrGJA29NJeQCP-DjOG3UCb4zlu9YGGeJ_qRDlnY7ViEIY3-GCxRvSa0CAAALq1IAAAAEaAEHmQMww3uEMCcYdmcouHw2tlfN16PZSA8vD7FjYXAND7zSpeUjiG-8tRer408I__BKDUNIaT94On-aLPrc9zSNlxDFzykLAmGhwEX3kwRIu_EUruSDff97fDzNHQFKVtpDMVODE0EgbpaR9q0xEJoRxuqlY6LNnX-Y7mJlEszlShM9e2nBsFL85pOVEjBtuUMaYNRey6h4GbNrxnTs6NaEBoaZIfS4Yru5gqOkMW75TK1JO5U9HAFZ3zrMFyx9wVBQqWsW4TZFlbmRlSGxDyBd6MbzIzULKlEiWoYQn6RNq-v_0jrSqp5WZeQpxunnakrtW3CE621XpKlKe8X6pqZDV4RCNL-cwNc0MJWYlbV3NOLpkjICXp0rcn7YRlnrY_iKhIJY4gA6AQe_nmG-AaR-tE71VJmO6cQnExW53lZH66UveaDVoNz_WGfl6dKP-RwClEd3Ga0egaYQMLUVYLkuQ_i1J7KoY8MjwxwGEhbRAZeeKvFZASQCgUt7-y0tCs5aRFCVhU9EcNfbIqANCs2r7TCNI5YoOyGvZkzKDzWbJ6TIX2TylZqlurvTSGAojNcEqWUNUu4v6qetyRGW9QTbbsCx8cuSuK048N5l7Vi74DIiHEtSTomDu7KAwK8kEesv75QbrYNKw1Ls-wppdszRKouZ1LvwugaGDumXvmC9I8GnJckAH3wv6sjwphu_PvhXOlScVGplZZ1E78JScFMocF4cFKDJli0yXMgBQR_4OnsfVPGy-chSt2X3bffVTLeueFSevrpg3MYxhp-nyIUvC6VvDgV9KSDiLmZXVidzqeqJRF_XKG4jyf1wDGCwCBMg45i_-8uow-UPWoc4dVVsghF1OlszaFfd20sRPMwWs-mFcDTngv6dvb_nWJUu6cn55LFZKIeGn0UU1amCupmZjKey6kRNnNS3EsIDq4c312YalmHePq8cr8OA2LACGL_PYNOEuqnS9mdDYWLkpnfz1ix_y4Kxtv3Jw_82WLbetBQuTUu5NYSPoVnh9cuwo4WEoGyPwj6He5rigZhX0gKPuu21wc_xsPNnoiosiF3rx3-SIlnk639xcfoTxSvx6gvWZdHR

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 es_encParams_L2FwX0RhdGFTaWduYWwxPTE2MjY3OTkxMDIyL2FwX0RhdGFTaWduYWwyPUFCQWpIMGhpLVVxT1RGTGdCQzZsTzdIQ0RMOWcvYXBfRGF0YVNpZ25hbDM9MzI3MjMxNjE4L2FwX0RhdGFTaWduYWw0PTE5NDQyMTQ4NTM5MDMvYXBfZ2VvTGFuZz1n...
evs.jivox.com/trk/66/219890/1800/145089/45f3d18e47f96c/18/jvxSId_1688099253.5434/es_pId_vtnwou/ Frame F8D9 43 B
229 B 329ms
103ms Image
image/gif 3.222.88.10
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://evs.jivox.com/trk/66/219890/1800/145089/45f3d18e47f96c/18/jvxSId_1688099253.5434/es_pId_vtnwou/es_encParams_L2FwX0RhdGFTaWduYWwxPTE2MjY3OTkxMDIyL2FwX0RhdGFTaWduYWwyPUFCQWpIMGhpLVVxT1RGTGdCQzZsTzdIQ0RMOWcvYXBfRGF0YVNpZ25hbDM9MzI3MjMxNjE4L2FwX0RhdGFTaWduYWw0PTE5NDQyMTQ4NTM5MDMvYXBfZ2VvTGFuZz1nZXJtYW55X2dlcm1hbi9hcF9EYXRhU2lnbmFsNz1nZXJtYW55X2dlcm1hbi9hcF9iZXN0c2VsbGVySUQ9dW5kZWZpbmVkL2FwX2dkcHI9MC9hcF9EYXRhU2lnbmFsOD11bmRlZmluZWQvYWRiMS1rZXk9MTIvYWRiMTQtaWRfdmVyc2lvbj0xNjM5OF8xL2FkYjYta2V5PTE0L2FkYjctaWRfdmVyc2lvbj0xNTk0Nl8xL2FkYjE0LWtleT0xMC9hZGIxOS1rZXk9MTAvYWRiMy1pZF92ZXJzaW9uPTI4MTU0XzEvYWRiMTEtaWRfdmVyc2lvbj0yODUwNV8xL2FkYjEwLWtleT0yL2FkYjE3LWlkX3ZlcnNpb249NDM2NjhfMS9hZGIyMS1pZF92ZXJzaW9uPTE3MDk5XzEvYWRiMjEta2V5PTY5OTk1L2FkYjcta2V5PTIwL2FkYjgtaWRfdmVyc2lvbj00Mzc5NV8xL2FkYjE4LWtleT0yMC9hZGIyLWtleT0yL2FkYjE3LWtleT0yL2FkYjEyLWlkX3ZlcnNpb249MzE2NDBfMS9hZGI0LWlkX3ZlcnNpb249MjIzMjRfMS9hZGIxMy1rZXk9MTAwQS9hZGIxNi1pZF92ZXJzaW9uPTMxODM2XzEvYWRiNS1pZF92ZXJzaW9uPTMxNDYxXzEvYWRiMTYta2V5PTEyL2FkYjMta2V5PTcvYWRiOS1pZF92ZXJzaW9uPTE5Mzk4XzEvYWRiMTIta2V5PTM4L2FkYjQta2V5PTExL2FkYjgta2V5PTEyL2FkYjEzLWlkX3ZlcnNpb249MTU5MDdfMS9hZGIxOS1pZF92ZXJzaW9uPTMxNDYzXzEvYWRiMS1pZF92ZXJzaW9uPTMxNDYyXzEvYWRiMTUtaWRfdmVyc2lvbj0yNDM1M18xL2FkYjYtaWRfdmVyc2lvbj0zNzYyOF8xL2FkYjE1LWtleT0xMC9hZGIxMC1pZF92ZXJzaW9uPTI4NTAyXzEvYWRiNS1rZXk9My9hZGI5LWtleT0xMi9hZGIyMC1rZXk9MTAvYWRiMi1pZF92ZXJzaW9uPTIwMDA2XzEvYWRiMTEta2V5PTEyL2FkYjE4LWlkX3ZlcnNpb249MTk1NDhfMS9hZGIyMC1pZF92ZXJzaW9uPTIxNjIzXzEvYkRpbT03Mjh4OTAvcj0wLjczNzQyNTQ1MjU0NjExMzkvZXNfZXQ9My9lc19jZ05hbWU9Mjk1MGZkMTdhOWFmNGY5MzgzOWYwMzlkZDhhYWIxMjg5YWY3OTNkZjlkODE2ZDNhMjM5ZDdkNGQ5ZDcyZGRjZjk5Mzk0M2Y4OTU1MWVlYzhiYTVhNThhMWY3MWQzMzI4YTVlZWUwZGZlZjZmOTBhNjhiMzRjMTMwNzE3Y2U4YTYvZXNfc2VnTmFtZT1Qcm9zcGVjdGluZ19FT1NTXzE=
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/layout_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545&objectName=jvx_649e59b5313d3&adUnitId=1800&jvxSessionId=1688099253.5434&base=1&creativeResolveBeginTime=1688099253000&omid=0&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&localTimeOffset=0&pageURL=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.88.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-88-10.compute-1.amazonaws.com
Software: akka-http/10.1.11 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 30 Jun 2023 04:27:36 GMT
access-control-allow-credentials: false
content-type: image/gif
server: akka-http/10.1.11
content-length: 43
p3p: CP='IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA'

GET
H2 200 es_encParams_L2FwX0RhdGFTaWduYWwxPTE2MjY3OTkxMDIyL2FwX0RhdGFTaWduYWwyPUFCQWpIMGhpLVVxT1RGTGdCQzZsTzdIQ0RMOWcvYXBfRGF0YVNpZ25hbDM9MzI3MjMxNjE4L2FwX0RhdGFTaWduYWw0PTE5NDQyMTQ4NTM5MDMvYXBfZ2VvTGFuZz1n...
evs.jivox.com/trk/60/219890/1800/145089/45f3d18e47f96c/18/jvxSId_1688099253.5434/es_pId_vtnwou/ Frame F8D9 43 B
230 B 315ms
101ms Image
image/gif 3.222.88.10
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://evs.jivox.com/trk/60/219890/1800/145089/45f3d18e47f96c/18/jvxSId_1688099253.5434/es_pId_vtnwou/es_encParams_L2FwX0RhdGFTaWduYWwxPTE2MjY3OTkxMDIyL2FwX0RhdGFTaWduYWwyPUFCQWpIMGhpLVVxT1RGTGdCQzZsTzdIQ0RMOWcvYXBfRGF0YVNpZ25hbDM9MzI3MjMxNjE4L2FwX0RhdGFTaWduYWw0PTE5NDQyMTQ4NTM5MDMvYXBfZ2VvTGFuZz1nZXJtYW55X2dlcm1hbi9hcF9EYXRhU2lnbmFsNz1nZXJtYW55X2dlcm1hbi9hcF9iZXN0c2VsbGVySUQ9dW5kZWZpbmVkL2FwX2dkcHI9MC9hcF9EYXRhU2lnbmFsOD11bmRlZmluZWQvYWRiMS1rZXk9MTIvYWRiMTQtaWRfdmVyc2lvbj0xNjM5OF8xL2FkYjYta2V5PTE0L2FkYjctaWRfdmVyc2lvbj0xNTk0Nl8xL2FkYjE0LWtleT0xMC9hZGIxOS1rZXk9MTAvYWRiMy1pZF92ZXJzaW9uPTI4MTU0XzEvYWRiMTEtaWRfdmVyc2lvbj0yODUwNV8xL2FkYjEwLWtleT0yL2FkYjE3LWlkX3ZlcnNpb249NDM2NjhfMS9hZGIyMS1pZF92ZXJzaW9uPTE3MDk5XzEvYWRiMjEta2V5PTY5OTk1L2FkYjcta2V5PTIwL2FkYjgtaWRfdmVyc2lvbj00Mzc5NV8xL2FkYjE4LWtleT0yMC9hZGIyLWtleT0yL2FkYjE3LWtleT0yL2FkYjEyLWlkX3ZlcnNpb249MzE2NDBfMS9hZGI0LWlkX3ZlcnNpb249MjIzMjRfMS9hZGIxMy1rZXk9MTAwQS9hZGIxNi1pZF92ZXJzaW9uPTMxODM2XzEvYWRiNS1pZF92ZXJzaW9uPTMxNDYxXzEvYWRiMTYta2V5PTEyL2FkYjMta2V5PTcvYWRiOS1pZF92ZXJzaW9uPTE5Mzk4XzEvYWRiMTIta2V5PTM4L2FkYjQta2V5PTExL2FkYjgta2V5PTEyL2FkYjEzLWlkX3ZlcnNpb249MTU5MDdfMS9hZGIxOS1pZF92ZXJzaW9uPTMxNDYzXzEvYWRiMS1pZF92ZXJzaW9uPTMxNDYyXzEvYWRiMTUtaWRfdmVyc2lvbj0yNDM1M18xL2FkYjYtaWRfdmVyc2lvbj0zNzYyOF8xL2FkYjE1LWtleT0xMC9hZGIxMC1pZF92ZXJzaW9uPTI4NTAyXzEvYWRiNS1rZXk9My9hZGI5LWtleT0xMi9hZGIyMC1rZXk9MTAvYWRiMi1pZF92ZXJzaW9uPTIwMDA2XzEvYWRiMTEta2V5PTEyL2FkYjE4LWlkX3ZlcnNpb249MTk1NDhfMS9hZGIyMC1pZF92ZXJzaW9uPTIxNjIzXzEvZXNfY2xpY2tVcmw9aHR0cHMlM0ElMkYlMkZnb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQlMkZkYm0lMkZjbGslM0ZzYSUzREwlMjZhaSUzRENDSWlKc2xtZVpKR2VCNWlEM3dPNHpiWG9EX3E1Z3AxdHo1aXExWW9RZ2NfRzhZUXdFQUVnbFp2S0lXQ1Y0cENDb0FlZ0FkUzgxNVlDeUFFSnFRSkU0WHJYcWpxeVBxZ0RBY2dEbXdTcUJQc0JUOUJqblo0aDZzLV9VMnVIcjM5N1AyMm5lNGJhV2RmeXBDdkNoeFdSQUpCUzE1N2dBYVRpRXlEcGY3SWZtemRUbV94QlVpQTMtR3J5YkZYM0R5MjRLUkhMXzRZQ09KeEs0MUdWR29yWmJuMk5iTUF5a2dlMWl1ZXFVMFNXcmtraGJyWEZwNzl5dnA1UEhzaG12eHU3b0N6U3VBbTZpNkJ3SWtUU3U3N0VZQUh1anBXOHNzdlc3RjQ4Ym44LXBXNUR1bkc5UExqZVBmc1VQM1l6T3QyV1Fnd0hPbE93azZ6aDJZTVVHN05uU3lRMWw2b0RPa0hyRko4aHlMUThGeVZzSFJqOWlCTVNiSFJXX3NoWVd0dFF0Wld6TEVCbUczSHFGZXk3NEQwcFQ4Z1JOS1BwOGdad25tSlRyTjY1THZDYVFnNXBEV1FKcGRtWU8tbkFCSVBqbnQ2R0JPQUVBNUFHQWFBR1RZQUhsTU9vNlFHb0I0N09HNmdIazlnYnFBZnVsckVDcUFmLW5yRUNxQWVrbzdFQ3FBZlZ5UnVvQjZhLUc2Z0htZ2FvQl9QUkc2Z0hsdGdicUFlcW03RUNxQWVEcmJFQ3FBZl9uckVDcUFmZm43RUMyQWNBMGdnV0NJRGhnQkFRQVJnZE1nS3FBam9DZ0VCSXZmM0JPb0FLQTVnTEFjZ0xBWUFNQWJBVGhlREtFOWdURGRnVUFkQVZBZmdXQVlBWEFRJTI2YWUlM0QxJTI2bnVtJTNEMSUyNmNpZCUzRENBUVNQQUJ5Z1FpRGduNjF0NHRtOEtQNUxSNEtlWHNZU3BUMFB1V0NKUXdLOEkzUEdFQ216cVJKaW9iRTlnZk9vZThIRHZ1YV9FSWRwa3ZRUmpXQXVSZ0IlMjZzaWclM0RBT0Q2NF8zRGJQd05WOWZ3TFByNFl6bjhhVmZEeTFsTWZRJTI2Y2xpZW50JTNEY2EtcHViLTM4MzE4OTQ1NTkwMTQ2MTQlMjZkYm1fYyUzREFLQW1mLUNBNl9ueXl5Q0hfemdZcVNQUTlfRmFXTnh1U2xvMlh5OTZUd05pQmx6T2k1eFVlNktjRTBMbFhUYm5CX2sxVmF3SG43QkN1Q3hJa1piQ0tad1F0LTNNcTZ0SUtJaU9nWjNGREc3YmtSSHVwR1RDbnFHaU1pd2N4Z0lmaWREYkFDWWRlcFFva3dVZzh3Zlo3Wkl1a3BfUGxydzgzOGR6aFRSY1R6RXFYbUl5RWJNbGtiRSUyNmRibV9kJTNEQUtBbWYtRE8xVmRPdnh5RVdTVU9Dck1OejJTc2hvS3lYQlNfS2xVeXRySGFaLW45R1dtd1FYZ1lJTmVxTmVnZm83NkI5Wkhid2JGQ29wTy1WTC1jbWNYaHVKTW0tT3lmRnhtT2xST2lJNko4aXgyZF9Pc1hIOHE1OU1PeGNGdzZ1eWdSOF9JNUZyeDd1SG9CMGxxcHNiZXBBTkczNVZ0dTQ1dVA0SFQ3dGg5bERzRnBzUjlpVndpNGhVbjhJcWpXQ1NEZDVuUjhkTURFbEo2a2VDeHJTTjVNYmZoQ19feHJELWh2b3cxSnZodnpwZU9scWI0aUxGTU54M0hVeDRlMzBKc1YwZFNCazZ3d0JHUXM5WmxWdEJ2WG5wN1ZTWjdCVXQ2dGhLNGZ2VDJUNjA2di1rQ05Vd0paUU15SndFVFRZekk3dmpzNF8zbUd1NE1lU3FLMzJlTjVva0hYRWFiVmhpYjNDQ19NS3JiaFkxdFE0Wll2N3BIa19YNFJRN1JpanF2YTA2Q2Z4RlhqcTM1WjBlZkdCSkpUOWUybXFIdWZwN3kxNXNreFg1YnJwV3NnYmpBbDZOQzlSRlo4Y3NhWUpJR0dYUWlqemYxU0xLRzl6U2x1bWxoMmRTUGlldkhzLVVIaDRidlUzUktTclNucENfR0V4UkhKUWpSeG92V1RmdUlrVlRfQVNPcHRINWY0aFVyRFd4QlM3R2RyUXQyaC0tUUJKMjlyYnIxbmNpdkxrTi1TVHFBMDNRdlYzR1lGTFUzQm12eHJ0bktFJTI2YWR1cmwlM0RodHRwJTI1M0ElMjUyRiUyNTJGd3d3Lm5pa2UuY29tL2NtVXJsPWh0dHBzJTNBJTJGJTJGYXNzZXRzLmppdm94LmNvbSUyRmFzc2V0cyUyRndpZGdldHMlMkYyMDIzJTJGNiUyRmE0NjIyMHo2NDg4NTc2NGNiZDBlJTJGMSUyRjcyOHg5MF9QUk9TX0VPU1NfMjElMkZpbmRleC5odG1sL2JEaW09NzI4eDkwL3I9MC40MTQ4MTc4NTE5Mjg2OTUzNi9jbGlja01hY3JvPWh0dHBzJTNBJTJGJTJGZ29vZ2xlYWRzLmcuZG91YmxlY2xpY2submV0JTJGZGJtJTJGY2xrJTNGc2ElM0RMJTI2YWklM0RDQ0lpSnNsbWVaSkdlQjVpRDN3TzR6YlhvRF9xNWdwMXR6NWlxMVlvUWdjX0c4WVF3RUFFZ2xadktJV0NWNHBDQ29BZWdBZFM4MTVZL2NhY2hlTWFjcm89MTY4ODA5OTI1MDExODU0NS9wYWdlVXJsPWh0dHBzJTNBJTJGJTJGYTI1ZWE2ZWZmNDBiZWJlZDU4YTNjM2NiM2M1MDAwOTcuc2FmZWZyYW1lLmdvb2dsZXN5bmRpY2F0aW9uLmNvbSUyRnNhZmVmcmFtZSUyRjEtMC00MCUyRmh0bWwlMkZjb250YWluZXIuaHRtbC9lc19jZ05hbWU9Mjk1MGZkMTdhOWFmNGY5MzgzOWYwMzlkZDhhYWIxMjg5YWY3OTNkZjlkODE2ZDNhMjM5ZDdkNGQ5ZDcyZGRjZjk5Mzk0M2Y4OTU1MWVlYzhiYTVhNThhMWY3MWQzMzI4YTVlZWUwZGZlZjZmOTBhNjhiMzRjMTMwNzE3Y2U4YTYvZXNfc2VnTmFtZT1Qcm9zcGVjdGluZ19FT1NTXzE=
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/layout_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545&objectName=jvx_649e59b5313d3&adUnitId=1800&jvxSessionId=1688099253.5434&base=1&creativeResolveBeginTime=1688099253000&omid=0&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&localTimeOffset=0&pageURL=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.88.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-88-10.compute-1.amazonaws.com
Software: akka-http/10.1.11 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 30 Jun 2023 04:27:36 GMT
access-control-allow-credentials: false
content-type: image/gif
server: akka-http/10.1.11
content-length: 43
p3p: CP='IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA'

GET
H2 200 es_encParams_L2FwX0RhdGFTaWduYWwxPTE2MjY3OTkxMDIyL2FwX0RhdGFTaWduYWwyPUFCQWpIMGhpLVVxT1RGTGdCQzZsTzdIQ0RMOWcvYXBfRGF0YVNpZ25hbDM9MzI3MjMxNjE4L2FwX0RhdGFTaWduYWw0PTE5NDQyMTQ4NTM5MDMvYXBfZ2VvTGFuZz1n...
evs.jivox.com/trk/77/219890/1800/145089/45f3d18e47f96c/18/jvxSId_1688099253.5434/es_pId_vtnwou/ Frame F8D9 43 B
229 B 315ms
102ms Image
image/gif 3.222.88.10
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://evs.jivox.com/trk/77/219890/1800/145089/45f3d18e47f96c/18/jvxSId_1688099253.5434/es_pId_vtnwou/es_encParams_L2FwX0RhdGFTaWduYWwxPTE2MjY3OTkxMDIyL2FwX0RhdGFTaWduYWwyPUFCQWpIMGhpLVVxT1RGTGdCQzZsTzdIQ0RMOWcvYXBfRGF0YVNpZ25hbDM9MzI3MjMxNjE4L2FwX0RhdGFTaWduYWw0PTE5NDQyMTQ4NTM5MDMvYXBfZ2VvTGFuZz1nZXJtYW55X2dlcm1hbi9hcF9EYXRhU2lnbmFsNz1nZXJtYW55X2dlcm1hbi9hcF9iZXN0c2VsbGVySUQ9dW5kZWZpbmVkL2FwX2dkcHI9MC9hcF9EYXRhU2lnbmFsOD11bmRlZmluZWQvYWRiMS1rZXk9MTIvYWRiMTQtaWRfdmVyc2lvbj0xNjM5OF8xL2FkYjYta2V5PTE0L2FkYjctaWRfdmVyc2lvbj0xNTk0Nl8xL2FkYjE0LWtleT0xMC9hZGIxOS1rZXk9MTAvYWRiMy1pZF92ZXJzaW9uPTI4MTU0XzEvYWRiMTEtaWRfdmVyc2lvbj0yODUwNV8xL2FkYjEwLWtleT0yL2FkYjE3LWlkX3ZlcnNpb249NDM2NjhfMS9hZGIyMS1pZF92ZXJzaW9uPTE3MDk5XzEvYWRiMjEta2V5PTY5OTk1L2FkYjcta2V5PTIwL2FkYjgtaWRfdmVyc2lvbj00Mzc5NV8xL2FkYjE4LWtleT0yMC9hZGIyLWtleT0yL2FkYjE3LWtleT0yL2FkYjEyLWlkX3ZlcnNpb249MzE2NDBfMS9hZGI0LWlkX3ZlcnNpb249MjIzMjRfMS9hZGIxMy1rZXk9MTAwQS9hZGIxNi1pZF92ZXJzaW9uPTMxODM2XzEvYWRiNS1pZF92ZXJzaW9uPTMxNDYxXzEvYWRiMTYta2V5PTEyL2FkYjMta2V5PTcvYWRiOS1pZF92ZXJzaW9uPTE5Mzk4XzEvYWRiMTIta2V5PTM4L2FkYjQta2V5PTExL2FkYjgta2V5PTEyL2FkYjEzLWlkX3ZlcnNpb249MTU5MDdfMS9hZGIxOS1pZF92ZXJzaW9uPTMxNDYzXzEvYWRiMS1pZF92ZXJzaW9uPTMxNDYyXzEvYWRiMTUtaWRfdmVyc2lvbj0yNDM1M18xL2FkYjYtaWRfdmVyc2lvbj0zNzYyOF8xL2FkYjE1LWtleT0xMC9hZGIxMC1pZF92ZXJzaW9uPTI4NTAyXzEvYWRiNS1rZXk9My9hZGI5LWtleT0xMi9hZGIyMC1rZXk9MTAvYWRiMi1pZF92ZXJzaW9uPTIwMDA2XzEvYWRiMTEta2V5PTEyL2FkYjE4LWlkX3ZlcnNpb249MTk1NDhfMS9hZGIyMC1pZF92ZXJzaW9uPTIxNjIzXzEvZXNfY2xpY2tVcmw9aHR0cHMlM0ElMkYlMkZnb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQlMkZkYm0lMkZjbGslM0ZzYSUzREwlMjZhaSUzRENDSWlKc2xtZVpKR2VCNWlEM3dPNHpiWG9EX3E1Z3AxdHo1aXExWW9RZ2NfRzhZUXdFQUVnbFp2S0lXQ1Y0cENDb0FlZ0FkUzgxNVlDeUFFSnFRSkU0WHJYcWpxeVBxZ0RBY2dEbXdTcUJQc0JUOUJqblo0aDZzLV9VMnVIcjM5N1AyMm5lNGJhV2RmeXBDdkNoeFdSQUpCUzE1N2dBYVRpRXlEcGY3SWZtemRUbV94QlVpQTMtR3J5YkZYM0R5MjRLUkhMXzRZQ09KeEs0MUdWR29yWmJuMk5iTUF5a2dlMWl1ZXFVMFNXcmtraGJyWEZwNzl5dnA1UEhzaG12eHU3b0N6U3VBbTZpNkJ3SWtUU3U3N0VZQUh1anBXOHNzdlc3RjQ4Ym44LXBXNUR1bkc5UExqZVBmc1VQM1l6T3QyV1Fnd0hPbE93azZ6aDJZTVVHN05uU3lRMWw2b0RPa0hyRko4aHlMUThGeVZzSFJqOWlCTVNiSFJXX3NoWVd0dFF0Wld6TEVCbUczSHFGZXk3NEQwcFQ4Z1JOS1BwOGdad25tSlRyTjY1THZDYVFnNXBEV1FKcGRtWU8tbkFCSVBqbnQ2R0JPQUVBNUFHQWFBR1RZQUhsTU9vNlFHb0I0N09HNmdIazlnYnFBZnVsckVDcUFmLW5yRUNxQWVrbzdFQ3FBZlZ5UnVvQjZhLUc2Z0htZ2FvQl9QUkc2Z0hsdGdicUFlcW03RUNxQWVEcmJFQ3FBZl9uckVDcUFmZm43RUMyQWNBMGdnV0NJRGhnQkFRQVJnZE1nS3FBam9DZ0VCSXZmM0JPb0FLQTVnTEFjZ0xBWUFNQWJBVGhlREtFOWdURGRnVUFkQVZBZmdXQVlBWEFRJTI2YWUlM0QxJTI2bnVtJTNEMSUyNmNpZCUzRENBUVNQQUJ5Z1FpRGduNjF0NHRtOEtQNUxSNEtlWHNZU3BUMFB1V0NKUXdLOEkzUEdFQ216cVJKaW9iRTlnZk9vZThIRHZ1YV9FSWRwa3ZRUmpXQXVSZ0IlMjZzaWclM0RBT0Q2NF8zRGJQd05WOWZ3TFByNFl6bjhhVmZEeTFsTWZRJTI2Y2xpZW50JTNEY2EtcHViLTM4MzE4OTQ1NTkwMTQ2MTQlMjZkYm1fYyUzREFLQW1mLUNBNl9ueXl5Q0hfemdZcVNQUTlfRmFXTnh1U2xvMlh5OTZUd05pQmx6T2k1eFVlNktjRTBMbFhUYm5CX2sxVmF3SG43QkN1Q3hJa1piQ0tad1F0LTNNcTZ0SUtJaU9nWjNGREc3YmtSSHVwR1RDbnFHaU1pd2N4Z0lmaWREYkFDWWRlcFFva3dVZzh3Zlo3Wkl1a3BfUGxydzgzOGR6aFRSY1R6RXFYbUl5RWJNbGtiRSUyNmRibV9kJTNEQUtBbWYtRE8xVmRPdnh5RVdTVU9Dck1OejJTc2hvS3lYQlNfS2xVeXRySGFaLW45R1dtd1FYZ1lJTmVxTmVnZm83NkI5Wkhid2JGQ29wTy1WTC1jbWNYaHVKTW0tT3lmRnhtT2xST2lJNko4aXgyZF9Pc1hIOHE1OU1PeGNGdzZ1eWdSOF9JNUZyeDd1SG9CMGxxcHNiZXBBTkczNVZ0dTQ1dVA0SFQ3dGg5bERzRnBzUjlpVndpNGhVbjhJcWpXQ1NEZDVuUjhkTURFbEo2a2VDeHJTTjVNYmZoQ19feHJELWh2b3cxSnZodnpwZU9scWI0aUxGTU54M0hVeDRlMzBKc1YwZFNCazZ3d0JHUXM5WmxWdEJ2WG5wN1ZTWjdCVXQ2dGhLNGZ2VDJUNjA2di1rQ05Vd0paUU15SndFVFRZekk3dmpzNF8zbUd1NE1lU3FLMzJlTjVva0hYRWFiVmhpYjNDQ19NS3JiaFkxdFE0Wll2N3BIa19YNFJRN1JpanF2YTA2Q2Z4RlhqcTM1WjBlZkdCSkpUOWUybXFIdWZwN3kxNXNreFg1YnJwV3NnYmpBbDZOQzlSRlo4Y3NhWUpJR0dYUWlqemYxU0xLRzl6U2x1bWxoMmRTUGlldkhzLVVIaDRidlUzUktTclNucENfR0V4UkhKUWpSeG92V1RmdUlrVlRfQVNPcHRINWY0aFVyRFd4QlM3R2RyUXQyaC0tUUJKMjlyYnIxbmNpdkxrTi1TVHFBMDNRdlYzR1lGTFUzQm12eHJ0bktFJTI2YWR1cmwlM0RodHRwJTI1M0ElMjUyRiUyNTJGd3d3Lm5pa2UuY29tL2NtVXJsPWh0dHBzJTNBJTJGJTJGYXNzZXRzLmppdm94LmNvbSUyRmFzc2V0cyUyRndpZGdldHMlMkYyMDIzJTJGNiUyRmE0NjIyMHo2NDg4NTc2NGNiZDBlJTJGMSUyRjcyOHg5MF9QUk9TX0VPU1NfMjElMkZpbmRleC5odG1sL2JEaW09NzI4eDkwL3I9MC42NzU0MDU1NTkxNjE2MjY2L2NsaWNrTWFjcm89aHR0cHMlM0ElMkYlMkZnb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQlMkZkYm0lMkZjbGslM0ZzYSUzREwlMjZhaSUzRENDSWlKc2xtZVpKR2VCNWlEM3dPNHpiWG9EX3E1Z3AxdHo1aXExWW9RZ2NfRzhZUXdFQUVnbFp2S0lXQ1Y0cENDb0FlZ0FkUzgxNVkvY2FjaGVNYWNybz0xNjg4MDk5MjUwMTE4NTQ1L3BhZ2VVcmw9aHR0cHMlM0ElMkYlMkZhMjVlYTZlZmY0MGJlYmVkNThhM2MzY2IzYzUwMDA5Ny5zYWZlZnJhbWUuZ29vZ2xlc3luZGljYXRpb24uY29tJTJGc2FmZWZyYW1lJTJGMS0wLTQwJTJGaHRtbCUyRmNvbnRhaW5lci5odG1sL2VzX2NnTmFtZT0yOTUwZmQxN2E5YWY0ZjkzODM5ZjAzOWRkOGFhYjEyODlhZjc5M2RmOWQ4MTZkM2EyMzlkN2Q0ZDlkNzJkZGNmOTkzOTQzZjg5NTUxZWVjOGJhNWE1OGExZjcxZDMzMjhhNWVlZTBkZmVmNmY5MGE2OGIzNGMxMzA3MTdjZThhNi9lc19zZWdOYW1lPVByb3NwZWN0aW5nX0VPU1NfMQ==
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/layout_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545&objectName=jvx_649e59b5313d3&adUnitId=1800&jvxSessionId=1688099253.5434&base=1&creativeResolveBeginTime=1688099253000&omid=0&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&localTimeOffset=0&pageURL=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.88.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-88-10.compute-1.amazonaws.com
Software: akka-http/10.1.11 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 30 Jun 2023 04:27:36 GMT
access-control-allow-credentials: false
content-type: image/gif
server: akka-http/10.1.11
content-length: 43
p3p: CP='IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA'

GET
H2 200 jivoxWidgetApiV2.min.js Show response
playercdn.jivox.com/1682338336/widgets/jivoxWidgetApi/gz/ Frame 4206 29 KB
6 KB 15ms
8ms Script
application/x-javascript 108.138.7.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://playercdn.jivox.com/1682338336/widgets/jivoxWidgetApi/gz/jivoxWidgetApiV2.min.js
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/layout_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545&objectName=jvx_649e59b5313d3&adUnitId=1800&jvxSessionId=1688099253.5434&base=1&creativeResolveBeginTime=1688099253000&omid=0&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&localTimeOffset=0&pageURL=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.7.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-7-120.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f6c84a15873bbae73ff06857139327b85a6869fa0e21d36666aa2bb5d9bbb19b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 20:45:08 GMT
content-encoding: gzip
via: 1.1 002af2e4f72157b8b4bd2de012b5b57c.cloudfront.net (CloudFront)
last-modified: Mon, 24 Apr 2023 12:21:43 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
age: 27749
etag: "2a0e0abd8f7f11fb012a534ea115a29a"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400, s-maxage=86400
accept-ranges: bytes
content-length: 5987
x-amz-cf-id: jp7agYCYKwovxANYdwddNNTBD9SUjBQ9x0GxddN9v46OQqhwpixsXg==

GET
H2 200 style.css
assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/ Frame 4206 1 KB
800 B 40ms
8ms Stylesheet
text/css 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/style.css
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/layout_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545&objectName=jvx_649e59b5313d3&adUnitId=1800&jvxSessionId=1688099253.5434&base=1&creativeResolveBeginTime=1688099253000&omid=0&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&localTimeOffset=0&pageURL=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9196edd0a6256a97d5281ca830f94a948cdf114a713e1396b2e5329bb8064a96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 14:37:40 GMT
content-encoding: br
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
last-modified: Tue, 13 Jun 2023 11:47:51 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
age: 49810
x-amz-server-side-encryption: AES256
etag: W/"9d95ff48234d691e47a0ead4030ba408"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: max-age=86400, s-maxage=86400
x-amz-cf-id: Q8X6qmJysGm7m25G9JW3IewsItc9fDaQmKKC4Cjq2H7r7W-UJCuVBA==

GET
H2 200 custom.css
assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/ Frame 4206 8 KB
2 KB 44ms
12ms Stylesheet
text/css 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/custom.css
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/layout_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545&objectName=jvx_649e59b5313d3&adUnitId=1800&jvxSessionId=1688099253.5434&base=1&creativeResolveBeginTime=1688099253000&omid=0&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&localTimeOffset=0&pageURL=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 39115472a1e322a2c98536299856862dc3bf17005b8788b7fa998381285e3212

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 04:02:29 GMT
content-encoding: gzip
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
last-modified: Tue, 13 Jun 2023 11:47:49 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
age: 56739
x-amz-server-side-encryption: AES256
etag: W/"2b5bd87b522fbdaebe4855be7399c177"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: max-age=86400, s-maxage=86400
x-amz-cf-id: bJrBI1YDAf2XWRzbpdX6vC2a-BCaD-ULRWKgv-Vtbp_qLzNbtmCZUg==

GET
H2 200 jvx.css
assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/ Frame 4206 29 B
432 B 41ms
10ms Stylesheet
text/css 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/jvx.css
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/layout_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545&objectName=jvx_649e59b5313d3&adUnitId=1800&jvxSessionId=1688099253.5434&base=1&creativeResolveBeginTime=1688099253000&omid=0&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&localTimeOffset=0&pageURL=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 902be5fbd39a6b9bf8a2720091581c3b5ef5f9173953801f272b39556081e03a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 01:11:52 GMT
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
last-modified: Tue, 13 Jun 2023 11:47:50 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
age: 68476
x-amz-server-side-encryption: AES256
etag: "f06626e90894e6768f62888392963942"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: max-age=86400, s-maxage=86400
accept-ranges: bytes
content-length: 29
x-amz-cf-id: 2RbELjaivvR9t43dDiZItdTy9HSI2ZRDvy7FCKi5M5EillvRebhTYw==

GET
H2 200 gsap_min.js Show response
assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/ Frame 4206 62 KB
25 KB 58ms
27ms Script
application/x-javascript 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/gsap_min.js
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/layout_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545&objectName=jvx_649e59b5313d3&adUnitId=1800&jvxSessionId=1688099253.5434&base=1&creativeResolveBeginTime=1688099253000&omid=0&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&localTimeOffset=0&pageURL=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a14255e68fc99fc5b4a8b323c13070ac67f42775917706fd3b147b436810a5da

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 03:49:26 GMT
content-encoding: gzip
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
last-modified: Tue, 13 Jun 2023 11:47:50 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
age: 56739
x-amz-server-side-encryption: AES256
etag: W/"25d67f605b728204ba1ac06206941ad6"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400, s-maxage=86400
x-amz-cf-id: G4yOCzhxTiLYLc9tPpbV7-DIBTNewTaXwWTByQaDQhcuJITWqphkTw==

GET
H2 200 main.js Show response
assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/ Frame 4206 389 KB
66 KB 62ms
32ms Script
application/x-javascript 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/main.js
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/layout_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545&objectName=jvx_649e59b5313d3&adUnitId=1800&jvxSessionId=1688099253.5434&base=1&creativeResolveBeginTime=1688099253000&omid=0&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&localTimeOffset=0&pageURL=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1c31d20262f143d8cc3d431f271f331b7e699dbf79f0b34dcaebbe9b126f6e4c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 12:42:02 GMT
content-encoding: br
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
last-modified: Tue, 13 Jun 2023 11:47:50 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
age: 56767
x-amz-server-side-encryption: AES256
etag: W/"3053b61cfa0daa738753bd4dd0ebb573"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400, s-maxage=86400
x-amz-cf-id: aFypj86b_QJFeYqgFlxFF9Z6EO-zy5SoPSvq2IiaaHex9_drxOaRDA==

GET
H2 200 dynamic_logic_live_728x90.js Show response
assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/ Frame 4206 42 KB
7 KB 60ms
30ms Script
application/x-javascript 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/dynamic_logic_live_728x90.js
Requested by: Host: as.jivox.com
URL: https://as.jivox.com/unit/layout_renderer.php?creativeUnitType=18&bDim=728x90&bUnitId=1800&siteId=45f3d18e47f96c&campaignId=145089&es_pId=vtnwou&isDynamic=1&ap_DataSignal1=16267991022&ap_DataSignal2=ABAjH0hi-UqOTFLgBC6lO7HCDL9g&ap_DataSignal3=327231618&ap_DataSignal4=1944214853903&gdpr=&gdpr_consent=&jvxVer=2&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%26sig%3DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%26client%3Dca-pub-3831894559014614%26dbm_c%3DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%26dbm_d%3DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%26adurl%3D&r=1688099250118545&objectName=jvx_649e59b5313d3&adUnitId=1800&jvxSessionId=1688099253.5434&base=1&creativeResolveBeginTime=1688099253000&omid=0&ap_geoLang=germany_german&ap_DataSignal7=germany_german&ap_bestsellerID=undefined&ap_gdpr=0&ap_DataSignal8=undefined&localTimeOffset=0&pageURL=https%3A%2F%2Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7871a0b54071567e7ee8e65c33fb5eeff4ee0ee6c7bfac10eb1543c837ec6dd1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 05:15:24 GMT
content-encoding: gzip
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
last-modified: Tue, 13 Jun 2023 11:47:49 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
age: 83601
x-amz-server-side-encryption: AES256
etag: W/"0c2475eede9437b0178dfa358abb8b5b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400, s-maxage=86400
x-amz-cf-id: oTQOMz09oyb7FpQACv4PJckzibb-P7xnsKwhBqNImYredoQtSFPTXQ==

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2DEB 0
20 B 47ms
47ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B4pMWs1meZP7INJ3Cx_APm5WxkA4AAAAAOAHgBAI&bg=!g4ClgNTNAAb90kgr3dI7ADkAdvg8WphuTCVw4unHRc77ZtrLZSOSDR2O4fg9wDptUkxqK40YK7PoXs-Cch_ddQP5KOgG76jT1pECAAAIVlIAAAAEaAEHmQM_hyX0OFpR91YBb131DsPTRelucppUS6Wyb9l6q_SZLWTxYCiGQEyMcsDwSOxkrRo7smOcg6DCLLqugxJ7YbYlEWovIQwDHMLkakv3feWl8V6yGvdN8isKuBd3wM-VUIj_JKtDyXhD3Q2AVnoQWX6dWf2x3zuIH8qQCE8EH-hNYjsJOiwR0h5qlWmgUwscSRlqF5D8bwCNOEy0dWECYM07I2uW5dGe7U0qnPa_BlEX_I5HTuo6oCwB-l5oqdWkwXDG1ODi7SWhyuzZ4dg8roHYEvK8LsF_ziQ8SwGbq7K0HPGwhZUKA7roXpdJ5znacg7InTlI3SEmpSodZzpIpqhxcMdBH9U4W3tKYNlY6vTwFEteOX00UTXTP1JMLC4U_HkFEoI48f2LI1yT4a-XsG54eNQJwLxEsDF2usX_2qHt93097TE3FhfCWX9w1ZPlGuqppbZ1p9EZTTccgfnp9UkFLy70QC_CQBcvyuttfrAvFsFphvHKxQP9Jb37VUV1l7i5rmxwioF5qt6O-7htKCclnbbvQkZi_67kpgRfnX-DxmwbJ8G5gjoCNv1qQvK2OQDILB1UDGjZyI_SZ53qDsAkmc1BFtR_lnpbq7dnJ_jkwHskXMp3bnzmVDnxwD3F-gkCswVhwJGtArtaMu9djhhje5zjG6L27iTpii1PtryaR6Yco1Ocm_TDzjvOXdIqyqHPoaIA_xxGW3Il9S0iFiSvDyfU8_DjCqmvgEAWCWnZ9tW31Ds-5hOKLQ0lRuITIfcKztLa8jYmSBamDAPRizScuXqPMfrpk4HRU14uyHWCGr9jbic5rQrCqlMXo0f3tB_xN0G5rK6Xqv3whdJaKf5U7oKFQRt0hSBzc5wl6EEwORKl0NS1oUMufEMrQ5r9y2ZlwokFT-302KkzumCMtDkTcmMQxu1i7AAC36ryKALvDzKW29UE-EyGbUOHeFRXUQM4MiUCk5Mwn_9tOt_jtgO8AGpKxaGrjykiLI8OYApq7e9B4C0vHEJFh6ZBb6zNjS5ugyShRu72oo1FWmckzqj7RF_wG7gBLnaByB77irMaet1HgxQJGYv9-BncEUxyKqH8EvhT9yI2RTxkSU-lvVBm

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 4206 8 KB
4 KB 14ms
14ms Script
application/javascript 2a02:26f0:480:9::210:ee04
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=14526021&cmp=145089&sid=45f3d18e47f96c&plc=vtnwou&num=&adid=&advid=&adsrv=125&btreg=ad_container_id&btadsrv=jivox&crt=WE%3Agermany_german%3A531100310%3ANo%20LineItem%20ID&crtname=&chnl=&unit=&pid=&uid=&tagtype=&dvtagver=6.1.src&DVPX_PP_IMP_ID=1688099253.5434
Requested by: Host: cdn.jivox.com
URL: https://cdn.jivox.com/files/46220/Nike_DV/dv_nike.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:9::210:ee04 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 104fe1d096865fb450f1d921b99ea70d85d935d9c8a2e88e980de371e03ea9e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 30 Jun 2023 04:27:36 GMT
Content-Encoding: gzip
Last-Modified: Wed, 28 Jun 2023 12:21:21 GMT
Server: UploadServer
ETag: "4c41482e45017a01683eea2db59c11aa"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3373
Expires: Wed, 28 Jun 2023 12:36:53 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 28E0 0
20 B 44ms
43ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BK9JVs1meZJWxIvSTjuwPhbOMiAEAAAAAOAHgBAI&bg=!srGlseXNAAb90kgr3dI7ADkAdvg8WvdSVuHvDADx_ozJOngu5YsRsZBL5fuwAJVXHoFk5v8nlstQNXe5qHBAidxDAudL-rfTU-cCAAAKZVIAAAAEaAEHCgAr5Vqx6IY916h669W3_UZ8-YsjREfM1-TjkRsv54BoeuYcZHMFPkDdVEIh95kDMOby3abwW1P_D9NI3xfK-SMjI3lCCIYVDePCHvfX4z_oBuoQBAKCHKkFELRoUtMvuVoVk86wgot4sv3EgafjASaFH7LEo-NnWg0NXGFP4LnHtXmfchriodmMM90dj4ndj0YHFVuORqoWwYCShcA9Gk_etX3H22B_8ZYE-6etsbeJUDH3sqbLPu1poN4_eNzmSW36Dzat_Y7bGpnYBP_EvWCoQFV-4uPdjdSS2SYr6RpKHAMBQdMDupgph4ZH0Dr8kWr_RTq61CZSznZ-ULxhHiIiueLu_WiCAwbjD4uTt0EtklCWH0tZgx_zv4mHTHU3jWKDjeOSusHFtl3K8nYJR503dFN1VNs1o7WQOpwwgfFjnTBPMIn7_EutS8tItW2I1GGK6-S8yXdM1OpJ_TlzAfe2kVk-Zergc_IREANXKSFqnqm4VFgcKrYCyqJwo1SxOJKm42eIfopTisCjBT8qskE_oBQa22RDbPKjRd9LkxPGVHFft32vW8WcL7WQUmhu6NNzmLNyui8hepy2XDO-MBez6yN-4eB9cx_O0fiAfIWSTg2g2ZwKvQh9ONq8PZ7aS1-3UIfFpzpg4jF_8g5CJLCYTjeggz-qTDQoZ92OKHV6HMP6zcLyk0cGSCej9mJ991lrGHL8RqjW3JUYUV949V62zqNrjyR2os1Ji8JsXlSImpdSK6IC7fpC6oPqwFiVo8CBAfC-G52IlZCp_jxxU_Q3FotUuZqcP2ZqrxgWyCQh1KcEa8YPpn7v3O00EOkjFuw9TXJXnngJ0FRza700qYHiFtKaipVhZA1ER5tReYGjqTXWd0kpw-hAL7vvhfvg-BX56xRdD9ep0SZS6TUYz2yz3YXHu7-kO84A-rLJW2NY6ChPN1aowZa5V8XyupVPLZLgA_tXhx5kX3mZNRwJaw42pal_NHYb3smVoI6EWs1sLV7cKAzHmQj0q63hwwIlxwLWgRbWQtIJhnP4yIg8wFqa6nW2Pn1zJ4AhPAvSCCcvjLQrDpcway1btviaCQgGUrls_o_-tiz6KUjoIM9orqbFIYrZ2j-6i-vJ3gJFKt4w8PJ_jRK7Ga7pTW1usZv1KQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D2B8 0
20 B 44ms
43ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bmum8s1meZNHnB-in9u8P_fm38AYAAAAAOAHgBAI&bg=!sLOls-fNAAb90kgr3dI7ADkAdvg8WvT4DHDU_va7IJC2XX_06c29t4AxhEvnK026biF7j1oK95TBFc80R-HsO6A1oPXVSRtGjx4CAAALplIAAAAEaAEHmQMxXKqlf5GBjSrBaQsIkM-ss8wnD8qvjEdMnsPaWiT6JiTVl_wA-jea2FsimXjpzT6tnZgkJWrPK4-eFXyvI4RfjpzQsycqgTebXrz_PyFbtJQA19RxaGLPdxgxPA5KWWjWwIpu2vFSD8nspFSlQtGK-mGvNdveukB4kwb7NphWsOycpqwJuPSznd0PnyZRfY3_eVfFqO52EMfWgdUcDGUxUakO1wLvzRSPEF_886CgGtI2FvZVM6elKlF6D7YDpyUV_URGmRxS65-2L-v9m9LVAyQhs5Shr_3ju2V5Zm43BfQVmP6HXK4Et01kiNpLZEiKH9Bd9oUOFycTTfQE6xFVnhgz981SgKwh9qbVqNGIdWma9oz0TQsfjKJhwOkNeLl3bs3vePvv3ErVyg4w0H5FOoyYoVpy-t7ikkEP6I4vbw0PSlFShu2lQe4DbYaBh-Tkz0GJNTFILj2Wdf-olsKXmVlzKHgnK22qOhTH0YXToaCEbskuFGlrK45cI5n4_kb4CIH9wf9vMMWlP8AySFTjxSgokdG2UL-H40ihEW9XViWZulLffgcC9RDEHRJTqjCenDx0ZffTpsHOFl2ylv-X75vCAFwI7tfRNHjr4j1PWfOuzrzO5kR-P4Vi1-6jmMTGHyhkVHE_4osFGGuVgnb3hJBfxX7fy9c9OCrfjUIpwa-7wDJ4wau72wNtqCJT29TX47FxbznHss8UcE49D_CRmWgksCDLkl7OZFzUit80woLodVCuaRqCV5vnC_b6SleKkzdNnKSGUKEt0yw8fWdBnqJnVQLgLWdgrbx9pqIOEs2wxy9-wDMRHiaKndKTeeVsvxWsv5YgW5XbyHbPilVkMGpvovsbARg1tdCrU071YNtvuMmsloQtP6fkZ2qlyzujSIn8es8C85dT6vmP7LZ6iU2cbp_-1VRm04_oqoRVmJdhuzg0kAN-yVsK9ERvHu-enEI_E8mGob5NNKHkzr-LyT-D_a3cdVXqmjgvd2Na6qcI0qZ3ByP5zeIV_ziy1NAKnk5HT67e9nabBwOYSfxKkgo7aDzCP2huxyV8Z9qz_8TbEvjyk_j4-TNWWE_BGJnuIA

Requested by

Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Jun 2023 04:27:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dv-measurements4050.js Show response
cdn.doubleverify.com/ Frame E981 543 KB
103 KB 17ms
17ms Script
application/javascript 2a02:26f0:480:9::210:ee04
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements4050.js
Requested by: Host: castles4kids.co.nz
URL: https://castles4kids.co.nz/EasyLink.php/?get=gc4Md
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:9::210:ee04 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: e1d64dcce03bbb7c2bd033767a73cd36fd3d14f2f9f1424e1a184f37038938b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 30 Jun 2023 04:27:37 GMT
Content-Encoding: gzip
Last-Modified: Wed, 28 Jun 2023 08:54:41 GMT
Server: UploadServer
ETag: "5a377c6b590ab29192c9d6aaadc2c413"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 105238
Expires: Thu, 27 Jun 2024 08:54:46 GMT

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 07A9 16 B
209 B 76ms
71ms Fetch
application/json 52.56.247.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.56.247.104 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 30 Jun 2023 04:27:37 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 172ms
62ms Preflight 52.56.247.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.56.247.104 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-56-247-104.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://as.ad4m.at
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Fri, 30 Jun 2023 04:27:37 GMT
server: nginx

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame E981 8 KB
4 KB 42ms
31ms Script
text/javascript 130.211.44.5
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=137&ttfrms=29&brid=3&brver=114.0.5735.198&bridua=3&bds=1&tstype=128&srcurlD=2&aUrlD=3&ssl=https:&dfs=569&ddur=15&uid=1688099257152271&jsCallback=dvCallback_1688099257152475&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.198%20Safari%2F537.36&htmlmsging=1&chro=1&hist=3&winh=90&winw=728&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=4050&tgjsver=4050&lvvn=28&m1=13&refD=4&referrer=https%3A%2F%2Fas.jivox.com%2Funit%2Flayout_renderer.php%3FcreativeUnitType%3D18%26bDim%3D728x90%26bUnitId%3D1800%26siteId%3D45f3d18e47f96c%26campaignId%3D145089%26es_pId%3Dvtnwou%26isDynamic%3D1%26ap_DataSignal1%3D16267991022%26ap_DataSignal2%3DABAjH0hi-UqOTFLgBC6lO7HCDL9g%26ap_DataSignal3%3D327231618%26ap_DataSignal4%3D1944214853903%26gdpr%3D%26gdpr_consent%3D%26jvxVer%3D2%26cMacro%3Dhttps%253A%252F%252Fgoogleads.g.doubleclick.net%252Fdbm%252Fclk%253Fsa%253DL%2526ai%253DCCIiJslmeZJGeB5iD3wO4zbXoD_q5gp1tz5iq1YoQgc_G8YQwEAEglZvKIWCV4pCCoAegAdS815YCyAEJqQJE4XrXqjqyPqgDAcgDmwSqBPsBT9BjnZ4h6s-_U2uHr397P22ne4baWdfypCvChxWRAJBS157gAaTiEyDpf7IfmzdTm_xBUiA3-GrybFX3Dy24KRHL_4YCOJxK41GVGorZbn2NbMAykge1iueqU0SWrkkhbrXFp79yvp5PHshmvxu7oCzSuAm6i6BwIkTSu77EYAHujpW8ssvW7F48bn8-pW5DunG9PLjePfsUP3YzOt2WQgwHOlOwk6zh2YMUG7NnSyQ1l6oDOkHrFJ8hyLQ8FyVsHRj9iBMSbHRW_shYWttQtZWzLEBmG3HqFey74D0pT8gRNKPp8gZwnmJTrN65LvCaQg5pDWQJpdmYO-nABIPjnt6GBOAEA5AGAaAGTYAHlMOo6QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAbATheDKE9gTDdgUAdAVAfgWAYAXAQ%2526ae%253D1%2526num%253D1%2526cid%253DCAQSPABygQiDgn61t4tm8KP5LR4KeXsYSpT0PuWCJQwK8I3PGECmzqRJiobE9gfOoe8HDvua_EIdpkvQRjWAuRgB%2526sig%253DAOD64_3DbPwNV9fwLPr4Yzn8aVfDy1lMfQ%2526client%253Dca-pub-3831894559014614%2526dbm_c%253DAKAmf-CA6_nyyyCH_zgYqSPQ9_FaWNxuSlo2Xy96TwNiBlzOi5xUe6KcE0LlXTbnB_k1VawHn7BCuCxIkZbCKZwQt-3Mq6tIKIiOgZ3FDG7bkRHupGTCnqGiMiwcxgIfidDbACYdepQokwUg8wfZ7ZIukp_Plrw838dzhTRcTzEqXmIyEbMlkbE%2526dbm_d%253DAKAmf-DO1VdOvxyEWSUOCrMNz2SshoKyXBS_KlUytrHaZ-n9GWmwQXgYINeqNegfo76B9ZHbwbFCopO-VL-cmcXhuJMm-OyfFxmOlROiI6J8ix2d_OsXH8q59MOxcFw6uygR8_I5Frx7uHoB0lqpsbepANG35Vtu45uP4HT7th9lDsFpsR9iVwi4hUn8IqjWCSDd5nR8dMDElJ6keCxrSN5MbfhC__xrD-hvow1JvhvzpeOlqb4iLFMNx3HUx4e30JsV0dSBk6wwBGQs9ZlVtBvXnp7VSZ7BUt6thK4fvT2T606v-kCNUwJZQMyJwETTYzI7vjs4_3mGu4MeSqK32eN5okHXEabVhib3CC_MKrbhY1tQ4ZYv7pHk_X4RQ7Rijqva06CfxFXjq35Z0efGBJJT9e2mqHufp7y15skxX5brpWsgbjAl6NC9RFZ8csaYJIGGXQijzf1SLKG9zSlumlh2dSPievHs-UHh4bvU3RKSrSnpC_GExRHJQjRxovWTfuIkVT_ASOptH5f4hUrDWxBS7GdrQt2h--QBJ29rbr1ncivLkN-STqA03QvV3GYFLU3BmvxrtnKE%2526adurl%253D%26r%3D1688099250118545%26objectName%3Djvx_649e59b5313d3%26adUnitId%3D1800%26jvxSessionId%3D1688099253.5434%26base%3D1%26creativeResolveBeginTime%3D1688099253000%26omid%3D0%26ap_geoLang%3Dgermany_german%26ap_DataSignal7%3Dgermany_german%26ap_bestsellerID%3Dundefined%26ap_gdpr%3D0%26ap_DataSignal8%3Dundefined%26localTimeOffset%3D0%26pageURL%3Dhttps%253A%252F%252Fa25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com%252Fsafeframe%252F1-0-40%252Fhtml%252Fcontainer.html%26allowExp%3D0&fcifrms=10&brh=3&sdf=2&dvp_epl=4351&noc=4&nav_pltfrm=Win32&ctx=14526021&cmp=145089&sid=45f3d18e47f96c&plc=vtnwou&crt=WE%3Agermany_german%3A531100310%3ANo%20LineItem%20ID&btreg=ad_container_id&btadsrv=jivox&adsrv=125&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&DVPX_PP_IMP_ID=1688099253.5434&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=711448443015.8978&dvp_tukv=15760757483.74643&dvp_strhd=0.5&dvpx_strhd=0.5&dvp_tuid=450006527364&dvf=3&jurtd=3885598682
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements4050.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.44.5 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 5.44.211.130.bc.googleusercontent.com
Software: /
Resource Hash: fbb231a94c854563483bf7917bf46d4e366e157fb4fd056e924264c06875b6a6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 30 Jun 2023 04:27:37 GMT
Content-Encoding: br
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: keep-alive
Timing-Allow-Origin: *
Expires: 06/29/2023 04:27:37

GET
H/1.1 200
OK resolveDynamicData.php Show response
traffick.jivox.com/jivox/serverAPIs/ Frame 4206 11 KB
2 KB 119ms
115ms Script
application/json 52.205.83.180
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://traffick.jivox.com/jivox/serverAPIs/resolveDynamicData.php?campaignId=145089&var=NC_AID_FD_EX:NC_AID_FD_EX&ap_NC_AID_FD_EX=germany_german_531100310&ap_NC_AID_FD_EX:order=random&callback=getaudienceSet&r_=0.2817618165847242&ap_gdpr=0&gdpr=&gdpr_consent=
Requested by: Host: playercdn.jivox.com
URL: https://playercdn.jivox.com/1682338336/widgets/jivoxWidgetApi/gz/jivoxWidgetApiV2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.83.180 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-83-180.compute-1.amazonaws.com
Software: Jetty(9.4.39.v20210325) /
Resource Hash: ee9d4d37dea33dbd429dee664a58bca760bad0779d8cf5d61874e4bbc1f01767

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Fri, 30 Jun 2023 04:27:37 GMT
Content-Encoding: gzip
Server: Jetty(9.4.39.v20210325)
Connection: keep-alive
Content-Length: 2198
Content-Type: application/json;charset=utf-8

GET
H2 200 es_encParams_L2FwX0RhdGFTaWduYWwxXzE2MjY3OTkxMDIyL2FwX0RhdGFTaWduYWwyX0FCQWpIMGhpLVVxT1RGTGdCQzZsTzdIQ0RMOWcvYXBfRGF0YVNpZ25hbDNfMzI3MjMxNjE4L2FwX0RhdGFTaWduYWw0XzE5NDQyMTQ4NTM5MDMvYXBfZ2VvTGFuZ19n...
evs.jivox.com/trk/72/219890/1800/145089/45f3d18e47f96c/18/jvxSId_1688099253.5434/es_pId_vtnwou/ Frame 2DD4 43 B
229 B 117ms
111ms Image
image/gif 3.222.88.10
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://evs.jivox.com/trk/72/219890/1800/145089/45f3d18e47f96c/18/jvxSId_1688099253.5434/es_pId_vtnwou/es_encParams_L2FwX0RhdGFTaWduYWwxXzE2MjY3OTkxMDIyL2FwX0RhdGFTaWduYWwyX0FCQWpIMGhpLVVxT1RGTGdCQzZsTzdIQ0RMOWcvYXBfRGF0YVNpZ25hbDNfMzI3MjMxNjE4L2FwX0RhdGFTaWduYWw0XzE5NDQyMTQ4NTM5MDMvYXBfZ2VvTGFuZ19nZXJtYW55X2dlcm1hbi9hcF9EYXRhU2lnbmFsN19nZXJtYW55X2dlcm1hbi9hcF9iZXN0c2VsbGVySURfdW5kZWZpbmVkL2FwX2dkcHJfMC9hcF9EYXRhU2lnbmFsOF91bmRlZmluZWQvYWRiMS1rZXk9MTIvYWRiMTQtaWRfdmVyc2lvbj0xNjM5OF8xL2FkYjYta2V5PTE0L2FkYjctaWRfdmVyc2lvbj0xNTk0Nl8xL2FkYjE0LWtleT0xMC9hZGIxOS1rZXk9MTAvYWRiMy1pZF92ZXJzaW9uPTI4MTU0XzEvYWRiMTEtaWRfdmVyc2lvbj0yODUwNV8xL2FkYjEwLWtleT0yL2FkYjE3LWlkX3ZlcnNpb249NDM2NjhfMS9hZGIyMS1pZF92ZXJzaW9uPTE3MDk5XzEvYWRiMjEta2V5PTY5OTk1L2FkYjcta2V5PTIwL2FkYjgtaWRfdmVyc2lvbj00Mzc5NV8xL2FkYjE4LWtleT0yMC9hZGIyLWtleT0yL2FkYjE3LWtleT0yL2FkYjEyLWlkX3ZlcnNpb249MzE2NDBfMS9hZGI0LWlkX3ZlcnNpb249MjIzMjRfMS9hZGIxMy1rZXk9MTAwQS9hZGIxNi1pZF92ZXJzaW9uPTMxODM2XzEvYWRiNS1pZF92ZXJzaW9uPTMxNDYxXzEvYWRiMTYta2V5PTEyL2FkYjMta2V5PTcvYWRiOS1pZF92ZXJzaW9uPTE5Mzk4XzEvYWRiMTIta2V5PTM4L2FkYjQta2V5PTExL2FkYjgta2V5PTEyL2FkYjEzLWlkX3ZlcnNpb249MTU5MDdfMS9hZGIxOS1pZF92ZXJzaW9uPTMxNDYzXzEvYWRiMS1pZF92ZXJzaW9uPTMxNDYyXzEvYWRiMTUtaWRfdmVyc2lvbj0yNDM1M18xL2FkYjYtaWRfdmVyc2lvbj0zNzYyOF8xL2FkYjE1LWtleT0xMC9hZGIxMC1pZF92ZXJzaW9uPTI4NTAyXzEvYWRiNS1rZXk9My9hZGI5LWtleT0xMi9hZGIyMC1rZXk9MTAvYWRiMi1pZF92ZXJzaW9uPTIwMDA2XzEvYWRiMTEta2V5PTEyL2FkYjE4LWlkX3ZlcnNpb249MTk1NDhfMS9hZGIyMC1pZF92ZXJzaW9uPTIxNjIzXzEvZXNfZXQ9My9iRGltPTcyOHg5MC9qdnhSYW5kb209MC4xNjg3MDU4Nzk1MjY5MzAwNi9lc19jZ05hbWU9Mjk1MGZkMTdhOWFmNGY5MzgzOWYwMzlkZDhhYWIxMjg5YWY3OTNkZjlkODE2ZDNhMjM5ZDdkNGQ5ZDcyZGRjZjk5Mzk0M2Y4OTU1MWVlYzhiYTVhNThhMWY3MWQzMzI4YTVlZWUwZGZlZjZmOTBhNjhiMzRjMTMwNzE3Y2U4YTYvZXNfc2VnTmFtZT1Qcm9zcGVjdGluZ19FT1NTXzE=
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.88.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-88-10.compute-1.amazonaws.com
Software: akka-http/10.1.11 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 30 Jun 2023 04:27:37 GMT
access-control-allow-credentials: false
content-type: image/gif
server: akka-http/10.1.11
content-length: 43
p3p: CP='IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA'

GET
H2 200 es_encParams_L2FwX0RhdGFTaWduYWwxPTE2MjY3OTkxMDIyL2FwX0RhdGFTaWduYWwyPUFCQWpIMGhpLVVxT1RGTGdCQzZsTzdIQ0RMOWcvYXBfRGF0YVNpZ25hbDM9MzI3MjMxNjE4L2FwX0RhdGFTaWduYWw0PTE5NDQyMTQ4NTM5MDMvYXBfZ2VvTGFuZz1n...
evs.jivox.com/trk/73/219890/1800/145089/45f3d18e47f96c/18/jvxSId_1688099253.5434/es_pId_vtnwou/ Frame F8D9 43 B
229 B 129ms
99ms Image
image/gif 3.222.88.10
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://evs.jivox.com/trk/73/219890/1800/145089/45f3d18e47f96c/18/jvxSId_1688099253.5434/es_pId_vtnwou/es_encParams_L2FwX0RhdGFTaWduYWwxPTE2MjY3OTkxMDIyL2FwX0RhdGFTaWduYWwyPUFCQWpIMGhpLVVxT1RGTGdCQzZsTzdIQ0RMOWcvYXBfRGF0YVNpZ25hbDM9MzI3MjMxNjE4L2FwX0RhdGFTaWduYWw0PTE5NDQyMTQ4NTM5MDMvYXBfZ2VvTGFuZz1nZXJtYW55X2dlcm1hbi9hcF9EYXRhU2lnbmFsNz1nZXJtYW55X2dlcm1hbi9hcF9iZXN0c2VsbGVySUQ9dW5kZWZpbmVkL2FwX2dkcHI9MC9hcF9EYXRhU2lnbmFsOD11bmRlZmluZWQvYWRiMS1rZXk9MTIvYWRiMTQtaWRfdmVyc2lvbj0xNjM5OF8xL2FkYjYta2V5PTE0L2FkYjctaWRfdmVyc2lvbj0xNTk0Nl8xL2FkYjE0LWtleT0xMC9hZGIxOS1rZXk9MTAvYWRiMy1pZF92ZXJzaW9uPTI4MTU0XzEvYWRiMTEtaWRfdmVyc2lvbj0yODUwNV8xL2FkYjEwLWtleT0yL2FkYjE3LWlkX3ZlcnNpb249NDM2NjhfMS9hZGIyMS1pZF92ZXJzaW9uPTE3MDk5XzEvYWRiMjEta2V5PTY5OTk1L2FkYjcta2V5PTIwL2FkYjgtaWRfdmVyc2lvbj00Mzc5NV8xL2FkYjE4LWtleT0yMC9hZGIyLWtleT0yL2FkYjE3LWtleT0yL2FkYjEyLWlkX3ZlcnNpb249MzE2NDBfMS9hZGI0LWlkX3ZlcnNpb249MjIzMjRfMS9hZGIxMy1rZXk9MTAwQS9hZGIxNi1pZF92ZXJzaW9uPTMxODM2XzEvYWRiNS1pZF92ZXJzaW9uPTMxNDYxXzEvYWRiMTYta2V5PTEyL2FkYjMta2V5PTcvYWRiOS1pZF92ZXJzaW9uPTE5Mzk4XzEvYWRiMTIta2V5PTM4L2FkYjQta2V5PTExL2FkYjgta2V5PTEyL2FkYjEzLWlkX3ZlcnNpb249MTU5MDdfMS9hZGIxOS1pZF92ZXJzaW9uPTMxNDYzXzEvYWRiMS1pZF92ZXJzaW9uPTMxNDYyXzEvYWRiMTUtaWRfdmVyc2lvbj0yNDM1M18xL2FkYjYtaWRfdmVyc2lvbj0zNzYyOF8xL2FkYjE1LWtleT0xMC9hZGIxMC1pZF92ZXJzaW9uPTI4NTAyXzEvYWRiNS1rZXk9My9hZGI5LWtleT0xMi9hZGIyMC1rZXk9MTAvYWRiMi1pZF92ZXJzaW9uPTIwMDA2XzEvYWRiMTEta2V5PTEyL2FkYjE4LWlkX3ZlcnNpb249MTk1NDhfMS9hZGIyMC1pZF92ZXJzaW9uPTIxNjIzXzEvYkRpbT03Mjh4OTAvcj0wLjM3NDUyNDc4MzkwNzU5MDAzL2VzX2NnTmFtZT0yOTUwZmQxN2E5YWY0ZjkzODM5ZjAzOWRkOGFhYjEyODlhZjc5M2RmOWQ4MTZkM2EyMzlkN2Q0ZDlkNzJkZGNmOTkzOTQzZjg5NTUxZWVjOGJhNWE1OGExZjcxZDMzMjhhNWVlZTBkZmVmNmY5MGE2OGIzNGMxMzA3MTdjZThhNi9lc19zZWdOYW1lPVByb3NwZWN0aW5nX0VPU1NfMQ==
Requested by: Host: a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com
URL: https://a25ea6eff40bebed58a3c3cb3c500097.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.88.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-88-10.compute-1.amazonaws.com
Software: akka-http/10.1.11 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 30 Jun 2023 04:27:37 GMT
access-control-allow-credentials: false
content-type: image/gif
server: akka-http/10.1.11
content-length: 43
p3p: CP='IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA'

GET
H2 200 es_encParams_L2FwX0RhdGFTaWduYWwxPTE2MjY3OTkxMDIyL2FwX0RhdGFTaWduYWwyPUFCQWpIMGhpLVVxT1RGTGdCQzZsTzdIQ0RMOWcvYXBfRGF0YVNpZ25hbDM9MzI3MjMxNjE4L2FwX0RhdGFTaWduYWw0PTE5NDQyMTQ4NTM5MDMvYXBfZ2VvTGFuZz1n...
evs.jivox.com/asvar/impr/219890/1800/145089/45f3d18e47f96c/18/jvxSId_1688099253.5434/es_pId_vtnwou/ Frame F8D9 43 B
229 B 295ms
0ms Image
image/gif 3.222.88.10
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://evs.jivox.com/asvar/impr/219890/1800/145089/45f3d18e47f96c/18/jvxSId_1688099253.5434/es_pId_vtnwou/es_encParams_L2FwX0RhdGFTaWduYWwxPTE2MjY3OTkxMDIyL2FwX0RhdGFTaWduYWwyPUFCQWpIMGhpLVVxT1RGTGdCQzZsTzdIQ0RMOWcvYXBfRGF0YVNpZ25hbDM9MzI3MjMxNjE4L2FwX0RhdGFTaWduYWw0PTE5NDQyMTQ4NTM5MDMvYXBfZ2VvTGFuZz1nZXJtYW55X2dlcm1hbi9hcF9EYXRhU2lnbmFsNz1nZXJtYW55X2dlcm1hbi9hcF9iZXN0c2VsbGVySUQ9dW5kZWZpbmVkL2FwX2dkcHI9MC9hcF9EYXRhU2lnbmFsOD11bmRlZmluZWQvZXNfYXY9UFJPU1BFQ1RJTkclN0NCRVNULlNFTExFUiU3Q2dlcm1hbnklN0NnZXJtYW4lN0NEQk0lN0NQQyU3Q0lBQi5MZWFkZXJib2FyZCU3QzcyOHg5MCU3Q05BJTdDVEVOTklTJTJDVEVOTklTJTJDVEVOTklTJTJDVEVOTklTJTdDTUVOUyUyQ01FTlMlMkNNRU5TJTJDTUVOUyU3QzE2MjY3OTkxMDIyJTdDQUJBakgwaGktVXFPVEZMZ0JDNmxPN0hDREw5ZyU3QzMyNzIzMTYxOCU3QzE5NDQyMTQ4NTM5MDMlN0NOQSU3Q05BJTdDTkElN0NOQSU3Q05BJTdDTkElN0NOQSU3Q05BJTdDTkElN0NOQSU3QzEwMTAwNDAyOTclMkMxNDE3OTQ0MSUyQzEwMDM4NDIzMjIlMkMxMDAzODQyNjY4JTdDJTIzRkZDNzk1JTJDJTIzRkY2RTZFJTJDJTIzRkZDNzk1JTJDJTIzRkY2RTZFJTJDJTIzRkZDNzk1JTJDJTIzRkY2RTZFJTJDJTIzRkZDNzk1JTJDJTIzRkY2RTZFJTdDTkElN0NGVFclMkZBUFAlN0NBUFAlMkNBUFAlMkNGVFclMkNGVFclN0NOQSU3Q05BJTdDTkElN0NOQSU3Q1NVX0VPU1MtMjAyMyU3Q05FVy5UZW1wbGF0ZS8vYkRpbT03Mjh4OTAvcj0wLjY1MTgxMjgzMTgwMzg0NDcvZXNfY2dOYW1lPTI5NTBmZDE3YTlhZjRmOTM4MzlmMDM5ZGQ4YWFiMTI4OWFmNzkzZGY5ZDgxNmQzYTIzOWQ3ZDRkOWQ3MmRkY2Y5OTM5NDNmODk1NTFlZWM4YmE1YTU4YTFmNzFkMzMyOGE1ZWVlMGRmZWY2ZjkwYTY4YjM0YzEzMDcxN2NlOGE2L2VzX3NlZ05hbWU9UHJvc3BlY3RpbmdfRU9TU18x
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.88.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-88-10.compute-1.amazonaws.com
Software: akka-http/10.1.11 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 30 Jun 2023 04:27:37 GMT
access-control-allow-credentials: false
content-type: image/gif
server: akka-http/10.1.11
content-length: 43
p3p: CP='IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA'

GET
H2 200 fonts.css
assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/ Frame 4206 731 B
1 KB 13ms
12ms Stylesheet
text/css 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/fonts.css
Requested by: Host: assets.jivox.com
URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c7a2db618b534110b5c3dd3bc94bfbbd7978891ae803c719bc140d660cd568fe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 19:31:26 GMT
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
last-modified: Tue, 13 Jun 2023 11:47:50 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
age: 76686
x-amz-server-side-encryption: AES256
etag: "bdd83318690eccaa80727554b769ecfb"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: max-age=86400, s-maxage=86400
accept-ranges: bytes
content-length: 731
x-amz-cf-id: pmiRy8TjrVhfa4PuUI6lrQANnCDI2cwSc96zeTAKUt2uosSdNSxLAA==

GET
H2 200 FuturaNDforNike365Cn-XBd.woff
assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/ Frame 4206 31 KB
31 KB 11ms
9ms Font
application/octet-stream 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/FuturaNDforNike365Cn-XBd.woff
Requested by: Host: assets.jivox.com
URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/fonts.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fa99309f02472fcfdfd0fb97608acc27717e6dde13566e69fd45c3eb10963964

Request headers

Referer: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/fonts.css
Origin: https://as.jivox.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 00:33:50 GMT
via: 1.1 1d087f24771eb6834b16162f1bb01660.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 76685
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 31292
last-modified: Tue, 13 Jun 2023 11:47:50 GMT
server: AmazonS3
etag: "881a60b5ff95e9ea442ef8e455327f17"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=86400, s-maxage=86400
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges: bytes
x-amz-cf-id: uvuxGQcXzxbcubo5KUwbNxgN7cs_yIZHrg0wt1rTWQiGROs3-NjjBQ==

GET
H2 200 HelveticaNowDisplay-Bold.woff
assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/ Frame 4206 69 KB
69 KB 16ms
15ms Font
application/octet-stream 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/HelveticaNowDisplay-Bold.woff
Requested by: Host: assets.jivox.com
URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/fonts.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a2299362fc445446837df63375318e9e42076fb65ae5dcaf1288ab406ab14b8d

Request headers

Referer: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/fonts.css
Origin: https://as.jivox.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 00:33:50 GMT
via: 1.1 1d087f24771eb6834b16162f1bb01660.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 76685
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 70560
last-modified: Tue, 13 Jun 2023 11:47:50 GMT
server: AmazonS3
etag: "d048c6bfbf328f4c1ef00c5dadbbeda7"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=86400, s-maxage=86400
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges: bytes
x-amz-cf-id: 4DLKCTUT4pc5vjbbCIs-Y4f7uJdWJIPfEFR9A-FAR2L1XVr4Sjq-RQ==

GET
H2 200 HelveticaNowDisplay-Medium.woff
assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/ Frame 4206 68 KB
69 KB 22ms
21ms Font
application/octet-stream 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/HelveticaNowDisplay-Medium.woff
Requested by: Host: assets.jivox.com
URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/fonts.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8d1d9d1bb9f7e18e544b8061ec81e38db18f57597f9e2b619949e45935bae354

Request headers

Referer: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/fonts.css
Origin: https://as.jivox.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 23:37:57 GMT
via: 1.1 1d087f24771eb6834b16162f1bb01660.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 76685
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 70004
last-modified: Tue, 13 Jun 2023 11:47:50 GMT
server: AmazonS3
etag: "2ab2f91059b197f326006e073f5bfd96"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=86400, s-maxage=86400
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges: bytes
x-amz-cf-id: XC502Rh_gITfRngfLw1vP5HFOsfssfU9ZuedXuzIYFgs6oasvvDa2g==

GET
H2 200 HelveticaNowDisplay-Regular.woff
assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/ Frame 4206 65 KB
65 KB 25ms
24ms Font
application/octet-stream 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/HelveticaNowDisplay-Regular.woff
Requested by: Host: assets.jivox.com
URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/fonts.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a14651084cc817bd308f4dda3f8680a8ef34169802ccef201e43e10fe7e5157c

Request headers

Referer: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/fonts.css
Origin: https://as.jivox.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 29 Jun 2023 20:37:55 GMT
via: 1.1 1d087f24771eb6834b16162f1bb01660.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 76685
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 66308
last-modified: Tue, 13 Jun 2023 11:47:50 GMT
server: AmazonS3
etag: "7a0342edb6d12072b1a5d71322ef11ba"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=86400, s-maxage=86400
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges: bytes
x-amz-cf-id: 4SF74407UnDu_t7B4PPXzIaJR3KIN4q_JTdpt-3HR3aApfQRmMyBiA==

GET
H2 200 nike_swoosh.woff
assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/ Frame 4206 936 B
1 KB 27ms
26ms Font
application/octet-stream 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/nike_swoosh.woff
Requested by: Host: assets.jivox.com
URL: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/fonts.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-98.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 56b88ad46d144d236e361abef933a6d02525e449a956f527047a2e273cd0f6be

Request headers

Referer: https://assets.jivox.com/assets/widgets/2023/6/a46220z64885764cbd0e/1/728x90_PROS_EOSS_21/fonts.css
Origin: https://as.jivox.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 00:33:50 GMT
via: 1.1 1d087f24771eb6834b16162f1bb01660.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 56765
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 936
last-modified: Tue, 13 Jun 2023 11:47:51 GMT
server: AmazonS3
etag: "23d4bd7bea1d557c33f520340f8cce7f"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=86400, s-maxage=86400
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges: bytes
x-amz-cf-id: u2pDgMwZLEj-UznSg36KVK5xRhAQ2PnhugQ7VUz-0ekylEApC0FzVg==

GET
H2 200 dbe9fe76-7157-47bc-9cb7-1158d2019f4b.png
assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/ Frame 4206 16 KB
17 KB 14ms
13ms Image
image/webp 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/dbe9fe76-7157-47bc-9cb7-1158d2019f4b.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

9233a883b3f26fa3eb97b5034fafa8e73e53cf32def1b777bd2b096416af8f23

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 18:52:04 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 13512934
x-cache: Hit from cloudfront
content-disposition: inline; filename="dbe9fe76-7157-47bc-9cb7-1158d2019f4b.webp"
content-length: 16446
x-request-id: 08fa3a0646df539427da4ffc3446f873
last-modified: Tue, 24 Jan 2023 18:21:19 GMT
server: Cloudinary
etag: "95d3866a970fb38b7e326e6e34884fa9"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 2uCTCypuwpm-lM5UkHnCTQzU8np67uN8pvnBqxMEgXkbsrqkvIUeGw==

GET
H2 200 bce67848-ff2d-49f5-b4e4-ce714bbc008f.png
assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/ Frame 4206 16 KB
17 KB 15ms
13ms Image
image/webp 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/bce67848-ff2d-49f5-b4e4-ce714bbc008f.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

e6cd68b03c9d2e3c6490caf76c75c175c3594deb44d03b04fbb42e1046ec09a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 27 May 2023 06:00:04 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 2932054
x-cache: Hit from cloudfront
content-disposition: inline; filename="bce67848-ff2d-49f5-b4e4-ce714bbc008f.webp"
content-length: 16510
last-modified: Tue, 24 Jan 2023 18:30:20 GMT
server: Cloudinary
etag: "1492d516df33eeaead44718b7de221e4"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: Ax_kMIrpZKVjZ9g6OZ91r2Z_YoaRRvMJdchDNH9oI5ASGx32jwiS-A==

GET
H2 200 6b72f059-74a9-4d74-8ccf-dae989a59e23.png
assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/ED_v1/ Frame 4206 17 KB
18 KB 16ms
14ms Image
image/webp 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/ED_v1/6b72f059-74a9-4d74-8ccf-dae989a59e23.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

2a645f443c2438b9713f71acd4b7e3c2723d2ef7a7d952aace28e22b89cd8c04

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 03:13:39 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 4439
x-cache: Hit from cloudfront
content-disposition: inline; filename="6b72f059-74a9-4d74-8ccf-dae989a59e23.webp"
content-length: 17368
last-modified: Fri, 23 Jun 2023 03:12:52 GMT
server: Cloudinary
etag: "359d532912874bf7f058e3c73b7a4325"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 86aPKgwiTZkDoUhLtLX78n9CRj_lg-b8JrCehQR3K6i7KTEszLJmNA==

GET
H2 200 d61ae7c1-ccad-4552-a542-764fe94f0185.png
assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/ED_v1/ Frame 4206 20 KB
21 KB 29ms
27ms Image
image/webp 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/ED_v1/d61ae7c1-ccad-4552-a542-764fe94f0185.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

459e59166d8dfff80b0322eff79c4280e9909ac1d2de7875cf9ab9e914c96bba

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 03:13:39 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 4439
x-cache: Hit from cloudfront
content-disposition: inline; filename="d61ae7c1-ccad-4552-a542-764fe94f0185.webp"
content-length: 20768
last-modified: Fri, 23 Jun 2023 03:12:52 GMT
server: Cloudinary
etag: "43bcbc2a7c7cf1a2510f5370742f0427"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: f2hCslXflJF6vz3nfPkP2dw9QGXOrYANXOHX5bccoWguIEUIfpZIZA==

GET
H2 200 6cfcf063-6ae3-4aa7-8a3c-ae6857aac784.png
assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/ Frame 4206 14 KB
15 KB 16ms
15ms Image
image/webp 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/6cfcf063-6ae3-4aa7-8a3c-ae6857aac784.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

172a1a105b31f4eca791b41b9a8cf38680851735ffa0525367bdd3fd1005a5a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 04 May 2023 07:41:18 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 4913180
x-cache: Hit from cloudfront
content-disposition: inline; filename="6cfcf063-6ae3-4aa7-8a3c-ae6857aac784.webp"
content-length: 14222
x-request-id: 27d3cc9ca221aa4ad330f91eca46ef16
last-modified: Thu, 04 May 2023 07:41:01 GMT
server: Cloudinary
etag: "0b875f9667699a9c53c7a7ff9bcefeff"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: rvFKSqsEiDotIGhrp1zObp1kteGEP2qkbRDBQEkkLvVUKUXGYCd9aw==

GET
H2 200 f4c06a18-309e-4665-8d23-4f6dbab146a7.png
assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/ Frame 4206 38 KB
39 KB 18ms
17ms Image
image/webp 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/f4c06a18-309e-4665-8d23-4f6dbab146a7.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

5a55d186768a65b413f5d7b2a60f6b3a401618f534262156167ce768a13b5c1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 24 May 2023 11:23:52 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 3171826
x-cache: Hit from cloudfront
content-disposition: inline; filename="f4c06a18-309e-4665-8d23-4f6dbab146a7.webp"
content-length: 39004
last-modified: Thu, 04 May 2023 07:41:06 GMT
server: Cloudinary
etag: "e8a8d54f23daca5086f93e01b40bdaed"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: Hq0DZaeXa3jEty1G-L2Em2gkw7cGCIBpqNnzR08yN0T3eSalZdEVMA==

GET
H2 200 21d71d54-900d-4519-876a-0b1784f2a0c3.png
assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/ Frame 4206 46 KB
46 KB 21ms
20ms Image
image/webp 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/21d71d54-900d-4519-876a-0b1784f2a0c3.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

2d8b2f1c22c32e50043f261b81e41183c22ec2aa1664ea6d7ebfbc79c90764a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 04 May 2023 07:41:43 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 4913155
x-cache: Hit from cloudfront
content-disposition: inline; filename="21d71d54-900d-4519-876a-0b1784f2a0c3.webp"
content-length: 46768
x-request-id: 8d316c7474ce1e9e660f80d0b3325a10
last-modified: Thu, 04 May 2023 07:41:03 GMT
server: Cloudinary
etag: "cc08a3cd52cbf63fdd5729f0a0311548"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: a1VLBYLGWq61bdkeyorFUc6HAsfDsVAUmkavgYVCymhKbmkc0K9C5A==

GET
H2 200 ce044915-eea8-4e2b-a7ba-2ceb92debe88.png
assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/ Frame 4206 46 KB
46 KB 27ms
26ms Image
image/webp 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/ce044915-eea8-4e2b-a7ba-2ceb92debe88.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

69e4392557fb0d15184a492b5c8677a2bb44ddae510bd68f870a840116df85ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 04 May 2023 07:41:43 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 4913155
x-cache: Hit from cloudfront
content-disposition: inline; filename="ce044915-eea8-4e2b-a7ba-2ceb92debe88.webp"
content-length: 46672
last-modified: Thu, 04 May 2023 07:41:03 GMT
server: Cloudinary
etag: "d931197f34f4d1e1e44631f668a0142d"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: L3_qPSRyernG3CsVldF5Uxe62ysYbcZ5e9Zggt0SfN6ai8qI6obS3Q==

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/dbe9fe76-7157-47bc-9cb7-1158d2019f4b.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

9233a883b3f26fa3eb97b5034fafa8e73e53cf32def1b777bd2b096416af8f23

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 18:52:04 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 13512934
x-cache: Hit from cloudfront
content-disposition: inline; filename="dbe9fe76-7157-47bc-9cb7-1158d2019f4b.webp"
content-length: 16446
x-request-id: 08fa3a0646df539427da4ffc3446f873
last-modified: Tue, 24 Jan 2023 18:21:19 GMT
server: Cloudinary
etag: "95d3866a970fb38b7e326e6e34884fa9"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: HqS5du1I6-0VaxT24QupFYjKkT9RcWUCjKp1bZbHOm9uyDjrjY19PQ==

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/bce67848-ff2d-49f5-b4e4-ce714bbc008f.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

e6cd68b03c9d2e3c6490caf76c75c175c3594deb44d03b04fbb42e1046ec09a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 27 May 2023 06:00:04 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 2932054
x-cache: Hit from cloudfront
content-disposition: inline; filename="bce67848-ff2d-49f5-b4e4-ce714bbc008f.webp"
content-length: 16510
last-modified: Tue, 24 Jan 2023 18:30:20 GMT
server: Cloudinary
etag: "1492d516df33eeaead44718b7de221e4"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: G4oWjMOT4jwjD9i8evGjZdfTP-_oaeA3E-5OMmqYs8MZXqhp1U54Qg==

GET
H2 200 6b72f059-74a9-4d74-8ccf-dae989a59e23.png
assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/ED_v1/ Frame 4206 17 KB
18 KB 9ms
8ms Image
image/webp 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/ED_v1/6b72f059-74a9-4d74-8ccf-dae989a59e23.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

2a645f443c2438b9713f71acd4b7e3c2723d2ef7a7d952aace28e22b89cd8c04

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 03:13:39 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 4439
x-cache: Hit from cloudfront
content-disposition: inline; filename="6b72f059-74a9-4d74-8ccf-dae989a59e23.webp"
content-length: 17368
last-modified: Fri, 23 Jun 2023 03:12:52 GMT
server: Cloudinary
etag: "359d532912874bf7f058e3c73b7a4325"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: WXRoQodhsIQuziS9WefJDHk4CqtKkjUMn-IQAW1RYOpvkBNYN6zshg==

GET
H2 200 d61ae7c1-ccad-4552-a542-764fe94f0185.png
assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/ED_v1/ Frame 4206 20 KB
21 KB 11ms
9ms Image
image/webp 18.66.122.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/ED_v1/d61ae7c1-ccad-4552-a542-764fe94f0185.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

459e59166d8dfff80b0322eff79c4280e9909ac1d2de7875cf9ab9e914c96bba

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 30 Jun 2023 03:13:39 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 4439
x-cache: Hit from cloudfront
content-disposition: inline; filename="d61ae7c1-ccad-4552-a542-764fe94f0185.webp"
content-length: 20768
last-modified: Fri, 23 Jun 2023 03:12:52 GMT
server: Cloudinary
etag: "43bcbc2a7c7cf1a2510f5370742f0427"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: aplNr8JzSzFTOETSxXHR7nDZwQPg7MGzrgmAJrQ96aRF_c0q0utiXg==

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/6cfcf063-6ae3-4aa7-8a3c-ae6857aac784.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

172a1a105b31f4eca791b41b9a8cf38680851735ffa0525367bdd3fd1005a5a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 04 May 2023 07:41:18 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 4913180
x-cache: Hit from cloudfront
content-disposition: inline; filename="6cfcf063-6ae3-4aa7-8a3c-ae6857aac784.webp"
content-length: 14222
x-request-id: 27d3cc9ca221aa4ad330f91eca46ef16
last-modified: Thu, 04 May 2023 07:41:01 GMT
server: Cloudinary
etag: "0b875f9667699a9c53c7a7ff9bcefeff"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: nSrUG4ed7Z-Xc4RGwa8cRsEksOXK0fxxQ3mZNceO25yYu1MqKBK64Q==

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/f4c06a18-309e-4665-8d23-4f6dbab146a7.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

5a55d186768a65b413f5d7b2a60f6b3a401618f534262156167ce768a13b5c1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 24 May 2023 11:23:52 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 3171826
x-cache: Hit from cloudfront
content-disposition: inline; filename="f4c06a18-309e-4665-8d23-4f6dbab146a7.webp"
content-length: 39004
last-modified: Thu, 04 May 2023 07:41:06 GMT
server: Cloudinary
etag: "e8a8d54f23daca5086f93e01b40bdaed"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: zmDy9fzoLpgzzPccPgn0wqvXbu1I8yEaCPr8-8xbyxnMzV5XJoTnAQ==

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/21d71d54-900d-4519-876a-0b1784f2a0c3.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

2d8b2f1c22c32e50043f261b81e41183c22ec2aa1664ea6d7ebfbc79c90764a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Thu, 04 May 2023 07:41:43 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 4913155
x-cache: Hit from cloudfront
content-disposition: inline; filename="21d71d54-900d-4519-876a-0b1784f2a0c3.webp"
content-length: 46768
x-request-id: 8d316c7474ce1e9e660f80d0b3325a10
last-modified: Thu, 04 May 2023 07:41:03 GMT
server: Cloudinary
etag: "cc08a3cd52cbf63fdd5729f0a0311548"
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, no-transform, immutable, max-age=31557600
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 0-KZjJ9pLENQNmX9Y7Sr4EngclJWE3du_JZgMbhwEVFPuwyc6Qgv-g==

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.jivox.com/creatives/CustomFeed/Nike_F3D/46220/8335_Feedonomics/Images/Monthly_v1/ce044915-eea8-4e2b-a7ba-2ceb92debe88.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.122.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS