herbalserver.me Open in urlscan Pro
2606:4700:3037::6815:3b5e Public Scan

Go To Rescan
Add Verdict Report

URL:
https://herbalserver.me/
Submission: On February 10 via manual (February 10th 2022, 3:09:56 pm UTC) from SG — Scanned from DE

Summary HTTP 197 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 31 IPs in 6 countries across 26 domains to perform 197 HTTP transactions. The main IP is 2606:4700:3037::6815:3b5e, located in United States and belongs to CLOUDFLARENET, US. The main domain is herbalserver.me.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 11th 2021. Valid for: a year.

This is the only time herbalserver.me was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
18	2606:4700:303... 2606:4700:3037::6815:3b5e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
27	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:808::2008	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
1 17	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
13	2a00:1450:400... 2a00:1450:4001:80f::200e	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
4	142.250.186.66 142.250.186.66	15169 (GOOGLE) (GOOGLE)
2 8	2a00:1450:400... 2a00:1450:4001:810::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
1	142.250.185.226 142.250.185.226	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
28	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
3 4	2620:116:800d... 2620:116:800d:21:3175:5196:e3fd:8c1d	16509 (AMAZON-02) (AMAZON-02)
3 3	18.196.159.27 18.196.159.27	16509 (AMAZON-02) (AMAZON-02)
3 30	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
4	35.186.253.211 35.186.253.211	15169 (GOOGLE) (GOOGLE)
5 5	185.64.190.78 185.64.190.78	62713 (AS-PUBMATIC) (AS-PUBMATIC)
5 5	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	141.95.66.118 141.95.66.118	16276 (OVH) (OVH)
2	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:800::2006	15169 (GOOGLE) (GOOGLE)
1 3	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	185.33.221.53 185.33.221.53	29990 (ASN-APPNEX) (ASN-APPNEX)
1	34.98.67.61 34.98.67.61	15169 (GOOGLE) (GOOGLE)
2 3	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
2 2	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a05:d01c:1d8... 2a05:d01c:1d8:8102:7312:c82c:fb3:8dc6	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:4006:81d::2003	15169 (GOOGLE) (GOOGLE)
1	66.102.1.155 66.102.1.155	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:13::a	15169 (GOOGLE) (GOOGLE)
2 2	54.194.183.173 54.194.183.173	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:20:... 2606:4700:20::681a:825	13335 (CLOUDFLAR...) (CLOUDFLARENET)
197	31

18 2606:4700:3037::6815:3b5e (United States)

ASN13335 (CLOUDFLARENET, US)

herbalserver.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:80f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:810::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:116:800d:21:3175:5196:e3fd:8c1d (United States) 3 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.196.159.27 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-159-27.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

30 142.250.186.34 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.64.190.78 (United Kingdom) 5 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 69.173.144.139 (Frankfurt am Main, Germany) 5 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 141.95.66.118 (France) 2 redirects

ASN16276 (OVH, FR)
PTR: ns3206961.ip-141-95-66.eu

googlecm.hit.gemius.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:800::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.18.234.21 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.33.221.53 (Amsterdam, Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.67.61 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 61.67.98.34.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.215.191 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d01c:1d8:8102:7312:c82c:fb3:8dc6 (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:81d::2003 (Queens, United States)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.102.1.155 (United States)

ASN15169 (GOOGLE, US)
PTR: wb-in-f155.1e100.net

bid.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

gcdn.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:13::a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

r5---sn-4g5lzned.c.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.194.183.173 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-194-183-173.eu-west-1.compute.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:825 (United States)

ASN13335 (CLOUDFLARENET, US)

cookieconsent.popupsmart.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
55	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 92 tpc.googlesyndication.com — Cisco Umbrella Rank: 120	632 KB
49	doubleclick.net 4 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 37 cm.g.doubleclick.net — Cisco Umbrella Rank: 175 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 276 bid.g.doubleclick.net — Cisco Umbrella Rank: 448	204 KB
22	google.com 2 redirects fundingchoicesmessages.google.com — Cisco Umbrella Rank: 2400 www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 59	87 KB
18	herbalserver.me herbalserver.me	298 KB
13	2mdn.net 1 redirects s0.2mdn.net — Cisco Umbrella Rank: 246 gcdn.2mdn.net — Cisco Umbrella Rank: 906 r5---sn-4g5lzned.c.2mdn.net — Cisco Umbrella Rank: 648117	2 MB
8	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35 imasdk.googleapis.com — Cisco Umbrella Rank: 407	131 KB
7	gstatic.com fonts.gstatic.com www.gstatic.com csi.gstatic.com	91 KB
5	rubiconproject.com 5 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 288	2 KB
5	pubmatic.com 5 redirects image6.pubmatic.com — Cisco Umbrella Rank: 582	2 KB
4	openx.net rtb.openx.net — Cisco Umbrella Rank: 1330	542 B
4	quantserve.com 3 redirects cms.quantserve.com — Cisco Umbrella Rank: 927	1 KB
4	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 146	151 KB
4	google.de www.google.de — Cisco Umbrella Rank: 6342 adservice.google.de — Cisco Umbrella Rank: 9027	1 KB
3	rlcdn.com 2 redirects id.rlcdn.com — Cisco Umbrella Rank: 548	1 KB
3	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 210	3 KB
3	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 488	3 KB
3	agkn.com 3 redirects d.agkn.com — Cisco Umbrella Rank: 487	2 KB
3	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 99 partner.googleadservices.com — Cisco Umbrella Rank: 741	17 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 50	139 KB
2	everesttech.net 2 redirects pixel.everesttech.net — Cisco Umbrella Rank: 2907	751 B
2	addthis.com 2 redirects e.dlx.addthis.com — Cisco Umbrella Rank: 1492	1 KB
2	gemius.pl 2 redirects googlecm.hit.gemius.pl — Cisco Umbrella Rank: 7252	547 B
1	popupsmart.com cookieconsent.popupsmart.com — Cisco Umbrella Rank: 176913	2 KB
1	innovid.com ag.innovid.com — Cisco Umbrella Rank: 1383	296 B
1	mookie1.com odr.mookie1.com — Cisco Umbrella Rank: 776	324 B
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	347 B
197	26

	Domain	Requested by
30	cm.g.doubleclick.net	3 redirects googleads.g.doubleclick.net herbalserver.me
28	tpc.googlesyndication.com	googleads.g.doubleclick.net herbalserver.me tpc.googlesyndication.com imasdk.googleapis.com pagead2.googlesyndication.com
27	pagead2.googlesyndication.com	herbalserver.me pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
18	herbalserver.me	herbalserver.me
16	googleads.g.doubleclick.net	1 redirects pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net herbalserver.me
12	fundingchoicesmessages.google.com	pagead2.googlesyndication.com
10	s0.2mdn.net	herbalserver.me s0.2mdn.net
8	www.google.com	2 redirects herbalserver.me googleads.g.doubleclick.net tpc.googlesyndication.com
6	fonts.googleapis.com	herbalserver.me googleads.g.doubleclick.net
5	pixel.rubiconproject.com	5 redirects
5	image6.pubmatic.com	5 redirects
4	rtb.openx.net	googleads.g.doubleclick.net
4	cms.quantserve.com	3 redirects googleads.g.doubleclick.net
4	www.googletagservices.com	googleads.g.doubleclick.net herbalserver.me
3	id.rlcdn.com	2 redirects googleads.g.doubleclick.net
3	ib.adnxs.com	2 redirects googleads.g.doubleclick.net
3	dsum-sec.casalemedia.com	1 redirects googleads.g.doubleclick.net
3	d.agkn.com	3 redirects
3	fonts.gstatic.com	fonts.googleapis.com
3	www.googletagmanager.com	herbalserver.me www.googletagmanager.com
2	pixel.everesttech.net	2 redirects
2	r5---sn-4g5lzned.c.2mdn.net	googleads.g.doubleclick.net herbalserver.me
2	csi.gstatic.com	imasdk.googleapis.com
2	googleads4.g.doubleclick.net	herbalserver.me
2	e.dlx.addthis.com	2 redirects
2	imasdk.googleapis.com	googleads.g.doubleclick.net
2	www.gstatic.com	googleads.g.doubleclick.net
2	googlecm.hit.gemius.pl	2 redirects
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
2	www.google.de	herbalserver.me
2	www.googleadservices.com	www.googletagmanager.com www.googleadservices.com
1	cookieconsent.popupsmart.com	herbalserver.me
1	gcdn.2mdn.net	1 redirects
1	bid.g.doubleclick.net	imasdk.googleapis.com
1	ag.innovid.com	googleads.g.doubleclick.net
1	odr.mookie1.com	googleads.g.doubleclick.net
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	www.google-analytics.com	www.googletagmanager.com
197	39

This site contains links to these domains. Also see Links.

Domain
t.me

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-04-11` - `2022-04-10`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-01-10` - `2022-04-04`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.mookie1.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-22` - `2022-03-25`	a year	crt.sh
*.innovid.com RapidSSL RSA CA 2018	`2020-02-07` - `2022-04-07`	2 years	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
*.c.docs.google.com GTS CA 1C3	`2022-02-01` - `2022-04-12`	2 months	crt.sh

This page contains 25 frames:

Primary Page: https://herbalserver.me/
Frame ID: 100923ADB5E0D01F9627FEACCF9D740D
Requests: 56 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20190131/zrt_lookup.html
Frame ID: 41D10A079088F865512A64F4EBED5F32
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&adk=1812271804&adf=3025194257&lmt=1644505789&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fherbalserver.me%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=62&bdt=255&idt=80&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2321163080596&frm=20&pv=2&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=263
Frame ID: 2C50A001545CFF16EFAFB732D6A7BD03
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267
Frame ID: 9BEF05CAC5F0EF60CCE3EDD1FCA584A0
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270
Frame ID: A74A6155EC7739395AFAB9871FA8A8FD
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=869763061&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=1&bdt=256&idt=120&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1140x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2252&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=tXulFzcMua&p=https%3A//herbalserver.me&dtd=272
Frame ID: 7E8B664EC44F9C3DCA52EB075A5956FE
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 69F786694E0C2B7968CA8FBC8EDAD985
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 4E1DC8AED6ECDF053A362D5DD0785B5C
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1
Frame ID: E831FB72954667442C015E71795BCA5D
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1
Frame ID: 77DCA89B2DE26303722FAAAB9F142586
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeVmwEQ5tLurwIYuOiXwQEwAQ&v=APEucNUXPlecAny8ru-dErtDW3I7mHXPk0Pn4sB3-4_Gm_fVy9CAgV-T0113ZqX9_O27OA4q0HozA-ufYv0WFU28KwjdxCAlS12jmM90CzdczLHF1aB-mhWWUBpUz8WRswRKMiK6R9Tv_DR0W9eebWoI2vCl-K3v8XFEGDBoP_xRWl4MOKeT9YE
Frame ID: 31632108A45D8FE3583B8CB9EFD183E7
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BOEInHJFCgjHAooOPO_itMw9b0zu5pW7ySY2pqPj2TbM893H3lHegtHv41b_j9VKo9K7jvVIYbPK36H47viiozvLxrsRlZ_0tzlAb8XKjqmaF5Wz3GV_in8NmWfrvuQbv_LhO0Yv91JdTP8zXmjAOjNkJIkA&dbm_d=AKAmf-DdvXFwvcaueNsXDHBnveR6-6vu3I5DUOZkAoIhM3UARff2eD9iRYak8FbsQpdlYkpg7maP_Vp0WvtgPIMwHB5T54JK5ED1lDZfOab09IA6mheXWGGo-3bHtHSJ_25Z_aVe82iBZ1-AhXOzKI0O2q4JXDZGVMtjkaBr8FIJuLrKrUtwmuI5TW5ItiTX4awripTJOAamp0WqhWsSa9DbF2MrhkA_xzmMMnU58WYes6V5-8_X1coTUqsoF25SE3MU1Dh_XmwO67fWApgklE109n0jemXIgx5bpKppYMIg6xxo4H9zQeXoYZaDMBt_m4_LULkpyK_ZqVpMxpV3E9GNSKYxWo-M_nXX3fwdl4buIWJUUpGa070JSvfZSDPh0duyO86gc5SKSirCJGl3OUNb6hzMdMtvhfRsd0iTDRO9eCfk9XXtMdbvtL1RRdqGnruTZ4meIpM6HUIIkb4guWKNZXaKeA3Ky4fybfn3Md4etcx1MmXs7L4i13EbJPUm3Ux_En5vMm4vu8Zcx1ZUC7IPB5FuDG9PJlKhSHxZerx3VmWmoc6E6jhVXYsxZ8wMzaqcXDZkLLe1vFmZXNCcIvchZL5V8pMdQB4MGqfEO_ELFKlq-XKV9eo2JlTPzhMxhrA4Hu6gAzbKQiUo8pj7u0IEEYM_0IVmFjyz5L1pygYngReZOusULjt2PFOgB811Fyv_82ohLGmAK_w79NNzwX0XAceqKER-ZXRPJ_s5XiuExEVZFSbi2o6VYvQbs71tKg8a_i_OvYxg3GGXHhveZoCDzbVAA2sKO33Erd7UGbnCQV2-OdZYkce34Xyfo01g4caVEnk3-ESMOJVSZZzGZnm6A1vIl6tue971FY7u-2nXBQTJmq_tM6VmTehcenJ-k2-XiBVAJBl78rf3hLmNxyhfA9ZW0ROP0-H9uaA1kIFB78k_Sv4wXim1vflQeMS5zExVRXHkrqVTjZDfU7EuNUOejyqUdbD0tdLILyCdr35OBJzfbY99vyXOd8cRrCW8lXZjKhVGKJ7ybvg_97PAFhs08cf7wnA_SCLlObU_f8Xnm6cZQY4Zgc01EvtnM_OWCjwrmrCsbeuun4iPnZQa_3ddbNNQpJHKd2JZ_EfgZanRBKKhU-DBG25MBTI7mtiEVBKsMdTGazYwP2OuA8ghKtRlqdZJJjX7HBtpMJ9EGjU6m-pCnOGTq3NLFIcyzl_pmVbNQq3qMhNhR0zmQnpXmtoqeGnZtAP4ioPZvV6t6A0AaQlJ-3cFc6hXO2eyYMW0d5RPWsz3BhrjrVRVydBOElfQtzC5Yi1vPS2XIN2cSc06kSESea47TLol-1teQvM6KyyZsURntpWvqsDsMRoEoZC8efQeK25MwBF4LwNj8w1UB_-YMGHLD3KtlKE06LQ77jRUS4PdZGlo4z557lsnhcn7qI_InE-eKvTFiVtxsSi4qT7UkRGzvVgiSBNPrsjPgZNSnX3jH-hm7tEek5iPc8-pL-oi8UTz7wHprMzRxq79IX59ZxsinekW9Pc5ueBAHTXh1SWwC236oA0tn-VOqmA_iKvD2wCTy9Er9jmnk1O8hnvNqOSldJfrq1rmnFB05VUIIDtmpawsjtA-aCexwEDz2GThvdLG-nh5Oh_ZDDRVN7cvJg284X0KvXXYWUWYHbGzjGwlmyVBQBca9tGf9RA1M08LfmuDC6CxIZt5YyKlhYMLKzf_laMtBQjk6VV9EMq9UAoSbI0hEUPYIGGsN7i1pUB-20uqu9_899N1IrH3qEu5o5xUG6prpzF25DhufBFn4vi0WAJ8HUhiH1K3B46Yl_1xGIYGNAkjq3ZUCh6KEEiarlc-QTenAaOiOLT7qwMOMYovjvz5MERJFKrsGKj777vN3TV_hvnrjKQdJ9_t-jkX4AK-n1SW8Pq7Ylt4T4i1BrBw-2ouUJGqf_meTavDcwqB2RdeC68ZUGaOSq8wNEPvk-3Djmagw1tko3HDhaw_BziPuiTF6Gf8alB-bnpjpMPkJPyP75ukGB8BtAzKoLRFL4KM15mCpS0bzIRT3EB8o0FFa89ucDUow2XOXAVr1SVsM-fMI261ramLuowDDqx7hAiHfZVB8D0dh47Sv4r4DhF7RRumhibIHqScCIwFPpRYIZtJd-uymVOnBiYJjYFRyJ-Aq6orHJXwUICT953n9m_IGOw0Pm5a1bEdbYZG_UeQH4HKSaG1VOlHhWkL50_1DcNa9NDtUqhOEBRV-QJ_pt3DylqWRUhtFLON5rTIgalWdlXla20uttp5wLuhrkKDPvY3raNBvrGoGNp_P_g7lIeaQye1MHCVilmJNDVfB9pHydTjIAfZQCjrqedNvD21BfQTV1mXZ1Vj5G_CpzsclKs_bx4fWGG5VkPPCAaljZa7P6ezfP-E0PPr2ta-l0XPA2TaQMJz51uZtho-x7Wcn0D7JeZ_lQefaZ48mPZpgjtsgSS6I1ck_g2MbxLWhqo_WRBPALu6RAsie6fCpsgz9GTpNd3NdyXwzqDVz4EYGdVRDq7WFBgQj0peU2T2bAUEEFZS2rMQmg6dbUQMxKCelS3mcLocO3GfYl18T6djuouNjBja9T1KiDTKSrv_JKj1xUp89h9mpYX2wp7ZTQ_rdiLMPGYSItXusOMpTGznlheyavaR1KBFmKLZlkoJ3t2PKwL2aTkMmaF-zwiQwHLeOjvAfM0xvDNam8jvNq2eR9T8f-556LoHfXYmmCjUUPzq5JbGL_XVCi3iTyFK_PVcpxIhra2isMoEKzK3jnQKrmaQR0lJr-ga2IMTnQd-xs6ElM6a88QFDIJDcFBg_AFAnzxeZYKUnRiy5VgluvevhtDPSZFh2D662rnHCx5PnaEQ28mVDnpvj-mAKFtHwQSC5yRDKioKQaCPHftz2iHASz3zfED-t-i7b_1ZN-WQlQCqaFqENC-_7CJKEPEwtzWjDUad8jjTAjladuOp3nM3O34CaK_tVdzDIgM0nIhR_mynHf8KQZrX9mX4mHdavLbYqE1r_bDK&cid=CAASEuRoz_zmuGxcGDe3khBb-Aajmw&rfl=2%2Chttps%253A%252F%252Fherbalserver.me%252F%240
Frame ID: C3971A97B91AFE2C305839BE4F2AFBE7
Requests: 14 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: F60FADE183240A3B6D5986E6D67137F5
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 9C49DB692576C50A7FDC75C69B214236
Requests: 8 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/gzxFwBIDWVjrNRUrZhLg_NzoVxp69M9kEQUe35bI4iA.js
Frame ID: 8C2E4339895C2B365F97FC1BDA16C814
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/abg_lite_fy2019.js
Frame ID: 19BECAFAC17AC55FBA594087AC94459E
Requests: 13 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 86B050DAD57EC64F985B0D86D5D725C0
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/gzxFwBIDWVjrNRUrZhLg_NzoVxp69M9kEQUe35bI4iA.js
Frame ID: A055E12726742C17051AA5E85634C179
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/gzxFwBIDWVjrNRUrZhLg_NzoVxp69M9kEQUe35bI4iA.js
Frame ID: 5FC79E6EF13A7B6DF7C7F3CB64ACB785
Requests: 1 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html
Frame ID: 402DCAC9E16B207B25DD4648EF2518FB
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 51B2B9B79FDC130D6654BA3EB0B6F4C9
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 62386D4D3A21EA0A81D0BAD89BDF80D8
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html
Frame ID: F75BC625D471F870DCF17C2A553398D3
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: B9A73D3658CF7D427D0F5AF680512405
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 5E8ED5847F153C4A83E135DEE6DB4D0B
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Free SSH And VPN Servers

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Mautic (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

[^a-z]mtc.*\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

197
Requests

84 %
HTTPS

59 %
IPv6

26
Domains

39
Subdomains

31
IPs

6
Countries

4087 kB
Transfer

6638 kB
Size

33
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://t.me/rafli11
Title: Support

Search URL Search Domain Scan URL

URL: https://t.me/Phreaker_SXTCP
Title: Join Our Group Telegram

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 33

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/848695486/?random=379389542&cv=9&fst=1644505789286&num=1&label=Y1m_COLLtv4CEL6h2JQD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa290&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fherbalserver.me%2F&tiba=Free%20SSH%20And%20VPN%20Servers&auid=1280108730.1644505789&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=vSoFYtn9E-fDmLAPyoWygAQ&sscte=1&crd=CNPgGw HTTP 302
https://www.google.com/pagead/1p-conversion/848695486/?random=379389542&cv=9&fst=1644505789286&num=1&label=Y1m_COLLtv4CEL6h2JQD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa290&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fherbalserver.me%2F&tiba=Free%20SSH%20And%20VPN%20Servers&auid=1280108730.1644505789&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CNPgGw&is_vtc=1&ocp_id=vSoFYtn9E-fDmLAPyoWygAQ&cid=CAQSKQCNIrLMoxdYqoTJFYpUD2oyKJmxLezJ4f0WVnBinFnuPh26px7meJQJ&random=101031410&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-conversion/848695486/?random=379389542&cv=9&fst=1644505789286&num=1&label=Y1m_COLLtv4CEL6h2JQD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa290&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fherbalserver.me%2F&tiba=Free%20SSH%20And%20VPN%20Servers&auid=1280108730.1644505789&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CNPgGw&is_vtc=1&ocp_id=vSoFYtn9E-fDmLAPyoWygAQ&cid=CAQSKQCNIrLMoxdYqoTJFYpUD2oyKJmxLezJ4f0WVnBinFnuPh26px7meJQJ&random=101031410&resp=GooglemKTybQhCsO&ipr=y&prhg=0

Request Chain 58

https://d.agkn.com/pixel/2175/?google_gid=CAESENe3irKS4bsHwVE2IuBT7aI&google_cver=1&google_push=AYg5qPJa9IqVAf81tB79VycegikKL_bZbtjeJ0eZUBHFEjNfIiivpCtWe-vMuGjfnJ2W3HN41Ti6LOS7QoFW80R-jNthSDF4B-j- HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJa9IqVAf81tB79VycegikKL_bZbtjeJ0eZUBHFEjNfIiivpCtWe-vMuGjfnJ2W3HN41Ti6LOS7QoFW80R-jNthSDF4B-j-&google_hm=Q0FFU0VOZTNpcktTNGJzSHdWRTJJdUJUN2FJ

Request Chain 60

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEO80gZpCZ7O0Y-z3Gi5DkbY&google_cver=1&google_push=AYg5qPKJiuWI2B9thPZAi78aXCMtwOxrP83fJN32gh9tcebr_h-a8HrA-wZsmY4CzTyiq3QFL1k9hn7M5cINJb1vjjxAUhw1c5Qp HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEO80gZpCZ7O0Y-z3Gi5DkbY&google_cver=1&google_push=AYg5qPKJiuWI2B9thPZAi78aXCMtwOxrP83fJN32gh9tcebr_h-a8HrA-wZsmY4CzTyiq3QFL1k9hn7M5cINJb1vjjxAUhw1c5Qp&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=iLtx2ZDaRBezbC635xgl2A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKJiuWI2B9thPZAi78aXCMtwOxrP83fJN32gh9tcebr_h-a8HrA-wZsmY4CzTyiq3QFL1k9hn7M5cINJb1vjjxAUhw1c5Qp

Request Chain 61

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJxG0gz6AaiBAdc0IsMb0nc&google_cver=1&google_push=AYg5qPIwE-8onP-7qHujByfTtA1LB9BhzYUpq9Qg74apeSAFcl-fKgI_rk_pmY8DJTvpREZMzcSGgraVPzKdzssHwY9SeTBZvmo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFDWk8tMVgtNUpOUg==&google_push=AYg5qPIwE-8onP-7qHujByfTtA1LB9BhzYUpq9Qg74apeSAFcl-fKgI_rk_pmY8DJTvpREZMzcSGgraVPzKdzssHwY9SeTBZvmo

Request Chain 62

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei

Request Chain 63

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEOgFnb36wDHIx_rdVmKhBrI&google_cver=1&google_push=AYg5qPJSG_8bDx4zOP5lFZlXcmlpLg6_razSZIYxa_ssVV1S7QYr3QulW-Z4QhtZhSzejmMb2Ij4VJlgKjxlxlOcg-koaj8lrlVu HTTP 301
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJSG_8bDx4zOP5lFZlXcmlpLg6_razSZIYxa_ssVV1S7QYr3QulW-Z4QhtZhSzejmMb2Ij4VJlgKjxlxlOcg-koaj8lrlVu&google_hm=

Request Chain 66

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 118

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDtRf3baGq51irlw2fj-mJo&google_cver=1

Request Chain 119

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YgUqvvu2YNJWVdB0BYejVAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDtRf3baGq51irlw2fj-mJo&google_cver=1

Request Chain 120

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESECX9AuQ4-rx4S4NMO6Kv6ng&google_cver=1

Request Chain 121

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc2MTM1ODEyODU2NTA5NTAwMg%3D%3D

Request Chain 123

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFBU7HJwaOl_J8J6OyKF6bE&google_cver=1&google_push=AYg5qPKWRQha9QJWCSTuPw28VE8erq3I9EqCR2RMzL8WB61_9HLB-GE6LfDe6-iqETagm3NKZ3zwxa_W0x8gwKhmAmSZPbOStnwn HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPKWRQha9QJWCSTuPw28VE8erq3I9EqCR2RMzL8WB61_9HLB-GE6LfDe6-iqETagm3NKZ3zwxa_W0x8gwKhmAmSZPbOStnwn&google_hm=TsJsBe8YFTGp9DH2ChS5Pg

Request Chain 126

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEO80gZpCZ7O0Y-z3Gi5DkbY&google_cver=1&google_push=AYg5qPIybj6ScuGNjFvaFxxfFs_2GoIReUIZomdHpZZHsOHlCL3NS8y3nsS2JCKEWJpkplxXRzZvbQq6CLcIw0Sf5ME44O6TfGJ7 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=iLtx2ZDaRBezbC635xgl2A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIybj6ScuGNjFvaFxxfFs_2GoIReUIZomdHpZZHsOHlCL3NS8y3nsS2JCKEWJpkplxXRzZvbQq6CLcIw0Sf5ME44O6TfGJ7

Request Chain 127

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJxG0gz6AaiBAdc0IsMb0nc&google_cver=1&google_push=AYg5qPKS_CYcVTp5Rj6YeFfb6H6ds7m6M6YeJ_Lqrp9XsqUkTb5II6nDuYQM13w_42yto8mMZscBxDtsXZ0iFAtUtz5EsenE7olf HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFESFktWS0zRjlV&google_push=AYg5qPKS_CYcVTp5Rj6YeFfb6H6ds7m6M6YeJ_Lqrp9XsqUkTb5II6nDuYQM13w_42yto8mMZscBxDtsXZ0iFAtUtz5EsenE7olf

Request Chain 128

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc

Request Chain 129

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEOgFnb36wDHIx_rdVmKhBrI&google_cver=1&google_push=AYg5qPKtNAkUS7TZpN0_0y8OOPClIL7lFCOI5Zhl77cGPsSL61_jDCi0osy50Yrgo8mrNCRaJ1MGZanG-Ee6JxT1W8d4hiqG_ntdqg HTTP 301
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKtNAkUS7TZpN0_0y8OOPClIL7lFCOI5Zhl77cGPsSL61_jDCi0osy50Yrgo8mrNCRaJ1MGZanG-Ee6JxT1W8d4hiqG_ntdqg&google_hm=

Request Chain 131

https://d.agkn.com/pixel/2175/?google_gid=CAESENe3irKS4bsHwVE2IuBT7aI&google_cver=1&google_push=AYg5qPJkdVx29VwPjG0u7MykVQ4Duw3LM40PZ6XeAbEDFrp0JQNxuvzAjP2v5uli4FXQvJ936qVTp7rjN7R-h1nFXKzTkFHNm7Gb HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJkdVx29VwPjG0u7MykVQ4Duw3LM40PZ6XeAbEDFrp0JQNxuvzAjP2v5uli4FXQvJ936qVTp7rjN7R-h1nFXKzTkFHNm7Gb&google_hm=Q0FFU0VOZTNpcktTNGJzSHdWRTJJdUJUN2FJ

Request Chain 132

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPJWwYps6P-w2yXxqN2Y5mNFak89-hWHLyiMdqwtWWm41dlq32H81SGO2IiV983mXvEeGMM821p8gro3_6UZKcp0a3ritc0&google_gid=CAESEKeGwdBLgaJQagKNAOUYHdA&google_cver=1 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCL_VlJAGEgUI6AcQAEIASm9nb29nbGVfcHVzaD1BWWc1cVBKV3dZcHM2UC13MnlYeHFOMlk1bU5GYWs4OS1oV0hMeWlNZHF3dFdXbTQxZGxxMzJIODFTR08ySWlWOTgzbVh2RWVHTU04MjFwOGdybzNfNlVaS2NwMGEzcml0YzA HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwTEtzRnJRX2FaN3VvSklfZ1FINFFVOU5tbW5JaV9TZWhnMmJ5ZnFYdHB0UQ==&google_push

Request Chain 133

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKQO9AgWWVoA0rxLfSO_5qVo0iuBupBQdW0Udnnj8p9aiZ_-PXyciu4AGpE-pWxmPtja2CoMxnKiMvvt66_JZ280zJjJee9&google_gid=CAESEMY65MM-dqBJBKa5yTAYIDI&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKQO9AgWWVoA0rxLfSO_5qVo0iuBupBQdW0Udnnj8p9aiZ_-PXyciu4AGpE-pWxmPtja2CoMxnKiMvvt66_JZ280zJjJee9&google_gid=CAESEMY65MM-dqBJBKa5yTAYIDI&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAyMTAxNTA5NTEwMDAxMTUyOTc5OTEyMA%3D%3D&google_push=AYg5qPKQO9AgWWVoA0rxLfSO_5qVo0iuBupBQdW0Udnnj8p9aiZ_-PXyciu4AGpE-pWxmPtja2CoMxnKiMvvt66_JZ280zJjJee9

Request Chain 134

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJxG0gz6AaiBAdc0IsMb0nc&google_cver=1&google_push=AYg5qPKZ1cY9BJ2aOwDchiXUmhfewuZTuDnmhE9vGzNeeN6Qn0BHNBZI4b5dX5S7_r7-ANpQDrglyhX9NmObD5BCit56_TfxOK0Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFESkstMjgtMThOQg==&google_push=AYg5qPKZ1cY9BJ2aOwDchiXUmhfewuZTuDnmhE9vGzNeeN6Qn0BHNBZI4b5dX5S7_r7-ANpQDrglyhX9NmObD5BCit56_TfxOK0Y

Request Chain 135

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF

Request Chain 154

https://gcdn.2mdn.net/videoplayback/id/6253bb0e0d9b5336/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3788872058/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/signature/9B30FCBF8ACE2898F820DD06DF1A0602D448C606.411836930048FC541E1834414F092546E7DF508F/key/ck2/file/file.mp4 HTTP 302
https://r5---sn-4g5lzned.c.2mdn.net/videoplayback/id/6253bb0e0d9b5336/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3788872058/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/3C5263209B0E6ADF53B95FAAC558CFFD64B18AA7.839B87A41A14587312C6AD1CB443A377A75DAC0D/key/cms1/cms_redirect/yes/mh/Z9/mip/2001:1b60:1010:2:1012:c406:9e64:9203/mm/42/mn/sn-4g5lzned/ms/onc/mt/1644505615/mv/u/mvi/5/pl/29/file/file.mp4

Request Chain 155

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFBU7HJwaOl_J8J6OyKF6bE&google_cver=1&google_push=AYg5qPLGyZSHEDLEcFgL9cDCgPCdsrWTW6jaf-sqNo3pLo4D3mJbEuoI-nXM6M6Jov31YURYrhIpak0FvSd4znl8M6ShLP-goFs HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPLGyZSHEDLEcFgL9cDCgPCdsrWTW6jaf-sqNo3pLo4D3mJbEuoI-nXM6M6Jov31YURYrhIpak0FvSd4znl8M6ShLP-goFs&google_hm=TsJsBe8YFTGp9DH2ChS5Pg

Request Chain 156

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPL9eAb9R81CDTJNumzOLN19OGUP5031zaZ3amIS1Sa0XJzZocDVFXoFDuULNQUNny478UGrmHp1xlQRRl7V_UeqRpKdhiEF&google_gid=CAESEBA7Zs6exucdNdaRAsuSjco&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdVcXZ3QUFCZkpXNzExUw&google_push=AYg5qPL9eAb9R81CDTJNumzOLN19OGUP5031zaZ3amIS1Sa0XJzZocDVFXoFDuULNQUNny478UGrmHp1xlQRRl7V_UeqRpKdhiEF

Request Chain 159

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEO80gZpCZ7O0Y-z3Gi5DkbY&google_cver=1&google_push=AYg5qPIlnnl7_za_cWlHByl9s6EDssHavD84XxHNvzOpikeSqDFH8ErOYCMQi5xURCaTsUzT4rWozFWOPQwhjI9MNiGZSHfgSRcI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=iLtx2ZDaRBezbC635xgl2A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIlnnl7_za_cWlHByl9s6EDssHavD84XxHNvzOpikeSqDFH8ErOYCMQi5xURCaTsUzT4rWozFWOPQwhjI9MNiGZSHfgSRcI

Request Chain 160

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJxG0gz6AaiBAdc0IsMb0nc&google_cver=1&google_push=AYg5qPKq49hrfPh2POmavBY4kp_sywOyP5IDgO5lIyBrBLO5QGD-YD9E1Abas1RxxuyD6P5UIN1ooOq3AyM1cw_gIOQc3TeN6QXA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFEUUstMTEtTExTWA==&google_push=AYg5qPKq49hrfPh2POmavBY4kp_sywOyP5IDgO5lIyBrBLO5QGD-YD9E1Abas1RxxuyD6P5UIN1ooOq3AyM1cw_gIOQc3TeN6QXA

Request Chain 161

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc

Request Chain 165

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFBU7HJwaOl_J8J6OyKF6bE&google_cver=1&google_push=AYg5qPJnoIQ9JQwr-igX3uRXpDsRKQfJm7Rj-Js4N0PEmhpIT-pcnkV9mHUWJZet-ag2lQr-0HBw4EB9GnAWeNGVS2B_fKeE-p0 HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPJnoIQ9JQwr-igX3uRXpDsRKQfJm7Rj-Js4N0PEmhpIT-pcnkV9mHUWJZet-ag2lQr-0HBw4EB9GnAWeNGVS2B_fKeE-p0&google_hm=TsJsBe8YFTGp9DH2ChS5Pg

Request Chain 166

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPLwEYT0IUBxoRP3plbitaCAcenzTQu7pbeNR79YS0KsZZKfR8QNhMeNOVJ9U0ps17TH7FV4vZjUDzVEW1Ut-KoyoIg--a4&google_gid=CAESEBA7Zs6exucdNdaRAsuSjco&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdVcXZ3QUFBUUZLOEgwWQ&google_push=AYg5qPLwEYT0IUBxoRP3plbitaCAcenzTQu7pbeNR79YS0KsZZKfR8QNhMeNOVJ9U0ps17TH7FV4vZjUDzVEW1Ut-KoyoIg--a4

Request Chain 167

https://d.agkn.com/pixel/2175/?google_gid=CAESENe3irKS4bsHwVE2IuBT7aI&google_cver=1&google_push=AYg5qPKNYVLE0hZFKE2dbyng2Zu0ZfgNscINoZstPJElHQCbMc_I9EEc3g6iVyNyqlFaEt9oljraisxKDwoBQ8PMbl51j--cF8c HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPKNYVLE0hZFKE2dbyng2Zu0ZfgNscINoZstPJElHQCbMc_I9EEc3g6iVyNyqlFaEt9oljraisxKDwoBQ8PMbl51j--cF8c&google_hm=Q0FFU0VOZTNpcktTNGJzSHdWRTJJdUJUN2FJ

Request Chain 169

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEO80gZpCZ7O0Y-z3Gi5DkbY&google_cver=1&google_push=AYg5qPIyYccQYhnrZZhenldIsXzZvCPgfNfWjt3qyGCpgeY29oNlQ0oE2vN4EgO3a452HvNgjeIlwZvL3-QQOWLO3IZxZsKi1sM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=iLtx2ZDaRBezbC635xgl2A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIyYccQYhnrZZhenldIsXzZvCPgfNfWjt3qyGCpgeY29oNlQ0oE2vN4EgO3a452HvNgjeIlwZvL3-QQOWLO3IZxZsKi1sM

Request Chain 170

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJxG0gz6AaiBAdc0IsMb0nc&google_cver=1&google_push=AYg5qPLpZsh5WXvFjGoRSkS2Qx0ccIcg-HOA_lU5FGWSBaPAhmW_uioUc08o68n74WYXhPlaI676GXtWaTM6AZocQe2kIjykJg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFEUjUtRS1MM0w1&google_push=AYg5qPLpZsh5WXvFjGoRSkS2Qx0ccIcg-HOA_lU5FGWSBaPAhmW_uioUc08o68n74WYXhPlaI676GXtWaTM6AZocQe2kIjykJg

Request Chain 171

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc

197 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
herbalserver.me/ 12 KB
4 KB 418ms
245ms Document
text/html 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://herbalserver.me/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4543e1f8c7db08b874736db0c386295bac4426bcd69102a99ed244e97db90e38

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Thu, 10 Feb 2022 15:09:48 GMT
content-type: text/html; charset=UTF-8
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G7lBJNqzhBX%2FkSX0XxEln6HSyMXdrtC5x7r9KqzLUwKpkUhHMaRZvKx4HgGaz1CjzbcIqFxZtOYmLBEUoR3clmTqRVhz8dkdqgDjsfrvwfxAgLVm49ew%2Bj5iU2AAvEioYb%2B31eVxVkw07wLUqzY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6db642baf9ac5c20-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 153 KB
53 KB 83ms
40ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7721440529364330

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5887264b038ff233f757b47df5495353e994edbe0c144f7f67c18ec15b8570cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://herbalserver.me/
Origin: https://herbalserver.me
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53933
x-xss-protection: 0
server: cafe
etag: 2553418674623553775
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 10 Feb 2022 15:09:48 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 167 KB
62 KB 81ms
38ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-PK8J155HGK

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

82adfb0be5d034070608c85667b4a8d253ca81e3002e143fa0633a162c54af71

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:48 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63064
x-xss-protection: 0
expires: Thu, 10 Feb 2022 15:09:48 GMT

GET
H2 200 bootstrap.min.css
herbalserver.me/assets/css/ 139 KB
23 KB 118ms
117ms Stylesheet
text/css 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://herbalserver.me/assets/css/bootstrap.min.css
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 57a74c141f16da763279a16e6d26f925a9b5a35f9b093c3ca99a6d68aa76b869

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:49 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 12 Apr 2017 07:57:34 GMT
server: cloudflare
etag: W/"22cf1-54cf38fa0d780-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IpoTHcgyi3S0ov7nqpP3jcB4QB1XWBW%2BtKqtSDLaD8Szk%2FUQpwSOafVb41WOYXj23YWZLT4S6dDcX96m6JSyXFrt8%2B79lWNlTKI7Z5QFenPUUJI5vdRcN%2BhXqbcq%2BldtRlSK%2FVjmEPjCPAHgoII%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6db642bcadc45c20-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 main.css
herbalserver.me/assets/css/ 10 KB
2 KB 84ms
83ms Stylesheet
text/css 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://herbalserver.me/assets/css/main.css
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6594988ba2234776bb5317ccb82ee074cf0b2c6143ea81e95d4561e5dc56d109

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:48 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 16 Apr 2017 04:46:30 GMT
server: cloudflare
etag: W/"2913-54d415baf9580-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=74Mauu01lb3pM6SBafMNsy7hjwkBKRgq5CBojPyG6H3CNz9hHjp7fLYnJ0lMY9zLWuQmKfkWQz722lmCMRMeiUTeM%2F7f4qAZtM9fD6FE2eQhD5z9T1bprj4AB6zy4pl1UPtVoANt3N0JftbA0vI%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6db642bcadc65c20-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 font-awesome.min.css
herbalserver.me/assets/css/ 26 KB
6 KB 103ms
102ms Stylesheet
text/css 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://herbalserver.me/assets/css/font-awesome.min.css
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:48 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 30 Aug 2015 05:27:26 GMT
server: cloudflare
etag: W/"6857-51e80927f0b80-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HNNt%2B2XCC%2BHtn09c%2FHD9%2BsrMU30ftTMSrUF5UPku%2Bedar0gUipJucB%2FAjqyyDc4cUQm3dsTMMLAT3bhw6Hs634qff%2Bln%2F6raXsMzYFjr9EQ5I6DCCDfmmrYR7MQs0cA4o3QDEMa2B%2B%2B3v%2B2W5Bg%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6db642bcadc85c20-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 jquery.min.js Show response
herbalserver.me/assets/js/ 94 KB
34 KB 136ms
135ms Script
application/javascript 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://herbalserver.me/assets/js/jquery.min.js
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b940065e2a67c37e3bd02b23c651f4744a3c219aba2d4fb99a631113494d376

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:49 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 13 Jul 2015 15:46:58 GMT
server: cloudflare
etag: W/"1764d-51ac3a1bcc080-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LE1II3dNsnnoCGaPUZbtQj6dafwcHjh5ip%2BjzHAVj6euC1ctrV4SXTSMMrLL8a1Ok5EFRLjBXQfJYRCLTC1yB6UsF1rTDqHLN4ZcUeKSGlbovYgtLcueh%2BVUAKJcr95VdynCbh2KVARcMltvX1c%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6db642bcadca5c20-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 97 KB
39 KB 70ms
43ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-848695486

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b017a6ac440e574ef8e097b65c9087974d05819f77b217c649736c45ec34a30e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:49 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39590
x-xss-protection: 0
expires: Thu, 10 Feb 2022 15:09:49 GMT

GET
H3 200 invisible.js Show response
herbalserver.me/cdn-cgi/challenge-platform/h/b/scripts/ 51 KB
18 KB 40ms
38ms Script
text/javascript 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://herbalserver.me/cdn-cgi/challenge-platform/h/b/scripts/invisible.js
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7dcd6defd6b36a975077427d55cf2fb1948e9a45f472ce9544b55410568d4524

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:49 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LB42MigwsPxcXP19iCVoj%2BxpD8dy%2B%2FfByG0zj5mJXMuhUVJ0yr8FM1Ex9js2KPSFVlRtCeh2yecjLapaDqpxCtQYYfzGSpj02pWzUMmnwM%2BUV8IRVimZTDDEmzcDqE8ElhAbvdov%2B2BOlqlZ5PM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=604800, public
x-control-type-options: nosniff
cf-ray: 6db642bddd8591f0-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 id.png
herbalserver.me/flags/ 490 B
1 KB 95ms
93ms Image
image/png 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://herbalserver.me/flags/id.png
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f0a975753dcdc6069a98023ba10d5a43bf62c50b8605eb25e16fb4b5e1c87b5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:49 GMT
cf-cache-status: MISS
last-modified: Thu, 26 Oct 2017 16:28:06 GMT
server: cloudflare
etag: "1ea-55c75a82cf180"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6jyn4ykAPI0tVtmu6oyCTMPPEMcNCleuy65E7czlP%2BRKj%2BCz8SAAHalgTfMO9gBJNqt0ul8crswWcuDztdOXY9iJo30KfIYr0EykR0bCBGYfDPCvqoLeeuJjx8GJ6nsDVZl3YNE9l5k%2FeHc24pU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 6db642bddd8991f0-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 490

GET
H3 200 gambar1.png
herbalserver.me/ 30 KB
31 KB 2448ms
2446ms Image
image/png 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://herbalserver.me/gambar1.png
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4dc46ba2f868997fe7c228d0e54d135990fd44d06d6dbf74b6e6383599116d0d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:51 GMT
cf-cache-status: MISS
last-modified: Mon, 26 Apr 2021 16:17:28 GMT
server: cloudflare
etag: "78e5-5c0e27b571600"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mwdt5B55G76XYxDIWZknZjX5Dw0FP2JyPWQrVMG7fs2J1KQw4aAMolCM2WWWERuGbkYLGkcZLCHRjRauyd9NVqorBuAObzcmNS4GmulWkKN9AiZGukWM3P229vciL9ylzMjeI6wUv%2BIxoQvO8OE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 6db642bddd8d91f0-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 30949

GET
H3 200 gambar2.png
herbalserver.me/ 16 KB
17 KB 115ms
114ms Image
image/png 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://herbalserver.me/gambar2.png
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df954e5873568965ab1f79c4ee6d2391517aca57f4ea5f47e37a9c667b479404

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:49 GMT
cf-cache-status: MISS
last-modified: Mon, 26 Apr 2021 16:17:21 GMT
server: cloudflare
etag: "4070-5c0e27aec4640"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rfba0lxVsenN8WvfgWJwDhVDimnOWsG6OT2J0m88e82dmf5qHw7n%2FGYJZOJPDNGiJY%2BmnuEaE1lWbWOvepTx2cEpQsEZsJxkygxfuuUDouORTlx80Yu09OGo72Tluc74yFjdghn2JalBNzre1wU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 6db642bddd9091f0-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 16496

GET
H3 200 gambar3.png
herbalserver.me/ 13 KB
14 KB 1415ms
1413ms Image
image/png 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://herbalserver.me/gambar3.png
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d75f3141d9a78b8c9c27e6a6cf9eac13d2c9fae55b6f716f38b4eb341594d186

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:50 GMT
cf-cache-status: MISS
last-modified: Mon, 26 Apr 2021 16:15:44 GMT
server: cloudflare
etag: "344c-5c0e275242c00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jBmvdr0OfLDlI0epDpEMmNjrJW7oUnIPYlSN8hDuSQlgM744yC%2BGmpEg2z2yp7zTqvscO0aoF1nAxgwWPrLmX1QgvRMzRnErf1MIQWO8tHQ0pnBL38nQo7O%2B%2FPhd1L0Jdowd8AC8ir5ShxLTsfQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 6db642bddd9591f0-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 13388

GET
H3 200 gambar5.png
herbalserver.me/ 14 KB
15 KB 424ms
422ms Image
image/png 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://herbalserver.me/gambar5.png
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff3e9b5849108422da95246558cbf40771cfce60b825b91e8beef12af3661410

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:49 GMT
cf-cache-status: MISS
last-modified: Wed, 16 Jun 2021 16:06:54 GMT
server: cloudflare
etag: "3925-5c4e447752380"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ouBUTU%2FoIkEkfbUB%2F7KQTrdatNn%2F5g1pU%2Fl7rNMYKO4w36ZuMjMlZNqapo9hG1fMxKhigKM4kOlpNVKECqB2DvNET8OGjXfSO5FO8ST6Ko6VN2ApJ8L7Z9N8ypzhLsT5vFDmmkn%2FOBioYdKjRPQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 6db642bddd9891f0-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 14629

GET
H3 200 gambar4.png
herbalserver.me/ 50 KB
51 KB 139ms
137ms Image
image/png 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://herbalserver.me/gambar4.png
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2bc2ff5a3fecfdb5111cb2813380b9cdd5d4ff17fd051ee633cf9aae61b8e191

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:49 GMT
cf-cache-status: MISS
last-modified: Thu, 06 May 2021 09:57:56 GMT
server: cloudflare
etag: "c86d-5c1a6586fb100"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UY%2FvkMe7suQ9GQLV5%2FhnvEiT3oWxrG3ANm%2FoucJElF%2BtQmH7pOS%2FlAuRs8OsP19jy2kp%2FPjUk11NUVUczXA7walyy5n85S9mCiESEI3Socwk0hfmKU2TettAVmxUVOKdAgvhJxrP1cR%2FiP2FUx0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 6db642bddd9b91f0-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 51309

GET
H3 200 jquery.form.min.js Show response
herbalserver.me/assets/js/ 15 KB
6 KB 91ms
90ms Script
application/javascript 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://herbalserver.me/assets/js/jquery.form.min.js
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6fa82c9b5a2c86dbc50c757299b8afa6bdbc839e83501cac455f04195af74cb1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:49 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 16 Jan 2014 13:22:58 GMT
server: cloudflare
etag: W/"3ace-4f01652ec3080-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lhHf9TyJVhmLaV8%2B%2FCL0v6z8tq8K7Zpxo73G3Mz94JMsvfE3%2F27ejtdjoxZLcFbJAJ8fCo6z7rHM6VV3ckXYL%2BLs%2BpeIdl2CuH7FcCJk8ySvzColOlojMAnXp733qSU4BD7lpFvHSfN1ZA%2Fw68I%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6db642bdad0691f0-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 bootstrap.min.js Show response
herbalserver.me/assets/js/ 30 KB
9 KB 101ms
101ms Script
application/javascript 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://herbalserver.me/assets/js/bootstrap.min.js
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 63e1ce2e948cc2b234926f57ce1abbd3f34afd2ba00276a09242a789c3739c82

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:49 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 05 May 2014 01:55:04 GMT
server: cloudflare
etag: W/"7928-4f89d6b80ce00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4jZd%2FK4UuGFJyJuL3PrKojFHIR51g6Lm81EqyAF8xhQod09iTlP5cgRYvnwaZ%2F%2BIL9Ovgkdg%2F3DdSmI1qvhGdJbnRUEy%2BtctUkSLYDXYCp9M64DU4mmdGy3uxyBafN57MWoA3m49fcjdzW1Tacw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6db642bdcd4991f0-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 app.min.js Show response
herbalserver.me/assets/js/ 3 KB
995 B 2422ms
2421ms Script
application/javascript 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://herbalserver.me/assets/js/app.min.js
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe2026897e9821c921336dd6142e512eecd6a61efb6087bc23e37534299f0925

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:51 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 31 Aug 2015 13:08:08 GMT
server: cloudflare
etag: W/"cbb-51e9b1fedde00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=il0zeMxLcpEGgvHIH1G1VyA8LQHdD%2FxkQjLotTvoV87JjVNsiZBwWmCz9nUETfW2Dkhl%2B7pmyC0RrPvTNn639X6RP1fKfn%2FBZBLaICKdAGR7KVCuPMYFdqa1hD%2BfgnohYJAELNG6MHevclhzSQs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6db642bddd7791f0-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 cookie.js Show response
herbalserver.me/assets/js/ 4 KB
2 KB 2422ms
2421ms Script
application/javascript 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://herbalserver.me/assets/js/cookie.js
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2edec579f5b5f7614cbdbffff2c6634e9b12f6aa9c4c867b1c6df172e22180a6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:51 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Wed, 30 Dec 2020 10:34:44 GMT
server: cloudflare
etag: W/"f4f-5b7ac0e327900-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KmKj%2FavdkDuGDoSy7SLRHqzTs0Gel3Lms4VV5rn%2BG%2BzEMGpMiAS1C1BPGi%2BaJEhHGpT%2BThnJz5uojTiuGYYn55evM3tZTJCfX7UOGZJR%2FGLCtG%2BM7sTkysIWVPcV1%2B5KAAtj8EhPwOM%2BXk6YPKw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6db642bddd7b91f0-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 ads.js Show response
herbalserver.me/assets/js/ 0
558 B 1399ms
1398ms Script
application/javascript 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://herbalserver.me/assets/js/ads.js
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:50 GMT
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
last-modified: Wed, 07 Jul 2021 13:50:05 GMT
server: cloudflare
etag: "0-5c688d0d49d40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0sLl%2FtsHvEeNs3xRIqeBP3hkxJn8Nu%2By1xh9To1bYj8MeN8j8wBNBC5AHM2sPpNK6kTQ33INhmXs5ELMj7yTOiafcMv7EFdUmAqJabdfRDnWZzEJqEC8LdyYtDFY9%2FvNJnjY%2BMcGKugYuYO1NAQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6db642bddd8091f0-FRA
cf-bgj: minify

GET
H2 200 css
fonts.googleapis.com/ 2 KB
1 KB 68ms
25ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/assets/css/main.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b0d3e95d9ae6d861a6735dba876fe73ff082293d8663233cc19f54776f2912e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 10 Feb 2022 13:31:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 10 Feb 2022 15:09:49 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 10 Feb 2022 15:09:49 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202070101/ 290 KB
104 KB 74ms
48ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202070101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-7721440529364330&plah=herbalserver.me&bust=31064806

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7721440529364330

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cc9ac7ba24d3e3e2fae5b6d242781bbf3e8ae02f2294ff6fff16fe5071d6fcd4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 106764
x-xss-protection: 0
server: cafe
etag: 2598157498342340149
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 10 Feb 2022 15:09:49 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220208/r20190131/ Frame 41D1 10 KB
5 KB 61ms
17ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220208/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7721440529364330

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a575e2f63d79cdaf5a92b4453bfcaadb462119aa1216b4f28920e37e2d9b8e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4612
x-xss-protection: 0
date: Wed, 09 Feb 2022 21:54:54 GMT
expires: Wed, 23 Feb 2022 21:54:54 GMT
cache-control: public, max-age=1209600
age: 62095
etag: 18247940800414524076
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 css
fonts.googleapis.com/ 8 KB
787 B 26ms
26ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,500,700

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/assets/css/bootstrap.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32bc7c1c64fd1b755d48d6025b86b7e7a28ad35d1f420cf85cdc1123aa7dfcd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 10 Feb 2022 13:29:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 10 Feb 2022 15:09:49 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 10 Feb 2022 15:09:49 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
347 B 67ms
23ms Ping
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-PK8J155HGK&gtm=2oe290&_p=2087553988&sr=1600x1200&ul=en-us&cid=131292801.1644505789&_s=1&dl=https%3A%2F%2Fherbalserver.me%2F&dt=Free%20SSH%20And%20VPN%20Servers&sid=1644505789&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-PK8J155HGK
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:49 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://herbalserver.me
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 97 KB
39 KB 68ms
43ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-848695486&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-PK8J155HGK

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

00422bd0919e246881ba6fde9a521d5a0849af75b5b511ec62d226958687ded3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:49 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39595
x-xss-protection: 0
expires: Thu, 10 Feb 2022 15:09:49 GMT

GET
H2 200 JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2
fonts.gstatic.com/s/montserrat/v23/ 12 KB
13 KB 62ms
19ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v23/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a658b5f3ec0fd27f3c1500b420b2ed4ff557f5ddb65fbc83c21eae5cadc97dfb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://herbalserver.me
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 06:04:00 GMT
x-content-type-options: nosniff
age: 205549
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12648
x-xss-protection: 0
last-modified: Thu, 03 Feb 2022 00:11:58 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 08 Feb 2023 06:04:00 GMT

GET
H3 200 fontawesome-webfont.woff2
herbalserver.me/assets/fonts/ 63 KB
64 KB 2467ms
2467ms Font
font/woff2 2606:4700:3037::6815:3b5e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://herbalserver.me/assets/fonts/fontawesome-webfont.woff2?v=4.4.0
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/assets/css/font-awesome.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:3b5e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c4a1bb7ce3234407184f0d80cc4dec075e4ad616b44dcc5778e1cfb1bc24019

Request headers

Referer: https://herbalserver.me/assets/css/font-awesome.min.css
Origin: https://herbalserver.me
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:51 GMT
cf-cache-status: MISS
last-modified: Tue, 28 Jul 2015 02:44:46 GMT
server: cloudflare
etag: "fbd0-51be673fde380"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7ei8nMcmKAYFI0RMJv%2B77vB74cz0Iu%2FTNSeUqGF8cj%2BStPV44UN6a%2BOgeFx1CQIKKJf%2BvzuDFWrhZLHB9wdElhpujN9sXeauewIv1cayaI0XpFo%2B54xbhn846YxNNDl65yBS5cw95qT8rHSoJOU%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 6db642bddd9d91f0-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 64464

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 39 KB
15 KB 80ms
39ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-848695486&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

083ec931e5517a4ab713afbe9561e72b9186cb54e21b8b1eface9caefb54a966

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14879
x-xss-protection: 0
server: cafe
etag: 17635014576153706337
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 10 Feb 2022 15:09:49 GMT

GET
H2 200 ca-pub-7721440529364330 Show response
fundingchoicesmessages.google.com/i/ 89 KB
32 KB 87ms
43ms Script
application/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/ca-pub-7721440529364330?ers=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202070101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-7721440529364330&plah=herbalserver.me&bust=31064806

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

95fb191cc099965bb1377546006a2529cf9a745fa54909efb8ef5d1dd91baacb

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-gAGwD1xErreFKnBP4JPkqQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'nonce-gAGwD1xErreFKnBP4JPkqQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-gAGwD1xErreFKnBP4JPkqQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'nonce-gAGwD1xErreFKnBP4JPkqQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorServingWebSwitchboardHttp"
x-frame-options: SAMEORIGIN
date: Thu, 10 Feb 2022 15:09:49 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
report-to: {"group":"ContributorServingWebSwitchboardHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorServingWebSwitchboardHttp/external"}]}
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/848695486/ 2 KB
1 KB 54ms
29ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/848695486/?random=1644505789283&cv=9&fst=1644505789283&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa290&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fherbalserver.me%2F&tiba=Free%20SSH%20And%20VPN%20Servers&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cc7f754275bafa6d5f9b86d0f85f9bf052277be1d4098d96b21298940168f5d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1031
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/848695486/ 2 KB
1 KB 54ms
27ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/848695486/?random=1644505789286&cv=9&fst=1644505789286&num=1&label=Y1m_COLLtv4CEL6h2JQD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa290&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fherbalserver.me%2F&tiba=Free%20SSH%20And%20VPN%20Servers&auid=1280108730.1644505789&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

52aa1f72773f8a0567ed7c61546906784f6b7e995eda6744b458692bd1364cd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1155
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/848695486/ 42 B
548 B 76ms
31ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/848695486/?random=1644505789283&cv=9&fst=1644505200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa290&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fherbalserver.me%2F&tiba=Free%20SSH%20And%20VPN%20Servers&async=1&fmt=3&is_vtc=1&random=2201983491&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/848695486/ 42 B
548 B 72ms
29ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/848695486/?random=1644505789283&cv=9&fst=1644505200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa290&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fherbalserver.me%2F&tiba=Free%20SSH%20And%20VPN%20Servers&async=1&fmt=3&is_vtc=1&random=2201983491&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.google.de/pagead/1p-conversion/848695486/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/848695486/?random=379389542&cv=9&fst=1644505789286&num=1&label=Y1m_COLLtv4CEL6h2JQD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200...
https://www.google.com/pagead/1p-conversion/848695486/?random=379389542&cv=9&fst=1644505789286&num=1&label=Y1m_COLLtv4CEL6h2JQD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u...
https://www.google.de/pagead/1p-conversion/848695486/?random=379389542&cv=9&fst=1644505789286&num=1&label=Y1m_COLLtv4CEL6h2JQD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_...

42 B
64 B

59ms
33ms

Image
image/gif

2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/848695486/?random=379389542&cv=9&fst=1644505789286&num=1&label=Y1m_COLLtv4CEL6h2JQD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa290&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fherbalserver.me%2F&tiba=Free%20SSH%20And%20VPN%20Servers&auid=1280108730.1644505789&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CNPgGw&is_vtc=1&ocp_id=vSoFYtn9E-fDmLAPyoWygAQ&cid=CAQSKQCNIrLMoxdYqoTJFYpUD2oyKJmxLezJ4f0WVnBinFnuPh26px7meJQJ&random=101031410&resp=GooglemKTybQhCsO&ipr=y&prhg=0

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:49 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-conversion/848695486/?random=379389542&cv=9&fst=1644505789286&num=1&label=Y1m_COLLtv4CEL6h2JQD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa290&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fherbalserver.me%2F&tiba=Free%20SSH%20And%20VPN%20Servers&auid=1280108730.1644505789&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CNPgGw&is_vtc=1&ocp_id=vSoFYtn9E-fDmLAPyoWygAQ&cid=CAQSKQCNIrLMoxdYqoTJFYpUD2oyKJmxLezJ4f0WVnBinFnuPh26px7meJQJ&random=101031410&resp=GooglemKTybQhCsO&ipr=y&prhg=0
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxUmFKIixnt-pUNbGgQ6LVe-irKKO91S-wbiz3GujaSSVm0Zsaw_DCdoTzAWv3KUHPQCEKta9LlmaJHmWIW5Fyc= Show response
fundingchoicesmessages.google.com/el/ 0
26 B 56ms
30ms XHR
text/html 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUmFKIixnt-pUNbGgQ6LVe-irKKO91S-wbiz3GujaSSVm0Zsaw_DCdoTzAWv3KUHPQCEKta9LlmaJHmWIW5Fyc=?pvid=FC1D1090-FDBD-4782-AE0E-2524F2B5BBDE&anonid=C8812FFA-5AD5-4971-8E75-C3399A36C9B8

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.yTqqN9bZ4a0.es5.O/d=1/rs=AJlcJMzaE_tFyJT6xmprJgq24gGCd8YUiw/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-WXmy0IOJFGt+pRaqbB2fxA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-WXmy0IOJFGt+pRaqbB2fxA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://herbalserver.me/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 10 Feb 2022 15:09:49 GMT
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type: text/html; charset=utf-8
access-control-allow-origin: https://herbalserver.me
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-WXmy0IOJFGt+pRaqbB2fxA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-WXmy0IOJFGt+pRaqbB2fxA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxW3MFlOdHc48BNK-FB06Rw0gz7UGp720rMurIJ88dWBqpuSS_wWuRZGK_dvgncqY0umhI0gbyKDlB_WS6KHaSs= Show response
fundingchoicesmessages.google.com/f/ 43 KB
16 KB 67ms
42ms Script
application/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxW3MFlOdHc48BNK-FB06Rw0gz7UGp720rMurIJ88dWBqpuSS_wWuRZGK_dvgncqY0umhI0gbyKDlB_WS6KHaSs=?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjQ0NTA1Nzg5LDM4OTAwMDAwMF0sIkZDMUQxMDkwLUZEQkQtNDc4Mi1BRTBFLTI1MjRGMkI1QkJERSIsIkM4ODEyRkZBLTVBRDUtNDk3MS04RTc1LUMzMzk5QTM2QzlCOCIsbnVsbCxbbnVsbCxbN10sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLHRydWUsdHJ1ZV0sImh0dHBzOi8vaGVyYmFsc2VydmVyLm1lLyIsbnVsbCxbXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6f176eae1ee5487916ee02eb8de3395ddd8dc39f8c7d1b53e0bb558685209e80

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-1qVdqXDAg0YH14HTg0Oajw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-1qVdqXDAg0YH14HTg0Oajw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorGlobalRouterHttp"
x-frame-options: SAMEORIGIN
report-to: {"group":"ContributorGlobalRouterHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorGlobalRouterHttp/external"}]}
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'report-sample' 'nonce-1qVdqXDAg0YH14HTg0Oajw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-1qVdqXDAg0YH14HTg0Oajw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 219 B
646 B 93ms
25ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=herbalserver.me&callback=_gfp_s_&client=ca-pub-7721440529364330

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

5ffa1c05e357fc27f3ddbe5c4ae2204f0a529c89a5d29318130324ebaf22b966

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 202
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 81ms
25ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=herbalserver.me

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 15:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 71ms
28ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=herbalserver.me

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 15:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2C50 142 KB
37 KB 945ms
944ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&adk=1812271804&adf=3025194257&lmt=1644505789&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fherbalserver.me%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=62&bdt=255&idt=80&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2321163080596&frm=20&pv=2&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=263

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

687d73b65a385e60836c9ad4b4099749e787e0cdc83f7a41a097de248b8a6318

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 10 Feb 2022 15:09:50 GMT
server: cafe
content-length: 37944
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9BEF 96 KB
34 KB 1268ms
1268ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6723a2a0cb5b83004c97227b1473db3fc4aa14daf394d070fb9790fcc1f0e5f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 10 Feb 2022 15:09:50 GMT
server: cafe
content-length: 34346
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A74A 95 KB
33 KB 1201ms
1200ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb35b36fd355e51a257eb8e2b643bd2af74745a468bda25789fb6622f6f17188

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 10 Feb 2022 15:09:50 GMT
server: cafe
content-length: 34057
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7E8B 98 KB
33 KB 825ms
825ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=869763061&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=1&bdt=256&idt=120&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1140x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2252&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=tXulFzcMua&p=https%3A//herbalserver.me&dtd=272

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdd4ad7f62625a97c9525b327b57da6c705711a78f40c5b324c0ce6fb10166a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 10 Feb 2022 15:09:50 GMT
server: cafe
content-length: 33503
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 204 AGSKWxXX3BUquRWZ58uT0_KakXhIP32EZGLiZPeNinjId7va7I6Km1PeHAqflltSnJVYIHH4wbWjejMeMY9RzisE68oDFqRE094q5fkCyBrlO_iNUu_1aFjXmV_twtEitcJ89qew0WU-9F89Qa0PT0IxlANjeOdQBD8fOnSysp_g3tw39IXuogSsV0K-xeek Show response
fundingchoicesmessages.google.com/el/ 0
25 B 35ms
34ms XHR
text/html 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXX3BUquRWZ58uT0_KakXhIP32EZGLiZPeNinjId7va7I6Km1PeHAqflltSnJVYIHH4wbWjejMeMY9RzisE68oDFqRE094q5fkCyBrlO_iNUu_1aFjXmV_twtEitcJ89qew0WU-9F89Qa0PT0IxlANjeOdQBD8fOnSysp_g3tw39IXuogSsV0K-xeek

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorIabCcpaWebSignalJs.de.YQSw5eoKSLA.es5.O/d=1/rs=AJlcJMw453dlY2IjQ_E47liX_irMAl8v3A/m=iabccpawebsignalscript

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-2+PBh1Yz0jFAsMSl+6rKBA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-2+PBh1Yz0jFAsMSl+6rKBA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://herbalserver.me/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 10 Feb 2022 15:09:49 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://herbalserver.me
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-2+PBh1Yz0jFAsMSl+6rKBA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-2+PBh1Yz0jFAsMSl+6rKBA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxUGp0dLcMlB9v5R86brJMzt6cHNxag6Ovj7P4U1WbS6_1h4GLBLEaiMgxII-HTnyZiUbRf-4KsDJ_983DBnyFJ7oXjxoIgjsidYn_eKMwiHOytIqldWZ0tC4Ow_D9U5EV0acLluNQ3He6F0Egz4rW_fQvjIo2x9kQcVSIEgghaG44BrU0t4DN1Zfu-M Show response
fundingchoicesmessages.google.com/f/ 62 KB
23 KB 44ms
44ms Script
application/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUGp0dLcMlB9v5R86brJMzt6cHNxag6Ovj7P4U1WbS6_1h4GLBLEaiMgxII-HTnyZiUbRf-4KsDJ_983DBnyFJ7oXjxoIgjsidYn_eKMwiHOytIqldWZ0tC4Ow_D9U5EV0acLluNQ3He6F0Egz4rW_fQvjIo2x9kQcVSIEgghaG44BrU0t4DN1Zfu-M?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjQ0NTA1Nzg5LDQ3MjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsMTBdLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxLDFdLCJodHRwczovL2hlcmJhbHNlcnZlci5tZS8iLG51bGwsW11d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4693823ea65e7487c3f77bd050d760e6d7d35bad8c94fbc560ab6259bbdcd782

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-oSzuM3/5J0UCx0S/gMta6Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-oSzuM3/5J0UCx0S/gMta6Q' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorGlobalRouterHttp"
x-frame-options: SAMEORIGIN
report-to: {"group":"ContributorGlobalRouterHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorGlobalRouterHttp/external"}]}
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-oSzuM3/5J0UCx0S/gMta6Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-oSzuM3/5J0UCx0S/gMta6Q' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 14346019221664027350
tpc.googlesyndication.com/daca_images/simgad/ Frame 7E8B 91 KB
91 KB 76ms
22ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/14346019221664027350

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=869763061&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=1&bdt=256&idt=120&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1140x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2252&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=tXulFzcMua&p=https%3A//herbalserver.me&dtd=272

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b055c53c236759c604cef3e36943ac888a6a11fac97414d567e1b73fc9665ae7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 05 Feb 2022 20:41:32 GMT
x-content-type-options: nosniff
age: 412098
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 93276
x-xss-protection: 0
last-modified: Sat, 07 Aug 2021 17:36:59 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 05 Feb 2023 20:41:32 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/ Frame 7E8B 19 KB
8 KB 70ms
17ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a22b29e11f6ad3ed458e71525b4edfaf0b9ab4cd962ae9a239b9509c106c826

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:04:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 301
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7817
x-xss-protection: 0
server: cafe
etag: 7051432691878289762
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:04:49 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame 7E8B 2 KB
1 KB 70ms
21ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:07:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 158
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:07:12 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 7E8B 0
0 72ms
69ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CzE6DvSoFYtGfHPGIiM0P9uSLyAfXlLWFZe_vk62yDtnZHhABIKbdpoQBYJX68IGMB6AB1JDAyQPIAQKoAwHIA8kEqgTJAU_QttJIML1QVW0q_GNMy7MZfC1CvfeJZ8hC5Td7uxsHON8Dn2RIkEgBPIOfzEycsIJqZXczNwLN6ptZQjg8nG8yaiHhsTMtbMhCZpQY1pUGEkRFYZhSyqBvgKmfarMy-qjQg0S8ODhxyGc3EwsYaRjCDa2JVeY67V-iAmM8NhHtU1qq12384JCvWdrlA-jbUQOY83X1MbgUtn4TJFFXVqcNbreom5lTUpJt0zEzeC6LZc7R_v-rM5pXw9BQmrzvAQQER-92UVWTXMAEvNXl5s0DkgUECAQYAZIFBAgFGASgBgKAB5TvvzaoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBCU_A_SCAkIgOGAEBABGB-ACgHICwHYEw3QFQGYFgGAFwGyFxwKGggAEhRwdWItNzcyMTQ0MDUyOTM2NDMzMBgA&sigh=dDjA1g3BL6w&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=869763061&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=1&bdt=256&idt=120&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1140x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2252&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=tXulFzcMua&p=https%3A//herbalserver.me&dtd=272
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 10 Feb 2022 15:09:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 transparent.png
tpc.googlesyndication.com/pagead/images/ Frame 7E8B 67 B
188 B 106ms
62ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/transparent.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 18:59:48 GMT
x-content-type-options: nosniff
server: cafe
age: 72602
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 2462972746714251406
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67
x-xss-protection: 0
expires: Thu, 10 Feb 2022 18:59:48 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7E8B 124 KB
38 KB 118ms
44ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 10 Feb 2022 15:09:50 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame 7E8B 15 KB
6 KB 62ms
19ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:09:00 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 7E8B 0
0 71ms
29ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRu7z5jyjp7TJg7eKT7-q5tmnX1XKWKk0TXwNsbyxHAulYGjv2qm6skEYJsLWFdjlAPrYU36KFx1WBlFPsfKAnVMy__Kw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=869763061&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=1&bdt=256&idt=120&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1140x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2252&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=tXulFzcMua&p=https%3A//herbalserver.me&dtd=272
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H2 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame 7E8B 28 KB
11 KB 102ms
59ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b3b84e5e485619983c2f805dac6f3fde572d0c825c672d1a02f48af0149eea93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:14:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3308
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11662
x-xss-protection: 0
server: cafe
etag: 6226773659199191033
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:14:42 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 69F7 143 B
163 B 18ms
17ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=869763061&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=1&bdt=256&idt=120&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1140x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2252&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=tXulFzcMua&p=https%3A//herbalserver.me&dtd=272

Response headers

x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 145
x-xss-protection: 0
date: Thu, 10 Feb 2022 15:04:52 GMT
cache-control: public, max-age=3600
content-type: text/html; charset=UTF-8
age: 298
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4E1D 1 KB
749 B 26ms
22ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Thu, 10 Feb 2022 13:26:12 GMT
expires: Fri, 11 Feb 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 6218
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 7E8B 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b0b0991b938a26f63c2bc8d4916e30794c61865ee1aa168b2b648fec747e1b3d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dpixel
cms.quantserve.com/ Frame 4E1D 35 B
463 B 69ms
19ms Image
image/gif 2620:116:800d:21:3175:5196:e3fd:8c1d
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFBU7HJwaOl_J8J6OyKF6bE&google_cver=1&google_push=AYg5qPIsy5gSIDC_IE_g8OS7mAa0seqpVD_65Z5iEeB_rGp3M5xgw8j3vQfbc8zuFrpOWwK4mizwCvLOeC8kkN1tYxI34ibfq7bu

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:3175:5196:e3fd:8c1d , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:50 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E1D
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESENe3irKS4bsHwVE2IuBT7aI&google_cver=1&google_push=AYg5qPJa9IqVAf81tB79VycegikKL_bZbtjeJ0eZUBHFEjNfIiivpCtWe-vMuGjfnJ2W3HN41Ti6LOS7QoFW80R-jNthSDF4B-j-
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJa9IqVAf81tB79VycegikKL_bZbtjeJ0eZUBHFEjNfIiivpCtWe-vMuGjfnJ2W3HN41Ti6LOS7QoFW80R-jNthSDF4B-j-&google_hm=Q0FFU0VOZTNpcktTNGJzS...

170 B
188 B

66ms
44ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJa9IqVAf81tB79VycegikKL_bZbtjeJ0eZUBHFEjNfIiivpCtWe-vMuGjfnJ2W3HN41Ti6LOS7QoFW80R-jNthSDF4B-j-&google_hm=Q0FFU0VOZTNpcktTNGJzSHdWRTJJdUJUN2FJ

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 10 Feb 2022 15:09:50 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJa9IqVAf81tB79VycegikKL_bZbtjeJ0eZUBHFEjNfIiivpCtWe-vMuGjfnJ2W3HN41Ti6LOS7QoFW80R-jNthSDF4B-j-&google_hm=Q0FFU0VOZTNpcktTNGJzSHdWRTJJdUJUN2FJ
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 4E1D 43 B
350 B 67ms
26ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEGH5qutWCONhItGOZWXkDnw&google_cver=1&google_push=AYg5qPJsIidbQ6JO7yeoEbKSwnNh3VMk14zWX9TjreeBYQ8PqM-KDKIk_gwlf2ueAbC22JTslnaao5SmOE7MFYlVCKgMhxVS6I-_
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=869763061&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=1&bdt=256&idt=120&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1140x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2252&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=tXulFzcMua&p=https%3A//herbalserver.me&dtd=272
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:50 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: e2ntaa71uv15nl6lssod8uq4s2e812q6

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E1D
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=iLtx2ZDaRBezbC635xgl2A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

48ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=iLtx2ZDaRBezbC635xgl2A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKJiuWI2B9thPZAi78aXCMtwOxrP83fJN32gh9tcebr_h-a8HrA-wZsmY4CzTyiq3QFL1k9hn7M5cINJb1vjjxAUhw1c5Qp

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=iLtx2ZDaRBezbC635xgl2A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKJiuWI2B9thPZAi78aXCMtwOxrP83fJN32gh9tcebr_h-a8HrA-wZsmY4CzTyiq3QFL1k9hn7M5cINJb1vjjxAUhw1c5Qp
date: Thu, 10 Feb 2022 15:09:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E1D
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJxG0gz6AaiBAdc0IsMb0nc&google_cver=1&google_push=AYg5qPIwE-8onP-7qHujByfTtA1LB9BhzYUpq9Qg74apeSAFcl-fKgI_rk_pmY8DJTvpREZMzcS...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFDWk8tMVgtNUpOUg==&google_push=AYg5qPIwE-8onP-7qHujByfTtA1LB9BhzYUpq9Qg74apeSAFcl-fKgI_rk_pmY8DJTvpREZMzcSGgraVPzKdzssHwY9SeTBZvmo

170 B
188 B

67ms
42ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFDWk8tMVgtNUpOUg==&google_push=AYg5qPIwE-8onP-7qHujByfTtA1LB9BhzYUpq9Qg74apeSAFcl-fKgI_rk_pmY8DJTvpREZMzcSGgraVPzKdzssHwY9SeTBZvmo

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFDWk8tMVgtNUpOUg==&google_push=AYg5qPIwE-8onP-7qHujByfTtA1LB9BhzYUpq9Qg74apeSAFcl-fKgI_rk_pmY8DJTvpREZMzcSGgraVPzKdzssHwY9SeTBZvmo
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 4E1D
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYa...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E1D
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEOgFnb36wDHIx_rdVmKhBrI&google_cver=1&google_push=AYg5qPJSG_8bDx4zOP5lFZlX...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJSG_8bDx4zOP5lFZlXcmlpLg6_razSZIYxa_ssVV1S7QYr3QulW-Z4QhtZhSzejmMb2Ij4VJlgKjxlxlOcg-koaj8lrlVu&google_hm=

170 B
188 B

69ms
45ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJSG_8bDx4zOP5lFZlXcmlpLg6_razSZIYxa_ssVV1S7QYr3QulW-Z4QhtZhSzejmMb2Ij4VJlgKjxlxlOcg-koaj8lrlVu&google_hm=

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:50 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJSG_8bDx4zOP5lFZlXcmlpLg6_razSZIYxa_ssVV1S7QYr3QulW-Z4QhtZhSzejmMb2Ij4VJlgKjxlxlOcg-koaj8lrlVu&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Wed, 09 Feb 2022 15:09:50 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 4E1D 0
232 B 72ms
25ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LNNMpUIXLAsFqaNX7x-K8ghBtaoA9qA2XwFAHAn7VaxAXV-75JRJQ42XaLNXLb4JHUq3k9dQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:50 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202070101/ 150 KB
53 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202070101/reactive_library_fy2019.js?bust=31064806

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bc74eab328fba1cb362818376fa2a652990aa8b589bc2757ed2bc5e95dec300

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54646
x-xss-protection: 0
server: cafe
etag: 5396911621308697499
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 10 Feb 2022 15:09:50 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 69F7
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

102ms
92ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 10 Feb 2022 15:09:50 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 10 Feb 2022 15:09:50 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 10 Feb 2022 15:09:50 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 54ms
28ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=herbalserver.me

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 15:09:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 50ms
25ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=herbalserver.me

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 15:09:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/ Frame E831 10 KB
5 KB 31ms
18ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a575e2f63d79cdaf5a92b4453bfcaadb462119aa1216b4f28920e37e2d9b8e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4612
x-xss-protection: 0
date: Thu, 10 Feb 2022 04:17:51 GMT
expires: Thu, 24 Feb 2022 04:17:51 GMT
cache-control: public, max-age=1209600
age: 39119
etag: 18247940800414524076
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/ Frame 77DC 10 KB
5 KB 31ms
19ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a575e2f63d79cdaf5a92b4453bfcaadb462119aa1216b4f28920e37e2d9b8e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4612
x-xss-protection: 0
date: Thu, 10 Feb 2022 04:17:51 GMT
expires: Thu, 24 Feb 2022 04:17:51 GMT
cache-control: public, max-age=1209600
age: 39119
etag: 18247940800414524076
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 css
fonts.googleapis.com/ Frame A74A 8 KB
888 B 55ms
29ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f93d0298dd39f7dff18566a5b2754067e26c0182b469fd6b24e5d63429fef88b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 10 Feb 2022 13:28:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 10 Feb 2022 15:09:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 10 Feb 2022 15:09:50 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 9BEF 8 KB
888 B 54ms
29ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f93d0298dd39f7dff18566a5b2754067e26c0182b469fd6b24e5d63429fef88b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 10 Feb 2022 13:25:06 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 10 Feb 2022 15:09:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 10 Feb 2022 15:09:50 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame A74A 1 KB
875 B 55ms
16ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd11fa353cc6a8560f4c35e67c6fb8a3a4061ed3de4309cdf83fca65f8319bb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 848
x-xss-protection: 0
server: cafe
etag: 2277666839114365613
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:09:41 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/ Frame A74A 19 KB
8 KB 64ms
26ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a22b29e11f6ad3ed458e71525b4edfaf0b9ab4cd962ae9a239b9509c106c826

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:04:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 301
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7817
x-xss-protection: 0
server: cafe
etag: 7051432691878289762
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:04:49 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame A74A 2 KB
1 KB 102ms
64ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:07:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 158
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:07:12 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A74A 124 KB
38 KB 72ms
43ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 10 Feb 2022 15:09:50 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame A74A 15 KB
6 KB 59ms
22ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:09:00 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame A74A 0
0 29ms
26ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTbUxp2smnc9yMuI-ThBMt5kA6hSmtME-YbxtukJQTBYQzF_QtCUJUxGk-i8abfg6xUMcKuY0ERVo0FO8l9AF-58TOzOA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H2 200 ff20f166b0acb5bbc58563e896201b58.js Show response
www.gstatic.com/mysidia/ Frame A74A 27 KB
12 KB 68ms
21ms Script
text/javascript 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ff20f166b0acb5bbc58563e896201b58.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

60b6fb70c39877b90333526914dbc0d47052cd8c4c298c421aaee2f9d6b48bcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 05:35:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 120835
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11452
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 06:53:13 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 10 May 2022 05:35:55 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame 9BEF 1 KB
875 B 95ms
63ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd11fa353cc6a8560f4c35e67c6fb8a3a4061ed3de4309cdf83fca65f8319bb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 848
x-xss-protection: 0
server: cafe
etag: 2277666839114365613
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:09:41 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/ Frame 9BEF 19 KB
8 KB 52ms
20ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a22b29e11f6ad3ed458e71525b4edfaf0b9ab4cd962ae9a239b9509c106c826

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:04:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 301
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7817
x-xss-protection: 0
server: cafe
etag: 7051432691878289762
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:04:49 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame 9BEF 2 KB
1 KB 95ms
63ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:07:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 158
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:07:12 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9BEF 124 KB
38 KB 51ms
28ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 10 Feb 2022 15:09:50 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame 9BEF 15 KB
6 KB 47ms
17ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:09:00 GMT

GET
H2 200 ff20f166b0acb5bbc58563e896201b58.js Show response
www.gstatic.com/mysidia/ Frame 9BEF 27 KB
11 KB 64ms
24ms Script
text/javascript 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ff20f166b0acb5bbc58563e896201b58.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

60b6fb70c39877b90333526914dbc0d47052cd8c4c298c421aaee2f9d6b48bcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 05:35:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 120835
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11452
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 06:53:13 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 10 May 2022 05:35:55 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/18072571111409028994/ Frame 9BEF 38 KB
38 KB 77ms
47ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/18072571111409028994/downsize_200k_v1?w=600&h=314

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a85d30b4698cf3d45e59228ee6b101ede13cc95df1939074c574bbe691e7dd3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 07:20:19 GMT
x-content-type-options: nosniff
age: 28171
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39222
x-xss-protection: 0
last-modified: Wed, 09 Feb 2022 14:39:45 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 10 Feb 2023 07:20:19 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/18072571111409028994/ Frame A74A 38 KB
38 KB 55ms
37ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/18072571111409028994/downsize_200k_v1?w=600&h=314

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a85d30b4698cf3d45e59228ee6b101ede13cc95df1939074c574bbe691e7dd3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 07:20:19 GMT
x-content-type-options: nosniff
age: 28171
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39222
x-xss-protection: 0
last-modified: Wed, 09 Feb 2022 14:39:45 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 10 Feb 2023 07:20:19 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame A74A 0
0 66ms
62ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cx_Z_vSoFYvueHMOX7AO3oLLgD6yu1alowOnoqdsPloLNhYgWEAEgpt2mhAFglfrwgYwHoAGjveLeAsgBCakC8bRHEZ8vsz6oAwHIA8sEqgTNAU_Qp5Gg-mOJDMmqAQhmh41CyxecrR8XNYv9rC-Z6VuesIESrZ2vJMUEns7uXxSu1T6i6cK2RFe2kqe6Br43kzIZtl8d5UTgV5HezXYFJ5qzFu7f-p-JzsGBdAxUCBjzZMDzYdnIxOWP3mMp6aGzzF_aoa6N1ElfoaPK_P-7iO4EquR4n6pGKRuF1outYnLxuYQ25NTY8zin7agiJBkTYoj3MhlQwWD1EnQH9DeZRb4LVJ04LRQ1r303V3jrXAC4l-3kbF89Bt0xgKGK4ZHABPaDo8DrA5IFBAgEGAGSBQQIBRgEoAYugAfFwp2hAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcEEJSdE9IICQiA4YAQEAEYH4AKAcgLAbgTiCfYEw3QFQGAFwGyFxwKGggAEhRwdWItNzcyMTQ0MDUyOTM2NDMzMBgA&sigh=3RTD3vpyKyI&uach_m=[UACH]&template_id=5000

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 10 Feb 2022 15:09:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 9BEF 0
0 64ms
63ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CPzRavSoFYoGGHOai7AOJ24fAD6yu1alowOnoqdsPloLNhYgWEAEgpt2mhAFglfrwgYwHoAGjveLeAsgBCakC_389a8cusz6oAwHIA8sEqgTNAU_QccY2RI6e4yy5VotJDUO2ONA23K7j_tNpsw640kyVc7kmcOcAnfvMiP42wu6H4KJuhSyPLrGs3FD8_s9w2b87Ex3PnprnAO-D-E6l9XsvrdsDxqR7194a2OctAHQX5PjGvh4hLV0kvAHUFpXkuPuRKua2h4FC4gW9AY3rMeAs333yNCsDIDYyiQpBicrUgwFdO4-8D9R1K1EKnPNVkkX3SWyqpufb3Ooi9CyKfg8TaJTbzdkELDUkLQa1MFQxgoX-C1qa0wZ59hFJQKDABPaDo8DrA5IFBAgEGAGSBQQIBRgEoAYugAfFwp2hAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcEENi4OtIICQiA4YAQEAEYH4AKAcgLAbgTiCfYEw3QFQGAFwGyFxwKGggAEhRwdWItNzcyMTQ0MDUyOTM2NDMzMBgA&sigh=28Rt2ecYknk&uach_m=[UACH]&template_id=5000

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 10 Feb 2022 15:09:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 9BEF 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 9BEF 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame A74A 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame A74A 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 css2
fonts.googleapis.com/ Frame E831 4 KB
634 B 28ms
27ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 10 Feb 2022 13:25:59 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 10 Feb 2022 15:09:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 10 Feb 2022 15:09:50 GMT

GET
H3 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/elements/html/ Frame E831 19 KB
8 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a7b5f2e7e3fd51102d05b2706291210864e7890361d932311a18048073374ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:18:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3091
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8079
x-xss-protection: 0
server: cafe
etag: 5902764951541284931
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:18:19 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3163 624 B
297 B 39ms
33ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeVmwEQ5tLurwIYuOiXwQEwAQ&v=APEucNUXPlecAny8ru-dErtDW3I7mHXPk0Pn4sB3-4_Gm_fVy9CAgV-T0113ZqX9_O27OA4q0HozA-ufYv0WFU28KwjdxCAlS12jmM90CzdczLHF1aB-mhWWUBpUz8WRswRKMiK6R9Tv_DR0W9eebWoI2vCl-K3v8XFEGDBoP_xRWl4MOKeT9YE

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 10 Feb 2022 15:09:50 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C397 74 KB
31 KB 84ms
79ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BOEInHJFCgjHAooOPO_itMw9b0zu5pW7ySY2pqPj2TbM893H3lHegtHv41b_j9VKo9K7jvVIYbPK36H47viiozvLxrsRlZ_0tzlAb8XKjqmaF5Wz3GV_in8NmWfrvuQbv_LhO0Yv91JdTP8zXmjAOjNkJIkA&dbm_d=AKAmf-DdvXFwvcaueNsXDHBnveR6-6vu3I5DUOZkAoIhM3UARff2eD9iRYak8FbsQpdlYkpg7maP_Vp0WvtgPIMwHB5T54JK5ED1lDZfOab09IA6mheXWGGo-3bHtHSJ_25Z_aVe82iBZ1-AhXOzKI0O2q4JXDZGVMtjkaBr8FIJuLrKrUtwmuI5TW5ItiTX4awripTJOAamp0WqhWsSa9DbF2MrhkA_xzmMMnU58WYes6V5-8_X1coTUqsoF25SE3MU1Dh_XmwO67fWApgklE109n0jemXIgx5bpKppYMIg6xxo4H9zQeXoYZaDMBt_m4_LULkpyK_ZqVpMxpV3E9GNSKYxWo-M_nXX3fwdl4buIWJUUpGa070JSvfZSDPh0duyO86gc5SKSirCJGl3OUNb6hzMdMtvhfRsd0iTDRO9eCfk9XXtMdbvtL1RRdqGnruTZ4meIpM6HUIIkb4guWKNZXaKeA3Ky4fybfn3Md4etcx1MmXs7L4i13EbJPUm3Ux_En5vMm4vu8Zcx1ZUC7IPB5FuDG9PJlKhSHxZerx3VmWmoc6E6jhVXYsxZ8wMzaqcXDZkLLe1vFmZXNCcIvchZL5V8pMdQB4MGqfEO_ELFKlq-XKV9eo2JlTPzhMxhrA4Hu6gAzbKQiUo8pj7u0IEEYM_0IVmFjyz5L1pygYngReZOusULjt2PFOgB811Fyv_82ohLGmAK_w79NNzwX0XAceqKER-ZXRPJ_s5XiuExEVZFSbi2o6VYvQbs71tKg8a_i_OvYxg3GGXHhveZoCDzbVAA2sKO33Erd7UGbnCQV2-OdZYkce34Xyfo01g4caVEnk3-ESMOJVSZZzGZnm6A1vIl6tue971FY7u-2nXBQTJmq_tM6VmTehcenJ-k2-XiBVAJBl78rf3hLmNxyhfA9ZW0ROP0-H9uaA1kIFB78k_Sv4wXim1vflQeMS5zExVRXHkrqVTjZDfU7EuNUOejyqUdbD0tdLILyCdr35OBJzfbY99vyXOd8cRrCW8lXZjKhVGKJ7ybvg_97PAFhs08cf7wnA_SCLlObU_f8Xnm6cZQY4Zgc01EvtnM_OWCjwrmrCsbeuun4iPnZQa_3ddbNNQpJHKd2JZ_EfgZanRBKKhU-DBG25MBTI7mtiEVBKsMdTGazYwP2OuA8ghKtRlqdZJJjX7HBtpMJ9EGjU6m-pCnOGTq3NLFIcyzl_pmVbNQq3qMhNhR0zmQnpXmtoqeGnZtAP4ioPZvV6t6A0AaQlJ-3cFc6hXO2eyYMW0d5RPWsz3BhrjrVRVydBOElfQtzC5Yi1vPS2XIN2cSc06kSESea47TLol-1teQvM6KyyZsURntpWvqsDsMRoEoZC8efQeK25MwBF4LwNj8w1UB_-YMGHLD3KtlKE06LQ77jRUS4PdZGlo4z557lsnhcn7qI_InE-eKvTFiVtxsSi4qT7UkRGzvVgiSBNPrsjPgZNSnX3jH-hm7tEek5iPc8-pL-oi8UTz7wHprMzRxq79IX59ZxsinekW9Pc5ueBAHTXh1SWwC236oA0tn-VOqmA_iKvD2wCTy9Er9jmnk1O8hnvNqOSldJfrq1rmnFB05VUIIDtmpawsjtA-aCexwEDz2GThvdLG-nh5Oh_ZDDRVN7cvJg284X0KvXXYWUWYHbGzjGwlmyVBQBca9tGf9RA1M08LfmuDC6CxIZt5YyKlhYMLKzf_laMtBQjk6VV9EMq9UAoSbI0hEUPYIGGsN7i1pUB-20uqu9_899N1IrH3qEu5o5xUG6prpzF25DhufBFn4vi0WAJ8HUhiH1K3B46Yl_1xGIYGNAkjq3ZUCh6KEEiarlc-QTenAaOiOLT7qwMOMYovjvz5MERJFKrsGKj777vN3TV_hvnrjKQdJ9_t-jkX4AK-n1SW8Pq7Ylt4T4i1BrBw-2ouUJGqf_meTavDcwqB2RdeC68ZUGaOSq8wNEPvk-3Djmagw1tko3HDhaw_BziPuiTF6Gf8alB-bnpjpMPkJPyP75ukGB8BtAzKoLRFL4KM15mCpS0bzIRT3EB8o0FFa89ucDUow2XOXAVr1SVsM-fMI261ramLuowDDqx7hAiHfZVB8D0dh47Sv4r4DhF7RRumhibIHqScCIwFPpRYIZtJd-uymVOnBiYJjYFRyJ-Aq6orHJXwUICT953n9m_IGOw0Pm5a1bEdbYZG_UeQH4HKSaG1VOlHhWkL50_1DcNa9NDtUqhOEBRV-QJ_pt3DylqWRUhtFLON5rTIgalWdlXla20uttp5wLuhrkKDPvY3raNBvrGoGNp_P_g7lIeaQye1MHCVilmJNDVfB9pHydTjIAfZQCjrqedNvD21BfQTV1mXZ1Vj5G_CpzsclKs_bx4fWGG5VkPPCAaljZa7P6ezfP-E0PPr2ta-l0XPA2TaQMJz51uZtho-x7Wcn0D7JeZ_lQefaZ48mPZpgjtsgSS6I1ck_g2MbxLWhqo_WRBPALu6RAsie6fCpsgz9GTpNd3NdyXwzqDVz4EYGdVRDq7WFBgQj0peU2T2bAUEEFZS2rMQmg6dbUQMxKCelS3mcLocO3GfYl18T6djuouNjBja9T1KiDTKSrv_JKj1xUp89h9mpYX2wp7ZTQ_rdiLMPGYSItXusOMpTGznlheyavaR1KBFmKLZlkoJ3t2PKwL2aTkMmaF-zwiQwHLeOjvAfM0xvDNam8jvNq2eR9T8f-556LoHfXYmmCjUUPzq5JbGL_XVCi3iTyFK_PVcpxIhra2isMoEKzK3jnQKrmaQR0lJr-ga2IMTnQd-xs6ElM6a88QFDIJDcFBg_AFAnzxeZYKUnRiy5VgluvevhtDPSZFh2D662rnHCx5PnaEQ28mVDnpvj-mAKFtHwQSC5yRDKioKQaCPHftz2iHASz3zfED-t-i7b_1ZN-WQlQCqaFqENC-_7CJKEPEwtzWjDUad8jjTAjladuOp3nM3O34CaK_tVdzDIgM0nIhR_mynHf8KQZrX9mX4mHdavLbYqE1r_bDK&cid=CAASEuRoz_zmuGxcGDe3khBb-Aajmw&rfl=2%2Chttps%253A%252F%252Fherbalserver.me%252F%240

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

23b3f4f16b3b1c1ba10b0d4b9b114c95b04802cb48b602fe08bf116248eb9e29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31692
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame C397 2 KB
1 KB 23ms
19ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/window_focus_fy2019.js

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:07:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 158
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:07:12 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C397 124 KB
38 KB 38ms
34ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 10 Feb 2022 15:09:50 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame C397 15 KB
6 KB 27ms
18ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:09:00 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame C397 0
0 34ms
25ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR2lWptFy81leHkaqYvB0l8ii55Z-lWpqfxTn6D3OM3AsXe5G_J--4CnFIdFiRNYjS2uNGhWHveo-ri4IL-k7UGAv2ruw
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C397 42 B
63 B 62ms
52ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Be39DplA3bxz-XP-CQ5yzy4OvWAF2C-uOLfibw-aUC3xdKgT0ZYqtGQN9syE4of5yd9Y6hqdnzacY0GWGjZdKfLhAiIGXOBBdlxlDuNxZ1NXQB9TU

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame F60F 1 KB
749 B 19ms
18ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Thu, 10 Feb 2022 13:26:12 GMT
expires: Fri, 11 Feb 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 6218
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 9BEF 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 68728bac5788fa193eb8bdf3059d32ca0af34677e2f9988f93b3561ab2fe11eb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9C49 1 KB
749 B 19ms
18ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Thu, 10 Feb 2022 13:26:12 GMT
expires: Fri, 11 Feb 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 6218
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame A74A 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: abdb151c2c71b933821048354bcfc06d602b4943bb88f20f8d75581dffd6c6e6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v41/ Frame A74A 28 KB
28 KB 44ms
17ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v41/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05e2888e835d97fe6e4cfb256f62f47d5dccf6d9ac202ea9d82a6bc2b1716c1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 18:14:29 GMT
x-content-type-options: nosniff
age: 161722
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28196
x-xss-protection: 0
last-modified: Tue, 18 Jan 2022 17:53:50 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 08 Feb 2023 18:14:29 GMT

GET
H3 200 gzxFwBIDWVjrNRUrZhLg_NzoVxp69M9kEQUe35bI4iA.js Show response
pagead2.googlesyndication.com/bg/ Frame 8C2E 35 KB
13 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gzxFwBIDWVjrNRUrZhLg_NzoVxp69M9kEQUe35bI4iA.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

833c45c012035958eb35152b6612e0fcdce8571a7af4cf6411051edf96c8e220

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 22:07:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 61322
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13673
x-xss-protection: 0
last-modified: Mon, 07 Feb 2022 12:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 09 Feb 2023 22:07:49 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/ Frame 19BE 19 KB
8 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a22b29e11f6ad3ed458e71525b4edfaf0b9ab4cd962ae9a239b9509c106c826

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:04:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 302
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7817
x-xss-protection: 0
server: cafe
etag: 7051432691878289762
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:04:49 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 19BE 8 KB
714 B 29ms
29ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32bc7c1c64fd1b755d48d6025b86b7e7a28ad35d1f420cf85cdc1123aa7dfcd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 10 Feb 2022 13:25:00 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 10 Feb 2022 15:09:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 10 Feb 2022 15:09:51 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20211103_RC00/ Frame 19BE 14 KB
3 KB 61ms
17ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20211103_RC00/outstream.min.css

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 12:51:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 267481
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2798
x-xss-protection: 0
last-modified: Wed, 03 Nov 2021 10:36:35 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 Feb 2023 12:51:50 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20211103_RC00/ Frame 19BE 355 KB
123 KB 62ms
18ms Script
text/javascript 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20211103_RC00/outstream.min.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

425d7478422a02b8592686dd947b18cae0ca66ab39dc437067219356fb7a0a61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 18:59:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 159003
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 125995
x-xss-protection: 0
last-modified: Wed, 03 Nov 2021 10:36:35 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 08 Feb 2023 18:59:48 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame 19BE 15 KB
6 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:09:00 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 19BE 0
0 25ms
24ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS521BSMEkNms_KK-vurM0wyCACjX-cZ_QqwaiSTHg5ruXoqIWetTQzJJbU2MXVS41460KN10I_3ZAQf_L-v9oRiAkzZA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H2 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame C397 106 KB
38 KB 62ms
16ms Script
text/javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 10:06:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18209
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Feb 2022 10:06:22 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220208/r20110914/elements/html/ Frame C397 8 KB
3 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220208/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BOEInHJFCgjHAooOPO_itMw9b0zu5pW7ySY2pqPj2TbM893H3lHegtHv41b_j9VKo9K7jvVIYbPK36H47viiozvLxrsRlZ_0tzlAb8XKjqmaF5Wz3GV_in8NmWfrvuQbv_LhO0Yv91JdTP8zXmjAOjNkJIkA&dbm_d=AKAmf-DdvXFwvcaueNsXDHBnveR6-6vu3I5DUOZkAoIhM3UARff2eD9iRYak8FbsQpdlYkpg7maP_Vp0WvtgPIMwHB5T54JK5ED1lDZfOab09IA6mheXWGGo-3bHtHSJ_25Z_aVe82iBZ1-AhXOzKI0O2q4JXDZGVMtjkaBr8FIJuLrKrUtwmuI5TW5ItiTX4awripTJOAamp0WqhWsSa9DbF2MrhkA_xzmMMnU58WYes6V5-8_X1coTUqsoF25SE3MU1Dh_XmwO67fWApgklE109n0jemXIgx5bpKppYMIg6xxo4H9zQeXoYZaDMBt_m4_LULkpyK_ZqVpMxpV3E9GNSKYxWo-M_nXX3fwdl4buIWJUUpGa070JSvfZSDPh0duyO86gc5SKSirCJGl3OUNb6hzMdMtvhfRsd0iTDRO9eCfk9XXtMdbvtL1RRdqGnruTZ4meIpM6HUIIkb4guWKNZXaKeA3Ky4fybfn3Md4etcx1MmXs7L4i13EbJPUm3Ux_En5vMm4vu8Zcx1ZUC7IPB5FuDG9PJlKhSHxZerx3VmWmoc6E6jhVXYsxZ8wMzaqcXDZkLLe1vFmZXNCcIvchZL5V8pMdQB4MGqfEO_ELFKlq-XKV9eo2JlTPzhMxhrA4Hu6gAzbKQiUo8pj7u0IEEYM_0IVmFjyz5L1pygYngReZOusULjt2PFOgB811Fyv_82ohLGmAK_w79NNzwX0XAceqKER-ZXRPJ_s5XiuExEVZFSbi2o6VYvQbs71tKg8a_i_OvYxg3GGXHhveZoCDzbVAA2sKO33Erd7UGbnCQV2-OdZYkce34Xyfo01g4caVEnk3-ESMOJVSZZzGZnm6A1vIl6tue971FY7u-2nXBQTJmq_tM6VmTehcenJ-k2-XiBVAJBl78rf3hLmNxyhfA9ZW0ROP0-H9uaA1kIFB78k_Sv4wXim1vflQeMS5zExVRXHkrqVTjZDfU7EuNUOejyqUdbD0tdLILyCdr35OBJzfbY99vyXOd8cRrCW8lXZjKhVGKJ7ybvg_97PAFhs08cf7wnA_SCLlObU_f8Xnm6cZQY4Zgc01EvtnM_OWCjwrmrCsbeuun4iPnZQa_3ddbNNQpJHKd2JZ_EfgZanRBKKhU-DBG25MBTI7mtiEVBKsMdTGazYwP2OuA8ghKtRlqdZJJjX7HBtpMJ9EGjU6m-pCnOGTq3NLFIcyzl_pmVbNQq3qMhNhR0zmQnpXmtoqeGnZtAP4ioPZvV6t6A0AaQlJ-3cFc6hXO2eyYMW0d5RPWsz3BhrjrVRVydBOElfQtzC5Yi1vPS2XIN2cSc06kSESea47TLol-1teQvM6KyyZsURntpWvqsDsMRoEoZC8efQeK25MwBF4LwNj8w1UB_-YMGHLD3KtlKE06LQ77jRUS4PdZGlo4z557lsnhcn7qI_InE-eKvTFiVtxsSi4qT7UkRGzvVgiSBNPrsjPgZNSnX3jH-hm7tEek5iPc8-pL-oi8UTz7wHprMzRxq79IX59ZxsinekW9Pc5ueBAHTXh1SWwC236oA0tn-VOqmA_iKvD2wCTy9Er9jmnk1O8hnvNqOSldJfrq1rmnFB05VUIIDtmpawsjtA-aCexwEDz2GThvdLG-nh5Oh_ZDDRVN7cvJg284X0KvXXYWUWYHbGzjGwlmyVBQBca9tGf9RA1M08LfmuDC6CxIZt5YyKlhYMLKzf_laMtBQjk6VV9EMq9UAoSbI0hEUPYIGGsN7i1pUB-20uqu9_899N1IrH3qEu5o5xUG6prpzF25DhufBFn4vi0WAJ8HUhiH1K3B46Yl_1xGIYGNAkjq3ZUCh6KEEiarlc-QTenAaOiOLT7qwMOMYovjvz5MERJFKrsGKj777vN3TV_hvnrjKQdJ9_t-jkX4AK-n1SW8Pq7Ylt4T4i1BrBw-2ouUJGqf_meTavDcwqB2RdeC68ZUGaOSq8wNEPvk-3Djmagw1tko3HDhaw_BziPuiTF6Gf8alB-bnpjpMPkJPyP75ukGB8BtAzKoLRFL4KM15mCpS0bzIRT3EB8o0FFa89ucDUow2XOXAVr1SVsM-fMI261ramLuowDDqx7hAiHfZVB8D0dh47Sv4r4DhF7RRumhibIHqScCIwFPpRYIZtJd-uymVOnBiYJjYFRyJ-Aq6orHJXwUICT953n9m_IGOw0Pm5a1bEdbYZG_UeQH4HKSaG1VOlHhWkL50_1DcNa9NDtUqhOEBRV-QJ_pt3DylqWRUhtFLON5rTIgalWdlXla20uttp5wLuhrkKDPvY3raNBvrGoGNp_P_g7lIeaQye1MHCVilmJNDVfB9pHydTjIAfZQCjrqedNvD21BfQTV1mXZ1Vj5G_CpzsclKs_bx4fWGG5VkPPCAaljZa7P6ezfP-E0PPr2ta-l0XPA2TaQMJz51uZtho-x7Wcn0D7JeZ_lQefaZ48mPZpgjtsgSS6I1ck_g2MbxLWhqo_WRBPALu6RAsie6fCpsgz9GTpNd3NdyXwzqDVz4EYGdVRDq7WFBgQj0peU2T2bAUEEFZS2rMQmg6dbUQMxKCelS3mcLocO3GfYl18T6djuouNjBja9T1KiDTKSrv_JKj1xUp89h9mpYX2wp7ZTQ_rdiLMPGYSItXusOMpTGznlheyavaR1KBFmKLZlkoJ3t2PKwL2aTkMmaF-zwiQwHLeOjvAfM0xvDNam8jvNq2eR9T8f-556LoHfXYmmCjUUPzq5JbGL_XVCi3iTyFK_PVcpxIhra2isMoEKzK3jnQKrmaQR0lJr-ga2IMTnQd-xs6ElM6a88QFDIJDcFBg_AFAnzxeZYKUnRiy5VgluvevhtDPSZFh2D662rnHCx5PnaEQ28mVDnpvj-mAKFtHwQSC5yRDKioKQaCPHftz2iHASz3zfED-t-i7b_1ZN-WQlQCqaFqENC-_7CJKEPEwtzWjDUad8jjTAjladuOp3nM3O34CaK_tVdzDIgM0nIhR_mynHf8KQZrX9mX4mHdavLbYqE1r_bDK&cid=CAASEuRoz_zmuGxcGDe3khBb-Aajmw&rfl=2%2Chttps%253A%252F%252Fherbalserver.me%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:09:08 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220208/r20110914/ Frame C397 24 KB
9 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220208/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

406dae81a8e95037a3bca53ca771f446df097cf86084d76de62fd308e2bf32a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:06:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 229
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9577
x-xss-protection: 0
server: cafe
etag: 11201793935764353180
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 15:06:02 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3163
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDtRf3baGq51irlw2fj-mJo&google_cver=1

43 B
894 B

27ms
23ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDtRf3baGq51irlw2fj-mJo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeVmwEQ5tLurwIYuOiXwQEwAQ&v=APEucNUXPlecAny8ru-dErtDW3I7mHXPk0Pn4sB3-4_Gm_fVy9CAgV-T0113ZqX9_O27OA4q0HozA-ufYv0WFU28KwjdxCAlS12jmM90CzdczLHF1aB-mhWWUBpUz8WRswRKMiK6R9Tv_DR0W9eebWoI2vCl-K3v8XFEGDBoP_xRWl4MOKeT9YE
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 Feb 2022 15:09:51 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 10 Feb 2022 15:09:51 GMT

Redirect headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDtRf3baGq51irlw2fj-mJo&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3163
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YgUqvvu2YNJWVdB0BYejVAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDtRf3baGq51irlw2fj-mJo&google_cver=1

43 B
894 B

23ms
23ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDtRf3baGq51irlw2fj-mJo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeVmwEQ5tLurwIYuOiXwQEwAQ&v=APEucNUXPlecAny8ru-dErtDW3I7mHXPk0Pn4sB3-4_Gm_fVy9CAgV-T0113ZqX9_O27OA4q0HozA-ufYv0WFU28KwjdxCAlS12jmM90CzdczLHF1aB-mhWWUBpUz8WRswRKMiK6R9Tv_DR0W9eebWoI2vCl-K3v8XFEGDBoP_xRWl4MOKeT9YE
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 Feb 2022 15:09:51 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 10 Feb 2022 15:09:51 GMT

Redirect headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDtRf3baGq51irlw2fj-mJo&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3163
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESECX9AuQ4-rx4S4NMO6Kv6ng&google_cver=1

43 B
1004 B

69ms
68ms

Image
image/gif

185.33.221.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESECX9AuQ4-rx4S4NMO6Kv6ng&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJeVmwEQ5tLurwIYuOiXwQEwAQ&v=APEucNUXPlecAny8ru-dErtDW3I7mHXPk0Pn4sB3-4_Gm_fVy9CAgV-T0113ZqX9_O27OA4q0HozA-ufYv0WFU28KwjdxCAlS12jmM90CzdczLHF1aB-mhWWUBpUz8WRswRKMiK6R9Tv_DR0W9eebWoI2vCl-K3v8XFEGDBoP_xRWl4MOKeT9YE

Protocol

HTTP/1.1

Server

185.33.221.53 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 Feb 2022 15:09:51 GMT
X-Proxy-Origin: 84.19.175.165; 84.19.175.165; 718.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 3da193e9-fc82-463a-96a6-618d9f8f13d5
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESECX9AuQ4-rx4S4NMO6Kv6ng&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3163
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc2MTM1ODEyODU2NTA5NTAwMg%3D%3D

170 B
188 B

45ms
45ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc2MTM1ODEyODU2NTA5NTAwMg%3D%3D

Requested by

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 10 Feb 2022 15:09:51 GMT
X-Proxy-Origin: 84.19.175.165; 84.19.175.165; 718.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 4329f365-ba16-4a99-b4ca-e221439f636d
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDc2MTM1ODEyODU2NTA5NTAwMg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v41/ Frame 9BEF 28 KB
28 KB 21ms
20ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v41/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05e2888e835d97fe6e4cfb256f62f47d5dccf6d9ac202ea9d82a6bc2b1716c1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 18:14:29 GMT
x-content-type-options: nosniff
age: 161722
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28196
x-xss-protection: 0
last-modified: Tue, 18 Jan 2022 17:53:50 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 08 Feb 2023 18:14:29 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F60F
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFBU7HJwaOl_J8J6OyKF6bE&google_cver=1&google_push=AYg5qPKWRQha9QJWCSTuPw28VE8erq3I9EqCR2RMzL8WB61_9HLB-GE6Lf...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPKWRQha9QJWCSTuPw28VE8erq3I9EqCR2RMzL8WB61_9HLB-GE6LfDe6-iqETagm3NKZ3zwxa_W0x8gwKhmAmSZPbOStnwn&google_hm=TsJsBe8YFTGp...

170 B
188 B

47ms
45ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPKWRQha9QJWCSTuPw28VE8erq3I9EqCR2RMzL8WB61_9HLB-GE6LfDe6-iqETagm3NKZ3zwxa_W0x8gwKhmAmSZPbOStnwn&google_hm=TsJsBe8YFTGp9DH2ChS5Pg

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPKWRQha9QJWCSTuPw28VE8erq3I9EqCR2RMzL8WB61_9HLB-GE6LfDe6-iqETagm3NKZ3zwxa_W0x8gwKhmAmSZPbOStnwn&google_hm=TsJsBe8YFTGp9DH2ChS5Pg
pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame F60F 43 B
324 B 77ms
25ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESELufvu216e_8bpCD-FxLYmI&google_push=AYg5qPJYMDBoglRHWsCSSx00wTl2VcQr0Ehb0zJQYGGkro4Zc2-lW8i9ODG8WmYv6OJjTeQqgGTOl_P7BiEuU9lL2hfTSnjPNl0Q&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame F60F 43 B
64 B 50ms
27ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEGH5qutWCONhItGOZWXkDnw&google_cver=1&google_push=AYg5qPIw_5iN1A26z3XlbS19CTtvWp7BdQxDqq8g0g87_ttTC1dftamH6K9V2ndmTK09RLze9gpngxczMhTfouycZ2Fi02rLxjRf
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:50 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: lr71allb842qmfgopg7ri12k901bgldj

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F60F
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=iLtx2ZDaRBezbC635xgl2A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

44ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=iLtx2ZDaRBezbC635xgl2A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIybj6ScuGNjFvaFxxfFs_2GoIReUIZomdHpZZHsOHlCL3NS8y3nsS2JCKEWJpkplxXRzZvbQq6CLcIw0Sf5ME44O6TfGJ7

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=iLtx2ZDaRBezbC635xgl2A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIybj6ScuGNjFvaFxxfFs_2GoIReUIZomdHpZZHsOHlCL3NS8y3nsS2JCKEWJpkplxXRzZvbQq6CLcIw0Sf5ME44O6TfGJ7
date: Thu, 10 Feb 2022 15:09:51 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F60F
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJxG0gz6AaiBAdc0IsMb0nc&google_cver=1&google_push=AYg5qPKS_CYcVTp5Rj6YeFfb6H6ds7m6M6YeJ_Lqrp9XsqUkTb5II6nDuYQM13w_42yto8mMZsc...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFESFktWS0zRjlV&google_push=AYg5qPKS_CYcVTp5Rj6YeFfb6H6ds7m6M6YeJ_Lqrp9XsqUkTb5II6nDuYQM13w_42yto8mMZscBxDtsXZ0iFAtUtz5EsenE7olf

170 B
188 B

43ms
42ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFESFktWS0zRjlV&google_push=AYg5qPKS_CYcVTp5Rj6YeFfb6H6ds7m6M6YeJ_Lqrp9XsqUkTb5II6nDuYQM13w_42yto8mMZscBxDtsXZ0iFAtUtz5EsenE7olf

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFESFktWS0zRjlV&google_push=AYg5qPKS_CYcVTp5Rj6YeFfb6H6ds7m6M6YeJ_Lqrp9XsqUkTb5II6nDuYQM13w_42yto8mMZscBxDtsXZ0iFAtUtz5EsenE7olf
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame F60F
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnik...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F60F
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEOgFnb36wDHIx_rdVmKhBrI&google_cver=1&google_push=AYg5qPKtNAkUS7TZpN0_0y8O...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKtNAkUS7TZpN0_0y8OOPClIL7lFCOI5Zhl77cGPsSL61_jDCi0osy50Yrgo8mrNCRaJ1MGZanG-Ee6JxT1W8d4hiqG_ntdqg&google_hm=

170 B
188 B

45ms
44ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKtNAkUS7TZpN0_0y8OOPClIL7lFCOI5Zhl77cGPsSL61_jDCi0osy50Yrgo8mrNCRaJ1MGZanG-Ee6JxT1W8d4hiqG_ntdqg&google_hm=

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPKtNAkUS7TZpN0_0y8OOPClIL7lFCOI5Zhl77cGPsSL61_jDCi0osy50Yrgo8mrNCRaJ1MGZanG-Ee6JxT1W8d4hiqG_ntdqg&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Wed, 09 Feb 2022 15:09:51 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame F60F 0
12 B 26ms
25ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LxcMQLHYN11-lnd_eT61ZcQvpHf9CmCDS-Y5wScMy-ItSDU8sUTYPC0SEjb8m4qHubZ5cyWw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9C49
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESENe3irKS4bsHwVE2IuBT7aI&google_cver=1&google_push=AYg5qPJkdVx29VwPjG0u7MykVQ4Duw3LM40PZ6XeAbEDFrp0JQNxuvzAjP2v5uli4FXQvJ936qVTp7rjN7R-h1nFXKzTkFHNm7Gb
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJkdVx29VwPjG0u7MykVQ4Duw3LM40PZ6XeAbEDFrp0JQNxuvzAjP2v5uli4FXQvJ936qVTp7rjN7R-h1nFXKzTkFHNm7Gb&google_hm=Q0FFU0VOZTNpcktTNGJzS...

170 B
188 B

47ms
46ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJkdVx29VwPjG0u7MykVQ4Duw3LM40PZ6XeAbEDFrp0JQNxuvzAjP2v5uli4FXQvJ936qVTp7rjN7R-h1nFXKzTkFHNm7Gb&google_hm=Q0FFU0VOZTNpcktTNGJzSHdWRTJJdUJUN2FJ

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 10 Feb 2022 15:09:50 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJkdVx29VwPjG0u7MykVQ4Duw3LM40PZ6XeAbEDFrp0JQNxuvzAjP2v5uli4FXQvJ936qVTp7rjN7R-h1nFXKzTkFHNm7Gb&google_hm=Q0FFU0VOZTNpcktTNGJzSHdWRTJJdUJUN2FJ
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9C49
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPJWwYps6P-w2yXxqN2Y5mNFak89-hWHLyiMdqwtWWm41dlq32H81SGO2IiV983mXvEeGMM821p8gro3_6UZKcp0a3ritc0&google_gid=CAESEKeGwdBLgaJQagKNAOUYHdA&goog...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCL_VlJAGEgUI6AcQAEIASm9nb29nbGVfcHVzaD1BWWc1cVBKV3dZcHM2UC13MnlYeHFOMlk1bU5GYWs4OS1oV0hMeWlNZHF3dFdXbTQxZGxxMzJIODFTR08ySWlWOTgzbVh2RWVHTU04MjFwOGdybzNfNl...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwTEtzRnJRX2FaN3VvSklfZ1FINFFVOU5tbW5JaV9TZWhnMmJ5ZnFYdHB0UQ==&google_push

170 B
188 B

46ms
45ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwTEtzRnJRX2FaN3VvSklfZ1FINFFVOU5tbW5JaV9TZWhnMmJ5ZnFYdHB0UQ==&google_push

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 10 Feb 2022 15:09:51 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwTEtzRnJRX2FaN3VvSklfZ1FINFFVOU5tbW5JaV9TZWhnMmJ5ZnFYdHB0UQ==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9C49
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKQO9Ag...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKQO9Ag...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAyMTAxNTA5NTEwMDAxMTUyOTc5OTEyMA%3D%3D&google_push=AYg5qPKQO9AgWWVoA0rxLfSO_5qVo0iuBupBQdW0Udnnj8p9aiZ_-PXyciu4AGpE-pWxmP...

170 B
188 B

45ms
44ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAyMTAxNTA5NTEwMDAxMTUyOTc5OTEyMA%3D%3D&google_push=AYg5qPKQO9AgWWVoA0rxLfSO_5qVo0iuBupBQdW0Udnnj8p9aiZ_-PXyciu4AGpE-pWxmPtja2CoMxnKiMvvt66_JZ280zJjJee9

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAyMTAxNTA5NTEwMDAxMTUyOTc5OTEyMA%3D%3D&google_push=AYg5qPKQO9AgWWVoA0rxLfSO_5qVo0iuBupBQdW0Udnnj8p9aiZ_-PXyciu4AGpE-pWxmPtja2CoMxnKiMvvt66_JZ280zJjJee9
pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Thu, 10 Feb 2022 15:09:51 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9C49
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJxG0gz6AaiBAdc0IsMb0nc&google_cver=1&google_push=AYg5qPKZ1cY9BJ2aOwDchiXUmhfewuZTuDnmhE9vGzNeeN6Qn0BHNBZI4b5dX5S7_r7-ANpQDrg...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFESkstMjgtMThOQg==&google_push=AYg5qPKZ1cY9BJ2aOwDchiXUmhfewuZTuDnmhE9vGzNeeN6Qn0BHNBZI4b5dX5S7_r7-ANpQDrglyhX9NmObD5BCit56_TfxOK0Y

170 B
188 B

42ms
41ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFESkstMjgtMThOQg==&google_push=AYg5qPKZ1cY9BJ2aOwDchiXUmhfewuZTuDnmhE9vGzNeeN6Qn0BHNBZI4b5dX5S7_r7-ANpQDrglyhX9NmObD5BCit56_TfxOK0Y

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFESkstMjgtMThOQg==&google_push=AYg5qPKZ1cY9BJ2aOwDchiXUmhfewuZTuDnmhE9vGzNeeN6Qn0BHNBZI4b5dX5S7_r7-ANpQDrglyhX9NmObD5BCit56_TfxOK0Y
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 9C49
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdW...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 9C49 43 B
296 B 150ms
32ms Image
image/gif 2a05:d01c:1d8:8102:7312:c82c:fb3:8dc6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESED-8BUsYjuYz2tUuwhdNjR8&google_cver=1&google_push=AYg5qPL3hqwB7R_GO8KBRChULU7CUPcmj6wTedacAX97iPiQ__lo7N6kk34MNCI6drhqrE7fxoZE3EItRujlldDb3cebbp7bWeTP
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8102:7312:c82c:fb3:8dc6 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 1
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 9C49 0
12 B 29ms
28ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KhbajjTydaPOQyrcNw75TL_AS_Q_-Av6fugmN1VbEEhs1Kpt59_dayhVp2lmCs2g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C397 41 KB
15 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 10:06:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18207
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 10 Feb 2023 10:06:24 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 86B0 1 KB
749 B 18ms
18ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Thu, 10 Feb 2022 13:26:12 GMT
expires: Fri, 11 Feb 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 6219
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame C397 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60ddec91f902c124fe5bc65faf471f98fa0656a373653868c987876cb3afee66

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 gzxFwBIDWVjrNRUrZhLg_NzoVxp69M9kEQUe35bI4iA.js Show response
pagead2.googlesyndication.com/bg/ Frame A055 35 KB
13 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gzxFwBIDWVjrNRUrZhLg_NzoVxp69M9kEQUe35bI4iA.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=1400915940&adf=1365585484&pi=t.ma~as.9829683902&w=1140&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1140x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=2&bdt=255&idt=118&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=245&ady=1085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=hIZsfFT0Wz&p=https%3A//herbalserver.me&dtd=270

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

833c45c012035958eb35152b6612e0fcdce8571a7af4cf6411051edf96c8e220

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 22:07:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 61322
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13673
x-xss-protection: 0
last-modified: Mon, 07 Feb 2022 12:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 09 Feb 2023 22:07:49 GMT

GET
H3 200 gzxFwBIDWVjrNRUrZhLg_NzoVxp69M9kEQUe35bI4iA.js Show response
pagead2.googlesyndication.com/bg/ Frame 5FC7 35 KB
13 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gzxFwBIDWVjrNRUrZhLg_NzoVxp69M9kEQUe35bI4iA.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7721440529364330&output=html&h=280&slotname=9829683902&adk=4113963702&adf=2653041513&pi=t.ma~as.9829683902&w=1200&fwrn=4&fwrnh=100&lmt=1644505789&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fherbalserver.me%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505789135&bpp=3&bdt=255&idt=116&shv=r20220208&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2321163080596&frm=20&pv=1&ga_vid=131292801.1644505789&ga_sid=1644505789&ga_hid=2087553988&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=306&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064747%2C31064806%2C31063247&oid=2&pvsid=2870686407588897&pem=288&tmod=1828797444&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=3bUkDE7m3f&p=https%3A//herbalserver.me&dtd=267

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

833c45c012035958eb35152b6612e0fcdce8571a7af4cf6411051edf96c8e220

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 22:07:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 61322
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13673
x-xss-protection: 0
last-modified: Mon, 07 Feb 2022 12:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 09 Feb 2023 22:07:49 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/ Frame 402D 13 KB
4 KB 45ms
18ms Document
text/html 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0423d024d4e076f797c5fcc61f51723f1c8b047a5fd22e84b5e4c1b15e1e790e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 4146
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Wed, 09 Feb 2022 01:04:46 GMT
expires: Thu, 09 Feb 2023 01:04:46 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 02 Feb 2022 09:49:19 GMT
content-type: text/html
age: 137105
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C397 0
571 B 134ms
90ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvgyJnVjw-kKRL-aFTnaw6A-gxA67ruOwiJDX7EmRHHaEc1CmUS1JNbuzMZqFXr1GZg4bam-a8VEfRTC0nXKYWv7ZqBqial68T5ixIB7983c-K8gsk2x3-sr_EwRnaJgvwsKJ0aV_fm6KxXwiW6XkMHzj0smKvV8mGbh5vyniQrqUyiiccWeinznt78KcX1VIXrTP5youAr_rg0xzVJpDlqMyydWGOwSA3yBy2Fin5BSfNes5ayG6MqwlQPJQiJWN2OLxv06K9w2QFk5mDpG3hSEWgolgX0qLDUaqFHEXe1YGEyRXEWsYwhk5momc_AH3HBoD_CZnLfRUGYYWkIMzPxIt_qz9mJXGPoC1YxLYBQmm1esV5IpxMOAeViwApPMLImTBHkO5_T1WfuhLYgl9RH72W2GU1FPPsoeIZQA2dUt2_U9w3qNBNLFUkuk70zlwVleQpBluwFJK4di55szeA1aqShX5j1hFRz9O_KQND6m_GzHr6lftUharq2P1k2hbTtcIalTHr-rNqpjnICteTKcTEqeR4k795lQwIGoxfWzx6FpT58KsWauH5OFSAn3ROkB9hTnCtIDcsU2ifFhFmSfh1_23uq3BdjAc_qT0G60g_uWIFSTfLQ38IFMDI9XSCd00qPPixKihWlZbPCd0Na-hfIiLrX4aCqxzXTghyQ2IksMVxus3Q1WVqxWxL-dFt8Zrggo-5UUZqkbrF8tfV1N1HUIFPg0YTWL5DhkH6lA7FNj2rVd3ArqU0SKcUPr1wIfawGo7Jm0U9Yp7RkYXcR6fEXJK090ylbRF_T2dyM8DmUANaxmF7c0UWZCn4EWq90r0-iouB6XL5PJjsXINoD7Ty5PyJnx7iijwaFe7cuYW3XNN8HvZ7RVIIIjfWatBr5vg2_qsqbPOimzfzIr4x3we48zaN-OIHG2J-dSIGfG6RbghxmDFUrWyOt4EaXdlTg2iRsP6cU8xmxRmGK51B_a0lJUR-H8etQLCEKsu4pJkns26E-4T59mbDElpUM-IfA9J_je7eO4NjmD9P_n_NiyxwzzydSjTcoREyjzn3NibpLRGt8SDnLho4-KrU6IDxUffB0nUdd08lx1wG_OXLlkNb9Tb-eB2-PuHe61iGOUL7mXRbIIO9pq2X_ZJ4-zO4I54kTpm8aMZm6dofuxt728upetYIyypxaU4b84CtpODlrTxROAQ&sai=AMfl-YThUGODHhTpMVIYKR_iAMCmQtQljEhKF7Svj3tQbJpagkZgbX_cPkVRGaopPuzaKiI2RPz9BAgPHSP_btxO7Dk4KBUu2gV6zckoohzzA9QZyfsbqltdfHOhyMq0ejfIoX92TXxrhnc06-IU2aHe_4GSW97VwA&sig=Cg0ArKJSzIni9bEf210pEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=208&cbvp=1&cstd=205&cisv=r20220208.25746&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Thu, 10 Feb 2022 15:09:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 51B2 22 KB
8 KB 16ms
16ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 10 Feb 2022 10:06:25 GMT
expires: Fri, 10 Feb 2023 10:06:25 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 18206
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 204 csi
csi.gstatic.com/ Frame 19BE 0
327 B 339ms
108ms Ping
image/gif 2607:f8b0:4006:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~kzh4adkr&c=4232581329372&slotId=2116290664686&qqid=CIbVpLu19fUCFYWAdwodPx8F1w&fb=outstream-lima&sei=44729911%2C44730425%2C44730426%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20211103_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81d::2003 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 19BE 0
20 B 53ms
52ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=CpptBvSoFYsaCG4WB3gO_vpS4Def7ifpno_vIgsIP1Zm_0couEAEgpt2mhAFglfrwgYwHoAHDxbPQAcgBBagDAcgDmwSqBO4BT9ByO3O8acTwXnqUUUlsJkRCHfj3FFuPzRLaxrjcB6nE9FuyIO60iKlt1QD-q-oYq_cVXyWjed-_9FS9I0BzZVlbLKICq7m1m0clzkTcL2g0AyTSdG-Wi9md-3xvsDDc6lTGfD1DYGXByUZh_ABhdkgXR-wiPyJQ900qnxwwi9BecFVdgo3ShzBZZXjrft8cYCrh3TDqdzXOuSq3AUgQLoxj2ZgwsEwkR5x69BOULXne_9Wcz6ZI-c0ZB3jmA8R8f37CdOe3sjsMCt7kAjyNGz7lzqWMkPhrjn0SlF2dPU7YshbrmyC1tUbb4rhIW8AEhs3x4fsD4AQDkAYBoAZOgAelusyvAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYH4AKAZgLAcgLAYAMAbAT3YOUDsgT58-H3wPQEwDYEwqIFAXYFAHQFQH4FgGAFwE&eventType=clickstring&clientTime=1644505791298&ai=CpptBvSoFYsaCG4WB3gO_vpS4Def7ifpno_vIgsIP1Zm_0couEAEgpt2mhAFglfrwgYwHoAHDxbPQAcgBBagDAcgDmwSqBO4BT9ByO3O8acTwXnqUUUlsJkRCHfj3FFuPzRLaxrjcB6nE9FuyIO60iKlt1QD-q-oYq_cVXyWjed-_9FS9I0BzZVlbLKICq7m1m0clzkTcL2g0AyTSdG-Wi9md-3xvsDDc6lTGfD1DYGXByUZh_ABhdkgXR-wiPyJQ900qnxwwi9BecFVdgo3ShzBZZXjrft8cYCrh3TDqdzXOuSq3AUgQLoxj2ZgwsEwkR5x69BOULXne_9Wcz6ZI-c0ZB3jmA8R8f37CdOe3sjsMCt7kAjyNGz7lzqWMkPhrjn0SlF2dPU7YshbrmyC1tUbb4rhIW8AEhs3x4fsD4AQDkAYBoAZOgAelusyvAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYH4AKAZgLAcgLAYAMAbAT3YOUDsgT58-H3wPQEwDYEwqIFAXYFAHQFQH4FgGAFwE

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 19BE 30 KB
15 KB 143ms
77ms XHR
text/xml 66.102.1.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-BFxwQYtULoTa-ibW85SDZPVPMB7OiGQbYlK1ul8yQZvKZMuP1RtPRDIbcekU24LO5GHHyTHPpoQl8GwzVfbAidE8NfEQ&dbm_d=AKAmf-B8RT4zTlrwPbTzeJD1P6QC6yT5jnoV4PYp0E4TjJMtUctb0l707xu6_AGCFcZ3o2v1zIjEL2qjAUsn6j117BErUkrMSeW1pBz2gi47uh6wtpaRVdPvV5QHx5Ti5YLRZKzYF-imTZGWweycIgmg-BUktarOGYCXDmSTBWwDa7Ad3FWA73wszwlqJC7zVHYdChiyeIsg5REdAVZWMxwPg_w0BfYxgI-Ht7lRok0jOhgw-KiVDo2GAr32ER4D4rrIr5Q215MkCd9zYJLvj_xL8FshBnukno5XppYsCHrkSwp9kabnujMJqh96Oy3RTUVlkmKrMQ9HtRWYkgGmZ1OyPiwEhJ-sHOxYgL7nqtlZ50QxDlWiZVrAvqsUKFDSwUXXZAx_UTojLJRVLa_1aXjfY0NulEwck4We0WChMfKg21FULcc97rgqiPm9IjPRbWWHvCr6UCEJqEkg3IbMw81u0Ljy7tsZCYh3FzW--bZCA4AjYNGTRl8B6Nx0QPM5cKiAr4PA7U7LNQmLy9Vgc6wHKQ3Jep5QodBMbv_lWb8gNHBNmNvXiO8vbtEbXjNuaB4nimPVNNtrxtjoFxB_8Fe1E1s8vygOV2gPEyibY9z9Ap8ZEmyiEUkDWmBgFyVROxY9Oxh29rgQeuECRglje0sIeok00Aw_feHrTHa741DFIs_r2hF_wc73cvOGdPQVDlEQvDEK4GZsMM8Nb92xDEYlRFXoiKSRJHOZp9z0Al5JJRb5QFJ9GGr5LY0TArVHnc-aPiYx6fkT7BLIC9jwToeFvV-Y0JyuQeGEU7gBSj7Y3ZGqM-HDxD6U_E9ysXFmNBobwLCY1BiICmCuGC8v_UCNSTvZDuQwmPVaf4_FFj4z_1b-EVhWWVC_DFChnZsAD2QwHZyGIguPkUjYjVg0k77MJfYmiGbgolSj3WdFhd6v9FHtzYdqXOzOamiV2jjrMOxfje84MEeraPwxhC64beIxOriu5z1kNrmUcZvadzlY6la3kQEDXTilIINSg9QhWUVU1XOcPi9xPGydYOELsCUJ7mAX2ABUklDiTbLryJphMLRAjjKd7lCoVKyYCpZPyPp54vSRlxpA20t9Nm-yKjeJLgirzSCa346OfKD4tk2uHPAFdnmC1bASx8ITLIZRztXsYL5_X_tJ1CgFhENSa-VUQeOxVBsAy1e_GKscRTKyX-cqKtDVzO5DW07LaLpN4uOq2TAPYcEQGcoy_brwQm3zMXRDCwNW1EwoJQsCrGD5UggYrF6RLqs3O3YJXounzZbzu3FH_GYzTL3T2wlcoEojoxQ5LRBK0x83qpv5JTwWR3mbUb5gcNtX_W7Bk5dkzwaUrdIwf2OpV8WE0yjpQ4HdPI0HKgHCfvhOgCMTy0Vwfy4wsEBlwEgkf9QlvrafH-bb0f6gXc8ef4aNhitKzH8gGYq2_H0VlYzH8HQVztqlHzs8eRUVeDMd14u510o_QpansYNU5sOg2keiKFx4lxYsYPFzOyMyvv5LkMZOsqDp2KJEof622mq-CH0kl6H3wtKDLRFfdkOVgBKaEpK1ih4x_70qkWiFlHBaMuJkBlIdVaASSYUuN8VO8xY2u08b3wX4c4TlbAS804cyHtfJ2DDVukOwHqe5mhw7Z18ce9tsSuBHlR_SwjyXxKHcpTpjPLio_tBOG_RW75lMEJc3ogTGkolt_7YixZUALHAaBGx0Jy2XbXW12sbDzNv2MhIuxWFCdUKaTMmTnQbW4lopNKQP5nkH3r9Ji_KnBfVUR8hLT_b5GoZY85mWhOsDCkhjF47veouhpd4wB1FAcNaLg6UxjCnJVD7SpQGlHOb-gx1SWRRNdA5djW9vhxcIc0s1PyTKLF05xMHDyX1dANJKRYEmxxFcfu-nyFFoLDBhH1Nr1PDUhLkSoCu1gUvafw1eXrspY4rPCo6qYO5s4_Hrcio1ygdJ5i-YJzOX11de1AF1N6HuZHmaeLvyxkazxLgLk5g3RvfOlIUdwEz4ZtZKBaVbWsh9dci3lNIZiYK_HUuyxUL9XhvFlv6HfQc5G7S_DEjgIxwRjeqElXt9qSdMzm9nfzt71ty1YoY-AFAQtfq1ma9bpVPSgo4b5VOhFcJswCPm-FrPlzLqFxGxBKZK1dRbaIULSTsuX4u5R7faUT9Mm5h1xBwUqwmVlv0XiVOZ2wB5oGBoQvKrx-B2gsuzkL2RcZglhPoNGz6SwNz1Ck3qC-JX0qevQ5pemK1NxqBIGf1wyKH2dJUU6cFBfJAkemzj3cSSnX87gD4olf_V_lDDr3xF9HgYB9ZZoUxNIV8x1TkwRf5FQsYiKNnozZPT_qL-aKr5HDTR5ouJLv43ioDi0uBARmUsdB5F8Io0Tzdo28KKYIRyNhtYPLTsrDKE5cnar9FgDF7tXO-QyJojy1RJv-h0Xbzx5n4kc5IFfxy70YnO85k55-wk6YPBbiS2yGZrsa1ZZsW-9ZKyK-gb-iW48S1IE9IKDp9OEAEDrK_b7r2z-8Ss6pj-roW5pL1Ti6Wza3RFgyMGQ8bqhFdCnFEJ6Zpf3G2Ug1eFArhGzMDp1bAUZkIggBJQHCnR3P4oNtgsjeVOoxkRnummFpKNNlvOHAY7n2r3vuH18EzsW9ZNGT_0PC-E3RnnLEYDCPDodPDcpdcas0BOMzSjDcgetYKLhOqGl6JkYBMHvaMmmq7LawBU7Iux4BJLbqUzJdCZMZQ6d2hlotO_aaLqBD0bPO64hIfZZZuk-bJOwsFobs68qD_nidN69_6ir_wQParGPCcMDs6eOg3D7k87Ize8I2brwK26hj1Mao0GlnPOBOLfw0lPz0DGiyMeS_5Ojbb_t6jFoG3N8tDdtav0ETHgCqCpQ3ZH2wd9RRQXj1lKqXZWCc3O3jndcs1ta-EE5izIyhKWkfvmGXeaTz-GqUlIUjJsxqe0kXN1O-wLrzjTHrt0mxGzbAHEacmPLrn8rT2VN-SiZaImxCcpq7_K0m6wIt72Gs3-83N3s-vcszM5LvYkYp3oZu9qqu5TAauTJc0KwXnclVCWq4PEiprhKpNX0L_asvT-fCmdv_i_ekPn9zqPgrWwOK-rhylnakXOehENi3MwVMjGUATdTLt0FQqCBj-IeRBcutWP2jrMcqiob3eKRMMr7Vvyy4_Z&cid=CAASEuRo_FBGG7pRpdUYVLcKudmF-w&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20211103_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.102.1.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wb-in-f155.1e100.net

Software

cafe /

Resource Hash

fc94e48a4b5de3cc76e1b94ad00fc2cc6ad34cd7c665a4de672316716ebe93c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:51 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15118
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6238 1 KB
749 B 20ms
17ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Thu, 10 Feb 2022 13:26:12 GMT
expires: Fri, 11 Feb 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 6219
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 adsense_-ad-hrule--ad3._ad_image_ Show response
fundingchoicesmessages.google.com/f/AGSKWxWOQsj4JF6MXumlhmk93TGYKTq5JQhSk8lQPYdAUnYGaQTDvC5sbGV-KfijFiZvTLJifbKwQYFi_3mAA-hj85FBoBhGW9bAwmMZupDtHOoId5p-WpuINmkBYXxl1Fg5nR2-rVDuSkW_-6Ra3w_L1lkEixMj4... 54 B
106 B 33ms
32ms Script
application/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWOQsj4JF6MXumlhmk93TGYKTq5JQhSk8lQPYdAUnYGaQTDvC5sbGV-KfijFiZvTLJifbKwQYFi_3mAA-hj85FBoBhGW9bAwmMZupDtHOoId5p-WpuINmkBYXxl1Fg5nR2-rVDuSkW_-6Ra3w_L1lkEixMj4f5wx7HBdzDAw052BFjfeS4qe9LmtNe4cmrkEe1XwcBq1_culd7puA398cG2oFcVKzAItA1-bOO3NsiKSxA=/_/TWBadbanner./adsense_-ad-hrule--ad3._ad_image_

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.KqEVvyz_RMg.es5.O/d=1/rs=AJlcJMz7dPxOrRC2xa1TQkMKh6uAwDLCKg/m=detection

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

68e1afec9952b74996ebb3622ff1301883539c3db81e0975489659c6a76497b3

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-peUS+lALn0ImFhrKcZ0H9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-peUS+lALn0ImFhrKcZ0H9g' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-peUS+lALn0ImFhrKcZ0H9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-peUS+lALn0ImFhrKcZ0H9g' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 google_top_exp.js Show response
pagead2.googlesyndication.com/pagead/js/ 47 B
93 B 18ms
18ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/google_top_exp.js

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.KqEVvyz_RMg.es5.O/d=1/rs=AJlcJMz7dPxOrRC2xa1TQkMKh6uAwDLCKg/m=detection

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ccecd185ac16ba0a538840f37701053fbb861f7fbbdd86039c7415fcd924d1f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 07:38:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27108
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67
x-xss-protection: 0
server: cafe
etag: 13036835877489095579
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 07:38:03 GMT

POST
H3 204 AGSKWxXVDOGQYX4hDhUVaR4TTxilYAS4n0GpjP9sJ4IAApUxoR8f-EV8Vq6SEsSrWO2GRGSUo9Tx4eJ7ODrHw2-cY0XelOi7iNu2qO6IHxQvYYlVA-6wy1Ao2ajFtRJzl0lPPlr4C4Urabd4uxebuk_CMNh6bO7Svox1UtEAzLk0nh-s9ERQWfx2n4-1IK9s Show response
fundingchoicesmessages.google.com/el/ 0
26 B 32ms
32ms XHR
text/html 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXVDOGQYX4hDhUVaR4TTxilYAS4n0GpjP9sJ4IAApUxoR8f-EV8Vq6SEsSrWO2GRGSUo9Tx4eJ7ODrHw2-cY0XelOi7iNu2qO6IHxQvYYlVA-6wy1Ao2ajFtRJzl0lPPlr4C4Urabd4uxebuk_CMNh6bO7Svox1UtEAzLk0nh-s9ERQWfx2n4-1IK9s

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.KqEVvyz_RMg.es5.O/d=1/rs=AJlcJMz7dPxOrRC2xa1TQkMKh6uAwDLCKg/m=detection

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-yjYSgtizWlwwJvSK8lCrRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-yjYSgtizWlwwJvSK8lCrRw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://herbalserver.me/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 10 Feb 2022 15:09:51 GMT
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type: text/html; charset=utf-8
access-control-allow-origin: https://herbalserver.me
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-yjYSgtizWlwwJvSK8lCrRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-yjYSgtizWlwwJvSK8lCrRw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 19BE 41 KB
15 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20211103_RC00/outstream.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 05 Feb 2022 18:05:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 421445
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 05 Feb 2023 18:05:46 GMT

HEAD
H/1.1

200
OK

file.mp4
r5---sn-4g5lzned.c.2mdn.net/videoplayback/id/6253bb0e0d9b5336/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3788872058/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,m... Frame 19BE
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/6253bb0e0d9b5336/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3788872058/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/sig...
https://r5---sn-4g5lzned.c.2mdn.net/videoplayback/id/6253bb0e0d9b5336/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3788872058/sparams/acao,ctier,expire,id,ip,ipbits,i...

0
0

83ms
18ms

Fetch
video/mp4

2a00:1450:4001:13::a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r5---sn-4g5lzned.c.2mdn.net/videoplayback/id/6253bb0e0d9b5336/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3788872058/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/3C5263209B0E6ADF53B95FAAC558CFFD64B18AA7.839B87A41A14587312C6AD1CB443A377A75DAC0D/key/cms1/cms_redirect/yes/mh/Z9/mip/2001:1b60:1010:2:1012:c406:9e64:9203/mm/42/mn/sn-4g5lzned/ms/onc/mt/1644505615/mv/u/mvi/5/pl/29/file/file.mp4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

HTTP/1.1

Server

2a00:1450:4001:13::a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Thu, 10 Feb 2022 15:09:51 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 2225750
Last-Modified: Wed, 09 Feb 2022 16:27:37 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Thu, 10 Feb 2022 15:09:51 GMT

Redirect headers

date: Thu, 10 Feb 2022 15:09:51 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 668
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
location: https://r5---sn-4g5lzned.c.2mdn.net/videoplayback/id/6253bb0e0d9b5336/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3788872058/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/3C5263209B0E6ADF53B95FAAC558CFFD64B18AA7.839B87A41A14587312C6AD1CB443A377A75DAC0D/key/cms1/cms_redirect/yes/mh/Z9/mip/2001:1b60:1010:2:1012:c406:9e64:9203/mm/42/mn/sn-4g5lzned/ms/onc/mt/1644505615/mv/u/mvi/5/pl/29/file/file.mp4
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://googleads.g.doubleclick.net
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 86B0
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFBU7HJwaOl_J8J6OyKF6bE&google_cver=1&google_push=AYg5qPLGyZSHEDLEcFgL9cDCgPCdsrWTW6jaf-sqNo3pLo4D3mJbEuoI-n...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPLGyZSHEDLEcFgL9cDCgPCdsrWTW6jaf-sqNo3pLo4D3mJbEuoI-nXM6M6Jov31YURYrhIpak0FvSd4znl8M6ShLP-goFs&google_hm=TsJsBe8YFTGp9...

170 B
188 B

44ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPLGyZSHEDLEcFgL9cDCgPCdsrWTW6jaf-sqNo3pLo4D3mJbEuoI-nXM6M6Jov31YURYrhIpak0FvSd4znl8M6ShLP-goFs&google_hm=TsJsBe8YFTGp9DH2ChS5Pg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPLGyZSHEDLEcFgL9cDCgPCdsrWTW6jaf-sqNo3pLo4D3mJbEuoI-nXM6M6Jov31YURYrhIpak0FvSd4znl8M6ShLP-goFs&google_hm=TsJsBe8YFTGp9DH2ChS5Pg
pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 86B0
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPL9eAb9R81CDTJNumzOLN19OGUP5031zaZ3amI...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdVcXZ3QUFCZkpXNzExUw&google_push=AYg5qPL9eAb9R81CDTJNumzOLN19OGUP5031zaZ3amIS1Sa0XJzZocDVFXoFDuULNQUNny478UGrmHp1xlQRRl7V_UeqRpKdhiEF

170 B
188 B

43ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdVcXZ3QUFCZkpXNzExUw&google_push=AYg5qPL9eAb9R81CDTJNumzOLN19OGUP5031zaZ3amIS1Sa0XJzZocDVFXoFDuULNQUNny478UGrmHp1xlQRRl7V_UeqRpKdhiEF

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdVcXZ3QUFCZkpXNzExUw&google_push=AYg5qPL9eAb9R81CDTJNumzOLN19OGUP5031zaZ3amIS1Sa0XJzZocDVFXoFDuULNQUNny478UGrmHp1xlQRRl7V_UeqRpKdhiEF
Date: Thu, 10 Feb 2022 15:09:51 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 466606.gif
id.rlcdn.com/ Frame 86B0 42 B
316 B 26ms
25ms Image
image/gif 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPKzZ4SqhxL-3Ln8KI3fxkX7iqTHmolIKygWbST1JT_IayWbs_ylsjrxlPabA4YjeUyeqLc6hWe46B1hK_ixpfrHXDZb03Pt&google_gid=CAESEKeGwdBLgaJQagKNAOUYHdA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 15:09:51 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H3 200 dds
rtb.openx.net/sync/ Frame 86B0 43 B
64 B 28ms
28ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEGH5qutWCONhItGOZWXkDnw&google_cver=1&google_push=AYg5qPKWTp6c06ZzVKjwZZ0qrTw1u3RlDzs7p6Dqi0XytS4xwFCMYAeEOdrRULLoW4APlmUljGSEMfGOHZ4ofc92AGLHM68htBM
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: ch0alj6qll0d6a6adj91snnp7rh8jp25

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 86B0
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=iLtx2ZDaRBezbC635xgl2A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

42ms
41ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=iLtx2ZDaRBezbC635xgl2A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIlnnl7_za_cWlHByl9s6EDssHavD84XxHNvzOpikeSqDFH8ErOYCMQi5xURCaTsUzT4rWozFWOPQwhjI9MNiGZSHfgSRcI

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=iLtx2ZDaRBezbC635xgl2A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIlnnl7_za_cWlHByl9s6EDssHavD84XxHNvzOpikeSqDFH8ErOYCMQi5xURCaTsUzT4rWozFWOPQwhjI9MNiGZSHfgSRcI
date: Thu, 10 Feb 2022 15:09:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 86B0
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJxG0gz6AaiBAdc0IsMb0nc&google_cver=1&google_push=AYg5qPKq49hrfPh2POmavBY4kp_sywOyP5IDgO5lIyBrBLO5QGD-YD9E1Abas1RxxuyD6P5UIN1...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFEUUstMTEtTExTWA==&google_push=AYg5qPKq49hrfPh2POmavBY4kp_sywOyP5IDgO5lIyBrBLO5QGD-YD9E1Abas1RxxuyD6P5UIN1ooOq3AyM1cw_gIOQc3TeN6QXA

170 B
188 B

41ms
40ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFEUUstMTEtTExTWA==&google_push=AYg5qPKq49hrfPh2POmavBY4kp_sywOyP5IDgO5lIyBrBLO5QGD-YD9E1Abas1RxxuyD6P5UIN1ooOq3AyM1cw_gIOQc3TeN6QXA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFEUUstMTEtTExTWA==&google_push=AYg5qPKq49hrfPh2POmavBY4kp_sywOyP5IDgO5lIyBrBLO5QGD-YD9E1Abas1RxxuyD6P5UIN1ooOq3AyM1cw_gIOQc3TeN6QXA
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 86B0
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IX...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 86B0 0
12 B 24ms
24ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KOriqwRrMkJ7Mobsi4hPZVMleVe9g1kX0zqSSpxpfJFdriJ0urEpsR3dFhMo6IsE6KwDtk

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 HYPE-736.thin.min.js Show response
s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/ Frame 402D 55 KB
24 KB 20ms
19ms Script
application/x-javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/HYPE-736.thin.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

34660fe46d78c890b82dd7e19886dca4ce2c46d31b1b308ba9b81e53a9f1669e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 00:11:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 226676
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24443
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 09:49:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Feb 2023 00:11:55 GMT

GET
H3 200 gzxFwBIDWVjrNRUrZhLg_NzoVxp69M9kEQUe35bI4iA.js Show response
pagead2.googlesyndication.com/bg/ Frame 51B2 35 KB
13 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gzxFwBIDWVjrNRUrZhLg_NzoVxp69M9kEQUe35bI4iA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

833c45c012035958eb35152b6612e0fcdce8571a7af4cf6411051edf96c8e220

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 22:07:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 61322
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13673
x-xss-protection: 0
last-modified: Mon, 07 Feb 2022 12:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 09 Feb 2023 22:07:49 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6238
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFBU7HJwaOl_J8J6OyKF6bE&google_cver=1&google_push=AYg5qPJnoIQ9JQwr-igX3uRXpDsRKQfJm7Rj-Js4N0PEmhpIT-pcnkV9mH...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPJnoIQ9JQwr-igX3uRXpDsRKQfJm7Rj-Js4N0PEmhpIT-pcnkV9mHUWJZet-ag2lQr-0HBw4EB9GnAWeNGVS2B_fKeE-p0&google_hm=TsJsBe8YFTGp9...

170 B
188 B

47ms
44ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPJnoIQ9JQwr-igX3uRXpDsRKQfJm7Rj-Js4N0PEmhpIT-pcnkV9mHUWJZet-ag2lQr-0HBw4EB9GnAWeNGVS2B_fKeE-p0&google_hm=TsJsBe8YFTGp9DH2ChS5Pg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPJnoIQ9JQwr-igX3uRXpDsRKQfJm7Rj-Js4N0PEmhpIT-pcnkV9mHUWJZet-ag2lQr-0HBw4EB9GnAWeNGVS2B_fKeE-p0&google_hm=TsJsBe8YFTGp9DH2ChS5Pg
pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6238
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPLwEYT0IUBxoRP3plbitaCAcenzTQu7pbeNR79...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdVcXZ3QUFBUUZLOEgwWQ&google_push=AYg5qPLwEYT0IUBxoRP3plbitaCAcenzTQu7pbeNR79YS0KsZZKfR8QNhMeNOVJ9U0ps17TH7FV4vZjUDzVEW1Ut-KoyoIg--a4

170 B
188 B

48ms
47ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdVcXZ3QUFBUUZLOEgwWQ&google_push=AYg5qPLwEYT0IUBxoRP3plbitaCAcenzTQu7pbeNR79YS0KsZZKfR8QNhMeNOVJ9U0ps17TH7FV4vZjUDzVEW1Ut-KoyoIg--a4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdVcXZ3QUFBUUZLOEgwWQ&google_push=AYg5qPLwEYT0IUBxoRP3plbitaCAcenzTQu7pbeNR79YS0KsZZKfR8QNhMeNOVJ9U0ps17TH7FV4vZjUDzVEW1Ut-KoyoIg--a4
Date: Thu, 10 Feb 2022 15:09:51 GMT
Server: Apache
Connection: keep-alive
Content-Length: 390
Content-Type: text/html; charset=iso-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6238
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESENe3irKS4bsHwVE2IuBT7aI&google_cver=1&google_push=AYg5qPKNYVLE0hZFKE2dbyng2Zu0ZfgNscINoZstPJElHQCbMc_I9EEc3g6iVyNyqlFaEt9oljraisxKDwoBQ8PMbl51j--cF8c
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPKNYVLE0hZFKE2dbyng2Zu0ZfgNscINoZstPJElHQCbMc_I9EEc3g6iVyNyqlFaEt9oljraisxKDwoBQ8PMbl51j--cF8c&google_hm=Q0FFU0VOZTNpcktTNGJzSH...

170 B
188 B

44ms
42ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPKNYVLE0hZFKE2dbyng2Zu0ZfgNscINoZstPJElHQCbMc_I9EEc3g6iVyNyqlFaEt9oljraisxKDwoBQ8PMbl51j--cF8c&google_hm=Q0FFU0VOZTNpcktTNGJzSHdWRTJJdUJUN2FJ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 10 Feb 2022 15:09:50 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPKNYVLE0hZFKE2dbyng2Zu0ZfgNscINoZstPJElHQCbMc_I9EEc3g6iVyNyqlFaEt9oljraisxKDwoBQ8PMbl51j--cF8c&google_hm=Q0FFU0VOZTNpcktTNGJzSHdWRTJJdUJUN2FJ
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame 6238 43 B
64 B 33ms
32ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEGH5qutWCONhItGOZWXkDnw&google_cver=1&google_push=AYg5qPKm9OeGKHFCHb1ya4jka7zpjhNgFMWo5Em1-cMcVU5gxDzwzO6gTGSppAAVZ99HCpJ4ycQJSqGE-R3t0qLMVLF9cYhXLw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:50 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: upame21r11jh9nvhuqbhu5log8c2in74

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6238
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=iLtx2ZDaRBezbC635xgl2A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

44ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=iLtx2ZDaRBezbC635xgl2A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIyYccQYhnrZZhenldIsXzZvCPgfNfWjt3qyGCpgeY29oNlQ0oE2vN4EgO3a452HvNgjeIlwZvL3-QQOWLO3IZxZsKi1sM

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=iLtx2ZDaRBezbC635xgl2A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIyYccQYhnrZZhenldIsXzZvCPgfNfWjt3qyGCpgeY29oNlQ0oE2vN4EgO3a452HvNgjeIlwZvL3-QQOWLO3IZxZsKi1sM
date: Thu, 10 Feb 2022 15:09:51 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6238
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJxG0gz6AaiBAdc0IsMb0nc&google_cver=1&google_push=AYg5qPLpZsh5WXvFjGoRSkS2Qx0ccIcg-HOA_lU5FGWSBaPAhmW_uioUc08o68n74WYXhPlaI67...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFEUjUtRS1MM0w1&google_push=AYg5qPLpZsh5WXvFjGoRSkS2Qx0ccIcg-HOA_lU5FGWSBaPAhmW_uioUc08o68n74WYXhPlaI676GXtWaTM6AZocQe2kIjykJg

170 B
188 B

43ms
41ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFEUjUtRS1MM0w1&google_push=AYg5qPLpZsh5WXvFjGoRSkS2Qx0ccIcg-HOA_lU5FGWSBaPAhmW_uioUc08o68n74WYXhPlaI676GXtWaTM6AZocQe2kIjykJg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pINEFEUjUtRS1MM0w1&google_push=AYg5qPLpZsh5WXvFjGoRSkS2Qx0ccIcg-HOA_lU5FGWSBaPAhmW_uioUc08o68n74WYXhPlaI676GXtWaTM6AZocQe2kIjykJg
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 6238
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_Hg...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 6238 0
12 B 25ms
24ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Jg6YgxZAojZEMXmWPTxYrBu7INK19Szbzem8-YNi8V_vM7PDlmdTW-S-ebQkabQvmadgb6

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:51 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H3 204 AGSKWxXVDOGQYX4hDhUVaR4TTxilYAS4n0GpjP9sJ4IAApUxoR8f-EV8Vq6SEsSrWO2GRGSUo9Tx4eJ7ODrHw2-cY0XelOi7iNu2qO6IHxQvYYlVA-6wy1Ao2ajFtRJzl0lPPlr4C4Urabd4uxebuk_CMNh6bO7Svox1UtEAzLk0nh-s9ERQWfx2n4-1IK9s Show response
fundingchoicesmessages.google.com/el/ 0
25 B 32ms
31ms XHR
text/html 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.KqEVvyz_RMg.es5.O/d=1/rs=AJlcJMz7dPxOrRC2xa1TQkMKh6uAwDLCKg/m=detection

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-TbUMBUrNwhoWYrmgVOp9Rw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-TbUMBUrNwhoWYrmgVOp9Rw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://herbalserver.me/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 10 Feb 2022 15:09:51 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://herbalserver.me
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-TbUMBUrNwhoWYrmgVOp9Rw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-TbUMBUrNwhoWYrmgVOp9Rw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxXVDOGQYX4hDhUVaR4TTxilYAS4n0GpjP9sJ4IAApUxoR8f-EV8Vq6SEsSrWO2GRGSUo9Tx4eJ7ODrHw2-cY0XelOi7iNu2qO6IHxQvYYlVA-6wy1Ao2ajFtRJzl0lPPlr4C4Urabd4uxebuk_CMNh6bO7Svox1UtEAzLk0nh-s9ERQWfx2n4-1IK9s Show response
fundingchoicesmessages.google.com/el/ 0
25 B 43ms
43ms XHR
text/html 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.KqEVvyz_RMg.es5.O/d=1/rs=AJlcJMz7dPxOrRC2xa1TQkMKh6uAwDLCKg/m=detection

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-0wOGKi3JxFTj5CFNQSuSNg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-0wOGKi3JxFTj5CFNQSuSNg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://herbalserver.me/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 10 Feb 2022 15:09:51 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://herbalserver.me
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-0wOGKi3JxFTj5CFNQSuSNg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-0wOGKi3JxFTj5CFNQSuSNg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxWYeSmUSo6J0XTDyAWs2KC9iXOWRsW6RUqiu_tl9_VnzxeSl1L5I7eLuSupkuH48BGtp9Tvm6VzlaUoCbzL75pC2GGRVWqqK_maehbJgoPHtrZ-2kJxc4_aLM2S75K1wKCWxwRiYjmewIIn3jIRTwSZrxR-ofpr1kSv4UhyNNKqTu_RVVY-qnlpf8R4 Show response
fundingchoicesmessages.google.com/f/ 38 KB
14 KB 55ms
48ms Script
application/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWYeSmUSo6J0XTDyAWs2KC9iXOWRsW6RUqiu_tl9_VnzxeSl1L5I7eLuSupkuH48BGtp9Tvm6VzlaUoCbzL75pC2GGRVWqqK_maehbJgoPHtrZ-2kJxc4_aLM2S75K1wKCWxwRiYjmewIIn3jIRTwSZrxR-ofpr1kSv4UhyNNKqTu_RVVY-qnlpf8R4?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjQ0NTA1NzkxLDUxOTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsMTAsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLDEsMSxudWxsLG51bGwsMV0sImh0dHBzOi8vaGVyYmFsc2VydmVyLm1lLyIsbnVsbCxbXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.KqEVvyz_RMg.es5.O/d=1/rs=AJlcJMz7dPxOrRC2xa1TQkMKh6uAwDLCKg/m=detection

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

36f6f0bbbb1456c3a034dae71587da319d7d94278316efd80d8b7e796e358620

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-dXJlvIVhVd5Jl13Os5hCew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-dXJlvIVhVd5Jl13Os5hCew' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorGlobalRouterHttp"
x-frame-options: SAMEORIGIN
report-to: {"group":"ContributorGlobalRouterHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorGlobalRouterHttp/external"}]}
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-dXJlvIVhVd5Jl13Os5hCew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-dXJlvIVhVd5Jl13Os5hCew' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxXVDOGQYX4hDhUVaR4TTxilYAS4n0GpjP9sJ4IAApUxoR8f-EV8Vq6SEsSrWO2GRGSUo9Tx4eJ7ODrHw2-cY0XelOi7iNu2qO6IHxQvYYlVA-6wy1Ao2ajFtRJzl0lPPlr4C4Urabd4uxebuk_CMNh6bO7Svox1UtEAzLk0nh-s9ERQWfx2n4-1IK9s Show response
fundingchoicesmessages.google.com/el/ 0
25 B 37ms
35ms XHR
text/html 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.KqEVvyz_RMg.es5.O/d=1/rs=AJlcJMz7dPxOrRC2xa1TQkMKh6uAwDLCKg/m=detection

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-qI58SsDfasur8ZI+tzQD9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-qI58SsDfasur8ZI+tzQD9A' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://herbalserver.me/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 10 Feb 2022 15:09:51 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://herbalserver.me
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-qI58SsDfasur8ZI+tzQD9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-qI58SsDfasur8ZI+tzQD9A' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 style.css
cookieconsent.popupsmart.com/src/css/ 8 KB
2 KB 235ms
166ms Stylesheet
text/css 2606:4700:20::681a:825
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cookieconsent.popupsmart.com/src/css/style.css
Requested by: Host: herbalserver.me
URL: https://herbalserver.me/assets/js/cookie.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:825 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8b9e348bdaf266ff0b636403d5155d36df4e1f30633295ee841d0d8dc8b0981a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-nf-request-id: 01FVHY8MG7X6633S36WEZ6EXEC
date: Thu, 10 Feb 2022 15:09:51 GMT
content-encoding: br
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=11077
cf-bgj: minify
server: cloudflare
etag: W/"cbce7d027f8ee32350221b4c93c23c38-ssl-df"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k490MZAjB%2FYCrMp9r1ftCP8fqD0kjLcvZ5oHREor6ixCtcKBBZEJqsDxC7olssxXUitMkrabPcdfS6bYYulFrK9aHn2K5yKztgmIvd%2Bp2WTGp7Pr7%2B4SmC2CduneFArgINSNTiiKeBu6zIU%2Bzb5%2BX8Aryob0Rupd7uM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=3600, must-revalidate
cf-ray: 6db642cd8c5290e8-FRA

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame F75B 23 KB
9 KB 19ms
17ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8727
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 06 Feb 2022 20:18:19 GMT
expires: Mon, 06 Feb 2023 20:18:19 GMT
cache-control: public, max-age=31536000
age: 327092
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 btn.png
s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/ Frame 402D 8 KB
9 KB 20ms
18ms Image
image/png 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/btn.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b674d9448f58de040dda3fd647d3c3a3f14499f425c46b393cb29604b237485

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 21:13:15 GMT
x-content-type-options: nosniff
age: 150996
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8678
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 09:49:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Feb 2023 21:13:15 GMT

GET
H3 200 dl2_sp_h_4.png
s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/ Frame 402D 30 KB
30 KB 20ms
19ms Image
image/png 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/dl2_sp_h_4.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f96ce15c899300b01a162163bfcc20af68274a7a846b90d58377d6ff9753cd57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 06 Feb 2022 07:03:13 GMT
x-content-type-options: nosniff
age: 374798
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30561
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 09:49:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 06 Feb 2023 07:03:13 GMT

GET
H3 200 r2.png
s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/ Frame 402D 3 KB
3 KB 29ms
27ms Image
image/png 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/r2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

63a707ed6d2b8ebabc312a52075c1ad750c553aaa934bec3025bf14e3487b15c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 18:44:04 GMT
x-content-type-options: nosniff
age: 159947
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3402
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 09:49:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Feb 2023 18:44:04 GMT

GET
H3 200 light_bg.jpg
s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/ Frame 402D 5 KB
5 KB 26ms
25ms Image
image/jpeg 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/light_bg.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

317cb7fd6b5ed242b6e3d923fbfcf6d89e31b3e2feaa0bf578e308b94f83069d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 08:58:55 GMT
x-content-type-options: nosniff
age: 108656
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5277
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 09:49:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 09 Feb 2023 08:58:55 GMT

GET
H3 200 a_light.png
s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/ Frame 402D 25 KB
25 KB 34ms
33ms Image
image/png 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/a_light.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4bd48185299861a8fffaa25e2a3c2002f47db7ffcc07d0709697f5d8228ae884

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 00:00:19 GMT
x-content-type-options: nosniff
age: 227372
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25903
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 09:49:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Feb 2023 00:00:19 GMT

GET
H3 200 a_dark.jpg
s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/ Frame 402D 14 KB
14 KB 29ms
27ms Image
image/jpeg 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/a_dark.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44638cda284b71705591b669c71f9ebdadf47733e0733707d4da9ff2a3fa1aa9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 00:42:48 GMT
x-content-type-options: nosniff
age: 138423
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14033
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 09:49:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 09 Feb 2023 00:42:48 GMT

GET
H3 200 t.png
s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/ Frame 402D 3 KB
3 KB 40ms
38ms Image
image/png 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/t.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

109a504026e25b8c788fc9f16d122be2c548315efeeb1201251f06b1f70a6b47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17510574773252750249/dl2_html5_728x90_DE_USK_BUY_NOW/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 04 Feb 2022 00:22:18 GMT
x-content-type-options: nosniff
age: 571653
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2631
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 09:49:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 04 Feb 2023 00:22:18 GMT

POST
H3 204 AGSKWxW8Y2jAM3f3onjxCNaYr36eDtch-3UXJUZo3LRmW9eX6LPOLVnhKuMzyzECdMmRwf1nOF31yvkqRKV2CnLR5kBc6K_Fw26y6fR_BdHYlxk2poMt-V6E-QZHg0D3OZeKyszvndfrg0UpLrL_zQ6fIuWD2wQrvxECXeZU-MwBIi12w7HfxB9n76_wmLGP Show response
fundingchoicesmessages.google.com/el/ 0
26 B 41ms
40ms XHR
text/html 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxW8Y2jAM3f3onjxCNaYr36eDtch-3UXJUZo3LRmW9eX6LPOLVnhKuMzyzECdMmRwf1nOF31yvkqRKV2CnLR5kBc6K_Fw26y6fR_BdHYlxk2poMt-V6E-QZHg0D3OZeKyszvndfrg0UpLrL_zQ6fIuWD2wQrvxECXeZU-MwBIi12w7HfxB9n76_wmLGP

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingCookieRefreshClientJs.de.zsxd70Xa-jg.es5.O/d=1/rs=AJlcJMwKBUWw7Z6dKz982-F-lFVnQXJO8Q/m=cookie_refresh

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-JWQxHwLefL94zdRxPvvL+g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-JWQxHwLefL94zdRxPvvL+g' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://herbalserver.me/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 10 Feb 2022 15:09:51 GMT
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin; report-to="ContributorLoggingHttp"
x-frame-options: SAMEORIGIN
access-control-max-age: 86400
report-to: {"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type: text/html; charset=utf-8
access-control-allow-origin: https://herbalserver.me
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-security-policy: script-src 'report-sample' 'nonce-JWQxHwLefL94zdRxPvvL+g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-JWQxHwLefL94zdRxPvvL+g' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C397 0
23 B 76ms
53ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvgyJnVjw-kKRL-aFTnaw6A-gxA67ruOwiJDX7EmRHHaEc1CmUS1JNbuzMZqFXr1GZg4bam-a8VEfRTC0nXKYWv7ZqBqial68T5ixIB7983c-K8gsk2x3-sr_EwRnaJgvwsKJ0aV_fm6KxXwiW6XkMHzj0smKvV8mGbh5vyniQrqUyiiccWeinznt78KcX1VIXrTP5youAr_rg0xzVJpDlqMyydWGOwSA3yBy2Fin5BSfNes5ayG6MqwlQPJQiJWN2OLxv06K9w2QFk5mDpG3hSEWgolgX0qLDUaqFHEXe1YGEyRXEWsYwhk5momc_AH3HBoD_CZnLfRUGYYWkIMzPxIt_qz9mJXGPoC1YxLYBQmm1esV5IpxMOAeViwApPMLImTBHkO5_T1WfuhLYgl9RH72W2GU1FPPsoeIZQA2dUt2_U9w3qNBNLFUkuk70zlwVleQpBluwFJK4di55szeA1aqShX5j1hFRz9O_KQND6m_GzHr6lftUharq2P1k2hbTtcIalTHr-rNqpjnICteTKcTEqeR4k795lQwIGoxfWzx6FpT58KsWauH5OFSAn3ROkB9hTnCtIDcsU2ifFhFmSfh1_23uq3BdjAc_qT0G60g_uWIFSTfLQ38IFMDI9XSCd00qPPixKihWlZbPCd0Na-hfIiLrX4aCqxzXTghyQ2IksMVxus3Q1WVqxWxL-dFt8Zrggo-5UUZqkbrF8tfV1N1HUIFPg0YTWL5DhkH6lA7FNj2rVd3ArqU0SKcUPr1wIfawGo7Jm0U9Yp7RkYXcR6fEXJK090ylbRF_T2dyM8DmUANaxmF7c0UWZCn4EWq90r0-iouB6XL5PJjsXINoD7Ty5PyJnx7iijwaFe7cuYW3XNN8HvZ7RVIIIjfWatBr5vg2_qsqbPOimzfzIr4x3we48zaN-OIHG2J-dSIGfG6RbghxmDFUrWyOt4EaXdlTg2iRsP6cU8xmxRmGK51B_a0lJUR-H8etQLCEKsu4pJkns26E-4T59mbDElpUM-IfA9J_je7eO4NjmD9P_n_NiyxwzzydSjTcoREyjzn3NibpLRGt8SDnLho4-KrU6IDxUffB0nUdd08lx1wG_OXLlkNb9Tb-eB2-PuHe61iGOUL7mXRbIIO9pq2X_ZJ4-zO4I54kTpm8aMZm6dofuxt728upetYIyypxaU4b84CtpODlrTxROAQ&sai=AMfl-YThUGODHhTpMVIYKR_iAMCmQtQljEhKF7Svj3tQbJpagkZgbX_cPkVRGaopPuzaKiI2RPz9BAgPHSP_btxO7Dk4KBUu2gV6zckoohzzA9QZyfsbqltdfHOhyMq0ejfIoX92TXxrhnc06-IU2aHe_4GSW97VwA&sig=Cg0ArKJSzIni9bEf210pEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=567&vt=11&dtpt=359&dett=3&cstd=205&cisv=r20220208.25746&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 15:09:51 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 pxHkm2-HxYlJ2clKwIK610_mLBl57TmuFqT0_zZ6EhE.js Show response
pagead2.googlesyndication.com/bg/ Frame F75B 35 KB
13 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/pxHkm2-HxYlJ2clKwIK610_mLBl57TmuFqT0_zZ6EhE.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a711e49b6f87c58949d9c94ac082bad74fe62c1979ed39ae16a4f4ff367a1211

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:24:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2706
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13734
x-xss-protection: 0
last-modified: Mon, 07 Feb 2022 12:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Feb 2023 14:24:45 GMT

GET
H3 206 file.mp4
r5---sn-4g5lzned.c.2mdn.net/videoplayback/id/6253bb0e0d9b5336/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3788872058/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,m... Frame 19BE 2 MB
2 MB 36ms
17ms Media
video/mp4 2a00:1450:4001:13::a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: herbalserver.me
URL: https://herbalserver.me/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:13::a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

28a7277dcc8f0794c035d8313b631fbfe67b63cd0734318247fc2c88930cf9f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Range: bytes=0-

Response headers

date: Thu, 10 Feb 2022 15:09:51 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-2225749/2225750
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 2225750
expires: Thu, 10 Feb 2022 15:09:51 GMT
last-modified: Wed, 09 Feb 2022 16:27:37 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://googleads.g.doubleclick.net
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://googleads.g.doubleclick.net
client-protocol: quic

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 13 KB
10 KB 63ms
31ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220208&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32ad77bfed1a39c4a0b90699765f61afe8a3560b2650dbe28c478f68cb480a20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 15:09:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9729
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 51B2 0
20 B 54ms
53ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BjD79vioFYofmONbV7_UP0py7yA4AAAAAOAHgBAI&bg=!hIelh8PNAAbS3PJy0tw7ACkAdvg8WksMiEqorpsKoskkPBLD7Op9rspke7dDLtyO2q6vPR-823oa4AIAAAC_UgAAAAJoAQeZAsDee62-7nAoKLutMnFA3zWI98oekZc5bGFadJbJ44WD1EMFLYoewx7FCu05oGz6jV0dshE6Y2fDfHyHlhkxb1OwI6EipuWOkKkbv4i6ijsxa2IuJ_AaMtvUTuqxm178irAf0pp7XrhiiPhN62fCir1GcolXgHkFXFlRrtjoXJh-Z9vshgXYxDrWRavwVohdyn9Ixc_yrt7HQQP-sjik4ojv7k_j3Z5rh93TEFlJOjRzscNGDeLGPlwa5kDy-7EdtYa4qB7FQTnuRSMGsQmQH2B1XVhNZ9SHY5r0paSJV71XrgMnXrAFIwL5Ahe9HkOZU2Tz1FAyHCmymC9NtAGeYiu19qwvy9nXmkQltqGaV7nd3BdEhjqBpJZx6ZuI2HoraQDJ1OkmVh8d7Q8OGhP-0RlKjr2loPD6NTtSUQBggI5n8nNM9VXEaJyt0D1yJu5C8oHE9xPzJiZjWZtdUjmTLhBJ7TZyA35iPJxCYGSxAiyXmgVc7WdtB9wdjf1Y2vhagh9YFudEO0-gTzlYHExahgwEi3CNJWuOMZf9jBRQly_UafstGqeb9HeDNLOEJjQnGmppznZ9zM_KuGTwZLQ6A0rk9D2jIKQGBKspu2b-4oYGj7UZNXpdQu181Lpuayg2f2bKQoV5SGEF7tE0Q0g95KootIMYiTlYdTxkPPb_4D8lDU7zZrjlHZVLWnOLiRUOW-qea4jPNinyizEnXaeVO1NmPAYbG0tz9v5omRd2jnuUF4bckKfW9d2OsPqAfi94w4Ew0Ucs-QpdzpZAotXLsimTMexSpGDnno1skSiSRUww-AedT0fELiIV6HT7bMmlyitwehs1x0qYuMH2mX78VykBXqn9UUBWIMKVlvFUFmrgj5gskcAL34ea8lvbIMHsDm0_A3jMOfJJwS0uj9P_O0bI6JE1_IaOz1FspzKxtgeCHA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F75B 0
20 B 54ms
53ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=B63PWvyoFYtWVGbKMmLAPn7WnoA4AAAAAOAHgBAI&bg=!_v2l_bnNAAbS3PJy0tw7ACkAdvg8Wp1eOy7SciMdQPAMyuYa3q2g6r8mJTD6QiCJaEHqL6urNjPzOAIAAACHUgAAAAJoAQeZAsuENgjGTHFug33cihCGIKdQtYmnWTNjK8oc1ucBFqZmOLjjZlmmr6ddwDhH42blsjvTcjOW9C8mp-32O5DDZ-n1hPpuFg-xlCrlnf4jtkNx-v2UF7OI9kO7LA-5YCpY_CEpFwujJ3XPwuTqdQuSG2KWuF5tpoMso37HW4qcEkOGMeVLUXP1bernGj4tHU68U16IwxhaF4WvOQCtXOcQV-D3Orv2XeDXNnmY7AOVgs8NNbVdzGXE6zX8iNw0uYC78Uis3dSd4tRWkfvG-Xqja0tG2-HbfBdwAiIjagq-wJp5-FttOut6xNNkdSdRLLfVCuj6_IiRJkLfE6f2qlNwcygtoBEKXBUkSrGWU_lS_hFGnOcgDv6WmXmnTQ7N18pzt5msecao-3IxB2AQd_s98uKsNJG-nVjaHSEtHEgLHAvmQhKOdxxMp17muZbgE7JU5UExGRi8fO_CkOwyimN0wseM56CiKOy9LPbzyImzuf4rDkSj-j4aDtGS6qy9pKij0jlc_s8eNohUzcp50pALECV51ckEq3Xd1cIckLugH8pt3GPJJG6ysMxNkq-ckUvoLOZ91sisLfusEM4Lt2w6tJp-8RgRCXXEgoOiNhVN_cWdHXD9doasionjlcAmdxkbmhg4pvWxVIOriE9iwHY0Hi5-j2_5cAyeCTtE3OQMJ3A2DbZtsehpIXjh7CZIdsD4ofybrWXIinaJW8qUL35i9T3KuqaJ58UDsey_b1w_YqNF-HUhOY9MTc-dIygHLtD5QRLt_qUbRL491pcu61RR8YWEiMt6RWwLlpBJRD3F5O8WWO5L7ccnwq-DMuVxoe9CO1cL3QQHAjMLKUliw3kNlrMjt0Dkf3nfVjiZuc7JC3aBwRk7RxcuH5LbuzLm1E169WoGwO0gV2nlyfBFCECo9sJx3drsFwky4R33HDW5aYKp5LIdvoKPvRxrSXRD

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 10 Feb 2022 15:09:51 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame B9A7 13 KB
5 KB 16ms
16ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 10 Feb 2022 15:05:51 GMT
expires: Fri, 10 Feb 2023 15:05:51 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 240
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 5E8E 783 B
532 B 27ms
27ms Document
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

293dbc77636c53eb555e304bec904566b2ea13e270a0cde4f96a1d4646093571

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-/CSfFrkwRyn+wS0surEpMg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Thu, 10 Feb 2022 15:09:51 GMT
date: Thu, 10 Feb 2022 15:09:51 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-/CSfFrkwRyn+wS0surEpMg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 510
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 gzxFwBIDWVjrNRUrZhLg_NzoVxp69M9kEQUe35bI4iA.js Show response
pagead2.googlesyndication.com/bg/ Frame B9A7 35 KB
13 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gzxFwBIDWVjrNRUrZhLg_NzoVxp69M9kEQUe35bI4iA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

833c45c012035958eb35152b6612e0fcdce8571a7af4cf6411051edf96c8e220

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 22:07:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 61322
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13673
x-xss-protection: 0
last-modified: Mon, 07 Feb 2022 12:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 09 Feb 2023 22:07:49 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 5E8E 0
0 58ms
58ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220208&jk=2870686407588897&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame B9A7 0
10 B 16ms
16ms Image
text/plain 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?6d7fAQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:09:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A74A 42 B
64 B 88ms
87ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssdsrGzYICz4wcqVCLh0Hn7tbl6Or3zbsLy-6wWcSTJN2lIFWeL4wIvLrQSlUE92jRd0tt8HmSzHSZ10A3l2MPz6zRWf5oqEzNnqVfJeFKZDF-e7vPFgw&sai=AMfl-YRYJo2eEbGv5d91diz3nyyepH2wKieJO-R3SBj0sWH8oohUwQRhxijlwNpPdUtryDViSXTaGiy-QKPwQ9IHV0qREV5AjBtdKDw&sig=Cg0ArKJSzL7LS9O7uz7XEAE&cid=CAASF-RoiEk_6lXi5nIbQkF78326qmKzcmtg&id=lidar2&mcvt=1002&p=0,0,280,1140&mtos=0,0,0,1002,1002&tos=0,0,0,1002,0&v=20220209&bin=7&avms=nio&bs=0,0&mc=0.41&if=1&app=0&itpl=22&adk=1400915940&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1644505789406&rpt=1786&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9BEF 42 B
64 B 87ms
87ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstO_ynialtv5yBO8Ip9hCgea68CUmn5ZqTzpRI9K4PdnRxD2NKdH29QmrP9Y1wJOcqQbr6Yjdr7xS2fwrwxjSh043tnK3MXrIbBCtzH5JdtaKyN2WMRtg&sai=AMfl-YTqJSPZe4QTvFVtUAAPs6lxZ-nSrPJYeoWpCNAfQyBsOUo_SCTUioLaPgPzcX-j-m_PpoMDQG7WaTzLDbrg5Y_wWAkxRw29jrw&sig=Cg0ArKJSzChvjTSLrbSwEAE&cid=CAASF-Ro1CHu7DXcBBmaWk8K-hS--pxTPL76&id=lidar2&mcvt=1001&p=0,0,280,1200&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20220209&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=4113963702&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1644505789403&rpt=1805&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C397 42 B
64 B 86ms
86ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst3iEeIECjHRo9rd_cBI7IHK6TSwEscxVf3eT6wp6Q2TxStq0Nqvdn3qxOHDKoqgDnyWDovY27tZcNa7wXLLHOqNXCxr-2njgwhood2BlFuUwmL4N4iTQ&sai=AMfl-YTkVYhN8SQHuKiHa3w4iy-XKhX6tnbumgg2VLqEOadvk59ygCuO5NuAZqpcVCC55SFJnKTmno3IxHV6UGGzMkRzTR3RxSs2GJM&sig=Cg0ArKJSzHYGcSVacVSjEAE&cid=CAASEuRoz_zmuGxcGDe3khBb-Aajmw&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=935,1000,1000,1000,1000&tos=935,65,0,0,0&v=20220209&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1644505790868&rpt=624&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 53ms
53ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220208&jk=2870686407588897&bg=!sLOls_fNAAbS3PJy0tw7ACkAdvg8WvKKW46ld-qvjEMqheRfdxta30xIYqDabKrQ6HSdHdzywpAjuQIAAABzUgAAAANoAQcKAHmp1MdJQxelRHPHfzCXiZsQtA-W4Z9sMUCt3U-YxPSpgimhAZ4vJ4JvFY-QbgpE-K-2rkbMV7HTzc_ElETZ1kLKwXr5ILJT4SKSswe3HvTEWtwRGVOyKCoxqO8HhRILOfpsSaQUKbvfLw6A2FyprzLEnnr2pxGn6bW-mQJ-wjx_lHN8DMXIrkeWWlxtthM16iuiJ4q9DvZ7tAe5D0lld3XywxFmZspvaIGuSRcpeuQmgVizgIdb5ec535cGXRYIS4zdJlF3Ecb_wHTzLx1B8HIhLg-hnYEGAzLG73ZMtuRyFsgKJEvsTe2Nl7jetrDm1YgPw3ljYSnfARlKz-FpepJAFAg26rmv7RjFFbRjDiQcdaOzIOeSLXErH_QzE7VbJwDJ3p2ONF9klFk_wHORch6mz0_VnSzhKE3vzUAXz4Q8tyzZgsKfXXcSIRLLUnrsLiHhtqI0MOEyN9uzP_xSitaqy9fJocIRb2qR1pXdO_PA_ZSkm_ibifXiydy3lqsXyIk9IvcWqLtF-fMu8wR-hlfnlyX3Ap2HV1SYyCZRd_CNzD6gFlspgN3Sc90BSeJG3jXWXFGwLEUezAOz9XwKObaXIee9wzy-iWNYQXrlAP5Zs2wikSsZ1gs5LXRePMzTChGRloey9hNwiPjMfFJK9nio4iRckNdhShyjFGIAURAQFn--kFS1bBz87Yz_KIzYf8kJtgw70bPLx5EyZJxlRmUy7HYZT1SovXDxb4fpfkQGeRzw2N5v2lcDRxdjitulHxZcO9Z8X2_aZmC8MB4XBr2ErP16nQj4nnHfgqrLTr3xQMao_2chbzejc3_6icLR7AyL7DjGDB7c56m-7gRi2cdJi6MOJeuTISKAAFH7pyx3LacFY6cZpbuwYHd7s-kPOTvRaA4d-O4Ep98lbrdtceODhq4qi9X7ngieoEYUP4HYKNT3vAV7GvuFRT3t6b9aB_GDUScjUxPt4Fb3Mdy98jz_wDO4KQ92LW9QnHX_U3aNTs45WyCKitQQ6_I

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://herbalserver.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 19BE 0
17 B 215ms
112ms Ping
image/gif 2607:f8b0:4006:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=2~kzh4adl0&c=4232581329372&slotId=2116290664686&qqid=CIbVpLu19fUCFYWAdwodPx8F1w&fb=outstream-lima&gpm_i=12&gpm_c=12&gpm_a=12&smb=1000&br=989&mt=video%2Fmp4&vs=640x360&ulv=1&cll=0&vmfc=18&vhc=0&msm=1&aits=17%2C36%2C18%2C22%2C37%2C59%2C342%2C343%2C344%2C345%2C346%2C347%2C692%2C43%2C44%2C45%2C46%2C0&webm=3&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fwebm%2Cvideo%2Fwebm%2Cvideo%2Fwebm&hvmf=false&vms=1&bit=343&vsrc=doubleclick_dmm&ape=1&ple=1&umsem=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20211103_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81d::2003 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 15:09:52 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc

Verdicts & Comments Add Verdict or Comment

81 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

33 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
herbalserver.me/	1969-12-31 23:59:59	Name: PHPSESSID Value: jtj7clpab0plo76g6flohfm1dn
.herbalserver.me/	1970-01-20 18:19:37	Name: _ga_PK8J155HGK Value: GS1.1.1644505789.1.0.1644505789.0
.herbalserver.me/	1970-01-20 18:19:37	Name: _ga Value: GA1.1.131292801.1644505789
.herbalserver.me/	1970-01-20 02:58:01	Name: _gcl_au Value: 1.1.1280108730.1644505789
.doubleclick.net/	1970-01-20 10:10:01	Name: IDE Value: AHWqTUlqD10ylIsblAz5DbfCKvuXXzqp3xYrf_xOt7QvUKtdbpSLV9607m2YLpIG
.herbalserver.me/	1970-01-20 10:10:01	Name: __gads Value: ID=e1464c154e09cb9b-221f11273bcd005e:T=1644505789:RT=1644505789:S=ALNI_MYbzyolHm_mS9u3uUul7nbazlv22A
.quantserve.com/	1970-01-20 02:58:01	Name: d Value: EAkBCQG0JYEA
.quantserve.com/	1970-01-20 10:18:40	Name: mc Value: 62052abe-7fa2b-9fa11-60f58
.agkn.com/	1970-01-20 09:34:01	Name: ab Value: 0001%3ApbB0jEKvi8G3MDL4lz6HJZ6TBqJ00jjK
.casalemedia.com/	1970-01-20 09:34:01	Name: CMID Value: YgUqvvu2YNJWVdB0BYejVAAA
.casalemedia.com/	1970-01-20 02:58:01	Name: CMPS Value: 3186
.casalemedia.com/	1970-01-20 02:58:01	Name: CMPRO Value: 1184
.pubmatic.com/	1970-01-20 00:49:52	Name: KTPCACOOKIE Value: YES
.pubmatic.com/	1970-01-20 02:58:01	Name: KADUSERCOOKIE Value: 88BB71D9-90DA-4417-B36C-2EB7E71825D8
.doubleclick.net/	1970-01-20 00:48:29	Name: DSID Value: NO_DATA
.casalemedia.com/	1970-01-20 00:49:52	Name: CMST Value: YgUqvmIFKr8A
.adnxs.com/	1970-01-20 02:58:01	Name: uuid2 Value: 4761358128565095002
.rlcdn.com/	1970-01-20 09:34:01	Name: rlas3 Value: hM7muXDQfrouYehCMU4Qtijqr7fEHDunvcSowdxkU3g=
.casalemedia.com/	1970-01-20 09:34:01	Name: CMRUM3 Value: 2d62052abf2760CAESEDtRf3baGq51irlw2fj-mJo
.rlcdn.com/	1970-01-20 02:14:49	Name: pxrc Value: CL/VlJAGEgUI6AcQABIGCOndKhAA
.adnxs.com/	1970-01-20 02:58:01	Name: anj Value: dTM7k!M41.D>6NRF']wIg2IlljbN']!]tbPl1M>e)ZlrFUfJ+tGXxoaOZe3rXW`TeOm<Q-X@L#yKJ?XCb#s@K?cWdC3If)y3KL9D3I?+*kgO5D
.innovid.com/	1970-01-20 02:58:01	Name: uuid Value: df2b8dc3-149a-4af2-9dd5-2b72c71edf0e-20220210 10:09:51
.e.dlx.addthis.com/	1970-01-20 10:18:40	Name: na_tc Value: Y
.agkn.com/	1970-01-20 09:34:01	Name: u Value: C\|0CEApl-c-KZfnPwAAAAACAQ13AQGAAQpAAAAAAA
.herbalserver.me/	1970-01-20 09:34:01	Name: FCNEC Value: [["AKsRol-9u-sbQmjdN_nfE46ycYlq22zP7iLaijZBrRvC_ePRmQ2uhwoUCLwldlv_XkOJqGQ0AVSWdOP2j8r4wewUc1_dw0Di8SD11wRnIgkqxJv8SPid454V6npCYoKqUwX_lH_MOHkimYaerUv-0vEanf2ccZ0H1Q=="],null,[]]
.addthis.com/	1970-01-20 10:18:40	Name: na_id Value: 2022021015095100011529799120
.addthis.com/	1970-01-20 10:18:40	Name: na_tc Value: Y
.addthis.com/	1970-01-20 10:18:40	Name: uid Value: 62052abf4294c9dd
.addthis.com/	1970-01-20 10:18:40	Name: ouid Value: 62052abf00016b68bf4009956223f1a493c2c2e14e121401f7a3
.dlx.addthis.com/	1970-01-20 01:31:37	Name: na_rn Value: 0
.dlx.addthis.com/	1970-01-20 01:31:37	Name: na_sr Value: 20220210
.dlx.addthis.com/	1970-01-20 00:48:25	Name: na_srp Value: 3614
.dlx.addthis.com/	1970-01-20 01:31:37	Name: na_sc_e Value: 0

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.googleadservices.com/pagead/conversion_async.js(Line 71) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20211103_RC00/outstream.min.js(Line 346) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20211103_RC00/outstream.min.js(Line 346) Message: Unrecognized feature: 'attribution-reporting'.
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_cver=1&google_push=AYg5qPIPxwNAB58ZXAuPdNgz9ApJh1yHuraYansErlQeEhB19vibj3FAdvgks8A_k-2cG3RYWzqgGWLvxHm6d3ZeUUQThb26Avei Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPLk-NpLl5REtWJA2czGTojg_vW_7IgEXIYEoLTXqU2JGQrNIqd5BRYQojI1QXNyW1q7fjwL5CL2CLcqN-hnikNcf1k8Uiw&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc&google_push=AYg5qPLRYAKjcL-CNZu4WrbjhUm95mjVHkOdWL-2KiGIPQ9ouObvs2la4Y0XsqUwgXQtJf8ioAmgAxjwb9Zqr68CXC6psQk66zlF Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIyg9ftB-FDJ2aW8hpPGBUqj_F44XgmXNnDjTpCWnEw6vsKOVZEWRKBtPlsZUXNLhJ_rS6Nk0adTjWOcLL_HgNXmqpeueo&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUqvvu2YNJWVdB0BYejVAAABKAAAAAB&google_push=AYg5qPIVkapLPVAdyE2jL2Gu-Wu00p2R0Dx2r_0EZVCDADKKQotXcWktj_o2s8CKa26dwZa612VvfE8wHojrJtX_IXAfq4dpBMqk&google_cver=1&google_gid=CAESEBKqPn4rHS9CP_jTw9-Nhsc Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
ag.innovid.com
bid.g.doubleclick.net
cm.g.doubleclick.net
cms.quantserve.com
cookieconsent.popupsmart.com
csi.gstatic.com
d.agkn.com
dsum-sec.casalemedia.com
e.dlx.addthis.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
gcdn.2mdn.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
googlecm.hit.gemius.pl
herbalserver.me
ib.adnxs.com
id.rlcdn.com
image6.pubmatic.com
imasdk.googleapis.com
odr.mookie1.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.everesttech.net
pixel.rubiconproject.com
r5---sn-4g5lzned.c.2mdn.net
rtb.openx.net
s0.2mdn.net
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
cm.g.doubleclick.net
104.111.215.191
141.95.66.118
142.250.185.226
142.250.186.34
142.250.186.66
18.196.159.27
185.33.221.53
185.64.190.78
2.18.234.21
2606:4700:20::681a:825
2606:4700:3037::6815:3b5e
2607:f8b0:4006:81d::2003
2620:116:800d:21:3175:5196:e3fd:8c1d
2a00:1450:4001:13::a
2a00:1450:4001:800::2006
2a00:1450:4001:803::2003
2a00:1450:4001:808::2008
2a00:1450:4001:80e::200a
2a00:1450:4001:80f::2003
2a00:1450:4001:80f::200e
2a00:1450:4001:810::2004
2a00:1450:4001:811::2002
2a00:1450:4001:812::2002
2a00:1450:4001:827::200e
2a00:1450:4001:828::2002
2a00:1450:4001:829::2002
2a00:1450:4001:829::2003
2a00:1450:4001:82f::2001
2a00:1450:4001:830::2002
2a00:1450:4001:831::200a
2a05:d01c:1d8:8102:7312:c82c:fb3:8dc6
34.98.67.61
35.186.253.211
35.244.174.68
54.194.183.173
66.102.1.155
69.173.144.139
00422bd0919e246881ba6fde9a521d5a0849af75b5b511ec62d226958687ded3
0423d024d4e076f797c5fcc61f51723f1c8b047a5fd22e84b5e4c1b15e1e790e
05e2888e835d97fe6e4cfb256f62f47d5dccf6d9ac202ea9d82a6bc2b1716c1d
083ec931e5517a4ab713afbe9561e72b9186cb54e21b8b1eface9caefb54a966
096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bc74eab328fba1cb362818376fa2a652990aa8b589bc2757ed2bc5e95dec300
109a504026e25b8c788fc9f16d122be2c548315efeeb1201251f06b1f70a6b47
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8
1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306
1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954
23b3f4f16b3b1c1ba10b0d4b9b114c95b04802cb48b602fe08bf116248eb9e29
28a7277dcc8f0794c035d8313b631fbfe67b63cd0734318247fc2c88930cf9f4
28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9
293dbc77636c53eb555e304bec904566b2ea13e270a0cde4f96a1d4646093571
2bc2ff5a3fecfdb5111cb2813380b9cdd5d4ff17fd051ee633cf9aae61b8e191
2edec579f5b5f7614cbdbffff2c6634e9b12f6aa9c4c867b1c6df172e22180a6
317cb7fd6b5ed242b6e3d923fbfcf6d89e31b3e2feaa0bf578e308b94f83069d
32ad77bfed1a39c4a0b90699765f61afe8a3560b2650dbe28c478f68cb480a20
32bc7c1c64fd1b755d48d6025b86b7e7a28ad35d1f420cf85cdc1123aa7dfcd7
34660fe46d78c890b82dd7e19886dca4ce2c46d31b1b308ba9b81e53a9f1669e
36f6f0bbbb1456c3a034dae71587da319d7d94278316efd80d8b7e796e358620
3a22b29e11f6ad3ed458e71525b4edfaf0b9ab4cd962ae9a239b9509c106c826
3a7b5f2e7e3fd51102d05b2706291210864e7890361d932311a18048073374ae
3c4a1bb7ce3234407184f0d80cc4dec075e4ad616b44dcc5778e1cfb1bc24019
406dae81a8e95037a3bca53ca771f446df097cf86084d76de62fd308e2bf32a5
425d7478422a02b8592686dd947b18cae0ca66ab39dc437067219356fb7a0a61
44638cda284b71705591b669c71f9ebdadf47733e0733707d4da9ff2a3fa1aa9
44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e
4543e1f8c7db08b874736db0c386295bac4426bcd69102a99ed244e97db90e38
4693823ea65e7487c3f77bd050d760e6d7d35bad8c94fbc560ab6259bbdcd782
48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b940065e2a67c37e3bd02b23c651f4744a3c219aba2d4fb99a631113494d376
4bd48185299861a8fffaa25e2a3c2002f47db7ffcc07d0709697f5d8228ae884
4dc46ba2f868997fe7c228d0e54d135990fd44d06d6dbf74b6e6383599116d0d
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
52aa1f72773f8a0567ed7c61546906784f6b7e995eda6744b458692bd1364cd3
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
57a74c141f16da763279a16e6d26f925a9b5a35f9b093c3ca99a6d68aa76b869
5887264b038ff233f757b47df5495353e994edbe0c144f7f67c18ec15b8570cd
5ffa1c05e357fc27f3ddbe5c4ae2204f0a529c89a5d29318130324ebaf22b966
60b6fb70c39877b90333526914dbc0d47052cd8c4c298c421aaee2f9d6b48bcc
60ddec91f902c124fe5bc65faf471f98fa0656a373653868c987876cb3afee66
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63a707ed6d2b8ebabc312a52075c1ad750c553aaa934bec3025bf14e3487b15c
63e1ce2e948cc2b234926f57ce1abbd3f34afd2ba00276a09242a789c3739c82
6594988ba2234776bb5317ccb82ee074cf0b2c6143ea81e95d4561e5dc56d109
6723a2a0cb5b83004c97227b1473db3fc4aa14daf394d070fb9790fcc1f0e5f6
68728bac5788fa193eb8bdf3059d32ca0af34677e2f9988f93b3561ab2fe11eb
687d73b65a385e60836c9ad4b4099749e787e0cdc83f7a41a097de248b8a6318
68e1afec9952b74996ebb3622ff1301883539c3db81e0975489659c6a76497b3
6b674d9448f58de040dda3fd647d3c3a3f14499f425c46b393cb29604b237485
6f0a975753dcdc6069a98023ba10d5a43bf62c50b8605eb25e16fb4b5e1c87b5
6f176eae1ee5487916ee02eb8de3395ddd8dc39f8c7d1b53e0bb558685209e80
6fa82c9b5a2c86dbc50c757299b8afa6bdbc839e83501cac455f04195af74cb1
7dcd6defd6b36a975077427d55cf2fb1948e9a45f472ce9544b55410568d4524
82adfb0be5d034070608c85667b4a8d253ca81e3002e143fa0633a162c54af71
833c45c012035958eb35152b6612e0fcdce8571a7af4cf6411051edf96c8e220
8b9e348bdaf266ff0b636403d5155d36df4e1f30633295ee841d0d8dc8b0981a
936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829
95fb191cc099965bb1377546006a2529cf9a745fa54909efb8ef5d1dd91baacb
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a575e2f63d79cdaf5a92b4453bfcaadb462119aa1216b4f28920e37e2d9b8e7b
a658b5f3ec0fd27f3c1500b420b2ed4ff557f5ddb65fbc83c21eae5cadc97dfb
a711e49b6f87c58949d9c94ac082bad74fe62c1979ed39ae16a4f4ff367a1211
a85d30b4698cf3d45e59228ee6b101ede13cc95df1939074c574bbe691e7dd3d
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
abdb151c2c71b933821048354bcfc06d602b4943bb88f20f8d75581dffd6c6e6
b017a6ac440e574ef8e097b65c9087974d05819f77b217c649736c45ec34a30e
b055c53c236759c604cef3e36943ac888a6a11fac97414d567e1b73fc9665ae7
b0b0991b938a26f63c2bc8d4916e30794c61865ee1aa168b2b648fec747e1b3d
b0d3e95d9ae6d861a6735dba876fe73ff082293d8663233cc19f54776f2912e4
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3b84e5e485619983c2f805dac6f3fde572d0c825c672d1a02f48af0149eea93
bdd4ad7f62625a97c9525b327b57da6c705711a78f40c5b324c0ce6fb10166a8
bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66
cc7f754275bafa6d5f9b86d0f85f9bf052277be1d4098d96b21298940168f5d3
cc9ac7ba24d3e3e2fae5b6d242781bbf3e8ae02f2294ff6fff16fe5071d6fcd4
ccecd185ac16ba0a538840f37701053fbb861f7fbbdd86039c7415fcd924d1f2
d75f3141d9a78b8c9c27e6a6cf9eac13d2c9fae55b6f716f38b4eb341594d186
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6
df954e5873568965ab1f79c4ee6d2391517aca57f4ea5f47e37a9c667b479404
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb35b36fd355e51a257eb8e2b643bd2af74745a468bda25789fb6622f6f17188
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f93d0298dd39f7dff18566a5b2754067e26c0182b469fd6b24e5d63429fef88b
f96ce15c899300b01a162163bfcc20af68274a7a846b90d58377d6ff9753cd57
fc94e48a4b5de3cc76e1b94ad00fc2cc6ad34cd7c665a4de672316716ebe93c4
fd11fa353cc6a8560f4c35e67c6fb8a3a4061ed3de4309cdf83fca65f8319bb4
fe2026897e9821c921336dd6142e512eecd6a61efb6087bc23e37534299f0925
ff3e9b5849108422da95246558cbf40771cfce60b825b91e8beef12af3661410

herbalserver.me Open in urlscan Pro 2606:4700:3037::6815:3b5e Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

197 Requests

84 %HTTPS

59 %IPv6

26 Domains

39 Subdomains

31 IPs

6 Countries

4087 kBTransfer

6638 kBSize

33 Cookies

2 Outgoing links

Redirected requests

197 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

herbalserver.me Open in urlscan Pro
2606:4700:3037::6815:3b5e Public Scan

Screenshot
Live screenshot

Full Image

197
Requests

84 %
HTTPS

59 %
IPv6

26
Domains

39
Subdomains

31
IPs

6
Countries

4087 kB
Transfer

6638 kB
Size

33
Cookies

197 HTTP transactions
8 data transactions