wheregoes.com Open in urlscan Pro
138.197.62.132 Public Scan

Software

sffe /

Resource Hash

5042f25c3eb1530880fa3b05325462c028492caf22141409999cdd7e6364b8ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:26:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 351
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126823
x-xss-protection: 0
last-modified: Wed, 16 Mar 2022 08:34:12 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 28 Mar 2023 09:26:09 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 94 B
719 B 38ms
16ms XHR
application/json 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=wheregoes.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d3eb7350a0588ff4e1af60592b47c3a3c535379bf789126fcdf9737d2e80057e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 28 Mar 2022 09:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 83
x-xss-protection: 0
expires: Mon, 28 Mar 2022 09:32:00 GMT

GET
H2 200 CEAIT5QE.json Show response
srv.buysellads.com/ads/ 934 B
668 B 371ms
18ms Fetch
application/json 161.35.94.134
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://srv.buysellads.com/ads/CEAIT5QE.json?forcebanner=443784&ignoretargeting=yes
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 161.35.94.134 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: srv-eu-nl-17.buysellads.com
Software: //srv.buysellads.com /
Resource Hash: d74ca6396b3cf16962d2447e403d0e4304abc633d3db39f41fb90b5bea0eeb4c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 28 Mar 2022 09:32:00 GMT
content-encoding: gzip
server: //srv.buysellads.com
content-length: 555
vary: Accept-Encoding
content-type: application/json; charset=utf-8

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
117 B 450ms
121ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280a57d4001b&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 4396dd06ee7d0ca997541a97e93f2df625eff2e1ba10fce8fe028a5d1125ae77

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 28 Mar 2022 09:32:01 GMT
server: ATS/9.1.0.33
age: 1
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 548ms
219ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: fbe661a73dbc0f4448f99c8eb6e7e068163a770ed4f67a8cca944cc521700e46

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 28 Mar 2022 09:32:01 GMT
server: ATS/9.1.0.33
age: 1
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 432ms
104ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: ed4ffd6683aade94bdb08067fc59dde7486016413c22f4c571ad11c2f758ebec

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 28 Mar 2022 09:32:00 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 409ms
81ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 82064844ed4a3558599aaacf37ae92dd177c56f35dd89501e8c28293a96d9378

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 28 Mar 2022 09:32:00 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 407ms
79ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 1db5642f1bb9f251d03c1425aa362bf453d0a3845e98d27151db4df87f744fa7

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 28 Mar 2022 09:32:00 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 406ms
78ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a9691a0017c7c276934280be73c001e&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 92cbfa4341bf405a8606cd284f239640931678458c2e0fb065e124e81a982a34

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 28 Mar 2022 09:32:00 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 417ms
89ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: a81680151e6eb23b63a38691f64c4823168f9c6f518c9355816b59cbde30603f

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 28 Mar 2022 09:32:00 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
290 B 403ms
76ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee280c36f30017&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 591887ec7b5b44868fff8df4789c6e824d05a91568a641ff0b49e9e08c109049

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 28 Mar 2022 09:32:00 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 428ms
101ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee280cdbc80018&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 9b795cafaa8aee401c6da62770e2804a9ef50784ab257b929cf98caf2e888b7d

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 28 Mar 2022 09:32:00 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 400 display Show response
mantodea.mantisadnetwork.com/prebid/ 56 B
331 B 427ms
108ms XHR
text/html 54.80.147.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/display?tz=0&buster=1648459921222&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221651272%2F&measurable=true&bids[0][bidId]=120cf4b76274a69&bids[0][config][property]=WhereGoes&bids[0][config][zone]=Wheregoes_S2S_Leaderboard_ATF_ROS&bids[0][sizes][0][width]=728&bids[0][sizes][0][height]=90&bids[0][sizes][1][width]=970&bids[0][sizes][1][height]=90&bids[1][bidId]=1376ca5aaf5eb48&bids[1][config][property]=WhereGoes&bids[1][config][zone]=Wheregoes_S2S_Sidebar_ROS_Pos1&bids[1][sizes][0][width]=300&bids[1][sizes][0][height]=250&bids[2][bidId]=14cc0fa16c62e34&bids[2][config][property]=WhereGoes&bids[2][config][zone]=Wheregoes_S2S_Leaderboard_InContent_BTF_ROS&bids[2][sizes][0][width]=728&bids[2][sizes][0][height]=90&bids[2][sizes][1][width]=300&bids[2][sizes][1][height]=250&bids[2][sizes][2][width]=336&bids[2][sizes][2][height]=280&bids[3][bidId]=1549399de7f876e&bids[3][config][property]=WhereGoes&bids[3][config][zone]=Wheregoes_S2S_Sticky_Sidebar_ROS_Pos2&bids[3][sizes][0][width]=300&bids[3][sizes][0][height]=250&bids[3][sizes][1][width]=120&bids[3][sizes][1][height]=600&bids[3][sizes][2][width]=160&bids[3][sizes][2][height]=600&bids[3][sizes][3][width]=300&bids[3][sizes][3][height]=600&property=WhereGoes&foo
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.80.147.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-80-147-122.compute-1.amazonaws.com
Software: / Express
Resource Hash: 5352720a5ffb778e42dbb1d4b81c975c02018dd660e1fe9c430cbf13dba78762

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:00 GMT
x-powered-by: Express
etag: W/"38-oN4RNSEETikJBvZER0pAAAEOHrw"
vary: Origin
content-type: text/html; charset=utf-8
access-control-allow-origin: https://wheregoes.com
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 56
expires: -1

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 714 B
1 KB 1146ms
821ms XHR
application/json 185.255.84.150
IGUANE-

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221651272%2F&PublisherDomain=https%3A%2F%2Fwheregoes.com

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.255.84.150 , France, ASN200271 (IGUANE-, FR),

Reverse DNS

Software

ayl-lb-fra02 /

Resource Hash

c2b4b86506ba01a511206ef9373ff6134d46478d77c0f5f9378b789a790059da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:01 GMT
x-content-type-options: nosniff
server: ayl-lb-fra02
vary: Accept-Encoding
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-max-age: 3600
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 806
access-control-allow-headers: Accept-Encoding, Content-Type
content-length: 714
expires: 0

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 260 B
1 KB 558ms
237ms XHR
application/json 2602:803:c004:200::141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=2&alt_size_ids=55&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221651272%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=93f8d78a-f973-46b1-b86c-916519d3dce0&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.32662629387720465
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c004:200::141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: caef478936a7b38ae371f623157c7c4e94b287640d2a3f657cf807a3e4f86202

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:01 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 260
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
1 KB 401ms
80ms XHR
application/json 2602:803:c004:200::141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221651272%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=05521d55-0f1c-42a9-803b-0fa47c7fd0a7&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.6312432786184434
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c004:200::141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: f0b1ba6e8f5b0f36f6c65a4e011176abc43a2ded32dae48328cc9de97a9e2dc5

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:00 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 260 B
1 KB 401ms
80ms XHR
application/json 2602:803:c004:200::141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&alt_size_ids=2%2C16&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221651272%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=78432c7c-c8a5-4db2-95d6-c68a78afd273&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.47934228586878924
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c004:200::141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: edc4f167f133c04fbc7c8d5a66a3f2dc3b56b94dad6647aa6a0474bf2328c2ee

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:00 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 260
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 265 B
1 KB 421ms
98ms XHR
application/json 2602:803:c004:200::141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&alt_size_ids=9%2C8%2C10&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221651272%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=5c505daf-4d26-44c6-b949-f4f18206ed4f&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.15900349039858708
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c004:200::141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 822264ce7d0a58131748766c2f0379427210ffd1a9b0dceb9887bd2b0f93e545

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:00 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 265
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 471 B
1 KB 326ms
17ms XHR
application/json 37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

bidder.par.vip.prod.criteo.com

Software

nginx/1.21.3 /

Resource Hash

fe1e73b6ddfaa580c03fb632868adc1cfa7b1e1299efd29a92fa53c92921aa47

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:00 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9a675b9a-605b-4c21-974e-c2a6d3037dde
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 471
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
311 B 360ms
42ms XHR
application/json 178.250.0.165
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=33&wv=4.43.0&cb=41206970600

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 28 Mar 2022 09:32:00 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 93 B
743 B 410ms
98ms XHR
application/json 72.251.249.9
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.43.0
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: adc0c5d06cb9029ef37fd120f19c1dcb2437e5aa9ee280589be62c3777d88405

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 28 Mar 2022 09:32:00 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://wheregoes.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 98

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
360 B 318ms
7ms XHR
application/json 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://wheregoes.com
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
926 B 394ms
80ms XHR
application/json 34.107.148.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU18831I
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: aeaffce5b940d3f52f5ef43b3e9f56715823545ec51605c57f212d0c426df727

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:00 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 200 adreq Show response
ads.servenobid.com/ 475 B
596 B 526ms
214ms XHR
application/json 54.246.157.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=4922
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.246.157.68 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-157-68.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: d66ba954b36b83af0fcb94e866cf3e080ba7d808353519d5b4cccdfab3fdaa65

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 28 Mar 2022 09:32:01 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 41ms
16ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=wheregoes.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 28 Mar 2022 09:32:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 39ms
15ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=wheregoes.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 28 Mar 2022 09:32:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
442 B 62ms
38ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_paw&pvsid=961435492603190&vrg=2022031601&nw_id=8691100&nslots=4&eid=31063378%2C31065547%2C31065613%2C31065659%2C31065550&pub_url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221651272%2F&sig=2&req=0&req_cnt=1&dm=8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 140 KB
27 KB 82ms
81ms XHR
text/plain 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=961435492603190&correlator=310978188091576&eid=31063378%2C31065547%2C31065613%2C31065659%2C31065550&output=ldjh&gdfp_req=1&vrg=2022031601&ptt=17&impl=fifs&iu_parts=8691100%2CWheregoes_S2S_Leaderboard_ATF_ROS%2CWheregoes_S2S_Sidebar_ROS_Pos1%2CWheregoes_S2S_Leaderboard_InContent_BTF_ROS%2CWheregoes_S2S_Sticky_Sidebar_ROS_Pos2&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x90%2C300x250%2C320x50%7C728x90%7C300x250%7C336x280%2C300x250%7C120x600%7C160x600%7C300x600&fluid=0%2C0%2Cheight%2C0&ifi=1&adks=1696759606%2C2861055222%2C3878002045%2C3809685794&sfv=1-0-38&ecs=20220328&fsapi=false&prev_scp=optimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1641228026595-4_123456%26optimize_inview%3Dfalse%7Coptimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1641228120494-5_123456%26optimize_inview%3Dfalse%7Coptimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1641318314037-7_123456%26optimize_inview%3Dfalse%7Coptimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1641318529900-6_123456%26optimize_inview%3Dfalse&eri=1&cust_params=optimize_refreshed%3Dfalse%26optimize_acceptable%3Dfalse%26optimize_adl_debug%3Dfalse%26optimize_ctv_debug%3Dfalse%26optimize_debug%3Dfalse%26optimize%3Dtrue%26optimize_adl_id%3D%26optimize_amp%3Dfalse%26optimize_audience%3Dtech%26optimize_env%3Dprod%26optimize_pub%3Dwheregoes%26optimize_xp%3Da&sc=1&cookie_enabled=1&abxe=1&dt=1648459922393&lmt=1648459922&dlt=1648459919255&idt=1519&biw=1600&bih=1200&adxs=209%2C1091%2C209%2C1091&adys=474%2C666%2C1127%2C950&ucis=1%7C2%7C3%7C4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221651272%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1182x1412%7C300x952%7C862x1020%7C300x952&msz=1182x90%7C300x250%7C862x250%7C300x600&fws=516%2C0%2C0%2C0&ohw=1182%2C0%2C0%2C0&ga_vid=256129065.1648459922&ga_sid=1648459922&ga_hid=1482774060&ga_fc=false&btvi=0%7C0%7C0%7C0&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e291913575cbd5de8b8982f4676fe0cf54d20bef571674d71832a1ccd7c53ec7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:01 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26573
x-xss-protection: 0
google-lineitem-id: 5320060794,5324395187,5324395187,5320060794
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138305491763,138305874807,138305885909,138305489837
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 45ms
23ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022031601&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6856b38b7fa984ff9672ce0e1866ec0434d6ca4764ef73d5888f88af407e4c31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 28 Mar 2022 09:32:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10728
x-xss-protection: 0

GET
H2 200 container.html Show response
09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 76DC 6 KB
4 KB 80ms
14ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 28 Mar 2022 09:32:01 GMT
expires: Tue, 28 Mar 2023 09:32:01 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 41ms
18ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 28 Mar 2022 09:32:01 GMT

GET
H3 200 container.html Show response
09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 322E 6 KB
3 KB 30ms
13ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 28 Mar 2022 09:32:01 GMT
expires: Tue, 28 Mar 2023 09:32:01 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/ Frame 8DB2 19 KB
8 KB 38ms
10ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/abg_lite_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d072a09604e6a1fea8ef42203503771aa36b63a3c91fd1059966e26e6f5812b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:29:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 151
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7871
x-xss-protection: 0
server: cafe
etag: 7397949449432438406
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Apr 2022 09:29:30 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame 8DB2 2 KB
1 KB 38ms
12ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:31:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Apr 2022 09:31:09 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8DB2 119 KB
36 KB 25ms
23ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 28 Mar 2022 09:32:01 GMT

GET
H3 200 9435140927320421974
tpc.googlesyndication.com/simgad/ Frame 8DB2 92 KB
92 KB 44ms
18ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9435140927320421974

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de8279221cec92147e41e962754da2e9667fe862dc94f192566fa7bec3d11f11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 11:58:56 GMT
x-content-type-options: nosniff
age: 509585
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 93765
x-xss-protection: 0
last-modified: Tue, 10 Mar 2020 20:30:38 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 22 Mar 2023 11:58:56 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/ Frame 02DE 19 KB
8 KB 29ms
8ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/abg_lite_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d072a09604e6a1fea8ef42203503771aa36b63a3c91fd1059966e26e6f5812b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:29:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 151
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7871
x-xss-protection: 0
server: cafe
etag: 7397949449432438406
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Apr 2022 09:29:30 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame 02DE 2 KB
1 KB 33ms
12ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:31:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Apr 2022 09:31:09 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 02DE 119 KB
36 KB 50ms
48ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 28 Mar 2022 09:32:01 GMT

GET
H3 200 14411045596044271614
tpc.googlesyndication.com/simgad/ Frame 02DE 94 KB
94 KB 30ms
13ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14411045596044271614

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d08b67c252083a37cb7295ba5796d73c6e205c7aabe133d9cb604b73ea5985c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Wed, 23 Mar 2022 11:16:26 GMT
x-content-type-options: nosniff
age: 425735
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 96289
x-xss-protection: 0
last-modified: Tue, 10 Mar 2020 20:29:11 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 23 Mar 2023 11:16:26 GMT

GET
H3 200 container.html Show response
09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 609E 6 KB
3 KB 8ms
7ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 28 Mar 2022 09:32:01 GMT
expires: Tue, 28 Mar 2023 09:32:01 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8DB2 0
0 43ms
42ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstWxIgqm9eBgDAtGn8R9ea_qZeniteeaVD9Q662Cb460uQ4yt7x7m3XLlOgobFSpPqkdGbGYoPqHWRvnr9FqYZPck82Fh_BUoJMXfog7Mscbff6p2Gg9IeuIbd5rUip_Gqcxi5DFvGv4VqHH21mwYtNmKu91MtweqpwvENp7rI6ERpF2lFDSXPwS0WoxLXwlLYGrQ8tk7ZDhOzCWmrGJBSaEXhrwUxob6X13pdBvs2kOmeIH2fxLBqQUDLMVxvnpP7y4j79D_VjYgw0_sOkdyNdFWuVCVGwufC8oZBU2zIL7PhgqSxiC-6uPylpKoIPtiy2PD5YHaq6&sai=AMfl-YTFInMaXGKRn7ZbPvl6Kwp-3E1JrSIfIi8n5O_f6O627FUWbsgOwsR7agSOp-aGTjYxHxtcWcr88u35xHGuc3xkpfQ4U_2jygQ1to8IMCAa6ALS6Tm_YVejyrBBNJFv&sig=Cg0ArKJSzNXLoEs3lGNmEAE&uach_m=[UACH]&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20221651272/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 28 Mar 2022 09:32:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Mon, 28 Mar 2022 09:32:01 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 02DE 0
0 44ms
43ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstM3c_r9dhqEpI9LnfUHf2mvy6JQa6xYl_vS-_28SWn0bM8hk5YjflEkGZ9xZ4ho7SZqnk1V02_E8r6F1bWI3ia2Zpmgz2qA2Lq5Zi54k_NQhSwVDDvy6_T78TDU3334ySZVi1GNJtefnz997o-YaS4UKfj7JsT1heJDJjcc24jALA40GKF1T-d0C3KHWvRqdEaKQEOSXpKd7lGr2vQxsdyXLJqb1X9twEPODKCohcZpB_nRV4JhWmnMqJxP7GsyIVBrt9Fhnp_10RDaE4is47abAR_AByT9lXtMbgAXtq-P39OO-qGwOy8tbA1O6CKygyeOzc5TJglELLiHUF4TnomCW7xFw&sai=AMfl-YTVpO0LWZVF9Dam2eKka26OTdeAt1-ijdpK1ASLcVuyHaaa2KLR5kEx-HGD_5j5J7HW8Nm86WItmsy4P2BmO1PAL2VeR3FLngMRcQxvZ0MEqu5JqiXgkxh6WvEiR32a&sig=Cg0ArKJSzN4VhsTx7uYrEAE&uach_m=[UACH]&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20221651272/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 28 Mar 2022 09:32:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Mon, 28 Mar 2022 09:32:01 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame D011 13 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 28 Mar 2022 09:27:57 GMT
expires: Tue, 28 Mar 2023 09:27:57 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 244
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame C121 783 B
1 KB 36ms
15ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

ba6fa62cbdaad9c2d5484b9d6f06f11d59d3ee113e6691e469474777c4f06ee0

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-vvFj3qBjAyjxsFO9VldGVg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Mon, 28 Mar 2022 09:32:01 GMT
date: Mon, 28 Mar 2022 09:32:01 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-vvFj3qBjAyjxsFO9VldGVg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8DB2 0
0 72ms
54ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu14VfJeSRInKomfRBDBxdZ3qHzND-5lxkaGEcuRHGAh1EwRilxEEAsqcSlKpxDdehI6ldkeN8dt5M6pE0XFL48i-aOALbpLmTEsW9eaDinfb34G0aQDUUB2gc-OR1FrhOKWs-fUb-_y9TgVeFB1al9sx1fO3WSKhgLospyQnbrMOljTh4r4tZw2NdWXVVHBBa_99sA7KMezik8IEKY-Oq_KgkR_BlIFjK3NElMuFw18ulBK8XquK3_lF5gc58gfrnI2K4iyMgh__2giP2JqJ0q07jeNznm8Q-wM1BihYIfuOMyrCv8-Niq2qLj4bune2lVmdA7OMRxgbY&sai=AMfl-YRK_WTqTBYTTxEpOWkQLqRglLkcGu8KZG_UL9g9TQKjPlvRYuzvNu_xID9MxEDfl8MESpRUU-lNF2p73AWimLoq-Y1hZEfpJMu7VK4QSE5DzGzSqCaqmNdFl0C5Pynf&sig=Cg0ArKJSzD3NcGOGXS3cEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 28 Mar 2022 09:32:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Mon, 28 Mar 2022 09:32:02 GMT

GET
DATA 200
OK truncated
/ Frame 8DB2 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9368efafa069481064a8b6596381231f6adb1b7185f65950c5cfbcab80927e15

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 322E 22 KB
7 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com
URL: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Sun, 27 Mar 2022 22:14:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40628
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 27 Mar 2023 22:14:54 GMT

GET
H/1.1

200
OK

bounce Show response
secure.adnxs.com/ Frame 322E
Redirect Chain

https://secure.adnxs.com/ttj?id=18678115&size=728x90&cb=1268430417&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstA4kvpoqRz1dDATL6piSx2x8YBAg3tFqNSwH033ei6goSy01kVRHshMCCMm...
https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D18678115%26size%3D728x90%26cb%3D1268430417%26pubclick%3Dhttps%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%25253Fxai%25253DAKAOjstA4kvpoqRz1dDATL6pi...

8 KB
4 KB

44ms
43ms

Script
application/javascript

37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D18678115%26size%3D728x90%26cb%3D1268430417%26pubclick%3Dhttps%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%25253Fxai%25253DAKAOjstA4kvpoqRz1dDATL6piSx2x8YBAg3tFqNSwH033ei6goSy01kVRHshMCCMmbh3-bt4Qfe_R_CJClyw8YqFAzgH9khUGO_bYuEJY3oDyWAR9S2BL7wK9BhUmQxQtcONbVFwpwgKf7J18e4eWz7yf0l7sNFzedYBVrI3AOTjoyen6OznZDgVP0pTs94H11uX2Gkw8UaUSXZBHZ_3O_Gk0gF1tpYiMG_iyPoIHfzYAgm0kAZK43YYKeXbeYECjtOVV11Nyl2R9-Dy5aDrpvTIC4yfNX8vb1wblYRdlrCqoi9UFqdoi7wmlgIlXt7iVYGIaEHG-OrqP0Ct%252526sai%25253DAMfl-YTvB-gW8hC8Knn3_UbUJXCg0gI18O-5p1V0xTCR32U3vyEaF-NGylstuDPusFsUolPaPHGtVzmaB7Z5NcRbEJ98wzoXvLgIdTHVSo_6h73RkkTXjA3dfB-EBFTDC3Vp%252526sig%25253DCg0ArKJSzErCTktzWop9EAE%252526fbs_aeid%25253D%25255Bgw_fbsaeid%25255D%252526urlfix%25253D1%252526adurl%25253D

Requested by

Host: 09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com
URL: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

5f9d389d576fe1096155505a175c62e28ea8c93e9e26a5e306b020a61bbe00ba

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date: Mon, 28 Mar 2022 09:32:02 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 5ae09052-2920-4a75-9c96-1414aaafb51c
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:02 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: a21ccad8-24f9-45dc-bb5b-7cf5ee8c1c27
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D18678115%26size%3D728x90%26cb%3D1268430417%26pubclick%3Dhttps%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%25253Fxai%25253DAKAOjstA4kvpoqRz1dDATL6piSx2x8YBAg3tFqNSwH033ei6goSy01kVRHshMCCMmbh3-bt4Qfe_R_CJClyw8YqFAzgH9khUGO_bYuEJY3oDyWAR9S2BL7wK9BhUmQxQtcONbVFwpwgKf7J18e4eWz7yf0l7sNFzedYBVrI3AOTjoyen6OznZDgVP0pTs94H11uX2Gkw8UaUSXZBHZ_3O_Gk0gF1tpYiMG_iyPoIHfzYAgm0kAZK43YYKeXbeYECjtOVV11Nyl2R9-Dy5aDrpvTIC4yfNX8vb1wblYRdlrCqoi9UFqdoi7wmlgIlXt7iVYGIaEHG-OrqP0Ct%252526sai%25253DAMfl-YTvB-gW8hC8Knn3_UbUJXCg0gI18O-5p1V0xTCR32U3vyEaF-NGylstuDPusFsUolPaPHGtVzmaB7Z5NcRbEJ98wzoXvLgIdTHVSo_6h73RkkTXjA3dfB-EBFTDC3Vp%252526sig%25253DCg0ArKJSzErCTktzWop9EAE%252526fbs_aeid%25253D%25255Bgw_fbsaeid%25255D%252526urlfix%25253D1%252526adurl%25253D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 322E 119 KB
36 KB 30ms
29ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com
URL: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 28 Mar 2022 09:32:02 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 02DE 0
0 44ms
43ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsunLpRYZJLP10zs4L6BfuhmaLu4DbLpLXfedzTOJilZkkn9T5DJc3gpd7GEW9u6FJ8zKjM3tpXSB8aM_Nr0HJLjB7lfzaFfcBb839VpjrwK-WHdqsWom9s63nzlJqBrTHN_M0k1b7WQBUUA7AnfKppYLDDHIey6C4lo2KweMJlZov7qXE0_sQdHXXXLgcskQetlEfTg5-kM8z3qwvuYUcIIBSVc2qCcRCXZTifMPcoMaqrFjCoLvdFSweUaScxRGAx6_MJrzJSFKYLrgQAJn_gtDYJp7FAi8fluv94D_nuP2eHmNOfta-v2xoPfAveAKZ5D5ElXHdcqZaIWCOupEWfMd8gjtGOP&sai=AMfl-YQogzxcX6VZGANgrmiFKnBmsqwHvMGnTck4jNqrs-uNaekUtahFV5hfLfhoIaOYmnO95A5X5g_5oYlU4kNYDA2RHM4DYhKfVviF_XA2CD-GZfiNqY29a91z7EQrs4jP&sig=Cg0ArKJSzDZtyUTokL8vEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 28 Mar 2022 09:32:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Mon, 28 Mar 2022 09:32:02 GMT

GET
DATA 200
OK truncated
/ Frame 02DE 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 091155ed7041246c6e25feda1db645557e43c70e397683e0b9df5483f25c3e60

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 609E 22 KB
7 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com
URL: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Sun, 27 Mar 2022 22:14:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40628
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 27 Mar 2023 22:14:54 GMT

GET
H/1.1

200
OK

bounce Show response
secure.adnxs.com/ Frame 609E
Redirect Chain

https://secure.adnxs.com/ttj?id=18678115&size=300x250&cb=1390330396&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsu_optXUvIElOU-JqIXd4wAdrafkz_EwvLKIFGbjqmRs3yEF3Pl-07UAqr0...
https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D18678115%26size%3D300x250%26cb%3D1390330396%26pubclick%3Dhttps%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%25253Fxai%25253DAKAOjsu_optXUvIElOU-JqIX...

8 KB
4 KB

47ms
47ms

Script
application/javascript

37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D18678115%26size%3D300x250%26cb%3D1390330396%26pubclick%3Dhttps%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%25253Fxai%25253DAKAOjsu_optXUvIElOU-JqIXd4wAdrafkz_EwvLKIFGbjqmRs3yEF3Pl-07UAqr0LhqF5n9PeWj4-zXsuB92k64mhrdXhAP0xdrj3e7kfoA1pNz1jcjEtY_HZ6OdfNT7NNsySxqRY3d7766KQtK3bcy8Q4dTDoRAGbGvB3Y4lG59VzilGRiOpA9KsRbWH3vBVlY_FMeh7WXbI6iqWhatMTee7b_kH5bTEuHun5RVKjgycE2F9zot0DiHzFskeTHpdejrVTg6CbY0tYSZq77ap0icww6ExudhGlHkQl7pLHdj-xdUuVEsc9UZHt9ad1QbP7cdh9Xca7BStJtTuoZPVQ%252526sai%25253DAMfl-YSj52G40V9Gg70CnCbeWMep6vGC8yYIAyxJzuJrx22xxquWrNPffKcyZHtSsxpOn9GD-qqGPqws-w19msIh0hLH6a5YFuMUMvV8Gj_dksNOAXNRtlgXYjTP2CA7fq9U%252526sig%25253DCg0ArKJSzLevH4XFhC4QEAE%252526fbs_aeid%25253D%25255Bgw_fbsaeid%25255D%252526urlfix%25253D1%252526adurl%25253D

Requested by

Host: 09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com
URL: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

b89a5bba5644b4e95edc50982f164c910c142f0b18aa503b359c502563a3590a

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date: Mon, 28 Mar 2022 09:32:02 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: fd63a399-4227-4b59-9fd2-96d0a03c4b36
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:02 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 1490a624-6d23-48d3-90a8-6fc746fc5985
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D18678115%26size%3D300x250%26cb%3D1390330396%26pubclick%3Dhttps%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%25253Fxai%25253DAKAOjsu_optXUvIElOU-JqIXd4wAdrafkz_EwvLKIFGbjqmRs3yEF3Pl-07UAqr0LhqF5n9PeWj4-zXsuB92k64mhrdXhAP0xdrj3e7kfoA1pNz1jcjEtY_HZ6OdfNT7NNsySxqRY3d7766KQtK3bcy8Q4dTDoRAGbGvB3Y4lG59VzilGRiOpA9KsRbWH3vBVlY_FMeh7WXbI6iqWhatMTee7b_kH5bTEuHun5RVKjgycE2F9zot0DiHzFskeTHpdejrVTg6CbY0tYSZq77ap0icww6ExudhGlHkQl7pLHdj-xdUuVEsc9UZHt9ad1QbP7cdh9Xca7BStJtTuoZPVQ%252526sai%25253DAMfl-YSj52G40V9Gg70CnCbeWMep6vGC8yYIAyxJzuJrx22xxquWrNPffKcyZHtSsxpOn9GD-qqGPqws-w19msIh0hLH6a5YFuMUMvV8Gj_dksNOAXNRtlgXYjTP2CA7fq9U%252526sig%25253DCg0ArKJSzLevH4XFhC4QEAE%252526fbs_aeid%25253D%25255Bgw_fbsaeid%25255D%252526urlfix%25253D1%252526adurl%25253D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 609E 119 KB
36 KB 25ms
24ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com
URL: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 28 Mar 2022 09:32:02 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 322E 0
0 46ms
44ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssZT2aCRYs8RMEleimTx6jr2qnwMIGMI1vFQ0FeIMHYkn-svy3tFQJkq0XNxmzmKYdP1rZ25l_aF5LqkZFsNEErHuSbMb_sVoDzUVVfkdKpcut3pFSN8jJiaNxTgySEtegOV3FMgN6pkONuD53mM39--b-THzgn_-lFNcHwXPs00yjKwGGstB6vhBnJp2D1cLXO043ragtRl4GtiTiTBBKSn-UzS_O_fZIPGMxVrprPn058Ox6bLQEyy3vbvBE8uGtBhblTr1ZVlwaU3PxiX9gPRhViyk-yHEpXREbKMQegA74bswe4J0hrSOYJj2TriHV2LzmRhUAwELR8&sai=AMfl-YRuZ8GMfSX3bbMl6rITNGIYiS3uuxY4fkbyFlSVGhYU2RtBhfuKxy2rCg8FpunpddY8ARWQkmaL5-qzdB7nZPZxCNzMouid_mT98lW7g2_RsefT8gHJkMfc0hflIdSU&sig=Cg0ArKJSzJ1m-Qq5Rq_EEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com
URL: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 28 Mar 2022 09:32:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame C121 0
0 73ms
59ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022031601&jk=961435492603190&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 609E 0
0 45ms
45ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsukVX4_2TmL9sx3vGfy22DkH7Hmd1cQkIa2u--h8pOatRMrLYyCFLVmxQTtO6V5b5Cxy2sGZ9IN0DmPQR6IHi-NFtSPF5G9RkTHXzOf3Tu0OYKjacyQmTP8CSCL4eqMQHH9J-GkNIGUcRhQhDOyWhoFhR9ieY1ZXZ4RKCJYued0hnHXiPQAlg5Y-r0jmn9zzWGWCAS4H3g4Z1Iipu7ETL2ba57nEFJmPtxL1JysN0cLvE9tXDL8JrJ1gEfuiF0E2iiGtBg1rJifXnuFI4iHVXJYkmQtA3MIjyrkMXdI8Ik9Kd8Ne2Z-aMl-eJ9Rn7Je5_PjE200nG7O5U67OJMf0w&sai=AMfl-YSvkC8RfEM92X8McpWcUvq0wBPG1H6_U82FJOGvbiFCNNzWw3TwhGntRQuy-9aSR7C4tCb2sXQReNWKnXIYS2cdJ0MSOpnIPZA5VunAsVa4vzKZl0xOksNNyxFmpIBi&sig=Cg0ArKJSzGgGtr_KeOeEEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com
URL: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 28 Mar 2022 09:32:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 CGHVXjYJRnLTYRF6fgor0GmLhTjmHb-GVf8novFL6vc.js Show response
pagead2.googlesyndication.com/bg/ Frame D011 35 KB
14 KB 14ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CGHVXjYJRnLTYRF6fgor0GmLhTjmHb-GVf8novFL6vc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0861d55e36094672d361117a7e0a2bd0698b8538e61dbf8655ff27a2f14beaf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:26:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 351
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13806
x-xss-protection: 0
last-modified: Tue, 22 Mar 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 28 Mar 2023 09:26:11 GMT

GET
H2 200 sync Show response
gum.criteo.com/ Frame 609E 51 B
377 B 124ms
16ms Script
text/javascript 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=300x250&cb=1390330396&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsu_optXUvIElOU-JqIXd4wAdrafkz_EwvLKIFGbjqmRs3yEF3Pl-07UAqr0LhqF5n9PeWj4-zXsuB92k64mhrdXhAP0xdrj3e7kfoA1pNz1jcjEtY_HZ6OdfNT7NNsySxqRY3d7766KQtK3bcy8Q4dTDoRAGbGvB3Y4lG59VzilGRiOpA9KsRbWH3vBVlY_FMeh7WXbI6iqWhatMTee7b_kH5bTEuHun5RVKjgycE2F9zot0DiHzFskeTHpdejrVTg6CbY0tYSZq77ap0icww6ExudhGlHkQl7pLHdj-xdUuVEsc9UZHt9ad1QbP7cdh9Xca7BStJtTuoZPVQ%2526sai%253DAMfl-YSj52G40V9Gg70CnCbeWMep6vGC8yYIAyxJzuJrx22xxquWrNPffKcyZHtSsxpOn9GD-qqGPqws-w19msIh0hLH6a5YFuMUMvV8Gj_dksNOAXNRtlgXYjTP2CA7fq9U%2526sig%253DCg0ArKJSzLevH4XFhC4QEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:01 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 1562
strict-transport-security: max-age=31536000; preload;
content-length: 169
expires: 60

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame 609E 9 KB
7 KB 139ms
138ms Script
application/javascript 37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1648459922&bdh=oKPjZFrizbJAMJufgNbB5t3EfGA.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=1390330396&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsu_optXUvIElOU-JqIXd4wAdrafkz_EwvLKIFGbjqmRs3yEF3Pl-07UAqr0LhqF5n9PeWj4-zXsuB92k64mhrdXhAP0xdrj3e7kfoA1pNz1jcjEtY_HZ6OdfNT7NNsySxqRY3d7766KQtK3bcy8Q4dTDoRAGbGvB3Y4lG59VzilGRiOpA9KsRbWH3vBVlY_FMeh7WXbI6iqWhatMTee7b_kH5bTEuHun5RVKjgycE2F9zot0DiHzFskeTHpdejrVTg6CbY0tYSZq77ap0icww6ExudhGlHkQl7pLHdj-xdUuVEsc9UZHt9ad1QbP7cdh9Xca7BStJtTuoZPVQ%2526sai%253DAMfl-YSj52G40V9Gg70CnCbeWMep6vGC8yYIAyxJzuJrx22xxquWrNPffKcyZHtSsxpOn9GD-qqGPqws-w19msIh0hLH6a5YFuMUMvV8Gj_dksNOAXNRtlgXYjTP2CA7fq9U%2526sig%253DCg0ArKJSzLevH4XFhC4QEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

17205d5f969e19780b3edaa9afe8730d7d1023b201df8027e673e3b1e7576ba0

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date: Mon, 28 Mar 2022 09:32:02 GMT
Content-Encoding: gzip
X-Creative-ID: 77221793
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 0334cd2a-a8f2-451a-a6eb-27ab7532f5eb
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 sync Show response
gum.criteo.com/ Frame 322E 51 B
376 B 120ms
17ms Script
text/javascript 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=728x90&cb=1268430417&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjstA4kvpoqRz1dDATL6piSx2x8YBAg3tFqNSwH033ei6goSy01kVRHshMCCMmbh3-bt4Qfe_R_CJClyw8YqFAzgH9khUGO_bYuEJY3oDyWAR9S2BL7wK9BhUmQxQtcONbVFwpwgKf7J18e4eWz7yf0l7sNFzedYBVrI3AOTjoyen6OznZDgVP0pTs94H11uX2Gkw8UaUSXZBHZ_3O_Gk0gF1tpYiMG_iyPoIHfzYAgm0kAZK43YYKeXbeYECjtOVV11Nyl2R9-Dy5aDrpvTIC4yfNX8vb1wblYRdlrCqoi9UFqdoi7wmlgIlXt7iVYGIaEHG-OrqP0Ct%2526sai%253DAMfl-YTvB-gW8hC8Knn3_UbUJXCg0gI18O-5p1V0xTCR32U3vyEaF-NGylstuDPusFsUolPaPHGtVzmaB7Z5NcRbEJ98wzoXvLgIdTHVSo_6h73RkkTXjA3dfB-EBFTDC3Vp%2526sig%253DCg0ArKJSzErCTktzWop9EAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:02 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 1550
strict-transport-security: max-age=31536000; preload;
content-length: 169
expires: 60

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame 322E 8 KB
7 KB 158ms
157ms Script
application/javascript 37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1648459922&bdh=oKPjZFrizbJAMJufgNbB5t3EfGA.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=1268430417&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjstA4kvpoqRz1dDATL6piSx2x8YBAg3tFqNSwH033ei6goSy01kVRHshMCCMmbh3-bt4Qfe_R_CJClyw8YqFAzgH9khUGO_bYuEJY3oDyWAR9S2BL7wK9BhUmQxQtcONbVFwpwgKf7J18e4eWz7yf0l7sNFzedYBVrI3AOTjoyen6OznZDgVP0pTs94H11uX2Gkw8UaUSXZBHZ_3O_Gk0gF1tpYiMG_iyPoIHfzYAgm0kAZK43YYKeXbeYECjtOVV11Nyl2R9-Dy5aDrpvTIC4yfNX8vb1wblYRdlrCqoi9UFqdoi7wmlgIlXt7iVYGIaEHG-OrqP0Ct%2526sai%253DAMfl-YTvB-gW8hC8Knn3_UbUJXCg0gI18O-5p1V0xTCR32U3vyEaF-NGylstuDPusFsUolPaPHGtVzmaB7Z5NcRbEJ98wzoXvLgIdTHVSo_6h73RkkTXjA3dfB-EBFTDC3Vp%2526sig%253DCg0ArKJSzErCTktzWop9EAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

db03b2bf62c72fb78a7f0360a602ab4629aac1394cdc66429606c4ab29af3d92

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date: Mon, 28 Mar 2022 09:32:02 GMT
Content-Encoding: gzip
X-Creative-ID: 78827815
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: f005e239-a2e3-4a1b-aa31-8159cb3d3829
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK if Show response
fra1-ib.adnxs.com/ Frame 0E29 9 KB
6 KB 101ms
16ms Document
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QK3MfBMtxgAAAMA1gAFAQiSgYaSBhDvq5OxmaaY5wQYtc_676ij5KNNKjYJQkKUL2ghkT8RatCGsqZoiz8ZAAAAQDMzwz8hatCGsqZoiz8pQkIJJAAxARu44XqEPzDjgvQIOMpBQOUeSGVQoZ_pJFiY1VJgAGjr3JoBeJnZBYABAYoBA1VTRJIFBvTEAZgBrAKgAfoBqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGTBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3Vfb3B0WFV2SUVsT1UtSnFJWGQ0d0FkcmFma3pfRXd2TEtJRkdianFtUnMzeUVGM1BsLTA3VUFxcjBMaHFGNW45UGVXajQtelhzdUI5Mms2NG1ocmRYaEFQMHhkcmozZTdrZm9BMXBOejFqY2pFdFlfSFo2T2RmTlQ3Tk5zeVN4cVJZM2Q3NzY2S1F0SzNiY3k4UTRkVERvUkFHYkd2QjNZNGxHNTlWemlsR1JpT3BBOUtzUmJXSDN2QlZsWV9GTWVoN1dYYkk2aXFXaGF0TVRlZTdiX2tINWJURXVIdW41UlZLamd5Y0UyRjl6b3QwRGlIekZza2VUSHBkZWpyVlRnNkNiWTB0WVNacTc3YXAwaWN3dzZFeHVkaEdsSGtRbDdwTEhkai14ZFV1VkVzYzlVWkh0OWFkMVFiUDdjZGg5WGNhN0JTdEp0VHVvWlBWUSUyNTI2c2FpJSVj8ItNZmwtWVNqNTJHNDBWOUdnNzBDbkNiZVdNZXA2dkdDOHlZSUF5eEp6dUpyeDIyeHhxdVdyTlBmZktjeVpIdFNzeHBPbjlHRC1xcUdQcXdzLXcxOW1zSWgwaExINmE1WUZ1TVVNdlY4R2pfZGtzTk9BWE5SdGxnWFlqVFAyQ0E3ZnE5VSUyNTI2c2lnJQGRkENnMEFyS0pTekxldkg0WEZoQzRRRUFFJTI1MjZmYnNfYWVpZCUBKSglMjU1Qmd3X2Zicw0UADUBFBwyNnVybGZpeEFJBEQxBTcQYWR1cmwFEDjwAQDYAgDgAp_wP-oCFmhBofT9BzovL3doZXJlZ29lcy5jb20v8gINCgZIRUlHSFQSAzI1MPICDAoFV0lEVEgSAzMwMPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMjEzMjcwNTQ5MPICnRAKC1BSRV9TQ1JJUFRTEo0QPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaD10aGlzfHxzZWxmOy8qCgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KZnVuY3Rpb24gayhiKXtrWyIgIl0oYik7cmV0dXJuIGJ9a1siICJdPWZ1bmN0aW9uKCl7fTtmdW5jdGlvbiBsKCl7dmFyIGI9ZG9jdW1lbnQuY3VycmVudFNjcmlwdDtyZXR1cm4oYj12b2lkIDA9PT1iP251bGw6YikmJiI3NyI9PT1iLmdldEF0dHJpYnV0ZSgiZGF0YS1qYyIpP2I6ZG9jdW1lbnQucXVlcnlTZWxlY3RvcignW2RhdGEtamM9Ijc3Il0nKX07dmFyIG49UmVnRXhwKCJeaHR0cHM_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7CmZ1bmN0aW9uIHAoKXt2YXIgYj1oO3ZhciBjPVtdO3ZhciBlPW51bGw7ZG97dmFyIGE9Yjt0cnl7dmFyIGQ7aWYoZD0hIWEmJm51bGwhPWEubG9jYXRpb24uaHJlZiliOnt0cnl7ayhhLmZvbyk7ZD0hMDticmVhayBifWNhdGNoKG0pe31kPSExfXZhciBnPWR9Y2F0Y2gobSl7Zz0hMX1pZihnKXt2YXIgZj1hLmxvY2F0aW9uLmhyZWY7ZT1hLmRvY3VtZW50JiZhLmRvY3VtZW50LnJlZmVycmVyfHxudWxsfWVsc2UgZj1lLGU9bnVsbDtjLnB1c2gobmV3IHEoZnx8IiIpKTt0cnl7Yj1hLnBhcmVudH1jYXRjaChtKXtiPW51bGx9fXdoaWxlKGImJmEhPWIpO2E9MDtmb3IoYj1jLmxlbmd0aC0xO2E8PWI7KythKWNbYV0uZGVwdGg9Yi1hO2E9aDtpZihhLmxvY2F0aW9uJiZhLmxvY2F0aW9uLmFuY2VzdG9yT3JpZ2lucyYmYS5sb2NhdGlvbi5hbmNlc3Rvck9yaWdpbnMubGVuZ3RoPT1jLmxlbmd0aC0xKWZvcihiPTE7YjxjLmxlbmd0aDsrK2IpZj1jW2JdLGYudXJsfHwoZi51cmw9YS5sb2NhdGlvbi5hbmNlc3Rvck9yaWdpbnNbYi0KMV18fCIiLGYuaD0hMCk7YT1uZXcgcShoLmxvY2F0aW9uLmhyZWYsITEpO2Y9bnVsbDtmb3IoZT1iPWMubGVuZ3RoLTE7MDw9ZTstLWUpaWYoZz1jW2VdLCFmJiZuLnRlc3QoZy51cmwpJiYoZj1nKSxnLnVybCYmIWcuaCl7YT1nO2JyZWFrfWY9bnVsbDtlPWMubGVuZ3RoJiZjW2JdLnVybDswIT1hLmRlcHRoJiZlJiYoZj1jW2JdKTtjPW5ldyByKGEsZik7cmV0dXJuIGMuZz9jLmcudXJsOmMuaS51cmx9ZnVuY3Rpb24gcihiLGMpe3RoaXMuaT1iO3RoaXMuZz1jfWZ1bmN0aW9uIHEoYixjKXt0aGlzLnVybD1iO3RoaXMuaD0hIWM7dGhpcy5kZXB0aD1udWxsfTtmdW5jdGlvbiB0KCl7dmFyIGI9cCgpLGM9Yi5pbmRleE9mKCI_Iik7c2V0VGltZW91dChmdW5jdGlvbigpe3ZhciBlPXZvaWQgMD09PWU_LjAxOmU7aWYoIShNYXRoLnJhbmRvbSgpPmUpKXt2YXIgYT1sKCk7YT0iaHR0cHM6Ly8iKyhhJiYidHJ1ZSI9PT1hLmdldEF0dHJpYnV0ZSgiZGF0YS1qYy1yY2QiKT8icGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi1jbi5jb20iOiJwYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbSIpKyIvcGFnZWFkL2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249Ijt2YXIgZD0oZD1sKCkpJiZkLmdldEF0dHJpYnV0ZSgiZGF0YS1qYy12ZXJzaW9uIil8fCJ1bmtub3duIjtlPWErZCsiJnNhbXBsZT0iK2U7YT13aW5kb3c7aWYoZD1hLm5hdmlnYXRvcilkPWEubmF2aWdhdG9yLnVzZXJBZ2VudCxkPS9DaHJvbWUvLnRlc3QoZCkmJiEvRWRnZS8udGVzdChkKT8hMDohMTtkJiZhLm5hdmlnYXRvci5zZW5kQmVhY29uP2EubmF2aWdhdG9yLnNlbmRCZWFjb24oZSk6CihhLmdvb2dsZV9pbWFnZV9yZXF1ZXN0c3x8KGEuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzPVtdKSxkPWEuZG9jdW1lbnQsZD12b2lkIDA9PT1kP2RvY3VtZW50OmQsZD1kLmNyZWF0ZUVsZW1lbnQoImltZyIpLGQuc3JjPWUsYS3CcF9pbWFnZV9yZXF1ZXN0cy5wdXNoKGQpKX19LDAp0eOIMDw9Yz9iLnN1YnN0cmluZygwLGMpOmJ9d2luZG93LnJmbD39wchyZXR1cm4gZW5jb2RlVVJJQ29tcG9uZW50KHQoKSl9O30pLmNhbGwodGhpcyk7Cjwvc2PhCfQ0AT7yAskCCgpFWFRSQV9UQUdTEroCPGRpdiBzdHlsZT0icG9zaXRpb246IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcDogMHB4OyB2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIHNyYz0iaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCZhd2JpZF9iPUFLQW1mLUQ2em1WVTNTNE5mZnRkOXhTbjBjRTRrRjc5aU9zWU5yaWV4VUxXNEV0RlkyOExWa0t0aWhmM1ZuY1BtdVlyd0FzZGo2WnB0a0tkTndBb3B4WEM0dHpNM1BKZVZ3IiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIiBzdCUafGRpc3BsYXk6bm9uZSI-PC9kaXY-8gKaAQoMUE9TVF9TGm8JCIkBPClqNggBSYQIYWRzRqEMCC9wYSEkQC94YmZlX2JhY2tmaWxsLmpzAWUJSwA-DVMEPihZASAge3IzcHgoJzIi-wkcJyk7fSkoKTs96xDAEQoQSAGeNFBPUlRfUEFSQU1TEqsRHpkKipUA8JBhZGZldGNoP2Fkaz0yOTM4MjYwNTQyJmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTIxNy42NC4xNTEuNjkmb3V0cHV0PWh0bWwmdW52aWV3ZWRfcG9zaXRpb25fc3RhcnQ9MSZ1cmw9Ebw2VQsQJnN1Yl8NhwBiQY7wfXItMzA1NjQ0NyZobD1kZSZhY2VpZD1NSFlYdEFCWkdMUUFDUnUwQVBsVk5BR05ZVFFCSVdvMEFaRnROQUdDY0RRQlVYSTBBWVp5TkFHb2NqUUJ5SEkwQWFwek5BRmNkRFFCclhRMEFlaDBOQUVvZFRRQlMzVTBBVloxTkFGdQEQLGVuVTBBWHgxTkFHRQEQGG1YVTBBYXABEAB3ARAsdkhVMEFiMTFOQUhCARAAeQEgBGRkARAAbQEQADYBEARleAEQAHgBEAA5AVAAZgUgADkBEFhDM1kwQVF4Mk5BRU9kalFCSG5ZMEFTaAEQAHgBEPQOB3QyeEJBVXR6UVFGVGMwRUJ0QjFjQWlkQ3FnSW9RcW9DSzBLcUFyWkNxZ0w2UnFvQ2RFNnFBczFocWdMT2E2b0NDM09xQXA2SXFnS3VscW9DOTVxcUFvQ2JxZ0tCbTZvQ2dwdXFBdXlkcWdJZW9hb0N5YU9xQXJPa3FnS2lxS29DS3F5cUFxQ3pxZ0lTeDZvQ0tNMnFBc3ZOcWdJM3pxb0NuOUdxQXNiUnFnSWIxS29DcWRTcUFxblpxZ0xzMmFvQ21kMnFBa0xocWdLZjRhb0N5T0dxQW5faXFnSnI1S29Db09XcUFvem9xZ0k3NmFvQ3VlbXFBa0hycWdMeDY2b0NoLXlxQXZydHFnSmQ3cW9DNXZDcUFsX3hxZ0pNOHFvQ2FQS3FBcm55cWdKZzg2b0NqUFdxQXZQMXFnSTE5cW9DWGZhcUFvXzJxZ0k2LUtvQ2FQaXFBbno1cWdJMi1xb0NGX3VxQWliN3FnSXotNm9DUXZ1cUFxbjdxZ0lIX0tvQ0dQeXFBbGo4cWdJc19hb0NkdjJxQW43OXFnTHhfYW9DRGY2cUFpXy1xZ0pnX3FvQ2dfNnFBa3ZfcWdKRUFLc0NEd0dyQXNrQnF3S3BzOFVGS2czOUNOQ0dJd3JPZ2ZzU2lwdjdFa0N4LXhKYXNmc1MtOGY3RWhUSS14SlR5dnNTbmRIN0VsX1QteEtVMWZzUzF1SDdFdXZpLXhJTTRfc1MtT1g3RXNfbi14SUo2UHNTZmVuN0VsRHIteEx3Nl9zU2F1MzdFb0x2LXhLcDdfc1N5LV83RWwzeS14S0c4dnNTdnZMN0VnWDAteEs4OVBzU0tfWDdFalQyLXhKUTl2c1M5MVpyR3UxY3l5YXc4RmtveU11MUxyR1NRVGstU2ZwQyZleGs9MjEzMjcwNTQ5MCZhd2JpZF9jPUFLQW1mLURWemFmZGFONlNNamdIZ0FQeU53ZmVjN3UwODhBdTZnLWdkSXVrcjFIT0xldTE5LVpmRVBiUFRZVEZJUDFiQWhyb1prUjNsS0VvTGVMelk3WTdYblZMS1JIWHFsS2hMRHNvSm5Ta0wxU2haUXNyRFZDbHhPMTB3NTVOeGNKMEV2WC1HUmFMWWoyb3FHQXg2S2VFRTRRRHRmVENyZyZhd2JpZF9kPUFLQW1mLURwSzMtQVlfeFlGNjZ4M1JRVlQ0Y2huZGRnTXRnOWx2Vm9fOF91UW82WFQ4Z3dMSkZ6YzlpMU55Y0VDSVEyeUtPdm9UR1VudTgydnFIb1F5dGY5cS1WNnllZF81MkdrQ2JMdFplTUVGNU92VVhpLUR1cm1mMWhseG5zMnJXdkh5TzdGSE5Ya3RiaElVVXlHNDh6YzBPRDF3VUMwYjl5VDV6QkV5TWxhaGR1dDJiTFhBaUpWMHhOT09XNjJWRExoWkdXVFZjTHZDNVMzUWc0a0hPd0hobzQtaVRLM1NtdlJJQ0dzd2tPdk9tUF9kT0dDWWZ1R0o1Sk5yalNseXRmSmxYZHh1ejN2ZUJlM0ZPTE9DaW5WdXFTLVQyNGU3b1J2a1VJZGY3NFZkcy1xWmU4TkpzSk9RYlQ3Um82MU9SVWhQelhxejZwOExWYW8yQXQ1TzdfdWk2d2hwRW1MOGN2MEZUVVk4NXRwZi1xV3NLOVNpd0JXZUF4aFZhMnd6SUh5UUhRTnJBcWtsaHFaMnFfeFFVM1B2NjV5T1FfVXF2c19Yd2FMajdVOTdDNWpnQjdDUUtmOG8yNzBHYm5LUE1NMWlfZVNHb2NrLXc1bE9QMmN2WFA1emRkQjlicUN1TTBOVkRsWWVCNlc1VmF0SnpOc2cwaVpDUE14VUk5XzNwZTlqWGFUMFMwcGRfM3d1THVuWmJSVE8wSWZiWGNRYnFuVnlVNkxDdUR6U3BJNHBGOWtsMmpfc1Y4M2I2R0dJa2dvMVRpN2tvX3pxU29kQ0hGT0JvTmRiU0p6ckN4S0hPQk9TOGRtMTBDNzNJcUpRWlJ4Nk1BMEJZMktnZG5kX3pRUzg4enBXWncxeFA4NjVoUzZTd3FDZjc0VHpQOWhyNnZDbEpPcnVtMTl1b3VMZE9wbGNNbjRMa0M4aFg1VmszMm00ZTJ3NGNxM2ZZNmlld3BtWTRCZDJPcVY1MERBZHBuYnhYa1haUGhhRkhzUDFZSkhxemlCWkZWZ0RIN1RkOVBrVHQxTjlJT0tmUlhMbUlCWlg4dmlMVTRPSVNKcHhkZDNzWjZqVnNBUWVZMmRTYlhFM294Rl9peGNxQS1XOUtQMWkzUlFvdXcmY2lkPUNBQVNCT1JvcEZrJmFfY2lkPYADAIgDAZADAJgDGaADAaoD6QEKvwFodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9nZW5fMjBiXgrwvEN6SFNtR0RmQnlZNDVMd2lMZWxPNEpqSFB2ZmtRRHVOTkxHeUx6UUVCUHZESGlfTUEwVXpqVV8tTnlXQVJNTDlnVVFHaUFpMVNQY3FGVUk3OGp5QWx6NEhfZVlBJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEjM0NjMyMTA4Njk1NDM5NTExOSIINzcyMjE3OTMqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDTJGCZCoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEDnwXWIgFAZgFAKAFsLv8p52E_JV0wAUAyQUABQEU8D_SBQkJBQs4AAAA2AUB4AUB8AU0-gUEAVkokAYAmAYAuAYAwQYBHzQAAPA_0AbujwHaBhYKEAkSGQEBiIjgBgHyBgIIAIAHAYgHAKAHAaoHDDEyODc3ODk3OTEwNroHDwFYDbEsvgZAAMgHmdkF0gcNFYQBRwjaBwYJJ0TgBwDqBwIIAPAHw5sBiggCEAA.&s=225b77441d5d3243bf978b29138b1be5b0749ddf

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1648459922&bdh=oKPjZFrizbJAMJufgNbB5t3EfGA.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=1390330396&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsu_optXUvIElOU-JqIXd4wAdrafkz_EwvLKIFGbjqmRs3yEF3Pl-07UAqr0LhqF5n9PeWj4-zXsuB92k64mhrdXhAP0xdrj3e7kfoA1pNz1jcjEtY_HZ6OdfNT7NNsySxqRY3d7766KQtK3bcy8Q4dTDoRAGbGvB3Y4lG59VzilGRiOpA9KsRbWH3vBVlY_FMeh7WXbI6iqWhatMTee7b_kH5bTEuHun5RVKjgycE2F9zot0DiHzFskeTHpdejrVTg6CbY0tYSZq77ap0icww6ExudhGlHkQl7pLHdj-xdUuVEsc9UZHt9ad1QbP7cdh9Xca7BStJtTuoZPVQ%2526sai%253DAMfl-YSj52G40V9Gg70CnCbeWMep6vGC8yYIAyxJzuJrx22xxquWrNPffKcyZHtSsxpOn9GD-qqGPqws-w19msIh0hLH6a5YFuMUMvV8Gj_dksNOAXNRtlgXYjTP2CA7fq9U%2526sig%253DCg0ArKJSzLevH4XFhC4QEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

823d2b4d3f87e574cdd95c5f179fd2500c5ea00f6b647fcec96ad2b87eebba94

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/

Response headers

Server: nginx/1.21.3
Date: Mon, 28 Mar 2022 09:32:02 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
X-Creative-ID: 77221793
AN-X-Request-Uuid: 7e6387ac-7d7e-4993-ba7f-bc2e05a7c58e
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Encoding: gzip

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 0CF7 52 KB
17 KB 99ms
22ms Document
text/html 2.20.156.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141
Requested by: Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1648459922&bdh=oKPjZFrizbJAMJufgNbB5t3EfGA.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=1390330396&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsu_optXUvIElOU-JqIXd4wAdrafkz_EwvLKIFGbjqmRs3yEF3Pl-07UAqr0LhqF5n9PeWj4-zXsuB92k64mhrdXhAP0xdrj3e7kfoA1pNz1jcjEtY_HZ6OdfNT7NNsySxqRY3d7766KQtK3bcy8Q4dTDoRAGbGvB3Y4lG59VzilGRiOpA9KsRbWH3vBVlY_FMeh7WXbI6iqWhatMTee7b_kH5bTEuHun5RVKjgycE2F9zot0DiHzFskeTHpdejrVTg6CbY0tYSZq77ap0icww6ExudhGlHkQl7pLHdj-xdUuVEsc9UZHt9ad1QbP7cdh9Xca7BStJtTuoZPVQ%2526sai%253DAMfl-YSj52G40V9Gg70CnCbeWMep6vGC8yYIAyxJzuJrx22xxquWrNPffKcyZHtSsxpOn9GD-qqGPqws-w19msIh0hLH6a5YFuMUMvV8Gj_dksNOAXNRtlgXYjTP2CA7fq9U%2526sig%253DCg0ArKJSzLevH4XFhC4QEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.20.156.240 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-156-240.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/

Response headers

Server: nginx/1.18.0 (Ubuntu)
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
ETag: "623de86a-cf34"
Access-Control-Allow-Origin: *
Content-Type: text/html
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Tue, 29 Mar 2022 09:32:04 GMT
Date: Mon, 28 Mar 2022 09:32:02 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 609E 0
0 52ms
51ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvRImMfu2qAB5DVmAnqzbpr4a7C4bkY8L_hpFlGIxj83OKjukFUCvNc4w8nkKf-iiTBzBHn2fq0SEkyPx1wyeo6Gl5U8X7gkbyeBVSt-YdJHCAYGNGTpumBNo7X3rHbQsVcmDOv-9bwjKDKc6nIfY_bIW8Junl_GTjpxww-FNG1f4dtt8dhcpM2ifFiBa9aoQOHZONXmiUxRzVTtQRCVoHav_zp9OeW4vhrjuczMZQrhfGeYQPFkgcr1DmqSojwkt1PxQV8XmXFsvxWunXhWuAvN9-bZA95RDscg_cqAjWHIkNDBc28jV7op4yzjoIOeZxq7qQ0TTcnHmU1-CTSQc9n&sai=AMfl-YQZfgReeouH6m1h1-PdxGCBOlkovI_gPaoAwdMb20235PQGcvzIHnFjau_VnSgouQQsLqsCDN8Bv08milxZLVvcOSp_57nfXEfOBvRJKJr5hmtdk92oLjod3iQE7i7q&sig=Cg0ArKJSzGXaRjke_ljWEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 28 Mar 2022 09:32:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Mon, 28 Mar 2022 09:32:02 GMT

GET
DATA 200
OK truncated
/ Frame 609E 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e517e6d9b4cb99404e307bb8df5662ba2bc761f5fa9d7577951be28e63c71fa1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK if Show response
fra1-ib.adnxs.com/ Frame 05E8 10 KB
6 KB 56ms
11ms Document
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLnM_BM5xkAAAMA1gAFAQiSgYaSBhD_luTCr7nJhWUYifWg6PjYmd4SKjYJ0NA_wcWKej8RpkBmZ9E7dT8ZAAAAIIXrwT8hpkBmZ9E7dT8p0NAJJNAxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXjv1QWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGNBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0NgJEQUtBT2pzdEE0a3Zwb3FSejFkREFUTDZwaVN4Mng4WUJBZzN0RnFOU3dIMDMzZWk2Z29TeTAxa1ZSSHNoTUNDTW1iaDMtYnQ0UWZlX1JfQ0pDbHl3OFlxRkF6Z0g5a2hVR09fYll1RUpZM29EeVdBUjlTMkJMN3dLOUJoVW1ReFF0Y09OYlZGd3B3Z0tmN0oxOGU0ZVd6N3lmMGw3c05GemVkWUJWckkzQU9Uam95ZW42T3puWkRnVlAwcFRzOTRIMTF1WDJHa3c4VWFVU1haQkhaXzNPX0drMGdGMXRwWWlNR19peVBvSUhmellBZ20wa0FaSzQzWVlLZVhiZVlFQ2p0T1ZWMTFOeWwyUjktRHk1YURycHZUSUM0eWZOWDh2YjF3YmxZUmRsckNxb2k5VUZxZG9pN3dtbGdJbFh0N2lWWUdJYUVIRy1PcnFQMEN0JTI1MjZzYWklMjUzREFNZmwtWVR2Qi1nVzhoQzhLbm4zX1ViVUpYQ2cwZ0kxOE8tNXAxVjB4VENSMzJVM3Z5RWFGLU5HeWxzdHVEUHVzRnNVb2xQYVBIR3RWem1hQjdaNU5jUmJFSjk4d3pvWHZMZ0lkVEhWU29fNmg3M1Jra1RYakEzZGZCLUVCRlREQzNWcCUyNTI2c2lnJTI1M0RDZzBBcktKU3pFckNUa3R6V29wOUVBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTVCZ3dfZmJzYWVpZCUyNTVEJTI1MjZ1cmxmaXhFOwQxJQFbEGFkdXJsBRA08AEA2AIA4AKf8D_qAhZFm3w6Ly93aGVyZWdvZXMuY29tL_ICDAoGSEVJR0hUEgI5MAEP8O0FV0lEVEgSAzcyOPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMTcyNDY0Nzc1OPICnRAKC1BSRV9TQ1JJUFRTEo0QPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaD10aGlzfHxzZWxmOy8qCgogU1BEWC1MaWNlbnNlLUlkZW50Uj0ACGZ1bgWcYCBrKGIpe2tbIiAiXShiKTtyZXR1cm4gYn0JEwA9ESgQKCl7fTsRDYAgbCgpe3ZhciBiPWRvY3VtZW50LmN1cnJlbnRTY3JpcHQNR2goYj12b2lkIDA9PT1iP251bGw6YikmJiI3NyIBEmguZ2V0QXR0cmlidXRlKCJkYXRhLWpjIik_YjoVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEEF0nKX07AYcobj1SZWdFeHAoIl5FBNg_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7ORUAcBXgAGgFYQxjPVtdBQkEZT0Bxgg7ZG8F_xhhPWI7dHJ5BQwsZDtpZihkPSEhYSYmASRQIT1hLmxvY2F0aW9uLmhyZWYpYjp7AS2QayhhLmZvbyk7ZD0hMDticmVhayBifWNhdGNoKG0pe31kPSExfQHWCGc9ZBkXAGcBFgxpZihnKXkAZj5eABA7ZT1hLjE2BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBmPWUsDctMYy5wdXNoKG5ldyBxKGZ8fCIiKSkF1RRiPWEucGEh1BmGAGIF__BAfX13aGlsZShiJiZhIT1iKTthPTA7Zm9yKGI9Yy5sZW5ndGgtMTthPD1iOysrYSljW2FdLmRlcHRoPWItYTthPWghKzkeAa41KjhhbmNlc3Rvck9yaWdpbnNuHAANawA9HXUAKQmGDDE7YjwRikw7KytiKWY9Y1tiXSxmLnVybHx8KAUILkIBOnYAFFtiLQoxXSEMGCxmLmg9ITAB4ykiAGgZqyHVFCwhMSk7ZiUWJQIEZT0yBAEgMDw9ZTstLWUpIbpEPWNbZV0sIWYmJm4udGVzdChnAY8gKSYmKGY9ZyksBQ4oJiYhZy5oKXthPWdJGwB9DV0AZRXmBCYmAcwBOwQ7MEFlAGQhWggmJmUFSAEbCCk7YwWtEHIoYSxmddIUYy5nP2MuBWUMOmMuaQFAAH110DByKGIsYyl7dGhpcy5pQdUBCQhnPWMZIgBxHSIIdXJsESQUaD0hIWM7BS8FiCUKnSkAdHVJeHAoKSxjPWIuaW5kZXhPZigiPyIpO3NldFRpbWVvdXQuLQVB_QBlmToYZT8uMDE6ZUE1RCEoTWF0aC5yYW5kb20oKT5lKWkPDGE9bCghpAAiZf80Oi8vIisoYSYmInRydWWBawBhVmsEaC1yY2QiKT8icGFnZWFkMi5nb29nbGVzeW5kaWm5IC1jbi5jb20iOmYjAAUgDCkrIi8JRXgvZ2VuXzIwND9pZD1qY2EmamM9NzcmdmVyc2lvbj0ihUUMZD0oZAGxDCkmJmRamQANMTAiKXx8InVua25vd24iYeNcK2QrIiZzYW1wbGU9IitlO2E9d2luZG93IR00ZD1hLm5hdmlnYXRvcikyDgBQLnVzZXJBZ2VudCxkPS9DaHJvbWUvSYUgZCkmJiEvRWRnGREcPyEwOiExO2RhfRVRLC5zZW5kQmVhY29uPx1oHRcYKGUpOgooYS1GQF9pbWFnZV9yZXF1ZXN0c3x8XhoAED1bXSksAa6RvgQsZDn8BGQ_ERY8OmQsZD1kLmNyZWF0ZUVsZcF1PCgiaW1nIiksZC5zcmM9ZSxafACJ4hhkKSl9fSwwdRFcMDw9Yz9iLnN1YnN0cmluZygwLGMpOmJ9KVEMLnJmbC79Bu0YgGVuY29kZVVSSUNvbXBvbmVudCh0KCkpfTt9KS5jYWxsKGELECk7CjwvGgUIaPICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eSHDDHBvc2nBImQ6IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcA0KZHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcgAftV-EmFSsoCQacNHi6jAhRhd2JpZCYFBvCGX2I9QUtBbWYtQUJzOUNTd01fQ2RoT0E3em5nMDRvX0JhcHVYMEFtMHlaZHY2RUxDZDlDaEpoOGNIZWRMZk1lQkxQa0l6THhBdzFMV2Y1TENETERlMjd2VDFmWG5tR0FucUpJcEEiIGJvcmRlcj0wIHdpZHRoPTEgaGVpZ2h0PTEgYWx0PSIiMRqAZGlzcGxheTpub25lIj48L2Rpdj7yApoBCgxQT1NUX1NDFm8JCIkBPClqNggBacoMYWRzLkKaDDEGPHhiZmVfYmFja2ZpbGwuanMBZQlLAD4NUwA-nZUgIHtyM3B4KCcxIvsJHCcpO30pKCk7PesQ9RMKEEgBnjRQT1JUX1BBUkFNUxLgE5GVipUA8HlhZGZldGNoP2Fkaz0xODMyNDk0MTEzJmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD03Mjh4OTBfYXMmaXA9MjE3LjY0LjE1MS42OSZvdXRwdXQ9aHRtbCZ1bnZpZXdlZA72CkWLIF9zdGFydD0xJqHnEbs2UwsQJnN1Yl8NhgBiQY3w_XItMzA1NjQ0NyZobD1kZSZhY2VpZD1NSFVYdEFCMkY3UUFjeHUwQUREVTVnRDVWVFFCWmxvMEFYUmxOQUhrYmpRQmduQTBBWnh4TkFGUmNqUUJxSEkwQWNoeU5BRTFjelFCY0hNMEFhcHpOQUd0ZERRQjZIUTBBU2gxTkFGTGRUUUJWblUwQVc1MU5BRjZkVFFCZkhVMEFZUjFOQUdaZFRRQnFuVTBBYkIxTkFHOGRUUUJ2WFUwQWNGMU5BSEpkVFFCMTNVMEFlWjFOQUhwZFRRQjdIVTBBZkYxTkFIMmRUUUI5M1UwQWYxMU5BRUxkalFCREhZMEFRNTJOQUVlARD0wgJLSFkwQVRGMk5BRzNiRUVCUzNOQkFWTnpRUUd6SFZ3Q0toNWNBaWo1aUFJblFxb0NLRUtxQWlsQ3FnSUFTcW9DRzFHcUFzNWhxZ0otWXFvQ19uaXFBcGw2cWdMLWY2b0N0WXFxQWhpTnFnS0FtNm9DZ1p1cUFvS2JxZ0xKbzZvQ3M2U3FBcUtvcWdJc3JLb0NxckNxQXNleXFnS2VzNm9DcU1TcUFpak5xZ0o4emFvQ245R3FBdEhWcWdLRzFxb0NkZHFxQWtyZHFnTEgzNm9Dbi1HcUFzbmlxZ0kwNDZvQ1hlV3FBcURscWdLNTZhb0NQdXFxQWtEcnFnS043S29DLXUycUFyM3ZxZ0xxOEtvQ0ZfR3FBdGZ4cWdKSjhxb0NtUEtxQXJueXFnSmk4Nm9DR2ZTcUFwZjBxZ0xsOUtvQ1RmV3FBcHoxcWdLMTlhb0N1ZldxQXZyMXFnTDk5YW9DMWZhcUFndjRxZ0k2LUtvQ2JQaXFBb1A0cWdLci1xb0NKdnVxQWtIN3FnS1ctNm9DbV91cUFnYjhxZ0pKX0tvQ1dQeXFBbXo4cWdLeF9Lb0N1UHlxQWg3OXFnSWlfYW9Da2YycUFyNzlxZ0lyX3FvQ1lQNnFBb1AtcWdMNl82b0NOZ0NyQWdRQnF3SmtOMkVFVkxMRkJYY0gtUWo2UXR3SjBZWWpDbVJGVFE3QzJLRU96YUUxRVRpVi14S2pvUHNTYWFQN0V0S3IteElyclBzU0ljWDdFZ2JKLXhKZ3l2c1NjTXo3RWlQYi14SUY3ZnNTX3UzN0VqcngteEtjOHZzU3N2TDdFcl95LXhJUzlQc1NydlQ3RXRIMC14SXQ5ZnNTNV9YN0VqMzIteEpLOXZzU2JSYjNGX2hXYXhxR3ZQOGpxTHpfSS11MXZXayZleGs9MTcyNDY0Nzc1OCZhd2JpZF9jPan-8LBDVFFJTXdYSDlqSmNVeEtIN251R2dIVzRHRXMxTUVWdHNjMkthamZ1U2Y5MGVodjZPbFdNUG1hSHBzMGo0SWFTcVJ4RUpjcHVkVWVoVU5ad0RNeDZTaDZJeVlrMWpFd0c0aWptUk40WmxqSDZVdlpBekhQd1daSDhfZXJmT2dJMmNibzB2d3dvQ0lfaDNBYzJZdHNNV3N1NW1TUjAwbm5PVUlLVGM2SzZaNjFtamxHTlHNvgBkzb70kAREdDBZU1VyRkRXUTdZSHlyeGQ1N1dMYWxyOEFoUkNra01RWms2SExCNDRiWTBCb2tzbVlVQ3RLbHgtN296ZzlaVjh4bDE4SElGXzJBUFUwVllscFpJZlZmZjFxN1BGOE5fR3JVemd1dWR6clJrWFFDc2dpZzIybGxmOGFRYmlLRHUxQTE5SEVsS3RpdENMRWpsSGY4c1liYUZKVEZYZGVxNFlRc2I1YnJWNU1kMk5waU5ib1V5RTR6ZHVMUVRUdUVXR29SSGU5U1ZPSDhienlhelBUZjA4VkhxSWFibUN4bU40aXNLWkNUa2NuYWoxRjBfeE5OZWlxWHBMYzgwNEFfOENKMVkyV3ZId2VHM3l1YWR2bFV2bnpzaXQ2dkljbk1mMUZjOGlfNmpURTlXcV9VZTFlQnNMZWhIa0oyRDdscElBV1hsUk5fNEYzXzZxdVBkc051bWhsTXd4djdpaVRmRVFVTXlfQ3dXd1d6SmIycDZQSi1TOTFYX1o2dGtvWHhEQTZWWTFnNkVrZmNQVU1WcURTSnotTnV1TzJKVGoxbXI3TldjUFRXQ0JIV1F6eGQtN2Jyc2xkaERvQXllZ0tsWjBiTi1RSkhRb09HYjhqRmZQTlQzNzB5ZUlRNEUtUHM4azE2eDN2RElmUDRDRFhXZ3hWSWZGSTIxODBQWFAwV3VSeTFxUDU5UFY2bklSbFQ4WUJybzVSS0tKMDRSVVBxeVRVRGVrODc3YVJCOUpHZWxOemVzTy1QcnJMN2hXY3RTd0hGa1dqTUJwVFkyZzE5OXFjTHhCc1FsWGhaVjFMb1hETjVpSHM1X2hpS0FPNURFWkstZGpwOTVIMGhzTEszOFdmSUdVeGF4RExnTGU4VWhiVWxoMkNjSzYwdTlEOEtDYUVrSFFQWmtzMG1iMGRoVkxZU2E5TWZqUWxoZXBMa24zUFFIV0lYZHY2S0hqRWdOeFJMNHFISTJHOUNqR0R1Y1ZsRk1mcGpnRXZNN1J5OWtKblV2dk5vTTR2WlRwX01vd3lBdk9LVXp0eWVIUTh5X2E4WF9SNVZNNy10ZUZYX2cwWkpfbTJVcU82QVF0MTRNenFKbnpnSkNidkcxMGZZeHhJSmJHZzR3Z1FZTG1NVDJKYTF5Wm84a0Rpd0JNbHpubllpbzBWcjd6Tms4MjNMWXg4dnZkb1ZldUhYLW1rQ2ZQSzY5NjBrenp0V2JCV1FNTG5vRWNma0g4MU1jQmlWUjFIS1oyajNzdGhicWFTZEp2cUplOXRLZklqX2VTNnAyQUQ0bFhxRkdRdUdqemRWV2s1Yk16RUlvenVVYTdTcGdCeEhUbzRzaG5JZUVHVlZUQW5BUWl4czVnRng1dzFkbkVDT1JQUWlYNS1jSE5ERGY0UnJlRTJfY05mMmpNVWpFOUR0RjdEcHVBdXJUWFpsclJ5ZU5BYzM2NEhsYlhTRHZPWDV0UEI4TXJDb0Y3ZFlTMGRXNkFhNV92QkEmY2lkPUNBQVNCT1JvZDZrJmFfY2lkPYADAIgDAZADAJgDGaADAaoD6gEKvwFodHRwczovL_6TCxKTC_RTATNtZlFqZlUxQkxHdkVNd20waGk0VkNIWVVpSTF2REJjSUhDTXY4Y3Y4QmRUdEpaY1BlbHpyUWpLVWstUi1kRU9iRHp2Tkx3alJiVGdwOTNJU2g0a0c2RlM0dWcmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTNzI4MDk1NDc3NjI1NDc0NTQ3MSIINzg4Mjc4MTUqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDTIxNy42NC4xNTEuNjmoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEp6LLJYgFAZgFAKAF0MqSwuKA8ocgwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFysYF-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBu6PAdoGFgoQAAAAAAAAAAAFPAQAAAWKiOAGAfIGAggAgAcBiAcAoAcBqgcMMTM0NDcwOTYwNDcyugcPAVhMGAAgADAAOL4GQADIB-_VBdIHDQkBQwEBGBAAGADaBwYJJ0TgBwDqBwIIAPAHw5sBiggCEAA.&s=9be069b0af1cf39328b9a0056c3e049a5f425288

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1648459922&bdh=oKPjZFrizbJAMJufgNbB5t3EfGA.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=1268430417&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjstA4kvpoqRz1dDATL6piSx2x8YBAg3tFqNSwH033ei6goSy01kVRHshMCCMmbh3-bt4Qfe_R_CJClyw8YqFAzgH9khUGO_bYuEJY3oDyWAR9S2BL7wK9BhUmQxQtcONbVFwpwgKf7J18e4eWz7yf0l7sNFzedYBVrI3AOTjoyen6OznZDgVP0pTs94H11uX2Gkw8UaUSXZBHZ_3O_Gk0gF1tpYiMG_iyPoIHfzYAgm0kAZK43YYKeXbeYECjtOVV11Nyl2R9-Dy5aDrpvTIC4yfNX8vb1wblYRdlrCqoi9UFqdoi7wmlgIlXt7iVYGIaEHG-OrqP0Ct%2526sai%253DAMfl-YTvB-gW8hC8Knn3_UbUJXCg0gI18O-5p1V0xTCR32U3vyEaF-NGylstuDPusFsUolPaPHGtVzmaB7Z5NcRbEJ98wzoXvLgIdTHVSo_6h73RkkTXjA3dfB-EBFTDC3Vp%2526sig%253DCg0ArKJSzErCTktzWop9EAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

b9b9cf92c450c76e73eda45510deb24779b9d755bd933cd37987a360a352dada

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/

Response headers

Server: nginx/1.21.3
Date: Mon, 28 Mar 2022 09:32:02 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
X-Creative-ID: 78827815
AN-X-Request-Uuid: b5e6edd4-7a6f-41b0-bb40-8c72e06cff7d
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Encoding: gzip

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame F3C4 52 KB
17 KB 77ms
22ms Document
text/html 2.20.156.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141
Requested by: Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1648459922&bdh=oKPjZFrizbJAMJufgNbB5t3EfGA.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=1268430417&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjstA4kvpoqRz1dDATL6piSx2x8YBAg3tFqNSwH033ei6goSy01kVRHshMCCMmbh3-bt4Qfe_R_CJClyw8YqFAzgH9khUGO_bYuEJY3oDyWAR9S2BL7wK9BhUmQxQtcONbVFwpwgKf7J18e4eWz7yf0l7sNFzedYBVrI3AOTjoyen6OznZDgVP0pTs94H11uX2Gkw8UaUSXZBHZ_3O_Gk0gF1tpYiMG_iyPoIHfzYAgm0kAZK43YYKeXbeYECjtOVV11Nyl2R9-Dy5aDrpvTIC4yfNX8vb1wblYRdlrCqoi9UFqdoi7wmlgIlXt7iVYGIaEHG-OrqP0Ct%2526sai%253DAMfl-YTvB-gW8hC8Knn3_UbUJXCg0gI18O-5p1V0xTCR32U3vyEaF-NGylstuDPusFsUolPaPHGtVzmaB7Z5NcRbEJ98wzoXvLgIdTHVSo_6h73RkkTXjA3dfB-EBFTDC3Vp%2526sig%253DCg0ArKJSzErCTktzWop9EAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.20.156.240 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-156-240.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/

Response headers

Server: nginx/1.18.0 (Ubuntu)
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
ETag: "623de86a-cf34"
Access-Control-Allow-Origin: *
Content-Type: text/html
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Tue, 29 Mar 2022 09:32:04 GMT
Date: Mon, 28 Mar 2022 09:32:02 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 322E 0
0 47ms
46ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss8WoOyo6d21nCP8Ji3aHHTbve9WtmA2ysxGcLALVprMZGBSX55uF66EdyS3_dadldZocW6zQY801TYTpQgUanlM0aeW8fAfA090AvYB2EnkNR04prh_o_RbPKquC1X1KI2Hzh_GKc5O3Rlri2bsM6vPxcTE7o4N-ZkuwVjatTVdXUopZKqFQZE80r-3UDEFzninKhCFOTnR_pjv3in8-Fz4nepT5_DsjQ5WqkT8aSAeEMlLRVxFx14T8QXsh62kGvj4o8CdrTMfr7SGUsxVH7BIaSzZ8oa_Xe4L0ygBtXbPXO7MVwYfU2XYR5RBw8V6ePc0nzVkfGgQkwgYRQ&sai=AMfl-YQ6wi-aQ2kvDyQ5jwp8ji8ldt8bNuiMo83U-NqEUprJPqfKR_GL2XDm5lMsjkK9Oc94mnlUoiLldNzS2Rutx15vFfHDSMzcbTICCthurf2x12Gn3DNxdLglf6tV48vy&sig=Cg0ArKJSzLKpFrLhY4cHEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 28 Mar 2022 09:32:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Mon, 28 Mar 2022 09:32:02 GMT

GET
DATA 200
OK truncated
/ Frame 322E 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9ec67963f81671bbe20d4bc0cfdb71f2dbed292329fc889c802c9ecc51d98429

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0E29 0
20 B 40ms
39ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-D6zmVU3S4Nfftd9xSn0cE4kF79iOsYNriexULW4EtFY28LVkKtihf3VncPmuYrwAsdj6ZptkKdNwAopxXC4tzM3PJeVw

Requested by

Host: fra1-ib.adnxs.com
URL: https://fra1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QK3MfBMtxgAAAMA1gAFAQiSgYaSBhDvq5OxmaaY5wQYtc_676ij5KNNKjYJQkKUL2ghkT8RatCGsqZoiz8ZAAAAQDMzwz8hatCGsqZoiz8pQkIJJAAxARu44XqEPzDjgvQIOMpBQOUeSGVQoZ_pJFiY1VJgAGjr3JoBeJnZBYABAYoBA1VTRJIFBvTEAZgBrAKgAfoBqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGTBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3Vfb3B0WFV2SUVsT1UtSnFJWGQ0d0FkcmFma3pfRXd2TEtJRkdianFtUnMzeUVGM1BsLTA3VUFxcjBMaHFGNW45UGVXajQtelhzdUI5Mms2NG1ocmRYaEFQMHhkcmozZTdrZm9BMXBOejFqY2pFdFlfSFo2T2RmTlQ3Tk5zeVN4cVJZM2Q3NzY2S1F0SzNiY3k4UTRkVERvUkFHYkd2QjNZNGxHNTlWemlsR1JpT3BBOUtzUmJXSDN2QlZsWV9GTWVoN1dYYkk2aXFXaGF0TVRlZTdiX2tINWJURXVIdW41UlZLamd5Y0UyRjl6b3QwRGlIekZza2VUSHBkZWpyVlRnNkNiWTB0WVNacTc3YXAwaWN3dzZFeHVkaEdsSGtRbDdwTEhkai14ZFV1VkVzYzlVWkh0OWFkMVFiUDdjZGg5WGNhN0JTdEp0VHVvWlBWUSUyNTI2c2FpJSVj8ItNZmwtWVNqNTJHNDBWOUdnNzBDbkNiZVdNZXA2dkdDOHlZSUF5eEp6dUpyeDIyeHhxdVdyTlBmZktjeVpIdFNzeHBPbjlHRC1xcUdQcXdzLXcxOW1zSWgwaExINmE1WUZ1TVVNdlY4R2pfZGtzTk9BWE5SdGxnWFlqVFAyQ0E3ZnE5VSUyNTI2c2lnJQGRkENnMEFyS0pTekxldkg0WEZoQzRRRUFFJTI1MjZmYnNfYWVpZCUBKSglMjU1Qmd3X2Zicw0UADUBFBwyNnVybGZpeEFJBEQxBTcQYWR1cmwFEDjwAQDYAgDgAp_wP-oCFmhBofT9BzovL3doZXJlZ29lcy5jb20v8gINCgZIRUlHSFQSAzI1MPICDAoFV0lEVEgSAzMwMPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMjEzMjcwNTQ5MPICnRAKC1BSRV9TQ1JJUFRTEo0QPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaD10aGlzfHxzZWxmOy8qCgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KZnVuY3Rpb24gayhiKXtrWyIgIl0oYik7cmV0dXJuIGJ9a1siICJdPWZ1bmN0aW9uKCl7fTtmdW5jdGlvbiBsKCl7dmFyIGI9ZG9jdW1lbnQuY3VycmVudFNjcmlwdDtyZXR1cm4oYj12b2lkIDA9PT1iP251bGw6YikmJiI3NyI9PT1iLmdldEF0dHJpYnV0ZSgiZGF0YS1qYyIpP2I6ZG9jdW1lbnQucXVlcnlTZWxlY3RvcignW2RhdGEtamM9Ijc3Il0nKX07dmFyIG49UmVnRXhwKCJeaHR0cHM_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7CmZ1bmN0aW9uIHAoKXt2YXIgYj1oO3ZhciBjPVtdO3ZhciBlPW51bGw7ZG97dmFyIGE9Yjt0cnl7dmFyIGQ7aWYoZD0hIWEmJm51bGwhPWEubG9jYXRpb24uaHJlZiliOnt0cnl7ayhhLmZvbyk7ZD0hMDticmVhayBifWNhdGNoKG0pe31kPSExfXZhciBnPWR9Y2F0Y2gobSl7Zz0hMX1pZihnKXt2YXIgZj1hLmxvY2F0aW9uLmhyZWY7ZT1hLmRvY3VtZW50JiZhLmRvY3VtZW50LnJlZmVycmVyfHxudWxsfWVsc2UgZj1lLGU9bnVsbDtjLnB1c2gobmV3IHEoZnx8IiIpKTt0cnl7Yj1hLnBhcmVudH1jYXRjaChtKXtiPW51bGx9fXdoaWxlKGImJmEhPWIpO2E9MDtmb3IoYj1jLmxlbmd0aC0xO2E8PWI7KythKWNbYV0uZGVwdGg9Yi1hO2E9aDtpZihhLmxvY2F0aW9uJiZhLmxvY2F0aW9uLmFuY2VzdG9yT3JpZ2lucyYmYS5sb2NhdGlvbi5hbmNlc3Rvck9yaWdpbnMubGVuZ3RoPT1jLmxlbmd0aC0xKWZvcihiPTE7YjxjLmxlbmd0aDsrK2IpZj1jW2JdLGYudXJsfHwoZi51cmw9YS5sb2NhdGlvbi5hbmNlc3Rvck9yaWdpbnNbYi0KMV18fCIiLGYuaD0hMCk7YT1uZXcgcShoLmxvY2F0aW9uLmhyZWYsITEpO2Y9bnVsbDtmb3IoZT1iPWMubGVuZ3RoLTE7MDw9ZTstLWUpaWYoZz1jW2VdLCFmJiZuLnRlc3QoZy51cmwpJiYoZj1nKSxnLnVybCYmIWcuaCl7YT1nO2JyZWFrfWY9bnVsbDtlPWMubGVuZ3RoJiZjW2JdLnVybDswIT1hLmRlcHRoJiZlJiYoZj1jW2JdKTtjPW5ldyByKGEsZik7cmV0dXJuIGMuZz9jLmcudXJsOmMuaS51cmx9ZnVuY3Rpb24gcihiLGMpe3RoaXMuaT1iO3RoaXMuZz1jfWZ1bmN0aW9uIHEoYixjKXt0aGlzLnVybD1iO3RoaXMuaD0hIWM7dGhpcy5kZXB0aD1udWxsfTtmdW5jdGlvbiB0KCl7dmFyIGI9cCgpLGM9Yi5pbmRleE9mKCI_Iik7c2V0VGltZW91dChmdW5jdGlvbigpe3ZhciBlPXZvaWQgMD09PWU_LjAxOmU7aWYoIShNYXRoLnJhbmRvbSgpPmUpKXt2YXIgYT1sKCk7YT0iaHR0cHM6Ly8iKyhhJiYidHJ1ZSI9PT1hLmdldEF0dHJpYnV0ZSgiZGF0YS1qYy1yY2QiKT8icGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi1jbi5jb20iOiJwYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbSIpKyIvcGFnZWFkL2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249Ijt2YXIgZD0oZD1sKCkpJiZkLmdldEF0dHJpYnV0ZSgiZGF0YS1qYy12ZXJzaW9uIil8fCJ1bmtub3duIjtlPWErZCsiJnNhbXBsZT0iK2U7YT13aW5kb3c7aWYoZD1hLm5hdmlnYXRvcilkPWEubmF2aWdhdG9yLnVzZXJBZ2VudCxkPS9DaHJvbWUvLnRlc3QoZCkmJiEvRWRnZS8udGVzdChkKT8hMDohMTtkJiZhLm5hdmlnYXRvci5zZW5kQmVhY29uP2EubmF2aWdhdG9yLnNlbmRCZWFjb24oZSk6CihhLmdvb2dsZV9pbWFnZV9yZXF1ZXN0c3x8KGEuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzPVtdKSxkPWEuZG9jdW1lbnQsZD12b2lkIDA9PT1kP2RvY3VtZW50OmQsZD1kLmNyZWF0ZUVsZW1lbnQoImltZyIpLGQuc3JjPWUsYS3CcF9pbWFnZV9yZXF1ZXN0cy5wdXNoKGQpKX19LDAp0eOIMDw9Yz9iLnN1YnN0cmluZygwLGMpOmJ9d2luZG93LnJmbD39wchyZXR1cm4gZW5jb2RlVVJJQ29tcG9uZW50KHQoKSl9O30pLmNhbGwodGhpcyk7Cjwvc2PhCfQ0AT7yAskCCgpFWFRSQV9UQUdTEroCPGRpdiBzdHlsZT0icG9zaXRpb246IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcDogMHB4OyB2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIHNyYz0iaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCZhd2JpZF9iPUFLQW1mLUQ2em1WVTNTNE5mZnRkOXhTbjBjRTRrRjc5aU9zWU5yaWV4VUxXNEV0RlkyOExWa0t0aWhmM1ZuY1BtdVlyd0FzZGo2WnB0a0tkTndBb3B4WEM0dHpNM1BKZVZ3IiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIiBzdCUafGRpc3BsYXk6bm9uZSI-PC9kaXY-8gKaAQoMUE9TVF9TGm8JCIkBPClqNggBSYQIYWRzRqEMCC9wYSEkQC94YmZlX2JhY2tmaWxsLmpzAWUJSwA-DVMEPihZASAge3IzcHgoJzIi-wkcJyk7fSkoKTs96xDAEQoQSAGeNFBPUlRfUEFSQU1TEqsRHpkKipUA8JBhZGZldGNoP2Fkaz0yOTM4MjYwNTQyJmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTIxNy42NC4xNTEuNjkmb3V0cHV0PWh0bWwmdW52aWV3ZWRfcG9zaXRpb25fc3RhcnQ9MSZ1cmw9Ebw2VQsQJnN1Yl8NhwBiQY7wfXItMzA1NjQ0NyZobD1kZSZhY2VpZD1NSFlYdEFCWkdMUUFDUnUwQVBsVk5BR05ZVFFCSVdvMEFaRnROQUdDY0RRQlVYSTBBWVp5TkFHb2NqUUJ5SEkwQWFwek5BRmNkRFFCclhRMEFlaDBOQUVvZFRRQlMzVTBBVloxTkFGdQEQLGVuVTBBWHgxTkFHRQEQGG1YVTBBYXABEAB3ARAsdkhVMEFiMTFOQUhCARAAeQEgBGRkARAAbQEQADYBEARleAEQAHgBEAA5AVAAZgUgADkBEFhDM1kwQVF4Mk5BRU9kalFCSG5ZMEFTaAEQAHgBEPQOB3QyeEJBVXR6UVFGVGMwRUJ0QjFjQWlkQ3FnSW9RcW9DSzBLcUFyWkNxZ0w2UnFvQ2RFNnFBczFocWdMT2E2b0NDM09xQXA2SXFnS3VscW9DOTVxcUFvQ2JxZ0tCbTZvQ2dwdXFBdXlkcWdJZW9hb0N5YU9xQXJPa3FnS2lxS29DS3F5cUFxQ3pxZ0lTeDZvQ0tNMnFBc3ZOcWdJM3pxb0NuOUdxQXNiUnFnSWIxS29DcWRTcUFxblpxZ0xzMmFvQ21kMnFBa0xocWdLZjRhb0N5T0dxQW5faXFnSnI1S29Db09XcUFvem9xZ0k3NmFvQ3VlbXFBa0hycWdMeDY2b0NoLXlxQXZydHFnSmQ3cW9DNXZDcUFsX3hxZ0pNOHFvQ2FQS3FBcm55cWdKZzg2b0NqUFdxQXZQMXFnSTE5cW9DWGZhcUFvXzJxZ0k2LUtvQ2FQaXFBbno1cWdJMi1xb0NGX3VxQWliN3FnSXotNm9DUXZ1cUFxbjdxZ0lIX0tvQ0dQeXFBbGo4cWdJc19hb0NkdjJxQW43OXFnTHhfYW9DRGY2cUFpXy1xZ0pnX3FvQ2dfNnFBa3ZfcWdKRUFLc0NEd0dyQXNrQnF3S3BzOFVGS2czOUNOQ0dJd3JPZ2ZzU2lwdjdFa0N4LXhKYXNmc1MtOGY3RWhUSS14SlR5dnNTbmRIN0VsX1QteEtVMWZzUzF1SDdFdXZpLXhJTTRfc1MtT1g3RXNfbi14SUo2UHNTZmVuN0VsRHIteEx3Nl9zU2F1MzdFb0x2LXhLcDdfc1N5LV83RWwzeS14S0c4dnNTdnZMN0VnWDAteEs4OVBzU0tfWDdFalQyLXhKUTl2c1M5MVpyR3UxY3l5YXc4RmtveU11MUxyR1NRVGstU2ZwQyZleGs9MjEzMjcwNTQ5MCZhd2JpZF9jPUFLQW1mLURWemFmZGFONlNNamdIZ0FQeU53ZmVjN3UwODhBdTZnLWdkSXVrcjFIT0xldTE5LVpmRVBiUFRZVEZJUDFiQWhyb1prUjNsS0VvTGVMelk3WTdYblZMS1JIWHFsS2hMRHNvSm5Ta0wxU2haUXNyRFZDbHhPMTB3NTVOeGNKMEV2WC1HUmFMWWoyb3FHQXg2S2VFRTRRRHRmVENyZyZhd2JpZF9kPUFLQW1mLURwSzMtQVlfeFlGNjZ4M1JRVlQ0Y2huZGRnTXRnOWx2Vm9fOF91UW82WFQ4Z3dMSkZ6YzlpMU55Y0VDSVEyeUtPdm9UR1VudTgydnFIb1F5dGY5cS1WNnllZF81MkdrQ2JMdFplTUVGNU92VVhpLUR1cm1mMWhseG5zMnJXdkh5TzdGSE5Ya3RiaElVVXlHNDh6YzBPRDF3VUMwYjl5VDV6QkV5TWxhaGR1dDJiTFhBaUpWMHhOT09XNjJWRExoWkdXVFZjTHZDNVMzUWc0a0hPd0hobzQtaVRLM1NtdlJJQ0dzd2tPdk9tUF9kT0dDWWZ1R0o1Sk5yalNseXRmSmxYZHh1ejN2ZUJlM0ZPTE9DaW5WdXFTLVQyNGU3b1J2a1VJZGY3NFZkcy1xWmU4TkpzSk9RYlQ3Um82MU9SVWhQelhxejZwOExWYW8yQXQ1TzdfdWk2d2hwRW1MOGN2MEZUVVk4NXRwZi1xV3NLOVNpd0JXZUF4aFZhMnd6SUh5UUhRTnJBcWtsaHFaMnFfeFFVM1B2NjV5T1FfVXF2c19Yd2FMajdVOTdDNWpnQjdDUUtmOG8yNzBHYm5LUE1NMWlfZVNHb2NrLXc1bE9QMmN2WFA1emRkQjlicUN1TTBOVkRsWWVCNlc1VmF0SnpOc2cwaVpDUE14VUk5XzNwZTlqWGFUMFMwcGRfM3d1THVuWmJSVE8wSWZiWGNRYnFuVnlVNkxDdUR6U3BJNHBGOWtsMmpfc1Y4M2I2R0dJa2dvMVRpN2tvX3pxU29kQ0hGT0JvTmRiU0p6ckN4S0hPQk9TOGRtMTBDNzNJcUpRWlJ4Nk1BMEJZMktnZG5kX3pRUzg4enBXWncxeFA4NjVoUzZTd3FDZjc0VHpQOWhyNnZDbEpPcnVtMTl1b3VMZE9wbGNNbjRMa0M4aFg1VmszMm00ZTJ3NGNxM2ZZNmlld3BtWTRCZDJPcVY1MERBZHBuYnhYa1haUGhhRkhzUDFZSkhxemlCWkZWZ0RIN1RkOVBrVHQxTjlJT0tmUlhMbUlCWlg4dmlMVTRPSVNKcHhkZDNzWjZqVnNBUWVZMmRTYlhFM294Rl9peGNxQS1XOUtQMWkzUlFvdXcmY2lkPUNBQVNCT1JvcEZrJmFfY2lkPYADAIgDAZADAJgDGaADAaoD6QEKvwFodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9nZW5fMjBiXgrwvEN6SFNtR0RmQnlZNDVMd2lMZWxPNEpqSFB2ZmtRRHVOTkxHeUx6UUVCUHZESGlfTUEwVXpqVV8tTnlXQVJNTDlnVVFHaUFpMVNQY3FGVUk3OGp5QWx6NEhfZVlBJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEjM0NjMyMTA4Njk1NDM5NTExOSIINzcyMjE3OTMqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDTJGCZCoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEDnwXWIgFAZgFAKAFsLv8p52E_JV0wAUAyQUABQEU8D_SBQkJBQs4AAAA2AUB4AUB8AU0-gUEAVkokAYAmAYAuAYAwQYBHzQAAPA_0AbujwHaBhYKEAkSGQEBiIjgBgHyBgIIAIAHAYgHAKAHAaoHDDEyODc3ODk3OTEwNroHDwFYDbEsvgZAAMgHmdkF0gcNFYQBRwjaBwYJJ0TgBwDqBwIIAPAHw5sBiggCEAA.&s=225b77441d5d3243bf978b29138b1be5b0749ddf

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 0E29 12 KB
6 KB 37ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8996d7b9fba17a4ad4880bb154f6b56d33f9ff87ecf4f830bc0488cdc1616f55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:24:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 482
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5307
x-xss-protection: 0
server: cafe
etag: 5818309846818389003
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 28 Mar 2022 10:24:00 GMT

GET
H/1.1 200
OK it
fra1-ib.adnxs.com/ Frame 0E29 0
815 B 8ms
7ms Image
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fra1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKJC_BMiQUAAAMA1gAFAQiSgYaSBhDvq5OxmaaY5wQYtc_676ij5KNNKjYJQkKUL2ghkT8RatCGsqZoiz8ZAAAAQDMzwz8hatCGsqZoiz8pQkIJJAAxARu44XqEPzDjgvQIOMpBQOUeSGVQoZ_pJFiY1VJgAGjr3JoBeJnZBYABAYoBA1VTRJIFBvTEAZgBrAKgAfoBqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGTBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3Vfb3B0WFV2SUVsT1UtSnFJWGQ0d0FkcmFma3pfRXd2TEtJRkdianFtUnMzeUVGM1BsLTA3VUFxcjBMaHFGNW45UGVXajQtelhzdUI5Mms2NG1ocmRYaEFQMHhkcmozZTdrZm9BMXBOejFqY2pFdFlfSFo2T2RmTlQ3Tk5zeVN4cVJZM2Q3NzY2S1F0SzNiY3k4UTRkVERvUkFHYkd2QjNZNGxHNTlWemlsR1JpT3BBOUtzUmJXSDN2QlZsWV9GTWVoN1dYYkk2aXFXaGF0TVRlZTdiX2tINWJURXVIdW41UlZLamd5Y0UyRjl6b3QwRGlIekZza2VUSHBkZWpyVlRnNkNiWTB0WVNacTc3YXAwaWN3dzZFeHVkaEdsSGtRbDdwTEhkai14ZFV1VkVzYzlVWkh0OWFkMVFiUDdjZGg5WGNhN0JTdEp0VHVvWlBWUSUyNTI2c2FpJSVj8NdNZmwtWVNqNTJHNDBWOUdnNzBDbkNiZVdNZXA2dkdDOHlZSUF5eEp6dUpyeDIyeHhxdVdyTlBmZktjeVpIdFNzeHBPbjlHRC1xcUdQcXdzLXcxOW1zSWgwaExINmE1WUZ1TVVNdlY4R2pfZGtzTk9BWE5SdGxnWFlqVFAyQ0E3ZnE5VSUyNTI2c2lnJTI1M0RDZzBBcktKU3pMZXZINFhGaEM0UUVBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTVCZ3dfZmJzYWVpZCUyNTVEJTI1MjZ1cmxmaXhBSSxEMSUyNTI2YWR1cmwFEDjwAQDYAgDgAp_wP-oCFmhBoZg6Ly93aGVyZWdvZXMuY29tL4ADAIgDAZADAJgDGaADAaoD6QEKvwERLGBwYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uBTwJHkQvZ2VuXzIwND9pZD1hd2JpZCYFBvRTAV9iPUFLQW1mLUN6SFNtR0RmQnlZNDVMd2lMZWxPNEpqSFB2ZmtRRHVOTkxHeUx6UUVCUHZESGlfTUEwVXpqVV8tTnlXQVJNTDlnVVFHaUFpMVNQY3FGVUk3OGp5QWx6NEhfZVlBJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEjM0NjMyMTA4Njk1NDM5NTExOSIINzcyMjE3OTMqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDTIxNy42NC4xNTEuNjmoBACyBAwIABAAGAAgADAAOAK4BADABADIBADaBAIIAeAEAPAEoZ_pJIgFAZgFAKAFsLv8p52E_JV0wAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFNPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAFMxkBoBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEyODc3ODk3OTEwNroHDwgAASkFsTC-BkAAyAeZ2QXSBw0JEUkYEAAYANoHBgknROAHAOoHAggA8AfDmwGKCAIQAA..&s=e7edb8a6c172e22e712834515e47f4df971f042f

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:02 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 576e2dab-8d5e-45fe-8f13-6336002d271a
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/224/ Frame 0E29 85 KB
29 KB 55ms
8ms Script
application/x-javascript 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/224/trk.js
Requested by: Host: fra1-ib.adnxs.com
URL: https://fra1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QK3MfBMtxgAAAMA1gAFAQiSgYaSBhDvq5OxmaaY5wQYtc_676ij5KNNKjYJQkKUL2ghkT8RatCGsqZoiz8ZAAAAQDMzwz8hatCGsqZoiz8pQkIJJAAxARu44XqEPzDjgvQIOMpBQOUeSGVQoZ_pJFiY1VJgAGjr3JoBeJnZBYABAYoBA1VTRJIFBvTEAZgBrAKgAfoBqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGTBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3Vfb3B0WFV2SUVsT1UtSnFJWGQ0d0FkcmFma3pfRXd2TEtJRkdianFtUnMzeUVGM1BsLTA3VUFxcjBMaHFGNW45UGVXajQtelhzdUI5Mms2NG1ocmRYaEFQMHhkcmozZTdrZm9BMXBOejFqY2pFdFlfSFo2T2RmTlQ3Tk5zeVN4cVJZM2Q3NzY2S1F0SzNiY3k4UTRkVERvUkFHYkd2QjNZNGxHNTlWemlsR1JpT3BBOUtzUmJXSDN2QlZsWV9GTWVoN1dYYkk2aXFXaGF0TVRlZTdiX2tINWJURXVIdW41UlZLamd5Y0UyRjl6b3QwRGlIekZza2VUSHBkZWpyVlRnNkNiWTB0WVNacTc3YXAwaWN3dzZFeHVkaEdsSGtRbDdwTEhkai14ZFV1VkVzYzlVWkh0OWFkMVFiUDdjZGg5WGNhN0JTdEp0VHVvWlBWUSUyNTI2c2FpJSVj8ItNZmwtWVNqNTJHNDBWOUdnNzBDbkNiZVdNZXA2dkdDOHlZSUF5eEp6dUpyeDIyeHhxdVdyTlBmZktjeVpIdFNzeHBPbjlHRC1xcUdQcXdzLXcxOW1zSWgwaExINmE1WUZ1TVVNdlY4R2pfZGtzTk9BWE5SdGxnWFlqVFAyQ0E3ZnE5VSUyNTI2c2lnJQGRkENnMEFyS0pTekxldkg0WEZoQzRRRUFFJTI1MjZmYnNfYWVpZCUBKSglMjU1Qmd3X2Zicw0UADUBFBwyNnVybGZpeEFJBEQxBTcQYWR1cmwFEDjwAQDYAgDgAp_wP-oCFmhBofT9BzovL3doZXJlZ29lcy5jb20v8gINCgZIRUlHSFQSAzI1MPICDAoFV0lEVEgSAzMwMPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMjEzMjcwNTQ5MPICnRAKC1BSRV9TQ1JJUFRTEo0QPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaD10aGlzfHxzZWxmOy8qCgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KZnVuY3Rpb24gayhiKXtrWyIgIl0oYik7cmV0dXJuIGJ9a1siICJdPWZ1bmN0aW9uKCl7fTtmdW5jdGlvbiBsKCl7dmFyIGI9ZG9jdW1lbnQuY3VycmVudFNjcmlwdDtyZXR1cm4oYj12b2lkIDA9PT1iP251bGw6YikmJiI3NyI9PT1iLmdldEF0dHJpYnV0ZSgiZGF0YS1qYyIpP2I6ZG9jdW1lbnQucXVlcnlTZWxlY3RvcignW2RhdGEtamM9Ijc3Il0nKX07dmFyIG49UmVnRXhwKCJeaHR0cHM_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7CmZ1bmN0aW9uIHAoKXt2YXIgYj1oO3ZhciBjPVtdO3ZhciBlPW51bGw7ZG97dmFyIGE9Yjt0cnl7dmFyIGQ7aWYoZD0hIWEmJm51bGwhPWEubG9jYXRpb24uaHJlZiliOnt0cnl7ayhhLmZvbyk7ZD0hMDticmVhayBifWNhdGNoKG0pe31kPSExfXZhciBnPWR9Y2F0Y2gobSl7Zz0hMX1pZihnKXt2YXIgZj1hLmxvY2F0aW9uLmhyZWY7ZT1hLmRvY3VtZW50JiZhLmRvY3VtZW50LnJlZmVycmVyfHxudWxsfWVsc2UgZj1lLGU9bnVsbDtjLnB1c2gobmV3IHEoZnx8IiIpKTt0cnl7Yj1hLnBhcmVudH1jYXRjaChtKXtiPW51bGx9fXdoaWxlKGImJmEhPWIpO2E9MDtmb3IoYj1jLmxlbmd0aC0xO2E8PWI7KythKWNbYV0uZGVwdGg9Yi1hO2E9aDtpZihhLmxvY2F0aW9uJiZhLmxvY2F0aW9uLmFuY2VzdG9yT3JpZ2lucyYmYS5sb2NhdGlvbi5hbmNlc3Rvck9yaWdpbnMubGVuZ3RoPT1jLmxlbmd0aC0xKWZvcihiPTE7YjxjLmxlbmd0aDsrK2IpZj1jW2JdLGYudXJsfHwoZi51cmw9YS5sb2NhdGlvbi5hbmNlc3Rvck9yaWdpbnNbYi0KMV18fCIiLGYuaD0hMCk7YT1uZXcgcShoLmxvY2F0aW9uLmhyZWYsITEpO2Y9bnVsbDtmb3IoZT1iPWMubGVuZ3RoLTE7MDw9ZTstLWUpaWYoZz1jW2VdLCFmJiZuLnRlc3QoZy51cmwpJiYoZj1nKSxnLnVybCYmIWcuaCl7YT1nO2JyZWFrfWY9bnVsbDtlPWMubGVuZ3RoJiZjW2JdLnVybDswIT1hLmRlcHRoJiZlJiYoZj1jW2JdKTtjPW5ldyByKGEsZik7cmV0dXJuIGMuZz9jLmcudXJsOmMuaS51cmx9ZnVuY3Rpb24gcihiLGMpe3RoaXMuaT1iO3RoaXMuZz1jfWZ1bmN0aW9uIHEoYixjKXt0aGlzLnVybD1iO3RoaXMuaD0hIWM7dGhpcy5kZXB0aD1udWxsfTtmdW5jdGlvbiB0KCl7dmFyIGI9cCgpLGM9Yi5pbmRleE9mKCI_Iik7c2V0VGltZW91dChmdW5jdGlvbigpe3ZhciBlPXZvaWQgMD09PWU_LjAxOmU7aWYoIShNYXRoLnJhbmRvbSgpPmUpKXt2YXIgYT1sKCk7YT0iaHR0cHM6Ly8iKyhhJiYidHJ1ZSI9PT1hLmdldEF0dHJpYnV0ZSgiZGF0YS1qYy1yY2QiKT8icGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi1jbi5jb20iOiJwYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbSIpKyIvcGFnZWFkL2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249Ijt2YXIgZD0oZD1sKCkpJiZkLmdldEF0dHJpYnV0ZSgiZGF0YS1qYy12ZXJzaW9uIil8fCJ1bmtub3duIjtlPWErZCsiJnNhbXBsZT0iK2U7YT13aW5kb3c7aWYoZD1hLm5hdmlnYXRvcilkPWEubmF2aWdhdG9yLnVzZXJBZ2VudCxkPS9DaHJvbWUvLnRlc3QoZCkmJiEvRWRnZS8udGVzdChkKT8hMDohMTtkJiZhLm5hdmlnYXRvci5zZW5kQmVhY29uP2EubmF2aWdhdG9yLnNlbmRCZWFjb24oZSk6CihhLmdvb2dsZV9pbWFnZV9yZXF1ZXN0c3x8KGEuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzPVtdKSxkPWEuZG9jdW1lbnQsZD12b2lkIDA9PT1kP2RvY3VtZW50OmQsZD1kLmNyZWF0ZUVsZW1lbnQoImltZyIpLGQuc3JjPWUsYS3CcF9pbWFnZV9yZXF1ZXN0cy5wdXNoKGQpKX19LDAp0eOIMDw9Yz9iLnN1YnN0cmluZygwLGMpOmJ9d2luZG93LnJmbD39wchyZXR1cm4gZW5jb2RlVVJJQ29tcG9uZW50KHQoKSl9O30pLmNhbGwodGhpcyk7Cjwvc2PhCfQ0AT7yAskCCgpFWFRSQV9UQUdTEroCPGRpdiBzdHlsZT0icG9zaXRpb246IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcDogMHB4OyB2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIHNyYz0iaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCZhd2JpZF9iPUFLQW1mLUQ2em1WVTNTNE5mZnRkOXhTbjBjRTRrRjc5aU9zWU5yaWV4VUxXNEV0RlkyOExWa0t0aWhmM1ZuY1BtdVlyd0FzZGo2WnB0a0tkTndBb3B4WEM0dHpNM1BKZVZ3IiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIiBzdCUafGRpc3BsYXk6bm9uZSI-PC9kaXY-8gKaAQoMUE9TVF9TGm8JCIkBPClqNggBSYQIYWRzRqEMCC9wYSEkQC94YmZlX2JhY2tmaWxsLmpzAWUJSwA-DVMEPihZASAge3IzcHgoJzIi-wkcJyk7fSkoKTs96xDAEQoQSAGeNFBPUlRfUEFSQU1TEqsRHpkKipUA8JBhZGZldGNoP2Fkaz0yOTM4MjYwNTQyJmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTIxNy42NC4xNTEuNjkmb3V0cHV0PWh0bWwmdW52aWV3ZWRfcG9zaXRpb25fc3RhcnQ9MSZ1cmw9Ebw2VQsQJnN1Yl8NhwBiQY7wfXItMzA1NjQ0NyZobD1kZSZhY2VpZD1NSFlYdEFCWkdMUUFDUnUwQVBsVk5BR05ZVFFCSVdvMEFaRnROQUdDY0RRQlVYSTBBWVp5TkFHb2NqUUJ5SEkwQWFwek5BRmNkRFFCclhRMEFlaDBOQUVvZFRRQlMzVTBBVloxTkFGdQEQLGVuVTBBWHgxTkFHRQEQGG1YVTBBYXABEAB3ARAsdkhVMEFiMTFOQUhCARAAeQEgBGRkARAAbQEQADYBEARleAEQAHgBEAA5AVAAZgUgADkBEFhDM1kwQVF4Mk5BRU9kalFCSG5ZMEFTaAEQAHgBEPQOB3QyeEJBVXR6UVFGVGMwRUJ0QjFjQWlkQ3FnSW9RcW9DSzBLcUFyWkNxZ0w2UnFvQ2RFNnFBczFocWdMT2E2b0NDM09xQXA2SXFnS3VscW9DOTVxcUFvQ2JxZ0tCbTZvQ2dwdXFBdXlkcWdJZW9hb0N5YU9xQXJPa3FnS2lxS29DS3F5cUFxQ3pxZ0lTeDZvQ0tNMnFBc3ZOcWdJM3pxb0NuOUdxQXNiUnFnSWIxS29DcWRTcUFxblpxZ0xzMmFvQ21kMnFBa0xocWdLZjRhb0N5T0dxQW5faXFnSnI1S29Db09XcUFvem9xZ0k3NmFvQ3VlbXFBa0hycWdMeDY2b0NoLXlxQXZydHFnSmQ3cW9DNXZDcUFsX3hxZ0pNOHFvQ2FQS3FBcm55cWdKZzg2b0NqUFdxQXZQMXFnSTE5cW9DWGZhcUFvXzJxZ0k2LUtvQ2FQaXFBbno1cWdJMi1xb0NGX3VxQWliN3FnSXotNm9DUXZ1cUFxbjdxZ0lIX0tvQ0dQeXFBbGo4cWdJc19hb0NkdjJxQW43OXFnTHhfYW9DRGY2cUFpXy1xZ0pnX3FvQ2dfNnFBa3ZfcWdKRUFLc0NEd0dyQXNrQnF3S3BzOFVGS2czOUNOQ0dJd3JPZ2ZzU2lwdjdFa0N4LXhKYXNmc1MtOGY3RWhUSS14SlR5dnNTbmRIN0VsX1QteEtVMWZzUzF1SDdFdXZpLXhJTTRfc1MtT1g3RXNfbi14SUo2UHNTZmVuN0VsRHIteEx3Nl9zU2F1MzdFb0x2LXhLcDdfc1N5LV83RWwzeS14S0c4dnNTdnZMN0VnWDAteEs4OVBzU0tfWDdFalQyLXhKUTl2c1M5MVpyR3UxY3l5YXc4RmtveU11MUxyR1NRVGstU2ZwQyZleGs9MjEzMjcwNTQ5MCZhd2JpZF9jPUFLQW1mLURWemFmZGFONlNNamdIZ0FQeU53ZmVjN3UwODhBdTZnLWdkSXVrcjFIT0xldTE5LVpmRVBiUFRZVEZJUDFiQWhyb1prUjNsS0VvTGVMelk3WTdYblZMS1JIWHFsS2hMRHNvSm5Ta0wxU2haUXNyRFZDbHhPMTB3NTVOeGNKMEV2WC1HUmFMWWoyb3FHQXg2S2VFRTRRRHRmVENyZyZhd2JpZF9kPUFLQW1mLURwSzMtQVlfeFlGNjZ4M1JRVlQ0Y2huZGRnTXRnOWx2Vm9fOF91UW82WFQ4Z3dMSkZ6YzlpMU55Y0VDSVEyeUtPdm9UR1VudTgydnFIb1F5dGY5cS1WNnllZF81MkdrQ2JMdFplTUVGNU92VVhpLUR1cm1mMWhseG5zMnJXdkh5TzdGSE5Ya3RiaElVVXlHNDh6YzBPRDF3VUMwYjl5VDV6QkV5TWxhaGR1dDJiTFhBaUpWMHhOT09XNjJWRExoWkdXVFZjTHZDNVMzUWc0a0hPd0hobzQtaVRLM1NtdlJJQ0dzd2tPdk9tUF9kT0dDWWZ1R0o1Sk5yalNseXRmSmxYZHh1ejN2ZUJlM0ZPTE9DaW5WdXFTLVQyNGU3b1J2a1VJZGY3NFZkcy1xWmU4TkpzSk9RYlQ3Um82MU9SVWhQelhxejZwOExWYW8yQXQ1TzdfdWk2d2hwRW1MOGN2MEZUVVk4NXRwZi1xV3NLOVNpd0JXZUF4aFZhMnd6SUh5UUhRTnJBcWtsaHFaMnFfeFFVM1B2NjV5T1FfVXF2c19Yd2FMajdVOTdDNWpnQjdDUUtmOG8yNzBHYm5LUE1NMWlfZVNHb2NrLXc1bE9QMmN2WFA1emRkQjlicUN1TTBOVkRsWWVCNlc1VmF0SnpOc2cwaVpDUE14VUk5XzNwZTlqWGFUMFMwcGRfM3d1THVuWmJSVE8wSWZiWGNRYnFuVnlVNkxDdUR6U3BJNHBGOWtsMmpfc1Y4M2I2R0dJa2dvMVRpN2tvX3pxU29kQ0hGT0JvTmRiU0p6ckN4S0hPQk9TOGRtMTBDNzNJcUpRWlJ4Nk1BMEJZMktnZG5kX3pRUzg4enBXWncxeFA4NjVoUzZTd3FDZjc0VHpQOWhyNnZDbEpPcnVtMTl1b3VMZE9wbGNNbjRMa0M4aFg1VmszMm00ZTJ3NGNxM2ZZNmlld3BtWTRCZDJPcVY1MERBZHBuYnhYa1haUGhhRkhzUDFZSkhxemlCWkZWZ0RIN1RkOVBrVHQxTjlJT0tmUlhMbUlCWlg4dmlMVTRPSVNKcHhkZDNzWjZqVnNBUWVZMmRTYlhFM294Rl9peGNxQS1XOUtQMWkzUlFvdXcmY2lkPUNBQVNCT1JvcEZrJmFfY2lkPYADAIgDAZADAJgDGaADAaoD6QEKvwFodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9nZW5fMjBiXgrwvEN6SFNtR0RmQnlZNDVMd2lMZWxPNEpqSFB2ZmtRRHVOTkxHeUx6UUVCUHZESGlfTUEwVXpqVV8tTnlXQVJNTDlnVVFHaUFpMVNQY3FGVUk3OGp5QWx6NEhfZVlBJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEjM0NjMyMTA4Njk1NDM5NTExOSIINzcyMjE3OTMqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDTJGCZCoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEDnwXWIgFAZgFAKAFsLv8p52E_JV0wAUAyQUABQEU8D_SBQkJBQs4AAAA2AUB4AUB8AU0-gUEAVkokAYAmAYAuAYAwQYBHzQAAPA_0AbujwHaBhYKEAkSGQEBiIjgBgHyBgIIAIAHAYgHAKAHAaoHDDEyODc3ODk3OTEwNroHDwFYDbEsvgZAAMgHmdkF0gcNFYQBRwjaBwYJJ0TgBwDqBwIIAPAHw5sBiggCEAA.&s=225b77441d5d3243bf978b29138b1be5b0749ddf
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c652cb3dcc3b49133285c42c49b296c3a3af4f9fceffde1022a6e3539e2422b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date: Mon, 28 Mar 2022 09:32:02 GMT
Content-Encoding: gzip
Age: 2766812
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 29216
X-Served-By: cache-lga21944-LGA, cache-hhn4027-HHN
Access-Control-Allow-Origin: *, *
Last-Modified: Thu, 24 Feb 2022 08:58:20 GMT
Server: AkamaiNetStorage
X-Timer: S1648459923.584053,VS0,VE0
ETag: "80cd3e09497c9fa4207d756c9d41697c:1645693100.060631"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Via: 1.1 varnish, 1.1 varnish
Expires: Fri, 24 Feb 2023 08:58:29 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 48360, 1259311

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 05E8 0
20 B 40ms
40ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-ABs9CSwM_CdhOA7zng04o_BapuX0Am0yZdv6ELCd9ChJh8cHedLfMeBLPkIzLxAw1LWf5LCDLDe27vT1fXnmGAnqJIpA

Requested by

Host: fra1-ib.adnxs.com
URL: https://fra1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLnM_BM5xkAAAMA1gAFAQiSgYaSBhD_luTCr7nJhWUYifWg6PjYmd4SKjYJ0NA_wcWKej8RpkBmZ9E7dT8ZAAAAIIXrwT8hpkBmZ9E7dT8p0NAJJNAxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXjv1QWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGNBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0NgJEQUtBT2pzdEE0a3Zwb3FSejFkREFUTDZwaVN4Mng4WUJBZzN0RnFOU3dIMDMzZWk2Z29TeTAxa1ZSSHNoTUNDTW1iaDMtYnQ0UWZlX1JfQ0pDbHl3OFlxRkF6Z0g5a2hVR09fYll1RUpZM29EeVdBUjlTMkJMN3dLOUJoVW1ReFF0Y09OYlZGd3B3Z0tmN0oxOGU0ZVd6N3lmMGw3c05GemVkWUJWckkzQU9Uam95ZW42T3puWkRnVlAwcFRzOTRIMTF1WDJHa3c4VWFVU1haQkhaXzNPX0drMGdGMXRwWWlNR19peVBvSUhmellBZ20wa0FaSzQzWVlLZVhiZVlFQ2p0T1ZWMTFOeWwyUjktRHk1YURycHZUSUM0eWZOWDh2YjF3YmxZUmRsckNxb2k5VUZxZG9pN3dtbGdJbFh0N2lWWUdJYUVIRy1PcnFQMEN0JTI1MjZzYWklMjUzREFNZmwtWVR2Qi1nVzhoQzhLbm4zX1ViVUpYQ2cwZ0kxOE8tNXAxVjB4VENSMzJVM3Z5RWFGLU5HeWxzdHVEUHVzRnNVb2xQYVBIR3RWem1hQjdaNU5jUmJFSjk4d3pvWHZMZ0lkVEhWU29fNmg3M1Jra1RYakEzZGZCLUVCRlREQzNWcCUyNTI2c2lnJTI1M0RDZzBBcktKU3pFckNUa3R6V29wOUVBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTVCZ3dfZmJzYWVpZCUyNTVEJTI1MjZ1cmxmaXhFOwQxJQFbEGFkdXJsBRA08AEA2AIA4AKf8D_qAhZFm3w6Ly93aGVyZWdvZXMuY29tL_ICDAoGSEVJR0hUEgI5MAEP8O0FV0lEVEgSAzcyOPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMTcyNDY0Nzc1OPICnRAKC1BSRV9TQ1JJUFRTEo0QPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaD10aGlzfHxzZWxmOy8qCgogU1BEWC1MaWNlbnNlLUlkZW50Uj0ACGZ1bgWcYCBrKGIpe2tbIiAiXShiKTtyZXR1cm4gYn0JEwA9ESgQKCl7fTsRDYAgbCgpe3ZhciBiPWRvY3VtZW50LmN1cnJlbnRTY3JpcHQNR2goYj12b2lkIDA9PT1iP251bGw6YikmJiI3NyIBEmguZ2V0QXR0cmlidXRlKCJkYXRhLWpjIik_YjoVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEEF0nKX07AYcobj1SZWdFeHAoIl5FBNg_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7ORUAcBXgAGgFYQxjPVtdBQkEZT0Bxgg7ZG8F_xhhPWI7dHJ5BQwsZDtpZihkPSEhYSYmASRQIT1hLmxvY2F0aW9uLmhyZWYpYjp7AS2QayhhLmZvbyk7ZD0hMDticmVhayBifWNhdGNoKG0pe31kPSExfQHWCGc9ZBkXAGcBFgxpZihnKXkAZj5eABA7ZT1hLjE2BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBmPWUsDctMYy5wdXNoKG5ldyBxKGZ8fCIiKSkF1RRiPWEucGEh1BmGAGIF__BAfX13aGlsZShiJiZhIT1iKTthPTA7Zm9yKGI9Yy5sZW5ndGgtMTthPD1iOysrYSljW2FdLmRlcHRoPWItYTthPWghKzkeAa41KjhhbmNlc3Rvck9yaWdpbnNuHAANawA9HXUAKQmGDDE7YjwRikw7KytiKWY9Y1tiXSxmLnVybHx8KAUILkIBOnYAFFtiLQoxXSEMGCxmLmg9ITAB4ykiAGgZqyHVFCwhMSk7ZiUWJQIEZT0yBAEgMDw9ZTstLWUpIbpEPWNbZV0sIWYmJm4udGVzdChnAY8gKSYmKGY9ZyksBQ4oJiYhZy5oKXthPWdJGwB9DV0AZRXmBCYmAcwBOwQ7MEFlAGQhWggmJmUFSAEbCCk7YwWtEHIoYSxmddIUYy5nP2MuBWUMOmMuaQFAAH110DByKGIsYyl7dGhpcy5pQdUBCQhnPWMZIgBxHSIIdXJsESQUaD0hIWM7BS8FiCUKnSkAdHVJeHAoKSxjPWIuaW5kZXhPZigiPyIpO3NldFRpbWVvdXQuLQVB_QBlmToYZT8uMDE6ZUE1RCEoTWF0aC5yYW5kb20oKT5lKWkPDGE9bCghpAAiZf80Oi8vIisoYSYmInRydWWBawBhVmsEaC1yY2QiKT8icGFnZWFkMi5nb29nbGVzeW5kaWm5IC1jbi5jb20iOmYjAAUgDCkrIi8JRXgvZ2VuXzIwND9pZD1qY2EmamM9NzcmdmVyc2lvbj0ihUUMZD0oZAGxDCkmJmRamQANMTAiKXx8InVua25vd24iYeNcK2QrIiZzYW1wbGU9IitlO2E9d2luZG93IR00ZD1hLm5hdmlnYXRvcikyDgBQLnVzZXJBZ2VudCxkPS9DaHJvbWUvSYUgZCkmJiEvRWRnGREcPyEwOiExO2RhfRVRLC5zZW5kQmVhY29uPx1oHRcYKGUpOgooYS1GQF9pbWFnZV9yZXF1ZXN0c3x8XhoAED1bXSksAa6RvgQsZDn8BGQ_ERY8OmQsZD1kLmNyZWF0ZUVsZcF1PCgiaW1nIiksZC5zcmM9ZSxafACJ4hhkKSl9fSwwdRFcMDw9Yz9iLnN1YnN0cmluZygwLGMpOmJ9KVEMLnJmbC79Bu0YgGVuY29kZVVSSUNvbXBvbmVudCh0KCkpfTt9KS5jYWxsKGELECk7CjwvGgUIaPICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eSHDDHBvc2nBImQ6IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcA0KZHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcgAftV-EmFSsoCQacNHi6jAhRhd2JpZCYFBvCGX2I9QUtBbWYtQUJzOUNTd01fQ2RoT0E3em5nMDRvX0JhcHVYMEFtMHlaZHY2RUxDZDlDaEpoOGNIZWRMZk1lQkxQa0l6THhBdzFMV2Y1TENETERlMjd2VDFmWG5tR0FucUpJcEEiIGJvcmRlcj0wIHdpZHRoPTEgaGVpZ2h0PTEgYWx0PSIiMRqAZGlzcGxheTpub25lIj48L2Rpdj7yApoBCgxQT1NUX1NDFm8JCIkBPClqNggBacoMYWRzLkKaDDEGPHhiZmVfYmFja2ZpbGwuanMBZQlLAD4NUwA-nZUgIHtyM3B4KCcxIvsJHCcpO30pKCk7PesQ9RMKEEgBnjRQT1JUX1BBUkFNUxLgE5GVipUA8HlhZGZldGNoP2Fkaz0xODMyNDk0MTEzJmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD03Mjh4OTBfYXMmaXA9MjE3LjY0LjE1MS42OSZvdXRwdXQ9aHRtbCZ1bnZpZXdlZA72CkWLIF9zdGFydD0xJqHnEbs2UwsQJnN1Yl8NhgBiQY3w_XItMzA1NjQ0NyZobD1kZSZhY2VpZD1NSFVYdEFCMkY3UUFjeHUwQUREVTVnRDVWVFFCWmxvMEFYUmxOQUhrYmpRQmduQTBBWnh4TkFGUmNqUUJxSEkwQWNoeU5BRTFjelFCY0hNMEFhcHpOQUd0ZERRQjZIUTBBU2gxTkFGTGRUUUJWblUwQVc1MU5BRjZkVFFCZkhVMEFZUjFOQUdaZFRRQnFuVTBBYkIxTkFHOGRUUUJ2WFUwQWNGMU5BSEpkVFFCMTNVMEFlWjFOQUhwZFRRQjdIVTBBZkYxTkFIMmRUUUI5M1UwQWYxMU5BRUxkalFCREhZMEFRNTJOQUVlARD0wgJLSFkwQVRGMk5BRzNiRUVCUzNOQkFWTnpRUUd6SFZ3Q0toNWNBaWo1aUFJblFxb0NLRUtxQWlsQ3FnSUFTcW9DRzFHcUFzNWhxZ0otWXFvQ19uaXFBcGw2cWdMLWY2b0N0WXFxQWhpTnFnS0FtNm9DZ1p1cUFvS2JxZ0xKbzZvQ3M2U3FBcUtvcWdJc3JLb0NxckNxQXNleXFnS2VzNm9DcU1TcUFpak5xZ0o4emFvQ245R3FBdEhWcWdLRzFxb0NkZHFxQWtyZHFnTEgzNm9Dbi1HcUFzbmlxZ0kwNDZvQ1hlV3FBcURscWdLNTZhb0NQdXFxQWtEcnFnS043S29DLXUycUFyM3ZxZ0xxOEtvQ0ZfR3FBdGZ4cWdKSjhxb0NtUEtxQXJueXFnSmk4Nm9DR2ZTcUFwZjBxZ0xsOUtvQ1RmV3FBcHoxcWdLMTlhb0N1ZldxQXZyMXFnTDk5YW9DMWZhcUFndjRxZ0k2LUtvQ2JQaXFBb1A0cWdLci1xb0NKdnVxQWtIN3FnS1ctNm9DbV91cUFnYjhxZ0pKX0tvQ1dQeXFBbXo4cWdLeF9Lb0N1UHlxQWg3OXFnSWlfYW9Da2YycUFyNzlxZ0lyX3FvQ1lQNnFBb1AtcWdMNl82b0NOZ0NyQWdRQnF3SmtOMkVFVkxMRkJYY0gtUWo2UXR3SjBZWWpDbVJGVFE3QzJLRU96YUUxRVRpVi14S2pvUHNTYWFQN0V0S3IteElyclBzU0ljWDdFZ2JKLXhKZ3l2c1NjTXo3RWlQYi14SUY3ZnNTX3UzN0VqcngteEtjOHZzU3N2TDdFcl95LXhJUzlQc1NydlQ3RXRIMC14SXQ5ZnNTNV9YN0VqMzIteEpLOXZzU2JSYjNGX2hXYXhxR3ZQOGpxTHpfSS11MXZXayZleGs9MTcyNDY0Nzc1OCZhd2JpZF9jPan-8LBDVFFJTXdYSDlqSmNVeEtIN251R2dIVzRHRXMxTUVWdHNjMkthamZ1U2Y5MGVodjZPbFdNUG1hSHBzMGo0SWFTcVJ4RUpjcHVkVWVoVU5ad0RNeDZTaDZJeVlrMWpFd0c0aWptUk40WmxqSDZVdlpBekhQd1daSDhfZXJmT2dJMmNibzB2d3dvQ0lfaDNBYzJZdHNNV3N1NW1TUjAwbm5PVUlLVGM2SzZaNjFtamxHTlHNvgBkzb70kAREdDBZU1VyRkRXUTdZSHlyeGQ1N1dMYWxyOEFoUkNra01RWms2SExCNDRiWTBCb2tzbVlVQ3RLbHgtN296ZzlaVjh4bDE4SElGXzJBUFUwVllscFpJZlZmZjFxN1BGOE5fR3JVemd1dWR6clJrWFFDc2dpZzIybGxmOGFRYmlLRHUxQTE5SEVsS3RpdENMRWpsSGY4c1liYUZKVEZYZGVxNFlRc2I1YnJWNU1kMk5waU5ib1V5RTR6ZHVMUVRUdUVXR29SSGU5U1ZPSDhienlhelBUZjA4VkhxSWFibUN4bU40aXNLWkNUa2NuYWoxRjBfeE5OZWlxWHBMYzgwNEFfOENKMVkyV3ZId2VHM3l1YWR2bFV2bnpzaXQ2dkljbk1mMUZjOGlfNmpURTlXcV9VZTFlQnNMZWhIa0oyRDdscElBV1hsUk5fNEYzXzZxdVBkc051bWhsTXd4djdpaVRmRVFVTXlfQ3dXd1d6SmIycDZQSi1TOTFYX1o2dGtvWHhEQTZWWTFnNkVrZmNQVU1WcURTSnotTnV1TzJKVGoxbXI3TldjUFRXQ0JIV1F6eGQtN2Jyc2xkaERvQXllZ0tsWjBiTi1RSkhRb09HYjhqRmZQTlQzNzB5ZUlRNEUtUHM4azE2eDN2RElmUDRDRFhXZ3hWSWZGSTIxODBQWFAwV3VSeTFxUDU5UFY2bklSbFQ4WUJybzVSS0tKMDRSVVBxeVRVRGVrODc3YVJCOUpHZWxOemVzTy1QcnJMN2hXY3RTd0hGa1dqTUJwVFkyZzE5OXFjTHhCc1FsWGhaVjFMb1hETjVpSHM1X2hpS0FPNURFWkstZGpwOTVIMGhzTEszOFdmSUdVeGF4RExnTGU4VWhiVWxoMkNjSzYwdTlEOEtDYUVrSFFQWmtzMG1iMGRoVkxZU2E5TWZqUWxoZXBMa24zUFFIV0lYZHY2S0hqRWdOeFJMNHFISTJHOUNqR0R1Y1ZsRk1mcGpnRXZNN1J5OWtKblV2dk5vTTR2WlRwX01vd3lBdk9LVXp0eWVIUTh5X2E4WF9SNVZNNy10ZUZYX2cwWkpfbTJVcU82QVF0MTRNenFKbnpnSkNidkcxMGZZeHhJSmJHZzR3Z1FZTG1NVDJKYTF5Wm84a0Rpd0JNbHpubllpbzBWcjd6Tms4MjNMWXg4dnZkb1ZldUhYLW1rQ2ZQSzY5NjBrenp0V2JCV1FNTG5vRWNma0g4MU1jQmlWUjFIS1oyajNzdGhicWFTZEp2cUplOXRLZklqX2VTNnAyQUQ0bFhxRkdRdUdqemRWV2s1Yk16RUlvenVVYTdTcGdCeEhUbzRzaG5JZUVHVlZUQW5BUWl4czVnRng1dzFkbkVDT1JQUWlYNS1jSE5ERGY0UnJlRTJfY05mMmpNVWpFOUR0RjdEcHVBdXJUWFpsclJ5ZU5BYzM2NEhsYlhTRHZPWDV0UEI4TXJDb0Y3ZFlTMGRXNkFhNV92QkEmY2lkPUNBQVNCT1JvZDZrJmFfY2lkPYADAIgDAZADAJgDGaADAaoD6gEKvwFodHRwczovL_6TCxKTC_RTATNtZlFqZlUxQkxHdkVNd20waGk0VkNIWVVpSTF2REJjSUhDTXY4Y3Y4QmRUdEpaY1BlbHpyUWpLVWstUi1kRU9iRHp2Tkx3alJiVGdwOTNJU2g0a0c2RlM0dWcmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTNzI4MDk1NDc3NjI1NDc0NTQ3MSIINzg4Mjc4MTUqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDTIxNy42NC4xNTEuNjmoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEp6LLJYgFAZgFAKAF0MqSwuKA8ocgwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFysYF-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBu6PAdoGFgoQAAAAAAAAAAAFPAQAAAWKiOAGAfIGAggAgAcBiAcAoAcBqgcMMTM0NDcwOTYwNDcyugcPAVhMGAAgADAAOL4GQADIB-_VBdIHDQkBQwEBGBAAGADaBwYJJ0TgBwDqBwIIAPAHw5sBiggCEAA.&s=9be069b0af1cf39328b9a0056c3e049a5f425288

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 05E8 12 KB
5 KB 35ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8996d7b9fba17a4ad4880bb154f6b56d33f9ff87ecf4f830bc0488cdc1616f55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:24:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 482
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5307
x-xss-protection: 0
server: cafe
etag: 5818309846818389003
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 28 Mar 2022 10:24:00 GMT

GET
H/1.1 200
OK it
fra1-ib.adnxs.com/ Frame 05E8 0
815 B 20ms
20ms Image
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fra1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKFC_BMhQUAAAMA1gAFAQiSgYaSBhD_luTCr7nJhWUYifWg6PjYmd4SKjYJz9A_wcWKej8RpkBmZ9E7dT8ZAAAAIIXrwT8hpkBmZ9E7dT8p0NAJJNAxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXjv1QWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGNBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0NgJEQUtBT2pzdEE0a3Zwb3FSejFkREFUTDZwaVN4Mng4WUJBZzN0RnFOU3dIMDMzZWk2Z29TeTAxa1ZSSHNoTUNDTW1iaDMtYnQ0UWZlX1JfQ0pDbHl3OFlxRkF6Z0g5a2hVR09fYll1RUpZM29EeVdBUjlTMkJMN3dLOUJoVW1ReFF0Y09OYlZGd3B3Z0tmN0oxOGU0ZVd6N3lmMGw3c05GemVkWUJWckkzQU9Uam95ZW42T3puWkRnVlAwcFRzOTRIMTF1WDJHa3c4VWFVU1haQkhaXzNPX0drMGdGMXRwWWlNR19peVBvSUhmellBZ20wa0FaSzQzWVlLZVhiZVlFQ2p0T1ZWMTFOeWwyUjktRHk1YURycHZUSUM0eWZOWDh2YjF3YmxZUmRsckNxb2k5VUZxZG9pN3dtbGdJbFh0N2lWWUdJYUVIRy1PcnFQMEN0JTI1MjZzYWklMjUzREFNZmwtWVR2Qi1nVzhoQzhLbm4zX1ViVUpYQ2cwZ0kxOE8tNXAxVjB4VENSMzJVM3Z5RWFGLU5HeWxzdHVEUHVzRnNVb2xQYVBIR3RWem1hQjdaNU5jUmJFSjk4d3pvWHZMZ0lkVEhWU29fNmg3M1Jra1RYakEzZGZCLUVCRlREQzNWcCUyNTI2c2lnJTI1M0RDZzBBcktKU3pFckNUa3R6V29wOUVBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTVCZ3dfZmJzYWVpZCUyNTVEJTI1MjZ1cmxmaXhFOwQxJQFbEGFkdXJsBRA08AEA2AIA4AKf8D_qAhZFm5g6Ly93aGVyZWdvZXMuY29tL4ADAIgDAZADAJgDGaADAaoD6gEKvwERLGBwYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uBTwJHkQvZ2VuXzIwND9pZD1hd2JpZCYFBvReAV9iPUFLQW1mLUEzbWZRamZVMUJMR3ZFTXdtMGhpNFZDSFlVaUkxdkRCY0lIQ012OGN2OEJkVHRKWmNQZWx6clFqS1VrLVItZEVPYkR6dk5Md2pSYlRncDkzSVNoNGtHNkZTNHVnJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzcyODA5NTQ3NzYyNTQ3NDU0NzEiCDc4ODI3ODE1KgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA0yMTcuNjQuMTUxLjY5qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKeiyyWIBQGYBQCgBdDKksLigPKHIMAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBcrGBfoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAk-oAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMzQ0NzA5NjA0NzK6Bw8IBSlEIAAwADi-BkAAyAfv1QXSBw0JDUYFHgjaBwYBf0wYAOAHAOoHAggA8AfDmwGKCAIQAA..&s=735ee4be2fd557011ba94739fed5bc333f8167da

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:02 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: d201550d-efce-45a6-9458-d56c05d17601
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/224/ Frame 05E8 85 KB
29 KB 50ms
6ms Script
application/x-javascript 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/224/trk.js
Requested by: Host: fra1-ib.adnxs.com
URL: https://fra1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLnM_BM5xkAAAMA1gAFAQiSgYaSBhD_luTCr7nJhWUYifWg6PjYmd4SKjYJ0NA_wcWKej8RpkBmZ9E7dT8ZAAAAIIXrwT8hpkBmZ9E7dT8p0NAJJNAxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXjv1QWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGNBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0NgJEQUtBT2pzdEE0a3Zwb3FSejFkREFUTDZwaVN4Mng4WUJBZzN0RnFOU3dIMDMzZWk2Z29TeTAxa1ZSSHNoTUNDTW1iaDMtYnQ0UWZlX1JfQ0pDbHl3OFlxRkF6Z0g5a2hVR09fYll1RUpZM29EeVdBUjlTMkJMN3dLOUJoVW1ReFF0Y09OYlZGd3B3Z0tmN0oxOGU0ZVd6N3lmMGw3c05GemVkWUJWckkzQU9Uam95ZW42T3puWkRnVlAwcFRzOTRIMTF1WDJHa3c4VWFVU1haQkhaXzNPX0drMGdGMXRwWWlNR19peVBvSUhmellBZ20wa0FaSzQzWVlLZVhiZVlFQ2p0T1ZWMTFOeWwyUjktRHk1YURycHZUSUM0eWZOWDh2YjF3YmxZUmRsckNxb2k5VUZxZG9pN3dtbGdJbFh0N2lWWUdJYUVIRy1PcnFQMEN0JTI1MjZzYWklMjUzREFNZmwtWVR2Qi1nVzhoQzhLbm4zX1ViVUpYQ2cwZ0kxOE8tNXAxVjB4VENSMzJVM3Z5RWFGLU5HeWxzdHVEUHVzRnNVb2xQYVBIR3RWem1hQjdaNU5jUmJFSjk4d3pvWHZMZ0lkVEhWU29fNmg3M1Jra1RYakEzZGZCLUVCRlREQzNWcCUyNTI2c2lnJTI1M0RDZzBBcktKU3pFckNUa3R6V29wOUVBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTVCZ3dfZmJzYWVpZCUyNTVEJTI1MjZ1cmxmaXhFOwQxJQFbEGFkdXJsBRA08AEA2AIA4AKf8D_qAhZFm3w6Ly93aGVyZWdvZXMuY29tL_ICDAoGSEVJR0hUEgI5MAEP8O0FV0lEVEgSAzcyOPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMTcyNDY0Nzc1OPICnRAKC1BSRV9TQ1JJUFRTEo0QPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaD10aGlzfHxzZWxmOy8qCgogU1BEWC1MaWNlbnNlLUlkZW50Uj0ACGZ1bgWcYCBrKGIpe2tbIiAiXShiKTtyZXR1cm4gYn0JEwA9ESgQKCl7fTsRDYAgbCgpe3ZhciBiPWRvY3VtZW50LmN1cnJlbnRTY3JpcHQNR2goYj12b2lkIDA9PT1iP251bGw6YikmJiI3NyIBEmguZ2V0QXR0cmlidXRlKCJkYXRhLWpjIik_YjoVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEEF0nKX07AYcobj1SZWdFeHAoIl5FBNg_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7ORUAcBXgAGgFYQxjPVtdBQkEZT0Bxgg7ZG8F_xhhPWI7dHJ5BQwsZDtpZihkPSEhYSYmASRQIT1hLmxvY2F0aW9uLmhyZWYpYjp7AS2QayhhLmZvbyk7ZD0hMDticmVhayBifWNhdGNoKG0pe31kPSExfQHWCGc9ZBkXAGcBFgxpZihnKXkAZj5eABA7ZT1hLjE2BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBmPWUsDctMYy5wdXNoKG5ldyBxKGZ8fCIiKSkF1RRiPWEucGEh1BmGAGIF__BAfX13aGlsZShiJiZhIT1iKTthPTA7Zm9yKGI9Yy5sZW5ndGgtMTthPD1iOysrYSljW2FdLmRlcHRoPWItYTthPWghKzkeAa41KjhhbmNlc3Rvck9yaWdpbnNuHAANawA9HXUAKQmGDDE7YjwRikw7KytiKWY9Y1tiXSxmLnVybHx8KAUILkIBOnYAFFtiLQoxXSEMGCxmLmg9ITAB4ykiAGgZqyHVFCwhMSk7ZiUWJQIEZT0yBAEgMDw9ZTstLWUpIbpEPWNbZV0sIWYmJm4udGVzdChnAY8gKSYmKGY9ZyksBQ4oJiYhZy5oKXthPWdJGwB9DV0AZRXmBCYmAcwBOwQ7MEFlAGQhWggmJmUFSAEbCCk7YwWtEHIoYSxmddIUYy5nP2MuBWUMOmMuaQFAAH110DByKGIsYyl7dGhpcy5pQdUBCQhnPWMZIgBxHSIIdXJsESQUaD0hIWM7BS8FiCUKnSkAdHVJeHAoKSxjPWIuaW5kZXhPZigiPyIpO3NldFRpbWVvdXQuLQVB_QBlmToYZT8uMDE6ZUE1RCEoTWF0aC5yYW5kb20oKT5lKWkPDGE9bCghpAAiZf80Oi8vIisoYSYmInRydWWBawBhVmsEaC1yY2QiKT8icGFnZWFkMi5nb29nbGVzeW5kaWm5IC1jbi5jb20iOmYjAAUgDCkrIi8JRXgvZ2VuXzIwND9pZD1qY2EmamM9NzcmdmVyc2lvbj0ihUUMZD0oZAGxDCkmJmRamQANMTAiKXx8InVua25vd24iYeNcK2QrIiZzYW1wbGU9IitlO2E9d2luZG93IR00ZD1hLm5hdmlnYXRvcikyDgBQLnVzZXJBZ2VudCxkPS9DaHJvbWUvSYUgZCkmJiEvRWRnGREcPyEwOiExO2RhfRVRLC5zZW5kQmVhY29uPx1oHRcYKGUpOgooYS1GQF9pbWFnZV9yZXF1ZXN0c3x8XhoAED1bXSksAa6RvgQsZDn8BGQ_ERY8OmQsZD1kLmNyZWF0ZUVsZcF1PCgiaW1nIiksZC5zcmM9ZSxafACJ4hhkKSl9fSwwdRFcMDw9Yz9iLnN1YnN0cmluZygwLGMpOmJ9KVEMLnJmbC79Bu0YgGVuY29kZVVSSUNvbXBvbmVudCh0KCkpfTt9KS5jYWxsKGELECk7CjwvGgUIaPICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eSHDDHBvc2nBImQ6IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcA0KZHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcgAftV-EmFSsoCQacNHi6jAhRhd2JpZCYFBvCGX2I9QUtBbWYtQUJzOUNTd01fQ2RoT0E3em5nMDRvX0JhcHVYMEFtMHlaZHY2RUxDZDlDaEpoOGNIZWRMZk1lQkxQa0l6THhBdzFMV2Y1TENETERlMjd2VDFmWG5tR0FucUpJcEEiIGJvcmRlcj0wIHdpZHRoPTEgaGVpZ2h0PTEgYWx0PSIiMRqAZGlzcGxheTpub25lIj48L2Rpdj7yApoBCgxQT1NUX1NDFm8JCIkBPClqNggBacoMYWRzLkKaDDEGPHhiZmVfYmFja2ZpbGwuanMBZQlLAD4NUwA-nZUgIHtyM3B4KCcxIvsJHCcpO30pKCk7PesQ9RMKEEgBnjRQT1JUX1BBUkFNUxLgE5GVipUA8HlhZGZldGNoP2Fkaz0xODMyNDk0MTEzJmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD03Mjh4OTBfYXMmaXA9MjE3LjY0LjE1MS42OSZvdXRwdXQ9aHRtbCZ1bnZpZXdlZA72CkWLIF9zdGFydD0xJqHnEbs2UwsQJnN1Yl8NhgBiQY3w_XItMzA1NjQ0NyZobD1kZSZhY2VpZD1NSFVYdEFCMkY3UUFjeHUwQUREVTVnRDVWVFFCWmxvMEFYUmxOQUhrYmpRQmduQTBBWnh4TkFGUmNqUUJxSEkwQWNoeU5BRTFjelFCY0hNMEFhcHpOQUd0ZERRQjZIUTBBU2gxTkFGTGRUUUJWblUwQVc1MU5BRjZkVFFCZkhVMEFZUjFOQUdaZFRRQnFuVTBBYkIxTkFHOGRUUUJ2WFUwQWNGMU5BSEpkVFFCMTNVMEFlWjFOQUhwZFRRQjdIVTBBZkYxTkFIMmRUUUI5M1UwQWYxMU5BRUxkalFCREhZMEFRNTJOQUVlARD0wgJLSFkwQVRGMk5BRzNiRUVCUzNOQkFWTnpRUUd6SFZ3Q0toNWNBaWo1aUFJblFxb0NLRUtxQWlsQ3FnSUFTcW9DRzFHcUFzNWhxZ0otWXFvQ19uaXFBcGw2cWdMLWY2b0N0WXFxQWhpTnFnS0FtNm9DZ1p1cUFvS2JxZ0xKbzZvQ3M2U3FBcUtvcWdJc3JLb0NxckNxQXNleXFnS2VzNm9DcU1TcUFpak5xZ0o4emFvQ245R3FBdEhWcWdLRzFxb0NkZHFxQWtyZHFnTEgzNm9Dbi1HcUFzbmlxZ0kwNDZvQ1hlV3FBcURscWdLNTZhb0NQdXFxQWtEcnFnS043S29DLXUycUFyM3ZxZ0xxOEtvQ0ZfR3FBdGZ4cWdKSjhxb0NtUEtxQXJueXFnSmk4Nm9DR2ZTcUFwZjBxZ0xsOUtvQ1RmV3FBcHoxcWdLMTlhb0N1ZldxQXZyMXFnTDk5YW9DMWZhcUFndjRxZ0k2LUtvQ2JQaXFBb1A0cWdLci1xb0NKdnVxQWtIN3FnS1ctNm9DbV91cUFnYjhxZ0pKX0tvQ1dQeXFBbXo4cWdLeF9Lb0N1UHlxQWg3OXFnSWlfYW9Da2YycUFyNzlxZ0lyX3FvQ1lQNnFBb1AtcWdMNl82b0NOZ0NyQWdRQnF3SmtOMkVFVkxMRkJYY0gtUWo2UXR3SjBZWWpDbVJGVFE3QzJLRU96YUUxRVRpVi14S2pvUHNTYWFQN0V0S3IteElyclBzU0ljWDdFZ2JKLXhKZ3l2c1NjTXo3RWlQYi14SUY3ZnNTX3UzN0VqcngteEtjOHZzU3N2TDdFcl95LXhJUzlQc1NydlQ3RXRIMC14SXQ5ZnNTNV9YN0VqMzIteEpLOXZzU2JSYjNGX2hXYXhxR3ZQOGpxTHpfSS11MXZXayZleGs9MTcyNDY0Nzc1OCZhd2JpZF9jPan-8LBDVFFJTXdYSDlqSmNVeEtIN251R2dIVzRHRXMxTUVWdHNjMkthamZ1U2Y5MGVodjZPbFdNUG1hSHBzMGo0SWFTcVJ4RUpjcHVkVWVoVU5ad0RNeDZTaDZJeVlrMWpFd0c0aWptUk40WmxqSDZVdlpBekhQd1daSDhfZXJmT2dJMmNibzB2d3dvQ0lfaDNBYzJZdHNNV3N1NW1TUjAwbm5PVUlLVGM2SzZaNjFtamxHTlHNvgBkzb70kAREdDBZU1VyRkRXUTdZSHlyeGQ1N1dMYWxyOEFoUkNra01RWms2SExCNDRiWTBCb2tzbVlVQ3RLbHgtN296ZzlaVjh4bDE4SElGXzJBUFUwVllscFpJZlZmZjFxN1BGOE5fR3JVemd1dWR6clJrWFFDc2dpZzIybGxmOGFRYmlLRHUxQTE5SEVsS3RpdENMRWpsSGY4c1liYUZKVEZYZGVxNFlRc2I1YnJWNU1kMk5waU5ib1V5RTR6ZHVMUVRUdUVXR29SSGU5U1ZPSDhienlhelBUZjA4VkhxSWFibUN4bU40aXNLWkNUa2NuYWoxRjBfeE5OZWlxWHBMYzgwNEFfOENKMVkyV3ZId2VHM3l1YWR2bFV2bnpzaXQ2dkljbk1mMUZjOGlfNmpURTlXcV9VZTFlQnNMZWhIa0oyRDdscElBV1hsUk5fNEYzXzZxdVBkc051bWhsTXd4djdpaVRmRVFVTXlfQ3dXd1d6SmIycDZQSi1TOTFYX1o2dGtvWHhEQTZWWTFnNkVrZmNQVU1WcURTSnotTnV1TzJKVGoxbXI3TldjUFRXQ0JIV1F6eGQtN2Jyc2xkaERvQXllZ0tsWjBiTi1RSkhRb09HYjhqRmZQTlQzNzB5ZUlRNEUtUHM4azE2eDN2RElmUDRDRFhXZ3hWSWZGSTIxODBQWFAwV3VSeTFxUDU5UFY2bklSbFQ4WUJybzVSS0tKMDRSVVBxeVRVRGVrODc3YVJCOUpHZWxOemVzTy1QcnJMN2hXY3RTd0hGa1dqTUJwVFkyZzE5OXFjTHhCc1FsWGhaVjFMb1hETjVpSHM1X2hpS0FPNURFWkstZGpwOTVIMGhzTEszOFdmSUdVeGF4RExnTGU4VWhiVWxoMkNjSzYwdTlEOEtDYUVrSFFQWmtzMG1iMGRoVkxZU2E5TWZqUWxoZXBMa24zUFFIV0lYZHY2S0hqRWdOeFJMNHFISTJHOUNqR0R1Y1ZsRk1mcGpnRXZNN1J5OWtKblV2dk5vTTR2WlRwX01vd3lBdk9LVXp0eWVIUTh5X2E4WF9SNVZNNy10ZUZYX2cwWkpfbTJVcU82QVF0MTRNenFKbnpnSkNidkcxMGZZeHhJSmJHZzR3Z1FZTG1NVDJKYTF5Wm84a0Rpd0JNbHpubllpbzBWcjd6Tms4MjNMWXg4dnZkb1ZldUhYLW1rQ2ZQSzY5NjBrenp0V2JCV1FNTG5vRWNma0g4MU1jQmlWUjFIS1oyajNzdGhicWFTZEp2cUplOXRLZklqX2VTNnAyQUQ0bFhxRkdRdUdqemRWV2s1Yk16RUlvenVVYTdTcGdCeEhUbzRzaG5JZUVHVlZUQW5BUWl4czVnRng1dzFkbkVDT1JQUWlYNS1jSE5ERGY0UnJlRTJfY05mMmpNVWpFOUR0RjdEcHVBdXJUWFpsclJ5ZU5BYzM2NEhsYlhTRHZPWDV0UEI4TXJDb0Y3ZFlTMGRXNkFhNV92QkEmY2lkPUNBQVNCT1JvZDZrJmFfY2lkPYADAIgDAZADAJgDGaADAaoD6gEKvwFodHRwczovL_6TCxKTC_RTATNtZlFqZlUxQkxHdkVNd20waGk0VkNIWVVpSTF2REJjSUhDTXY4Y3Y4QmRUdEpaY1BlbHpyUWpLVWstUi1kRU9iRHp2Tkx3alJiVGdwOTNJU2g0a0c2RlM0dWcmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTNzI4MDk1NDc3NjI1NDc0NTQ3MSIINzg4Mjc4MTUqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDTIxNy42NC4xNTEuNjmoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEp6LLJYgFAZgFAKAF0MqSwuKA8ocgwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFysYF-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBu6PAdoGFgoQAAAAAAAAAAAFPAQAAAWKiOAGAfIGAggAgAcBiAcAoAcBqgcMMTM0NDcwOTYwNDcyugcPAVhMGAAgADAAOL4GQADIB-_VBdIHDQkBQwEBGBAAGADaBwYJJ0TgBwDqBwIIAPAHw5sBiggCEAA.&s=9be069b0af1cf39328b9a0056c3e049a5f425288
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c652cb3dcc3b49133285c42c49b296c3a3af4f9fceffde1022a6e3539e2422b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date: Mon, 28 Mar 2022 09:32:02 GMT
Content-Encoding: gzip
Age: 2766813
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 29216
X-Served-By: cache-lga21942-LGA, cache-hhn4074-HHN
Access-Control-Allow-Origin: *, *
Last-Modified: Thu, 24 Feb 2022 08:58:20 GMT
Server: AkamaiNetStorage
X-Timer: S1648459923.582643,VS0,VE0
ETag: "80cd3e09497c9fa4207d756c9d41697c:1645693100.060631"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Via: 1.1 varnish, 1.1 varnish
Expires: Fri, 24 Feb 2023 08:58:29 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 1282644, 3318776

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 0CF7 0
743 B 9ms
9ms Script
text/html 37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:02 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 61a2ad7c-b181-44da-9f76-978bc1cae7d4
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame D348 13 KB
5 KB 17ms
9ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4980
x-xss-protection: 0
date: Mon, 28 Mar 2022 07:29:47 GMT
expires: Tue, 29 Mar 2022 07:29:47 GMT
cache-control: public, max-age=86400
age: 7335
etag: 12223946614886178233
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame 6F96 13 KB
5 KB 12ms
9ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4980
x-xss-protection: 0
date: Mon, 28 Mar 2022 07:29:47 GMT
expires: Tue, 29 Mar 2022 07:29:47 GMT
cache-control: public, max-age=86400
age: 7335
etag: 12223946614886178233
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame F3C4 0
743 B 39ms
39ms Script
text/html 37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:02 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 84ee8143-75ec-41a8-ae2e-8ef3aeea566e
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame D011 0
9 B 8ms
7ms Image
text/plain 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?L50XDA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 05E8 145 B
171 B 21ms
20ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

107b923f0c9fed5f92725f0340f4d0591ce86c19f11a882f0d506e8fa43f6dd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035249133473"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 28 Mar 2022 09:32:02 GMT

GET
H3 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0E29 145 B
171 B 26ms
26ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

107b923f0c9fed5f92725f0340f4d0591ce86c19f11a882f0d506e8fa43f6dd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035249133473"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 28 Mar 2022 09:32:02 GMT

POST
H/1.1 200
OK vevent
fra1-ib.adnxs.com/ Frame 05E8 0
839 B 11ms
10ms Ping
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKFC_BMhQUAAAMA1gAFAQiSgYaSBhD_luTCr7nJhWUYifWg6PjYmd4SKjYJz9A_wcWKej8RpkBmZ9E7dT8ZAAAAIIXrwT8hpkBmZ9E7dT8p0NAJJNAxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXjv1QWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGNBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0NgJEQUtBT2pzdEE0a3Zwb3FSejFkREFUTDZwaVN4Mng4WUJBZzN0RnFOU3dIMDMzZWk2Z29TeTAxa1ZSSHNoTUNDTW1iaDMtYnQ0UWZlX1JfQ0pDbHl3OFlxRkF6Z0g5a2hVR09fYll1RUpZM29EeVdBUjlTMkJMN3dLOUJoVW1ReFF0Y09OYlZGd3B3Z0tmN0oxOGU0ZVd6N3lmMGw3c05GemVkWUJWckkzQU9Uam95ZW42T3puWkRnVlAwcFRzOTRIMTF1WDJHa3c4VWFVU1haQkhaXzNPX0drMGdGMXRwWWlNR19peVBvSUhmellBZ20wa0FaSzQzWVlLZVhiZVlFQ2p0T1ZWMTFOeWwyUjktRHk1YURycHZUSUM0eWZOWDh2YjF3YmxZUmRsckNxb2k5VUZxZG9pN3dtbGdJbFh0N2lWWUdJYUVIRy1PcnFQMEN0JTI1MjZzYWklMjUzREFNZmwtWVR2Qi1nVzhoQzhLbm4zX1ViVUpYQ2cwZ0kxOE8tNXAxVjB4VENSMzJVM3Z5RWFGLU5HeWxzdHVEUHVzRnNVb2xQYVBIR3RWem1hQjdaNU5jUmJFSjk4d3pvWHZMZ0lkVEhWU29fNmg3M1Jra1RYakEzZGZCLUVCRlREQzNWcCUyNTI2c2lnJTI1M0RDZzBBcktKU3pFckNUa3R6V29wOUVBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTVCZ3dfZmJzYWVpZCUyNTVEJTI1MjZ1cmxmaXhFOwQxJQFbEGFkdXJsBRA08AEA2AIA4AKf8D_qAhZFm5g6Ly93aGVyZWdvZXMuY29tL4ADAIgDAZADAJgDGaADAaoD6gEKvwERLGBwYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uBTwJHkQvZ2VuXzIwND9pZD1hd2JpZCYFBvReAV9iPUFLQW1mLUEzbWZRamZVMUJMR3ZFTXdtMGhpNFZDSFlVaUkxdkRCY0lIQ012OGN2OEJkVHRKWmNQZWx6clFqS1VrLVItZEVPYkR6dk5Md2pSYlRncDkzSVNoNGtHNkZTNHVnJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzcyODA5NTQ3NzYyNTQ3NDU0NzEiCDc4ODI3ODE1KgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA0yMTcuNjQuMTUxLjY5qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKeiyyWIBQGYBQCgBdDKksLigPKHIMAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBcrGBfoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAk-oAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMzQ0NzA5NjA0NzK6Bw8IBSlEIAAwADi-BkAAyAfv1QXSBw0JDUYFHgjaBwYBf0wYAOAHAOoHAggA8AfDmwGKCAIQAA..&s=735ee4be2fd557011ba94739fed5bc333f8167da&type=nv&nvt=5&jm=1003&px=0&py=0&bw=728&bh=90&sid=1632185711152458629&vd=ct~0|rr~0&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=18678115&sw=1600&sh=1200&pw=728&ph=90&ww=728&wh=90&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:02 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9da55865-4132-4bae-8d1f-8a39d7c9c231
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://fra1-ib.adnxs.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK vevent
fra1-ib.adnxs.com/ Frame 0E29 0
839 B 25ms
24ms Ping
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKJC_BMiQUAAAMA1gAFAQiSgYaSBhDvq5OxmaaY5wQYtc_676ij5KNNKjYJQkKUL2ghkT8RatCGsqZoiz8ZAAAAQDMzwz8hatCGsqZoiz8pQkIJJAAxARu44XqEPzDjgvQIOMpBQOUeSGVQoZ_pJFiY1VJgAGjr3JoBeJnZBYABAYoBA1VTRJIFBvTEAZgBrAKgAfoBqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGTBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3Vfb3B0WFV2SUVsT1UtSnFJWGQ0d0FkcmFma3pfRXd2TEtJRkdianFtUnMzeUVGM1BsLTA3VUFxcjBMaHFGNW45UGVXajQtelhzdUI5Mms2NG1ocmRYaEFQMHhkcmozZTdrZm9BMXBOejFqY2pFdFlfSFo2T2RmTlQ3Tk5zeVN4cVJZM2Q3NzY2S1F0SzNiY3k4UTRkVERvUkFHYkd2QjNZNGxHNTlWemlsR1JpT3BBOUtzUmJXSDN2QlZsWV9GTWVoN1dYYkk2aXFXaGF0TVRlZTdiX2tINWJURXVIdW41UlZLamd5Y0UyRjl6b3QwRGlIekZza2VUSHBkZWpyVlRnNkNiWTB0WVNacTc3YXAwaWN3dzZFeHVkaEdsSGtRbDdwTEhkai14ZFV1VkVzYzlVWkh0OWFkMVFiUDdjZGg5WGNhN0JTdEp0VHVvWlBWUSUyNTI2c2FpJSVj8NdNZmwtWVNqNTJHNDBWOUdnNzBDbkNiZVdNZXA2dkdDOHlZSUF5eEp6dUpyeDIyeHhxdVdyTlBmZktjeVpIdFNzeHBPbjlHRC1xcUdQcXdzLXcxOW1zSWgwaExINmE1WUZ1TVVNdlY4R2pfZGtzTk9BWE5SdGxnWFlqVFAyQ0E3ZnE5VSUyNTI2c2lnJTI1M0RDZzBBcktKU3pMZXZINFhGaEM0UUVBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTVCZ3dfZmJzYWVpZCUyNTVEJTI1MjZ1cmxmaXhBSSxEMSUyNTI2YWR1cmwFEDjwAQDYAgDgAp_wP-oCFmhBoZg6Ly93aGVyZWdvZXMuY29tL4ADAIgDAZADAJgDGaADAaoD6QEKvwERLGBwYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uBTwJHkQvZ2VuXzIwND9pZD1hd2JpZCYFBvRTAV9iPUFLQW1mLUN6SFNtR0RmQnlZNDVMd2lMZWxPNEpqSFB2ZmtRRHVOTkxHeUx6UUVCUHZESGlfTUEwVXpqVV8tTnlXQVJNTDlnVVFHaUFpMVNQY3FGVUk3OGp5QWx6NEhfZVlBJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEjM0NjMyMTA4Njk1NDM5NTExOSIINzcyMjE3OTMqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDTIxNy42NC4xNTEuNjmoBACyBAwIABAAGAAgADAAOAK4BADABADIBADaBAIIAeAEAPAEoZ_pJIgFAZgFAKAFsLv8p52E_JV0wAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFNPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAFMxkBoBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEyODc3ODk3OTEwNroHDwgAASkFsTC-BkAAyAeZ2QXSBw0JEUkYEAAYANoHBgknROAHAOoHAggA8AfDmwGKCAIQAA..&s=e7edb8a6c172e22e712834515e47f4df971f042f&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=1632185711152458629&vd=ct~0|rr~0&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=18678115&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:02 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 1b1d47bd-ccff-4e3c-8aec-4b684cdaccec
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://fra1-ib.adnxs.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame D348 84 KB
32 KB 78ms
63ms XHR
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8292016eaf3d5140688b2542450bb71c6dfa8c596fca3125d73a92633fcfbb42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 28 Mar 2022 09:32:02 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32743
x-xss-protection: 0

POST
H3 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame 6F96 99 KB
33 KB 107ms
94ms XHR
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8c22b0c7c7f0864345ca6b97f9fa4b6bff1ba1b902c5b11680e8b9833f69b1c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 28 Mar 2022 09:32:02 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34185
x-xss-protection: 0

GET
H3 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/ Frame D348 25 KB
9 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a18b0faf6a447454e134730303202f8416b72f1d4f744b1d3b4646636240eb7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 08:28:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3826
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9657
x-xss-protection: 0
server: cafe
etag: 16576748017229546422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Apr 2022 08:28:16 GMT

GET
H3 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame D348 2 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd54241a6ef534d4fd55a95d52035292958c4a55c350f8bb38b396ef4f49c1e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:28:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 201
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1235
x-xss-protection: 0
server: cafe
etag: 218260476562286327
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Apr 2022 09:28:41 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D348 119 KB
36 KB 24ms
23ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 28 Mar 2022 09:32:02 GMT

GET
H3 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame D348 18 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

358cfc8eb339a8ee01040ab6926f11d3c8dd16f43a93764639e7e89f5a1923f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:13:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1119
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7502
x-xss-protection: 0
server: cafe
etag: 16841233975859622389
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Apr 2022 09:13:23 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame D348 0
0 33ms
15ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRHUkifNyx0hDDFRSruViUJKHsE9d9a_Pmd1ZjPJaH8GQvGr7AOzX4rAhQJROh1-E_sHx3TKkbLGFbxfyvxbOC_Ys2PDg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

GET
H3 200 one_click_handler_one_afma.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame D348 38 KB
14 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/one_click_handler_one_afma.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

343c45f736186d8b0be0e9cbc1a63d03a4175be29f95a05952ddecf10b6b5074

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 08:45:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2814
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14788
x-xss-protection: 0
server: cafe
etag: 1978181150704794858
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Apr 2022 08:45:08 GMT

GET
H3 200 11076182216265550272
tpc.googlesyndication.com/simgad/ Frame D348 33 KB
33 KB 8ms
7ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11076182216265550272?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmj01hnuqCQUn1QGMmjggPPawrb-A

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

765649282bb3067226382bec6bf47f87274a9a93cdf808ec802e9ecf8ea3afba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 22:47:22 GMT
x-content-type-options: nosniff
age: 470680
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33834
x-xss-protection: 0
last-modified: Fri, 04 Feb 2022 23:17:51 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 22 Mar 2023 22:47:22 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame D348 0
17 B 51ms
50ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CrnenkoBBYr_qC9HW1ga936uwBIqsyoVnwsX03cQPv-EeEAEg5pfWJWCVioOCmAegAZuI0Z8DyAECqQKNYEMGJ22yPqgDAcgDyQSqBNIBT9DxnMq7LQlsdCWMIz7wgozmgQQw5TEA-6Dnikl52GTe7uLyQlIJ2ODIx507BcEqzfW3GkZKQlA-ZvhyLSxKWWkqMpL6wyIYKvbg6mIxcDCyymPIuWh6pIWt_TIz4M8kTYS4hGJcx4QjtYbgeInc3SBM0B6-fg-gauo7xXCndR_iuMek76RuqrmOsN9lJliibeULuGZ7rLeKaeXEeku1o0IJ4Qb-MvErkIhlUdvqdrPjyqAmMdO-lHPUwOrIdaV7Vpj-Vks0OBmXN8o7Wtp6PYX0wASijs3e3wOSBQQIBBgBkgUECAUYBKAGAoAHzfeuYKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB0ggHCIBhEAEYAPIIDmJpZGRlci0zMDU2NDQ3gAoEyAsB2BMN0BUBmBYBgBcBshcICgYIABIAGAA&sigh=NajWwSNk-iE&uach_m=[UACH]&pr=10:0.016729&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 28 Mar 2022 09:32:02 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 92F6 143 B
163 B 9ms
7ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Response headers

x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 145
x-xss-protection: 0
date: Mon, 28 Mar 2022 09:06:59 GMT
cache-control: public, max-age=3600
content-type: text/html; charset=UTF-8
age: 1503
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 css
fonts.googleapis.com/ Frame 6F96 8 KB
1 KB 81ms
16ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1e046a89bb90f44dadb24f5fdfbe412b5f6d320b790f7317fad956b193234726

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 28 Mar 2022 08:11:14 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 28 Mar 2022 09:32:02 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 28 Mar 2022 09:32:02 GMT

GET
H3 200 load_preloaded_resource.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame 6F96 2 KB
1022 B 8ms
8ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/load_preloaded_resource.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

647367edb473a569f80c0fb035ec50908b0b37e995c63663c02552079b974e76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:25:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 384
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 985
x-xss-protection: 0
server: cafe
etag: 15191321979658692665
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Apr 2022 09:25:38 GMT

GET
H3 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/ Frame 6F96 25 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a18b0faf6a447454e134730303202f8416b72f1d4f744b1d3b4646636240eb7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 08:28:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3826
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9657
x-xss-protection: 0
server: cafe
etag: 16576748017229546422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Apr 2022 08:28:16 GMT

GET
H3 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame 6F96 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd54241a6ef534d4fd55a95d52035292958c4a55c350f8bb38b396ef4f49c1e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:28:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 201
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1235
x-xss-protection: 0
server: cafe
etag: 218260476562286327
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Apr 2022 09:28:41 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6F96 119 KB
36 KB 17ms
16ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 28 Mar 2022 09:32:02 GMT

GET
H3 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/ Frame 6F96 18 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220323/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

358cfc8eb339a8ee01040ab6926f11d3c8dd16f43a93764639e7e89f5a1923f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:13:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1119
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7502
x-xss-protection: 0
server: cafe
etag: 16841233975859622389
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Apr 2022 09:13:23 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 6F96 0
0 18ms
17ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRWnhU8eUxmp-LPF7gqU1tVh0Yb79J6oBvr1lc-hS4b2AQyBAeGcD-xBk5_1ROEghyDu9d_umHJeWWFxqV6ISrmY5GLzg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

GET
H2 200 1d21d5aea7a24b6f372ce9184fd343f6.js Show response
www.gstatic.com/mysidia/ Frame 6F96 38 KB
15 KB 32ms
6ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/1d21d5aea7a24b6f372ce9184fd343f6.js?tag=mysidia_one_click_handler_one_afma

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef12b22f172a4bfc7a485858c5fc6dd84964b3b83b8d5c27b839693f6f61fb8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Fri, 25 Mar 2022 11:58:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 250398
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14624
x-xss-protection: 0
last-modified: Tue, 22 Mar 2022 03:00:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 23 Jun 2022 11:58:44 GMT

GET
H/1.1 200
OK ai.aspx
at.bahn.de/ Frame 6F96 43 B
1 KB 103ms
20ms Image
image/gif 85.14.248.91
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://at.bahn.de/ai.aspx?extProvId=5&extPu=14058-gaw&extLi=16437573307&cb=4226782725

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.14.248.91 Meerbusch, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Microsoft-IIS/8.5 / ASP.NET

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: policyref="https://at.bahn.de/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
Pragma: no-cache
X-ET-Code: 0
Last-Modified: Mo, 28 Mrz 2022 09:32:02 GMT
Server: Microsoft-IIS/8.5
Date: Mon, 28 Mar 2022 09:32:02 GMT
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://googleads.g.doubleclick.net
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 1053
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 6F96 0
17 B 49ms
48ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CkJ9UkoBBYqrQDNOjboPbt4AJ7Kza52iDr8rq1Q-_4R4QASDml9YlYJWKg4KYB6ABrM3jpAHIAQGpAo1gQwYnbbI-qAMByAPLBKoEyAFP0HjLLVz6Kz0qvUv615ScntLz9FejMW46JCQnoP_rRcOqMBGHogw8JR2IyZrPc_o-WIviF2ceyvdpSkVlg8KgfXXDljwKbm2gDSJM1eUnq9XoZXe9VjbEyiMXznkpL17A9fB8psnJO61e_Zs0gXM78I6iTvAHCUpOVm3G7YJ3UGzhBbVFNZE-2YYYxawsbJuuRcRVDcUe5_E_dcnbEIEL7IkJ4scs8X7GDhHBCW73nFtDvklF3-utaI51x-Cdri2aV-0iYTHxJsAE2Irg-PQDkgUECAQYAZIFBAgFGASAB7yynNsCqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHSCAcIgGEQARgA8ggOYmlkZGVyLTMwNTY0NDeACgTICwHYEw2IFAHQFQGAFwGyFwgKBggAEgAYAA&sigh=AJHbl3VbI2Q&uach_m=[UACH]&pr=10:0.00648&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 28 Mar 2022 09:32:02 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame D348 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 65be58ea3a8a6da5ba05e6673d707352f364fc41ab9dde44447367819fbd7306

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame F808 143 B
163 B 7ms
6ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Response headers

x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 145
x-xss-protection: 0
date: Mon, 28 Mar 2022 09:06:59 GMT
cache-control: public, max-age=3600
content-type: text/html; charset=UTF-8
age: 1503
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 92F6
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

62ms
61ms

Document
text/html

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 28 Mar 2022 09:32:03 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 28 Mar 2022 09:32:03 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 28 Mar 2022 09:32:02 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 6F96 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4f25d9fe54a82184c9604406b3c056bb27b1a33cbb0b5e4054dd5ee05969e4d6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 CGHVXjYJRnLTYRF6fgor0GmLhTjmHb-GVf8novFL6vc.js Show response
pagead2.googlesyndication.com/bg/ Frame 0009 35 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CGHVXjYJRnLTYRF6fgor0GmLhTjmHb-GVf8novFL6vc.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0861d55e36094672d361117a7e0a2bd0698b8538e61dbf8655ff27a2f14beaf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:26:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 351
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13806
x-xss-protection: 0
last-modified: Tue, 22 Mar 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 28 Mar 2023 09:26:11 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v42/ Frame 6F96 28 KB
28 KB 31ms
8ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v42/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a67d07f733785876b3192826e76f537e2b9dc0be172ce52c773d30d65f712a07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 22:46:42 GMT
x-content-type-options: nosniff
age: 470720
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28328
x-xss-protection: 0
last-modified: Tue, 01 Mar 2022 21:57:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Mar 2023 22:46:42 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8DB2 42 B
64 B 56ms
41ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuFaO_6a_n0ICFRjGoY-aG4bEROBLapw8tWmUSpy3ni3pEM_n4iEm4KEO898PX1nckvD8PpFGCh_QhQxrmwcQYyDpQv0T9SlhjAqsEXcyxWahD_aaXG&sig=Cg0ArKJSzHZt2noBBhBnEAE&id=lidar2&mcvt=1038&p=666,1091,916,1391&mtos=1038,1038,1038,1038,1038&tos=1038,0,0,0,0&v=20220323&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=2861055222&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1648459922514&rpt=128&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame F808
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

81ms
80ms

Document
text/html

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 28 Mar 2022 09:32:03 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 28 Mar 2022 09:32:03 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 28 Mar 2022 09:32:03 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 CGHVXjYJRnLTYRF6fgor0GmLhTjmHb-GVf8novFL6vc.js Show response
pagead2.googlesyndication.com/bg/ Frame 62D4 35 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CGHVXjYJRnLTYRF6fgor0GmLhTjmHb-GVf8novFL6vc.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20221651272/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0861d55e36094672d361117a7e0a2bd0698b8538e61dbf8655ff27a2f14beaf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:26:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 352
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13806
x-xss-protection: 0
last-modified: Tue, 22 Mar 2022 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 28 Mar 2023 09:26:11 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 02DE 42 B
64 B 40ms
40ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsul8Nwih_J1-9znxJ6HujGtfWT7O9W2cBHSjUKRguqREtcycIqqz_K1dohCS5arGvUbOiU0HWmgxpgOeWy_20wF6cAFP7e8acq_LsfxooO2NDODGDa5&sig=Cg0ArKJSzP3qtU_b22I4EAE&id=lidar2&mcvt=1000&p=1127,209,1217,937&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20220323&bin=7&avms=nio&bs=1600,1200&mc=0.81&vu=1&app=0&itpl=3&adk=3878002045&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1648459922523&rpt=157&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 97 KB
31 KB 75ms
35ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

ff6956c6d9b77bdecabeef7eafb5625c810cf5694db1204d0a48e102ecd73c89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:03 GMT
content-encoding: gzip
last-modified: Tue, 08 Mar 2022 02:42:25 GMT
server: nginx
etag: W/"6226c291-1834f"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 29 Mar 2022 09:32:03 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 43ms
42ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2022031601&jk=961435492603190&bg=!Y2ClYCTNAAbzJazn0yU7ACkAdvg8WtzSWksa7FWu4PsUkBwdnHsJG8mwEHGYzIIUrIhry8mbo_M5xwIAAAF3UgAAAAloAQeZAumDARlA0ZpV8Sx_XjVp_7OIO30uNld98mOntsNcU0TRnQFnt1yK1An-tfWIGyVccgssmVNkJZwscUBvt4GxIIliM_v4r360f9AWSHMkQ8ScvBILVlTsB1DtVfIBd6E2SQwCam2byapWdI_vC8PscwrdbpXeF9exk0oTptahcMdlbpAu9AFSnnZvm2dEwmeYHwc3wpmpEuDEPQrJE4hwXEipYjpvlSxGKs60LcIfRKIrHmniOdoZk5ILtJ3_bIfeKhqSFkFmwWMVYEd1SIIeOGTQ3N-mr-R_tYMAawu9CbL9FJKKThQ2oira8VgChdlzhfqvX_ZYJG5IQzV9f9cAefWmI0xGcB0M_TLw0ra1290DxlPYLOFKqS8NI8KMB6CGqOTGHjCArYxUeRXW4LPKnljJ0LkYcVnj7vVXd3yWuNTSpfLbx2JTNUqzibTu8leMWEf4vhX_ecgS39iXJYxDepJV9WRZ7ubX8r4c-fP-OGdbOA6hJN2njhMtXPyq_G69ZDluFQ5BcgUIcTmoCx2OiDlG2mH8Bk1-7PSrzv6Ey7i90IPWEIMDdNoJSL5KEh9LWQ1iivpqhBwKyQaDX2zarwTvjXXZ6b46sKJLP0l6SUqFXUfS1er03od9fys669MDZuJKAfQv3KvZGobT6sf3cuE_d783x5AllATdivTjRJTaUbRx8cOjkTTS7cPSXifNeCTIxj8kqzmmw5IiIP4rjv3Bc5T0FAApztvcw7UrM7bs7mwB90ktZkU4aUTrnTaTyROvRdxl4OfEv3HRj-sO2vky4dqGvnj9GCLlcJaEeJ9NAbCDQuGH-5Vcl6u5avYSCsbzxHiOH-Jrmup8JjDz924QKRksIyxS5Jwh2X7ArcDulX8mX15h6o959MpoySRsJebMAqet_UfQClxNdNjjdJ_omlItxYrEgehhuR5OvDfJACea5Aj9TSTf0zygSdHFeZhdcxjyaLXvuTt8eP1F6NnSUnGNJ78o7U1B

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 5319 13 KB
5 KB 17ms
17ms Document
text/html 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=wheregoes.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

ea26c78f630f8d3924b66a3966e9d96b6ce9217ee085f6db77fa191e13a59848

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 2041
date: Mon, 28 Mar 2022 09:32:02 GMT
content-length: 5147
strict-transport-security: max-age=31536000; preload;

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 97 KB
31 KB 40ms
15ms XHR
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

ff6956c6d9b77bdecabeef7eafb5625c810cf5694db1204d0a48e102ecd73c89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:03 GMT
content-encoding: gzip
last-modified: Tue, 08 Mar 2022 02:42:25 GMT
server: nginx
etag: W/"6226c291-1834f"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 29 Mar 2022 09:32:03 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 5319
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=wheregoes.com&sn=ChromeSyncframe&so=0&topUrl=wheregoes.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=sYCmi3w0VksyM2NlREFvZDNlek9nMmxhYzFXV1RORG1POHQxK0lma0NER01oNmtqYVRwNFpuMXQ5dUg0bmdnMXJJZ3BQNy9WNGhOQjMxeldnWVl6SzBjcHVFYUM0aEx3K2llbkc4VTdnQitibTNkTmN6SXhrcjJmcGcybk...

415 B
625 B

48ms
18ms

Fetch
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=sYCmi3w0VksyM2NlREFvZDNlek9nMmxhYzFXV1RORG1POHQxK0lma0NER01oNmtqYVRwNFpuMXQ5dUg0bmdnMXJJZ3BQNy9WNGhOQjMxeldnWVl6SzBjcHVFYUM0aEx3K2llbkc4VTdnQitibTNkTmN6SXhrcjJmcGcybkFsREo3bXk2cHJUdWxzbEFHR3lobXduelhHR1RlSzNwOTdiU2htUGw0T1gvdHpQMmJDQlVmb0g5UnpiZnFUYmdhYjNCRmFMSVZ3T1hkSFJjNEh5RkQ4Y3ZydVQvN2hreklJWXBtcXpMQ1ZMUzlEME1OZXBJRkIwSTJGbnFVenUrZTJUTXhSMXBmV1NqVmFoTWpnM05qcmpVb25rNjlYZz09fA&cppv=2

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

b5cfb49a1ec1393ff0976675617c3d7286965ece49299ac4883d0f10e0f5a13d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:03 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 5388
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:02 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=sYCmi3w0VksyM2NlREFvZDNlek9nMmxhYzFXV1RORG1POHQxK0lma0NER01oNmtqYVRwNFpuMXQ5dUg0bmdnMXJJZ3BQNy9WNGhOQjMxeldnWVl6SzBjcHVFYUM0aEx3K2llbkc4VTdnQitibTNkTmN6SXhrcjJmcGcybkFsREo3bXk2cHJUdWxzbEFHR3lobXduelhHR1RlSzNwOTdiU2htUGw0T1gvdHpQMmJDQlVmb0g5UnpiZnFUYmdhYjNCRmFMSVZ3T1hkSFJjNEh5RkQ4Y3ZydVQvN2hreklJWXBtcXpMQ1ZMUzlEME1OZXBJRkIwSTJGbnFVenUrZTJUTXhSMXBmV1NqVmFoTWpnM05qcmpVb25rNjlYZz09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1819
content-length: 541
expires: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 609E 42 B
64 B 40ms
40ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuA2NuTNr0oRl2BwNcGEewDCTyDFLNTW9-MEK-A_Qwux9t9zq1DUmH8HjMQqXDwsM77dyBZ7uiog2TLt8g9Wn3FFPQfOp0NXc6NcjMys70hBA8hoGgj&sig=Cg0ArKJSzDAfkwo627MJEAE&id=lidar2&mcvt=1000&p=950,1091,1200,1391&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220323&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=19&adk=3809685794&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1648459922541&rpt=449&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 322E 42 B
64 B 39ms
39ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvg5I8dGve3_yw4UGvAXKxvipWA6wH50tKnVbzxCPGsm80t1MUBNj4C41x36HrlmrjICJngzrVptOk2_1glDVBBoZmqbqhpeZ5_R1UZgB48qEKsm0jc&sig=Cg0ArKJSzJlAEKj_n993EAE&id=lidar2&mcvt=1000&p=474,436,564,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220323&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=19&adk=1696759606&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1648459922503&rpt=519&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://09e5c2a6d4e77cbe07045cd260b88ed0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 0CF7 0
743 B 22ms
21ms Script
text/html 37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:03 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 5ace2663-171c-4281-95e5-a2f8962ecd85
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame F3C4 0
743 B 14ms
11ms Script
text/html 37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:03 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: d4d39398-adab-4052-80e8-a3f51a21b932
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK vevent
fra1-ib.adnxs.com/ Frame 05E8 0
839 B 27ms
27ms Ping
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKFC_BMhQUAAAMA1gAFAQiSgYaSBhD_luTCr7nJhWUYifWg6PjYmd4SKjYJz9A_wcWKej8RpkBmZ9E7dT8ZAAAAIIXrwT8hpkBmZ9E7dT8p0NAJJNAxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXjv1QWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGNBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0NgJEQUtBT2pzdEE0a3Zwb3FSejFkREFUTDZwaVN4Mng4WUJBZzN0RnFOU3dIMDMzZWk2Z29TeTAxa1ZSSHNoTUNDTW1iaDMtYnQ0UWZlX1JfQ0pDbHl3OFlxRkF6Z0g5a2hVR09fYll1RUpZM29EeVdBUjlTMkJMN3dLOUJoVW1ReFF0Y09OYlZGd3B3Z0tmN0oxOGU0ZVd6N3lmMGw3c05GemVkWUJWckkzQU9Uam95ZW42T3puWkRnVlAwcFRzOTRIMTF1WDJHa3c4VWFVU1haQkhaXzNPX0drMGdGMXRwWWlNR19peVBvSUhmellBZ20wa0FaSzQzWVlLZVhiZVlFQ2p0T1ZWMTFOeWwyUjktRHk1YURycHZUSUM0eWZOWDh2YjF3YmxZUmRsckNxb2k5VUZxZG9pN3dtbGdJbFh0N2lWWUdJYUVIRy1PcnFQMEN0JTI1MjZzYWklMjUzREFNZmwtWVR2Qi1nVzhoQzhLbm4zX1ViVUpYQ2cwZ0kxOE8tNXAxVjB4VENSMzJVM3Z5RWFGLU5HeWxzdHVEUHVzRnNVb2xQYVBIR3RWem1hQjdaNU5jUmJFSjk4d3pvWHZMZ0lkVEhWU29fNmg3M1Jra1RYakEzZGZCLUVCRlREQzNWcCUyNTI2c2lnJTI1M0RDZzBBcktKU3pFckNUa3R6V29wOUVBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTVCZ3dfZmJzYWVpZCUyNTVEJTI1MjZ1cmxmaXhFOwQxJQFbEGFkdXJsBRA08AEA2AIA4AKf8D_qAhZFm5g6Ly93aGVyZWdvZXMuY29tL4ADAIgDAZADAJgDGaADAaoD6gEKvwERLGBwYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uBTwJHkQvZ2VuXzIwND9pZD1hd2JpZCYFBvReAV9iPUFLQW1mLUEzbWZRamZVMUJMR3ZFTXdtMGhpNFZDSFlVaUkxdkRCY0lIQ012OGN2OEJkVHRKWmNQZWx6clFqS1VrLVItZEVPYkR6dk5Md2pSYlRncDkzSVNoNGtHNkZTNHVnJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzcyODA5NTQ3NzYyNTQ3NDU0NzEiCDc4ODI3ODE1KgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA0yMTcuNjQuMTUxLjY5qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKeiyyWIBQGYBQCgBdDKksLigPKHIMAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBcrGBfoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAk-oAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMzQ0NzA5NjA0NzK6Bw8IBSlEIAAwADi-BkAAyAfv1QXSBw0JDUYFHgjaBwYBf0wYAOAHAOoHAggA8AfDmwGKCAIQAA..&s=735ee4be2fd557011ba94739fed5bc333f8167da&type=pv&jm=1003&px=0&py=0&bw=728&bh=90&sf=1&sid=1632185711152458629&vd=ct~0|rr~5&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=18678115&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:03 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 6d79281b-be12-4146-bb6b-ea5be56c0a06
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://fra1-ib.adnxs.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK vevent
fra1-ib.adnxs.com/ Frame 0E29 0
839 B 49ms
49ms Ping
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKJC_BMiQUAAAMA1gAFAQiSgYaSBhDvq5OxmaaY5wQYtc_676ij5KNNKjYJQkKUL2ghkT8RatCGsqZoiz8ZAAAAQDMzwz8hatCGsqZoiz8pQkIJJAAxARu44XqEPzDjgvQIOMpBQOUeSGVQoZ_pJFiY1VJgAGjr3JoBeJnZBYABAYoBA1VTRJIFBvTEAZgBrAKgAfoBqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGTBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3Vfb3B0WFV2SUVsT1UtSnFJWGQ0d0FkcmFma3pfRXd2TEtJRkdianFtUnMzeUVGM1BsLTA3VUFxcjBMaHFGNW45UGVXajQtelhzdUI5Mms2NG1ocmRYaEFQMHhkcmozZTdrZm9BMXBOejFqY2pFdFlfSFo2T2RmTlQ3Tk5zeVN4cVJZM2Q3NzY2S1F0SzNiY3k4UTRkVERvUkFHYkd2QjNZNGxHNTlWemlsR1JpT3BBOUtzUmJXSDN2QlZsWV9GTWVoN1dYYkk2aXFXaGF0TVRlZTdiX2tINWJURXVIdW41UlZLamd5Y0UyRjl6b3QwRGlIekZza2VUSHBkZWpyVlRnNkNiWTB0WVNacTc3YXAwaWN3dzZFeHVkaEdsSGtRbDdwTEhkai14ZFV1VkVzYzlVWkh0OWFkMVFiUDdjZGg5WGNhN0JTdEp0VHVvWlBWUSUyNTI2c2FpJSVj8NdNZmwtWVNqNTJHNDBWOUdnNzBDbkNiZVdNZXA2dkdDOHlZSUF5eEp6dUpyeDIyeHhxdVdyTlBmZktjeVpIdFNzeHBPbjlHRC1xcUdQcXdzLXcxOW1zSWgwaExINmE1WUZ1TVVNdlY4R2pfZGtzTk9BWE5SdGxnWFlqVFAyQ0E3ZnE5VSUyNTI2c2lnJTI1M0RDZzBBcktKU3pMZXZINFhGaEM0UUVBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTVCZ3dfZmJzYWVpZCUyNTVEJTI1MjZ1cmxmaXhBSSxEMSUyNTI2YWR1cmwFEDjwAQDYAgDgAp_wP-oCFmhBoZg6Ly93aGVyZWdvZXMuY29tL4ADAIgDAZADAJgDGaADAaoD6QEKvwERLGBwYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uBTwJHkQvZ2VuXzIwND9pZD1hd2JpZCYFBvRTAV9iPUFLQW1mLUN6SFNtR0RmQnlZNDVMd2lMZWxPNEpqSFB2ZmtRRHVOTkxHeUx6UUVCUHZESGlfTUEwVXpqVV8tTnlXQVJNTDlnVVFHaUFpMVNQY3FGVUk3OGp5QWx6NEhfZVlBJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEjM0NjMyMTA4Njk1NDM5NTExOSIINzcyMjE3OTMqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDTIxNy42NC4xNTEuNjmoBACyBAwIABAAGAAgADAAOAK4BADABADIBADaBAIIAeAEAPAEoZ_pJIgFAZgFAKAFsLv8p52E_JV0wAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFNPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAFMxkBoBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEyODc3ODk3OTEwNroHDwgAASkFsTC-BkAAyAeZ2QXSBw0JEUkYEAAYANoHBgknROAHAOoHAggA8AfDmwGKCAIQAA..&s=e7edb8a6c172e22e712834515e47f4df971f042f&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=1632185711152458629&vd=ct~0|rr~5&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=18678115&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:03 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: ce37b95a-9524-47e7-9e91-2d9fd086df59
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://fra1-ib.adnxs.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D348 42 B
64 B 49ms
48ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuZQuH8rsVtj8YmKulJr7r2waU-vKiGXA9jfYVnA6eJ-B5xqqx-WYwsnxFD187vHqARIg4mrJK8jDm8hUylmjMvB60AdJ4bxELWwaaQ1j61NH0gToc&sig=Cg0ArKJSzP777pm5iByjEAE&cid=CAASFeRotJ2E3cK5mByHPQi4YV6J7PpBmg&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220323&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=2938260542&rs=5&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1648459923184&rpt=298&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6F96 42 B
64 B 46ms
45ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv39UwvLE-IkIW1MCPvd-zvvLx__pkM_88zNFEX_W2Oondz6gBjI_lx7TJz5tNQfQXtGDWhqdVA8NzUt4oiFhP5igDe22PTvRgK6hXg_vCv24fniLg&sig=Cg0ArKJSzDcR30nzXAnUEAE&cid=CAASFeRoZ23LfaZsHjM9D33H8x921VoXlw&id=lidar2&mcvt=1002&p=0,0,90,728&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20220323&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1832494113&rs=5&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1648459923188&rpt=487&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame B750 281 B
554 B 33ms
6ms Document
text/html 104.92.74.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-8.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "402b2-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 28 Mar 2022 09:32:04 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 28D2 2 KB
814 B 8ms
8ms Document
text/html 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1648459921554

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

a2-22-32-24.deploy.static.akamaitechnologies.com

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 8BC6 23 KB
8 KB 95ms
33ms Document
text/html 2.22.32.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU18831I&prvid=2034%2C2033%2C2030%2C273%2C233%2C2028%2C2027%2C236%2C2025%2C237%2C117%2C97%2C55%2C99%2C3012%2C3011%2C3010%2C201%2C3007%2C246%2C4%2C203%2C9%2C2011%2C3022%2C172%2C3020%2C173%2C251%2C175%2C2009%2C178%2C255%2C3018%2C3017%2C214%2C3014%2C337%2C338%2C70%2C77%2C38%2C182%2C261%2C141%2C222%2C301%2C225%2C10000%2C80%2C108%2C229%2C307&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1&itype=PREBID

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.22.32.24 Milan, Italy, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

67f8f8db0da8f8404871260c796fdeed4853f2fb8fdb9cb99db98854ebf91074

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

server: Apache
content-type: text/html; charset=UTF-8
x-mnet-hl2: E
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=172800
expires: Wed, 30 Mar 2022 09:32:04 GMT
date: Mon, 28 Mar 2022 09:32:04 GMT
content-length: 8259

GET
H2 200 iframe Show response
mantodea.mantisadnetwork.com/prebid/ Frame DD16 258 B
495 B 98ms
98ms Document
text/html 54.80.147.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1648459921654&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221651272%2F
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.80.147.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-80-147-122.compute-1.amazonaws.com
Software: / Express
Resource Hash: cb8223f111e367f49b7019c6cf9a53e2c6c9452173430bccb0d418716c51ac75

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

date: Mon, 28 Mar 2022 09:32:04 GMT
content-type: text/html; charset=utf-8
content-length: 258
x-powered-by: Express
vary: Origin
access-control-allow-credentials: true
cache-control: private, no-cache, no-store, must-revalidate
pragma: no-cache
expires: -1
etag: W/"102-CBNc/zjNheMos7etqW45cPnlvVs"

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 8EFA 52 KB
17 KB 21ms
21ms Document
text/html 2.20.156.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.20.156.240 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-156-240.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

Server: nginx/1.18.0 (Ubuntu)
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
ETag: "623de86a-cf34"
Access-Control-Allow-Origin: *
Content-Type: text/html
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Tue, 29 Mar 2022 09:32:06 GMT
Date: Mon, 28 Mar 2022 09:32:04 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 204
No Content beacon
ap.lijit.com/ Frame E631 0
0 16ms
15ms Document
text/plain 72.251.249.9
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=8128488
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

Date: Mon, 28 Mar 2022 09:32:04 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
X-Sovrn-Pod: ad_ap3ams1

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame C145 8 KB
4 KB 94ms
10ms Document
text/html 2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1648459800000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:46::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0849eef021b381cb3f64d424bdd29839513dbb4e964aef0420136906426a18de

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

cache-control: max-age=86400
content-type: text/html
content-encoding: br
last-modified: Tue, 15 Mar 2022 23:39:48 GMT
accept-ranges: bytes
etag: "866b66bb3ccc5c8de41913672c69b8f7"
server: AmazonS3
x-cache: TCP_HIT
x-amz-id-2: IwTmFwF2Q4pDk45NrqV1SCxS6WY7XhQFhHKnDZnUVFRpIpZ3Nb82ejWP2fDvFTm4gSBVxajsa0Y=
x-amz-request-id: S3DW7RJH7A693869
x-amz-meta-codebuild-content-sha256: 1bd3623b950dcf081744ebf0150c6ff72edcc5cbd4a3ea8293d7f9c29b2e9c0b
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:a4519585-d31b-4588-8499-6641ec459b43
x-amz-meta-codebuild-content-md5: d97b029b026ab1b5da9f71fc8f6cf19a
x-azure-ref-originshield: 0KXFBYgAAAABbEBOugLSfRoNdFR1rWcnxQU1TMDRFREdFMTgxNAA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-azure-ref: 0lIBBYgAAAAB0L8Uoo9KSR7E3agBVjXGXRlJBRURHRTEwMjAAODRlN2RmYTItMTQ0Mi00MzM0LWIzNGYtZTQyZDNmN2RkYWQ5
date: Mon, 28 Mar 2022 09:32:04 GMT

GET
H2 204 /
onetag-sys.com/usync/ 0
52 B 7ms
7ms Image
text/plain 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/usync/?tag=img

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-cache, no-transform

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame B750 32 KB
10 KB 7ms
6ms Script
text/html 104.92.74.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-8.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 9ad1bb44af5999c63ca2cb0cc07b90c55f3f4752a55578ff5fb7e2e953161e61

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date: Mon, 28 Mar 2022 09:32:04 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Mar 2022 16:28:01 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=83073
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9540
Expires: Tue, 29 Mar 2022 08:36:37 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 8EFA 0
743 B 17ms
17ms Script
text/html 37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:04 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 766ff648-9cdf-453a-8e7b-627eda9c2de3
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 fltiu.js Show response
pixel.yabidos.com/ Frame DD16 2 KB
1 KB 38ms
13ms Script
application/javascript 104.16.201.58
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.yabidos.com/fltiu.js?qid=83233313f553333313f513430313&cid=1041&p=undefined&s=wheregoes.com
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1648459921654&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221651272%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.201.58 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04e15c27c7c1e344842fec61d78bfb338739501f6d293a013d57a808efcc3674

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sat, 05 Mar 2022 11:39:44 GMT
server: cloudflare
age: 3961
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6f2f5b427af19b5d-FRA
content-length: 1168
expires: Mon, 28 Mar 2022 11:32:04 GMT

GET
H2

200

query
ecs.mantisadnetwork.com/sync/pixel/ Frame DD16
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=rjrqv8k&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=rjrqv8k&ttd_tpi=1
https://ecs.mantisadnetwork.com/sync/pixel/query?source=tradedesk&id=4fc6371a-ab45-49d4-9927-ceaa306337db

35 B
152 B

127ms
104ms

Image
image/gif

54.80.147.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ecs.mantisadnetwork.com/sync/pixel/query?source=tradedesk&id=4fc6371a-ab45-49d4-9927-ceaa306337db
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1648459921654&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221651272%2F
Protocol: H2
Server: 54.80.147.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-80-147-122.compute-1.amazonaws.com
Software: / Express
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:05 GMT
x-powered-by: Express
etag: W/"23-X71HIiL+uKIs9biqXcW44Tr4jis"
content-length: 35
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:05 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://ecs.mantisadnetwork.com/sync/pixel/query?source=tradedesk&id=4fc6371a-ab45-49d4-9927-ceaa306337db
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 241

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame 20A0 4 KB
2 KB 96ms
28ms Document
text/html 54.194.49.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.49.117 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-49-117.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: c21d8e1d23f247840e15345f52c64973a61726d806ce0115a1d3af757f321095

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/

Response headers

date: Mon, 28 Mar 2022 09:32:04 GMT
content-type: text/html;charset=UTF-8
server: nginx
etag: W/"0b47ae4a15b06854aca9d4331113f4750"
timing-allow-origin: *
content-encoding: gzip

GET
H2 204 ps
pixel.33across.com/ Frame EA93 0
0 566ms
110ms Document
text/plain 67.202.105.23

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.33across.com/ps?m=xch&rt=html&id=0010b00002Mq2FYAAZ&ru=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D304%26uid%3D33XUSERID33X
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.23 -, , ASN (),
Reverse DNS
Software: 33XP005 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/

Response headers

x-33x-status: 2000208
server: 33XP005
date: Mon, 28 Mar 2022 09:32:04 GMT

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 0321 2 KB
814 B 9ms
9ms Document
text/html 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame A0B9 816 B
1 KB 473ms
20ms Document
text/html 185.86.137.107

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.107 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b67fdd7a134bd99730fc1e8b84798630281f7f359157e2ddb0d29488f1e610be

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/

Response headers

content-length: 816
content-type: text/html
date: Mon, 28 Mar 2022 09:32:04 GMT

GET
H/1.1

200
OK

usermatch Show response
ssum-sec.casalemedia.com/ Frame 59DD
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

2 KB
3 KB

55ms
55ms

Document
text/html

2.20.157.55
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.20.157.55 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-157-55.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cb32c1ed61a8e7c3eab17c225ea500eb093cecec17d04e03ab1052eaac06f3fe

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/

Response headers

Server: Apache
Content-Type: text/html
Dropped-Udsids: 241|39|230|45|4|190|73|64
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary: Is-Traffic-Usersync
Expires: Mon, 28 Mar 2022 09:32:05 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:05 GMT
Content-Length: 1612
Connection: keep-alive

Redirect headers

Server: Apache
Content-Length: 311
Content-Type: text/html; charset=iso-8859-1
Location: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Expires: Mon, 28 Mar 2022 09:32:04 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:04 GMT
Connection: keep-alive

GET
H2

200

sync
ads.servenobid.com/ Frame C145
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=1350066995554957961

0
344 B

28ms
28ms

Image
image/avif

54.246.157.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=1350066995554957961
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.246.157.68 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-157-68.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:04 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:04 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 1d4c99d6-2d05-45ab-b06a-bfc826368628
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ads.servenobid.com/sync?pid=312&uid=1350066995554957961
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame C145
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=5f563619f1bd26f939937f2e

0
348 B

29ms
29ms

Image
image/avif

54.246.157.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=5f563619f1bd26f939937f2e
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.246.157.68 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-157-68.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:05 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:04 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ads.servenobid.com/sync?pid=310&uid=5f563619f1bd26f939937f2e
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap4ams1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame C145 0
277 B 18ms
17ms Image
text/plain 72.251.249.9
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 28 Mar 2022 09:32:04 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET
H2

502

rmpssp
sync.1rx.io/usersync2/ Frame C145
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1648459924920

0
0

15ms
14ms

Image
text/html

213.19.147.44
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1648459924920
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 213.19.147.44 Utrecht, Netherlands, ASN3356 (LEVEL3, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Redirect headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:04 GMT
server: Tengine
etag: RX753b2062991a46edb641046331e4cc5f003
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location: https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1648459924920
cache-control: no-store, no-cache, must-revalidate
content-type: text/html
expires: 0

GET
H2

200

sync
ads.servenobid.com/ Frame C145
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=5108559722871563563

0
344 B

29ms
29ms

Image
image/avif

54.246.157.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=5108559722871563563
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.246.157.68 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-157-68.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:05 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=5108559722871563563
Date: Mon, 28 Mar 2022 09:32:04 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK usa
sync.go.sonobi.com/ Frame C145 0
474 B 70ms
13ms Image
text/plain 178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-sync.go.sonobi.com

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:04 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-9
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame C145
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ads.servenobid.com/sync?pid=327&uid=77b01785-3d8b-4d74-b285-4d58243e98ba&gdpr=0&gdpr_consent=&us_privacy=1YN-

0
357 B

28ms
28ms

Image
image/avif

54.246.157.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=327&uid=77b01785-3d8b-4d74-b285-4d58243e98ba&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.246.157.68 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-157-68.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:05 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=327&uid=77b01785-3d8b-4d74-b285-4d58243e98ba&gdpr=0&gdpr_consent=&us_privacy=1YN-
date: Mon, 28 Mar 2022 09:32:04 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame C145
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ups.analytics.yahoo.com/ups/58559/occ?verify=true
https://ads.servenobid.com/sync?pid=337&uid=y-IJmhVT5E2uHsI9PB1PyB84RC8ENKbZ3Sw.NB2sg-~A

0
367 B

29ms
28ms

Image
image/avif

54.246.157.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-IJmhVT5E2uHsI9PB1PyB84RC8ENKbZ3Sw.NB2sg-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.246.157.68 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-157-68.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:05 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-IJmhVT5E2uHsI9PB1PyB84RC8ENKbZ3Sw.NB2sg-~A
date: Mon, 28 Mar 2022 09:32:04 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame B750
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=9LNNyBWXQQyxlh7Ar2RlNg&rk=usync-other
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=9LNNyBWXQQyxlh7Ar2RlNg

43 B
556 B

35ms
35ms

Image
image/gif

52.94.223.37

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=9LNNyBWXQQyxlh7Ar2RlNg

Protocol

HTTP/1.1

Server

52.94.223.37 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:05 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: T0AHA9A1W5D6P3XNJA24
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=9LNNyBWXQQyxlh7Ar2RlNg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

setuid
px.ads.linkedin.com/ Frame B750
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L1AIH3IL-1R-IZG2

0
707 B

219ms
177ms

Image
text/plain

2620:1ec:22::14

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L1AIH3IL-1R-IZG2
Protocol: H2
Server: 2620:1ec:22::14 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:04 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: FF446B6616AF4DC3A57163B1819F366F Ref B: VIEEDGE2911 Ref C: 2022-03-28T09:32:05Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXbQ/xDXt2VIB3PiUWTPQ==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L1AIH3IL-1R-IZG2
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame B750
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEG1fy163lsdcriNEf2m7blM&google_cver=1

0
239 B

44ms
9ms

Image
image/gif

69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEG1fy163lsdcriNEf2m7blM&google_cver=1
Protocol: HTTP/1.1
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEG1fy163lsdcriNEf2m7blM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B750
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=nnMIZzP9RYeB6t38FfBcgw&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=nnMIZzP9RYeB6t38FfBcgw

43 B
556 B

103ms
103ms

Image
image/gif

209.54.180.144

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=nnMIZzP9RYeB6t38FfBcgw

Protocol

HTTP/1.1

Server

209.54.180.144 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:05 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: SP28TM2JBZM97Q76HQ3A
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=nnMIZzP9RYeB6t38FfBcgw
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame B750
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/Wu8Qk9SptdWKvc44Dk9is8n5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=2352329920341639930

0
239 B

10ms
9ms

Image
image/gif

69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=2352329920341639930
Protocol: HTTP/1.1
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Content-Type: image/gif

Redirect headers

date: Mon, 28 Mar 2022 09:32:05 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=2352329920341639930
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H2 451 709414.gif
id.rlcdn.com/ Frame B750 0
0 40ms
18ms Image
text/plain 35.244.174.68

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709414.gif
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B750
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFBSUgzSUwtMVItSVpHMg==

170 B
188 B

33ms
18ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFBSUgzSUwtMVItSVpHMg==

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFBSUgzSUwtMVItSVpHMg==
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame B750 70 B
264 B 74ms
47ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:04 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 flimpobj.js Show response
pixel.yabidos.com/ Frame DD16 31 KB
24 KB 12ms
12ms Script
application/javascript 104.16.201.58
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.yabidos.com/flimpobj.js?cb=1648459925539&ver1=2.2.3&qid=83233313f553333313f513430313&rnd=c9z066iu2nro&cid=1041
Requested by: Host: pixel.yabidos.com
URL: https://pixel.yabidos.com/fltiu.js?qid=83233313f553333313f513430313&cid=1041&p=undefined&s=wheregoes.com
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.201.58 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4cf0498d6f16d928751dae8b235dab5e250f65d561f43e2dc20d982efac6016f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:04 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sat, 05 Mar 2022 11:39:44 GMT
server: cloudflare
age: 2440
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6f2f5b429b1f9b5d-FRA
content-length: 24217
expires: Mon, 28 Mar 2022 11:32:04 GMT

GET
H2 200 vbl.gif
pre.glotgrx.com/ Frame DD16 26 B
88 B 60ms
24ms Image
image/gif 2606:4700::6810:75c3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pre.glotgrx.com/vbl.gif?cb=1648459925584&rnd=c9z066iu2nro&ifm=1&uai=1&cid=1041&s=wheregoes.com&p=undefined&x=&adtg=&ats=0&atf=&nsi=&si=&nci=&nai=&pft=0&iip=0&adb=1&adc=0&adcd=i0_f0_o0_e0&ai=&icp=undefined&impid=&idl=&ttduid=&id5=&emh=
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1648459921654&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221651272%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:75c3 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:05 GMT
cf-cache-status: HIT
last-modified: Sat, 05 Mar 2022 11:39:33 GMT
server: cloudflare
age: 7020
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6f2f5b436fbccc42-ZRH
content-length: 26
expires: Mon, 28 Mar 2022 11:32:05 GMT

GET
H2 200 nflrc.gif
pre.glotgrx.com/ Frame DD16 26 B
304 B 59ms
23ms Image
image/gif 2606:4700::6810:75c3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pre.glotgrx.com/nflrc.gif?cb=1648459925572349&ver=1.2r81&qid=83233313f553333313f513430313&p=undefined&s=wheregoes.com&x=&cid=1041&od1=&od2=&adtg=&nci=&nai=&si=&ai=&nsi=&co=0&cstm1=&cstm2=&cstm3=&rnd=c9z066iu2nro&impid=&idl=&ttduid=&id5=&emh=&tps=2&ver1=2.2.3&1=bb230171181fa72b0866b908eee96617&2=0.0&3=1200_1600_1200_1600_24_24_1&5=%7B%220%22%3A%7B%220%22%3A%22Chrome%2520PDF%2520Plugin%2520-%2520%2520-%2520internal-pdf-viewer%2520-%2520Portable%2520Document%2520Formatfl_br%22%2C%221%22%3A%22Chrome%2520PDF%2520Viewer%2520-%2520%2520-%2520mhjfbmdgcfjbbpaeojofohoefgiehjai%2520-%2520fl_br%22%2C%222%22%3A%22Native%2520Client%2520-%2520%2520-%2520internal-nacl-plugin%2520-%2520fl_br%22%7D%7D&6=2&7={%22e%22:%2211%22,%22m%22:%220%22,%22f%22:%223428%22}&ats=0&atf=&dbgcid=1041&ifm=1&penv=b&pt=&ptbp=&tw=0&ldp=1&icpl=26&icp=https%253A//wheregoes.com/&irfl=26&irf=https%253A//wheregoes.com/&cty=4&fcs=0&flky=ver-fl-6-qid-fl-28-p-fl-9-s-fl-13-x-fl-0-cid-fl-4-od1-fl-0-od2-fl-0-adtg-fl-0-nci-fl-0-nai-fl-0-si-fl-0-ai-fl-0-nsi-fl-0-co-fl-0-cstm1-fl-0-cstm2-fl-0-cstm3-fl-0-rnd-fl-12-impid-fl-0-idl-fl-0-ttduid-fl-0-id5-fl-0-emh-fl-0-tps-fl-0-cb-fl-13-ver1-fl-5-&spfp=1&spfnp=0&sp1=Chromefl_andLinux&sp2=Chromefl_andWindows&adv=0&det=1&adb=1&iip=0&spf=0&adc=0&adcd=i0_f0_o0_e0&vps=0x0&gpu=Intel%20Iris%20OpenGL%20Engine&ncf=4g_10_undefined_null_0_undefined_false&chua={%22architecture%22:%22%22,%22brands%22:[],%22mobile%22:false,%22model%22:%22%22,%22platform%22:%22%22,%22platformVersion%22:%22%22,%22uaFullVersion%22:%22%22}&fli=&flerr=0&trim=&fio=20
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1648459921654&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221651272%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:75c3 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:05 GMT
cf-cache-status: HIT
last-modified: Sat, 05 Mar 2022 11:39:33 GMT
server: cloudflare
age: 7021
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6f2f5b436fbdcc42-ZRH
content-length: 26
expires: Mon, 28 Mar 2022 11:32:05 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame 20A0
Redirect Chain

https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID
https://rtb.gumgum.com/usersync?b=apn&i=1350066995554957961

35 B
208 B

43ms
35ms

Image
image/gif

54.194.49.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=apn&i=1350066995554957961
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.49.117 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-49-117.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:05 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:05 GMT
X-Proxy-Origin: 217.64.151.69; 217.64.151.69; 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 87f27b2b-ec1f-4958-a22b-230f9cdbe5ff
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://rtb.gumgum.com/usersync?b=apn&i=1350066995554957961
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame 20A0
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_8d243850-35d0-4d01-a838-5141a4ccebef&gdpr=0&gdpr_consent=&us_privacy=1---
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=e_8d243850-35d0-4d01-a838-5141a4ccebef&gdpr=0&gdpr_consent=&us_privacy=1---
https://pixel.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=gumgum2&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=gumgum2&&user_id=rH-3A6J9uge3eOcHrH2uB_585lC3fOFWr3rxeY-w
https://rtb.gumgum.com/usersync?b=bsw&i=5a4a5aee-43d3-4372-8a5a-c707786d919f

35 B
208 B

36ms
36ms

Image
image/gif

54.194.49.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=bsw&i=5a4a5aee-43d3-4372-8a5a-c707786d919f
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.49.117 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-49-117.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:05 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: //rtb.gumgum.com/usersync?b=bsw&i=5a4a5aee-43d3-4372-8a5a-c707786d919f
Date: Mon, 28 Mar 2022 09:32:05 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET

syncUser
sync.outbrain.com/ Frame 20A0
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D
https://rtb.gumgum.com/usersync?b=obn&i=ENC%28wjTY3WXBUt6av6WdsrCdymG1d4N0Hh9WD2N21UBheWBkw1kC0h1QimN9sEsbhMZd%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26pla...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_8d243850-35d0-4d01-a838-5141a4ccebef&obuid=ENC(wjTY3WXBUt6av6WdsrCdymG1d4N0Hh9WD2N21UBheWBkw1kC0h1QimN9sEsbhMZd)

0
0

GET
H2

200

usersync
rtb.gumgum.com/ Frame 20A0
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://us-u.openx.net/w/1.0/cm?cc=1&_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://rtb.gumgum.com/usersync?b=opx&i=eb3bdfce-42d9-49e3-8662-0bc88c3bf13b

35 B
208 B

35ms
34ms

Image
image/gif

54.194.49.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=opx&i=eb3bdfce-42d9-49e3-8662-0bc88c3bf13b
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.49.117 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-49-117.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:05 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

date: Mon, 28 Mar 2022 09:32:05 GMT
content-encoding: gzip
server: OXGW/17.2.1
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://rtb.gumgum.com/usersync?b=opx&i=eb3bdfce-42d9-49e3-8662-0bc88c3bf13b
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H2

200

usersync
rtb.gumgum.com/ Frame 20A0
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=sta&i=0-e450b3ed-4054-4f39-66a0-2137554f2081$ip$217.64.151.69

35 B
208 B

35ms
35ms

Image
image/gif

54.194.49.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=sta&i=0-e450b3ed-4054-4f39-66a0-2137554f2081$ip$217.64.151.69
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.49.117 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-49-117.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:05 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: https://rtb.gumgum.com/usersync?b=sta&i=0-e450b3ed-4054-4f39-66a0-2137554f2081$ip$217.64.151.69
Date: Mon, 28 Mar 2022 09:32:05 GMT
Connection: keep-alive
Content-Length: 122
Content-Type: text/html; charset=utf-8

GET
H2

200

usersync
rtb.gumgum.com/ Frame 20A0
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=oth&i=y-vW..OsFE2pemaug1rfuDrtlAuKMmrIAN0fDW~A

35 B
208 B

35ms
35ms

Image
image/gif

54.194.49.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=oth&i=y-vW..OsFE2pemaug1rfuDrtlAuKMmrIAN0fDW~A
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.49.117 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-49-117.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:05 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

date: Mon, 28 Mar 2022 09:32:05 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://rtb.gumgum.com/usersync?b=oth&i=y-vW..OsFE2pemaug1rfuDrtlAuKMmrIAN0fDW~A
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H2

200

usersync
rtb.gumgum.com/ Frame 20A0
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%...
https://rtb.gumgum.com/usersync?b=vnt&i=ee569489-ae79-11ec-8946-7f71f728f112

35 B
208 B

35ms
34ms

Image
image/gif

54.194.49.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=vnt&i=ee569489-ae79-11ec-8946-7f71f728f112
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.49.117 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-49-117.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:05 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: https://rtb.gumgum.com/usersync?b=vnt&i=ee569489-ae79-11ec-8946-7f71f728f112
Date: Mon, 28 Mar 2022 09:32:05 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: ee56948a-ae79-11ec-8946-7f71f728f112

GET
H2 204 services
sync.technoratimedia.com/ Frame 20A0 0
293 B 413ms
92ms Image
text/plain 193.122.128.135

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 193.122.128.135 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:05 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 536712135
access-control-allow-origin: https://g2.gumgum.com/
access-control-allow-credentials: true

GET
H2 200 142
match.deepintent.com/usersync/ Frame 20A0 0
44 B 417ms
96ms Image
text/plain 169.197.150.8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.8 -, , ASN (),
Reverse DNS
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:04 GMT
content-length: 0
server: b

GET
H2

200

usersync
rtb.gumgum.com/ Frame 20A0
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=e_8d243850-35d0-4d01-a838-5141a4ccebef&gdpr=0&gdpr_consent=&us_privacy=1---
https://stags.bluekai.com/site/23178?id=6RLf9PWkH7BeCd8xSYq7&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2NSSJRTDSUCXNNEDOQTFINSDQ6CTLFYTOJTVONPXA...
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=6RLf9PWkH7BeCd8xSYq7&us_privacy=1---

35 B
208 B

35ms
35ms

Image
image/gif

54.194.49.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=6RLf9PWkH7BeCd8xSYq7&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.49.117 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-49-117.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:05 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:05 GMT
P3p: CP="We do not support P3P header."
Location: https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=6RLf9PWkH7BeCd8xSYq7&us_privacy=1---
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 118
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200
OK

usersync
usersync.gumgum.com/ Frame 20A0
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=f22dcf90-839e-4dea-8d5a-c19bfbd07555

35 B
296 B

96ms
35ms

Image
image/gif

52.17.196.42

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=f22dcf90-839e-4dea-8d5a-c19bfbd07555
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.17.196.42 -, , ASN (),
Reverse DNS
Software: envoy /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:04 GMT
server: envoy
content-type: image/gif
cache-control: private, no-store, must-revalidate, max-age=0
x-envoy-upstream-service-time: 6
x-region: ireland
content-length: 35
expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=f22dcf90-839e-4dea-8d5a-c19bfbd07555
date: Mon, 28 Mar 2022 09:32:05 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET

4fc6371a-ab45-49d4-9927-ceaa306337db
sync.1rx.io/usersync/tradedesk/ Frame 20A0
Redirect Chain

https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5400361698
https://sync.1rx.io/usersync/tradedesk/4fc6371a-ab45-49d4-9927-ceaa306337db

0
0

GET
H2

200

usersync
rtb.gumgum.com/ Frame 20A0
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://rtb.gumgum.com/usersync?b=pln&i=jbuKzZYOiH5l&ev=1&pid=558355

35 B
208 B

35ms
35ms

Image
image/gif

54.194.49.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=pln&i=jbuKzZYOiH5l&ev=1&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.49.117 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-49-117.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:05 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: de-DE
location: https://rtb.gumgum.com/usersync?b=pln&i=jbuKzZYOiH5l&ev=1&pid=558355
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5799967b4-smtq2
expires: -1

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame 20A0 0
75 B 199ms
19ms Image
text/plain 185.86.137.107

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=15
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.107 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:05 GMT
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame 20A0 0
357 B 31ms
28ms Image
image/avif 54.246.157.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=309&uid=e_8d243850-35d0-4d01-a838-5141a4ccebef
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.246.157.68 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-157-68.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:05 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame F754
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://rtb.gumgum.com/usersync?b=mmh&i=42556241-8095-4400-aa7b-7b5decb18539&gdpr=0&gdpr_consent=

35 B
208 B

36ms
35ms

Document
image/gif

54.194.49.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=mmh&i=42556241-8095-4400-aa7b-7b5decb18539&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.49.117 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-49-117.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Mon, 28 Mar 2022 09:32:05 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

Date: Mon, 28 Mar 2022 09:32:05 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=360
Access-Control-Allow-Origin: *
Server: MT3 4267 dd20a5c master nrt-pixel-x20 config:1.0.0
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://rtb.gumgum.com/usersync?b=mmh&i=42556241-8095-4400-aa7b-7b5decb18539&gdpr=0&gdpr_consent=
Expires: Mon, 28 Mar 2022 09:32:04 GMT

GET
H/1.1

200
OK

usersync Show response
usersync.gumgum.com/ Frame E9AA
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=YkGAlQAQf65gtwBH
https://usersync.gumgum.com/usersync?b=atm&i=YkGAlQAQf65gtwBH&gdpr=0&gdpr_consent=&_test=YkGAlQAQf65gtwBH

35 B
296 B

141ms
35ms

Document
image/gif

52.17.196.42

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=YkGAlQAQf65gtwBH&gdpr=0&gdpr_consent=&_test=YkGAlQAQf65gtwBH
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.17.196.42 -, , ASN (),
Reverse DNS
Software: envoy /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
content-type: image/gif
content-length: 35
date: Mon, 28 Mar 2022 09:32:04 GMT
x-envoy-upstream-service-time: 5
x-region: ireland
server: envoy

Redirect headers

server: Varnish
retry-after: 0
location: https://usersync.gumgum.com/usersync?b=atm&i=YkGAlQAQf65gtwBH&gdpr=0&gdpr_consent=&_test=YkGAlQAQf65gtwBH
accept-ranges: bytes
date: Mon, 28 Mar 2022 09:32:05 GMT
via: 1.1 varnish
x-served-by: cache-hhn4072-HHN
x-cache: HIT
x-cache-hits: 0
x-timer: S1648459925.304654,VS0,VE0
cache-control: no-cache
pragma: no-cache
content-length: 0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame E723 170 B
188 B 21ms
17ms Document
image/png 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV84ZDI0Mzg1MC0zNWQwLTRkMDEtYTgzOC01MTQxYTRjY2ViZWY=&gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

content-type: image/png
date: Mon, 28 Mar 2022 09:32:05 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
server: HTTP server (unknown)
content-length: 170
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 773A 15 KB
6 KB 68ms
20ms Document
text/html 104.102.28.254

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.102.28.254 -, , ASN (),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

last-modified: Tue, 01 Feb 2022 06:38:00 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5549
content-type: text/html; charset=UTF-8
cache-control: max-age=41810
expires: Mon, 28 Mar 2022 21:08:55 GMT
date: Mon, 28 Mar 2022 09:32:05 GMT
vary: Accept-Encoding

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 73C2 0
0 881ms
109ms Document
text/plain 67.202.105.23

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.23 -, , ASN (),
Reverse DNS
Software: 33XP003 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

x-33x-status: 2000208
server: 33XP003
date: Mon, 28 Mar 2022 09:32:05 GMT

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 3BDE
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=ttd&i=4fc6371a-ab45-49d4-9927-ceaa306337db&t=1651051925

35 B
208 B

35ms
35ms

Document
image/gif

54.194.49.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=ttd&i=4fc6371a-ab45-49d4-9927-ceaa306337db&t=1651051925
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.49.117 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-49-117.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Mon, 28 Mar 2022 09:32:05 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

date: Mon, 28 Mar 2022 09:32:05 GMT
content-type: text/html
content-length: 209
location: https://rtb.gumgum.com/usersync?b=ttd&i=4fc6371a-ab45-49d4-9927-ceaa306337db&t=1651051925
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 5335
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

8ms
8ms

Document
text/html

104.92.74.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-8.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "402b2-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 28 Mar 2022 09:32:05 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

server: AkamaiGHost
content-length: 0
location: https://eus.rubiconproject.com/usync.html?p=gumgum
date: Mon, 28 Mar 2022 09:32:05 GMT
access-control-allow-credentials: true
access-control-allow-origin: *

GET
H/1.1

200
OK

usersync Show response
usersync.gumgum.com/ Frame DC64
Redirect Chain

https://cs.emxdgt.com/um?redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24EMXUID
https://cs.emxdgt.com/umcheck?apnxid=1350066995554957961&redirect=https://usersync.gumgum.com/usersync?b=emx&i=$EMXUID
https://usersync.gumgum.com/usersync?b=emx&uid=1350066995554957961brt014681648459925081053f1

35 B
296 B

77ms
30ms

Document
image/gif

52.17.196.42

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=emx&uid=1350066995554957961brt014681648459925081053f1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.17.196.42 -, , ASN (),
Reverse DNS
Software: envoy /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
content-type: image/gif
content-length: 35
date: Mon, 28 Mar 2022 09:32:04 GMT
x-envoy-upstream-service-time: 0
x-region: ireland
server: envoy

Redirect headers

content-type: text/html
date: Mon, 28 Mar 2022 09:32:05 GMT
location: https://usersync.gumgum.com/usersync?b=emx&uid=1350066995554957961brt014681648459925081053f1
content-length: 0

GET
H2

200

usersync
rtb.gumgum.com/ Frame 3BEF
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://rtb.gumgum.com/usersync?b=sus&i=YkGAlcCo8XcAACL4Zz8AAAAA

0
0

36ms
36ms

Document
image/gif

54.194.49.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=sus&i=YkGAlcCo8XcAACL4Zz8AAAAA
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.49.117 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-49-117.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Mon, 28 Mar 2022 09:32:05 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

Server: nginx
Date: Mon, 28 Mar 2022 09:32:05 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private
Location: https://rtb.gumgum.com/usersync?b=sus&i=YkGAlcCo8XcAACL4Zz8AAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-Ads-Time: 6
X-SO-HostName: a-ad40343.dc2p.scaleout.jp
X-SO-LB-Hostname: m-tgng19.dc4p.scaleout.jp
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":27,"gdpr":true,"ipv4":"0.0.0.0","key":"YkGAlcCo8XcAACL4Zz8AAAAA","privacy_sensitive":true,"uid":"","upstream_id":"a-ad40343"}
X-SO-Key: YkGAlcCo8XcAACL4Zz8AAAAA
X-SO-IP: 217.64.151.69
X-SO-Cluster-ID: 27
X-SO-Upstream-ID: a-ad40343

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 55B1
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://rtb.gumgum.com/usersync?b=rth&i=EHb3I4mynuHvQAH7lZ9S&pi=gumgum&tc=1

35 B
208 B

36ms
35ms

Document
image/gif

54.194.49.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=rth&i=EHb3I4mynuHvQAH7lZ9S&pi=gumgum&tc=1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.49.117 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-49-117.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Mon, 28 Mar 2022 09:32:05 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

date: Mon, 28 Mar 2022 09:32:05 GMT Mon, 28 Mar 2022 09:32:05 GMT
location: https://rtb.gumgum.com/usersync?b=rth&i=EHb3I4mynuHvQAH7lZ9S&pi=gumgum&tc=1
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
content-length: 0

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 59DD
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YkGAlOjc5F6ZU-NcsbhH2gAABF8AAAIB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YkGAlOjc5F6ZU-NcsbhH2gAABF8AAAIB&dcc=t

43 B
645 B

100ms
99ms

Image
image/gif

209.54.180.144

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YkGAlOjc5F6ZU-NcsbhH2gAABF8AAAIB&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

HTTP/1.1

Server

209.54.180.144 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:05 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: GVJXGT0Z48CWNKE0T68W
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:05 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: DZK20Y50ZQFX9MYG4NJN
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YkGAlOjc5F6ZU-NcsbhH2gAABF8AAAIB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame 59DD 70 B
264 B 31ms
30ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:05 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 59DD 170 B
188 B 18ms
17ms Image
image/png 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YkGAlOjc5F6ZU-NcsbhH2gAABF8AAAIB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 59DD
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YkGAlOjc5F6ZU.NcsbhH2gAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEIGZH9mInseR3HkJqb4zy7Q&google_cver=1&gdpr=1&google_hm=2

43 B
999 B

39ms
32ms

Image
image/gif

2.20.157.55
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEIGZH9mInseR3HkJqb4zy7Q&google_cver=1&gdpr=1&google_hm=2
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 2.20.157.55 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-157-55.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:05 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 28 Mar 2022 09:32:05 GMT

Redirect headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:05 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEIGZH9mInseR3HkJqb4zy7Q&google_cver=1&gdpr=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 341
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 59DD
Redirect Chain

https://ad.turn.com/r/cs?pid=21&gdpr=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=7665892162845194743

43 B
991 B

44ms
31ms

Image
image/gif

2.20.157.55
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=7665892162845194743
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 2.20.157.55 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-157-55.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:05 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 28 Mar 2022 09:32:05 GMT

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=7665892162845194743
pragma: no-cache
date: Mon, 28 Mar 2022 09:32:04 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H/1.1 400
Request failed due to privacy signals getuid
ib.adnxs.com/ Frame 59DD 0
0 23ms
21ms Image
text/html 37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

GET
H2 200 YkGAlOjc5F6ZU-NcsbhH2gAABF8AAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 59DD 43 B
991 B 40ms
33ms Image
image/gif 2a05:d018:d29:3605:2e02:fe1c:9c40:529

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/YkGAlOjc5F6ZU-NcsbhH2gAABF8AAAIB?gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3605:2e02:fe1c:9c40:529 -, , ASN (),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:05 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 59DD
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48&gdpr=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=no-consent&expiration=1651051925

43 B
982 B

88ms
57ms

Image
image/gif

2.20.157.55
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=no-consent&expiration=1651051925
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 2.20.157.55 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-157-55.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Mar 2022 09:32:05 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 28 Mar 2022 09:32:05 GMT

Redirect headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:04 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=64&external_user_id=no-consent&expiration=1651051925
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2 200 sync
ads.servenobid.com/ Frame 59DD 0
356 B 29ms
28ms Image
image/avif 54.246.157.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=YkGAlOjc5F6ZU-NcsbhH2gAABF8AAAIB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.246.157.68 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-157-68.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date: Mon, 28 Mar 2022 09:32:05 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 5335 32 KB
10 KB 13ms
12ms Script
text/html 104.92.74.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-8.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 9ad1bb44af5999c63ca2cb0cc07b90c55f3f4752a55578ff5fb7e2e953161e61

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date: Mon, 28 Mar 2022 09:32:05 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Mar 2022 16:28:01 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=83072
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9540
Expires: Tue, 29 Mar 2022 08:36:37 GMT

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame 5335 0
239 B 9ms
9ms Image
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=L1AIH3IL-1R-IZG2
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Content-Type: image/gif

GET PugMaster
image6.pubmatic.com/AdServer/ Frame 773A 0
0

GET sync
ads.servenobid.com/ Frame A0B9 0
0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame A0B9
Redirect Chain

https://demand.trafficroots.com/sync.php?partner=3379&redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D137%26partneruserid%3D%7Btrafficroots_id%7D&gdpr=0&gdpr_...
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=137&partneruserid=5ce0c76505&gdpr=0&gdpr_consent=

43 B
441 B

23ms
23ms

Image
image/gif

185.86.139.115

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=137&partneruserid=5ce0c76505&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.115 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:05 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Date: Mon, 28 Mar 2022 09:32:05 GMT
Referrer-Policy: origin-when-cross-origin
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Type: text/html; charset=UTF-8
Location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=137&partneruserid=5ce0c76505&gdpr=0&gdpr_consent=
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Connection: keep-alive
X-Content-Type-Options: nosniff

GET smartadserver
sync.1rx.io/usersync2/ Frame A0B9 0
0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame A0B9
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=0128d0c2-f77e-48ec-a6d1-ef71468f845a&gdpr_consent=null&gdpr=0

43 B
426 B

64ms
20ms

Image
image/gif

185.86.139.115

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=0128d0c2-f77e-48ec-a6d1-ef71468f845a&gdpr_consent=null&gdpr=0
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.115 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Mar 2022 09:32:05 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=0128d0c2-f77e-48ec-a6d1-ef71468f845a&gdpr_consent=null&gdpr=0
date: Mon, 28 Mar 2022 09:32:05 GMT
server: _
content-length: 0

GET img
sync.mathtag.com/sync/ Frame A0B9 0
0

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 8EFA 0
743 B 13ms
13ms Script
text/html 37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS