travel.blogmura.com Open in urlscan Pro
52.197.159.16 Public Scan

URL: https://mypage.blogmura.com/reader
Title: portrait ブログリーダー

URL: https://mypage.blogmura.com/signup/
Title: person_add 新規会員登録

URL: https://blogmura.com/history/list
Title: history 閲覧履歴

URL: https://blogmura-help.muragon.com/
Title: help ヘルプ

URL: https://mypage.blogmura.com/login/
Title: lock ログイン

URL: https://blogmura.com/locations
Title: 出身・住所

URL: https://blogmura.com/about
Title: ブログ村とは

URL: https://overseas.blogmura.com/
Title: 海外生活ブログ

URL: https://gourmet.blogmura.com/
Title: グルメブログ

URL: https://lifestyle.blogmura.com/
Title: ライフスタイルブログ

URL: https://photo.blogmura.com/
Title: 写真ブログ

URL: https://outdoor.blogmura.com/
Title: アウトドアブログ

URL: https://docs.google.com/forms/d/e/1FAIpQLScqbnSZwiDIIF9cmTPBJEWZuPZ2HT1DfyiBfuOhpqRMV1M89Q/viewform?usp=sf_link
Title: カテゴリーのご意見・ご要望はこちら

URL: https://blogmura.com/inquiry#faq-top
Title: help

URL: https://blogmura.com/inquiry#faq-ranking

URL: https://link.blogmura.com/out/?ch=10995793&url=https%3A%2F%2Fkagawa-udon-love.com

URL: https://blogmura.com/profiles/10995793/
Title: ゆーいちろう

URL: https://link.blogmura.com/out/?ch=11118403&url=http%3A%2F%2Fhurdygurdyman.blog.fc2.com%2F

URL: https://blogmura.com/profiles/11118403/
Title: ３８G

URL: https://link.blogmura.com/out/?ch=11028985&url=https%3A%2F%2Fyukikuma.club%2Fkochi%2F

URL: https://blogmura.com/profiles/11028985/
Title: ゆっきー

URL: https://link.blogmura.com/out/?ch=10980044&url=http%3A%2F%2Ftkmtkmtrip.blog.fc2.com%2F

URL: https://blogmura.com/profiles/10980044/
Title: たくみちょん

URL: https://link.blogmura.com/out/?ch=11056856&url=https%3A%2F%2Fcruise-navi.com

URL: https://blogmura.com/profiles/11056856/
Title: クルーズナビ

URL: https://link.blogmura.com/out/?ch=10945217&url=http%3A%2F%2Fdr-shinto.blog.jp%2F

URL: https://blogmura.com/profiles/10945217/
Title: 道幸龍現(道幸武久)と秘書ちみちゃん

URL: https://link.blogmura.com/out/?ch=10860474&url=https%3A%2F%2Fkankoku0802.blog.fc2.com%2F

URL: https://blogmura.com/profiles/10860474/
Title: 駐在おやじ

URL: https://link.blogmura.com/out/?ch=10271186&url=https%3A%2F%2Fameblo.jp%2Fnaruru8854%2F

URL: https://blogmura.com/profiles/10271186/
Title: おじゃる☆

URL: https://link.blogmura.com/out/?ch=11058207&url=https%3A%2F%2Fameblo.jp%2Fhola-el-mundo%2F

URL: https://blogmura.com/profiles/11058207/
Title: Sonoko

URL: https://link.blogmura.com/out/?ch=10977619&url=https%3A%2F%2Fyokosukashachuhaku.com%2F

URL: https://blogmura.com/profiles/10977619/
Title: 横須賀放浪者

URL: https://link.blogmura.com/out/?ch=10577221&url=https%3A%2F%2Ffysoft.exblog.jp%2F

URL: https://blogmura.com/profiles/10577221/
Title: fysoft

URL: https://link.blogmura.com/out/?ch=10460250&url=https%3A%2F%2Fkazeni.net

URL: https://blogmura.com/profiles/10460250/
Title: むーちん

URL: https://link.blogmura.com/out/?ch=10556209&url=http%3A%2F%2Ftabiseyo.blog.fc2.com%2F

URL: https://blogmura.com/profiles/10556209/
Title: アジャ子とパー太郎

URL: https://blogmura.com/inquiry#faq-feature-post

URL: https://link.blogmura.com/out/?ch=10763418&item=62608079&url=http%3A%2F%2Fblog.livedoor.jp%2Fkuma2015kuma%2Farchives%2F44942614.html

URL: https://blogmura.com/profiles/10763418/
Title: kumakuma

URL: https://link.blogmura.com/out/?ch=11026428&item=62606433&url=https%3A%2F%2Fboosanpo.hatenablog.com%2Fentry%2F2021%2F09%2F25%2F232451

URL: https://blogmura.com/profiles/11026428/
Title: アッキー

URL: https://link.blogmura.com/out/?ch=10977619&item=62625856&url=https%3A%2F%2Fyokosukashachuhaku.com%2Ftravel-preparations%2F%25e9%2583%25a8%25e5%25b1%258b%25e3%2581%25af%25e6%25b1%259a%25e3%2582%258c%25e6%2594%25be%25e9%25a1%258c%2F

URL: https://link.blogmura.com/out/?ch=10754358&item=62613947&url=https%3A%2F%2Fameblo.jp%2Fmomonoricopin%2Fentry-12699821050.html

URL: https://blogmura.com/profiles/10754358/
Title: ricopin

URL: https://link.blogmura.com/out/?ch=10115440&item=62649482&url=http%3A%2F%2Fblog.livedoor.jp%2Fbuschiba%2Farchives%2F52586727.html

URL: https://blogmura.com/profiles/10115440/
Title: 薫友

URL: https://link.blogmura.com/out/?ch=10763418&item=62658943&url=http%3A%2F%2Fblog.livedoor.jp%2Fkuma2015kuma%2Farchives%2F44950355.html

URL: https://link.blogmura.com/out/?ch=10922281&item=62609693&url=https%3A%2F%2Fsin-wa.net%2F2021%2F09%2F26%2Ftetu-2%2F

URL: https://blogmura.com/profiles/10922281/
Title: たなお

URL: https://link.blogmura.com/out/?ch=10984459&item=62610636&url=https%3A%2F%2Fameblo.jp%2F003650%2Fentry-12700083329.html

URL: https://blogmura.com/profiles/10984459/
Title: パンGET

URL: https://link.blogmura.com/out/?ch=11011205&item=62598234&url=https%3A%2F%2Fwww.awayokuba.net%2Fwriter%2Fmichael%2F17911.html

URL: https://blogmura.com/profiles/11011205/
Title: TEAMあわよくば編集部

URL: https://link.blogmura.com/out/?ch=10104886&item=62611223&url=https%3A%2F%2Fnaka02.exblog.jp%2F30702011%2F

URL: https://blogmura.com/profiles/10104886/
Title: キムチっ子

URL: https://blogmura.com/inquiry#faq-theme

URL: https://blogmura.com/inquiry#faq-post-image

URL: https://link.blogmura.com/out/?ch=11106617&item=62687073&url=https%3A%2F%2Fwww.singlesurf-riku.com%2Ftravel%2Fdaytrip%2F%25e3%2580%2590%25e3%2582%25b7%25e3%2583%25a5%25e3%2583%258e%25e3%2583%25bc%25e3%2582%25b1%25e3%2583%25aa%25e3%2583%25b3%25e3%2582%25b0%25e3%2580%2591%25e9%2580%258f%25e6%2598%258e%25e5%25ba%25a6%25e3%2581%258c%25e5%2587%2584%25e3%2581%258b%25e3%2581%25a3%25e3%2581%259f%25e4%25bc%258a%25e8%25b1%2586%25e4%25b8%258b%25e7%2594%25b0%2F

URL: https://link.blogmura.com/out/?ch=10429730&item=62686966&url=https%3A%2F%2Fameblo.jp%2Fconiston%2Fentry-12700473041.html

URL: https://link.blogmura.com/out/?ch=11111131&item=62686925&url=https%3A%2F%2Fethical-voyage.com%2F%25e3%2583%2597%25e3%2583%25a9%25e3%2582%25b9%25e3%2583%2581%25e3%2583%2583%25e3%2582%25af%25e3%2583%25ac%25e3%2582%25b8%25e8%25a2%258b%25e7%25a6%2581%25e6%25ad%25a2%25ef%25bc%2581%25e4%25ba%2580%25e5%25b2%25a1%25e5%25b8%2582%2F

URL: https://link.blogmura.com/out/?ch=10421922&item=62686733&url=https%3A%2F%2Fameblo.jp%2Fani-050728%2Fentry-12700476749.html

URL: https://link.blogmura.com/out/?ch=10718015&item=62686696&url=http%3A%2F%2Fmrchildrenakinabi.blog.jp%2Farchives%2F11075470.html

URL: https://link.blogmura.com/out/?ch=11110836&item=62686503&url=https%3A%2F%2Ftabilife-syokulife.com%2Farchives%2F1531

URL: https://link.blogmura.com/out/?ch=11054895&item=62686435&url=https%3A%2F%2Fblog.goo.ne.jp%2Fsweden-po%2Fe%2F8507364e12db9c9a4ea22acab2a59d40

URL: https://link.blogmura.com/out/?ch=11089986&item=62686269&url=https%3A%2F%2Fameblo.jp%2Fhappyearth-healing%2Fentry-12700473757.html

URL: https://link.blogmura.com/out/?ch=10424880&item=62686238&url=https%3A%2F%2Fameblo.jp%2Fkokishintengoku%2Fentry-12700354730.html

URL: https://link.blogmura.com/out/?ch=10252795&item=62686598&url=https%3A%2F%2Fameblo.jp%2Ft-houkai%2Fentry-12700419367.html

URL: https://link.blogmura.com/out/?ch=10802930&item=62685848&url=http%3A%2F%2Fblog.livedoor.jp%2Fislandersnet%2Farchives%2F58523260.html

URL: https://link.blogmura.com/out/?ch=11050442&item=62685771&url=https%3A%2F%2Fameblo.jp%2Fdyaoga178%2Fentry-12700471483.html

URL: https://link.blogmura.com/out/?ch=11037407&item=62685696&url=https%3A%2F%2Ftaiwan-kanko.com%2Farchives%2F15409

URL: https://link.blogmura.com/out/?ch=11099478&item=62685617&url=https%3A%2F%2Farima-dayori.com%2Fyahoomatome%2F

URL: https://link.blogmura.com/out/?ch=11013230&item=62685231&url=https%3A%2F%2Fameblo.jp%2F1173-321%2Fentry-12700468900.html

URL: https://link.blogmura.com/out/?ch=10103769&item=62685211&url=https%3A%2F%2Fmiccamiban.exblog.jp%2F30704858%2F

URL: https://link.blogmura.com/out/?ch=10774426&item=62685076&url=https%3A%2F%2Fameblo.jp%2Frifarif%2Fentry-12700463230.html

URL: https://link.blogmura.com/out/?ch=10628617&item=62686012&url=https%3A%2F%2Fsirena.blog.ss-blog.jp%2F2021-09-27

URL: https://blogmura.com/inquiry#faq-new-post

URL: https://blogmura.com/profiles/11106617/
Title: りく

URL: https://blogmura.com/profiles/10429730/
Title: Nancy

URL: https://blogmura.com/profiles/11111131/
Title: 18歳バックパッカー

URL: https://blogmura.com/profiles/10421922/
Title: ｃｈｏｃｏｌａｔ−ｖａｎｉｌｌａ

URL: https://blogmura.com/profiles/10718015/
Title: ちるな

URL: https://blogmura.com/inquiry#faq-new-site

URL: https://link.blogmura.com/out/?ch=11119216&url=https%3A%2F%2Fkototabisuru.com%2F

URL: https://blogmura.com/profiles/11119216/
Title: あまみ

URL: https://link.blogmura.com/out/?ch=11119185&url=https%3A%2F%2Fohige-brushing.com

URL: https://blogmura.com/profiles/11119185/
Title: 毎日、お髭ブラッシング

URL: https://link.blogmura.com/out/?ch=11119168&url=https%3A%2F%2Fchibachan-outdoor.com%2F

URL: https://blogmura.com/profiles/11119168/
Title: ちばちゃん

URL: https://link.blogmura.com/out/?ch=11119156&url=https%3A%2F%2Ffuufude-1-start.com%2F

URL: https://blogmura.com/profiles/11119156/
Title: fukusuke

URL: https://link.blogmura.com/out/?ch=11119129&url=https%3A%2F%2Fhello-izutube.com%2F

URL: https://blogmura.com/profiles/11119129/
Title: 伊豆ちゅーぶ

URL: https://mypage.blogmura.com/blog/profile/join-category
Title: カテゴリー参加・変更

URL: https://blogmura.com/profiles/11110836/
Title: TESTAMATTAさん

URL: https://blogmura.com/profiles/11054895/
Title: Pecoさん

URL: https://blogmura.com/profiles/11089986/
Title: 乙琶さん

URL: https://blogmura.com/profiles/10424880/
Title: hamiさん

URL: https://blogmura.com/profiles/10252795/
Title: 寒がりたー坊さん

URL: https://blogmura.com/profiles/10802930/
Title: BOSSさん

URL: https://blogmura.com/profiles/11050442/
Title: Kianさん

URL: https://blogmura.com/profiles/11037407/
Title: てつさん

URL: https://link.blogmura.com/out/?ch=10169445&item=62685657&url=https%3A%2F%2Fameblo.jp%2Fg-sherry%2Fentry-12700470870.html

URL: https://blogmura.com/profiles/10169445/
Title: Sherry Dolceさん

URL: https://blogmura.com/profiles/11099478/
Title: arimadayoriさん

URL: https://blogmura.com/profiles/11013230/
Title: Surf & Natureさん

URL: https://blogmura.com/profiles/10103769/
Title: ミカハンさん

URL: https://blogmura.com/profiles/10774426/
Title: RIFAさん

URL: https://blogmura.com/profiles/10628617/
Title: あらいぐまさん

URL: https://link.blogmura.com/out/?ch=10904893&item=62684856&url=https%3A%2F%2Fmoreali523425.com%2F2021%2F09%2F27%2Fpost-19383%2F

URL: https://blogmura.com/profiles/10904893/
Title: アリスさん

URL: https://link.blogmura.com/out/?ch=11103152&item=62684722&url=https%3A%2F%2Fkanaetamae.muragon.com%2Fentry%2F42.html

URL: https://blogmura.com/profiles/11103152/
Title: MIREIさん

URL: https://link.blogmura.com/out/?ch=11033318&item=62684677&url=https%3A%2F%2Fwww.atori-atosuki.com%2Fentry%2F2021%2F09%2F27%2F132450

URL: https://blogmura.com/profiles/11033318/
Title: あとりさん

URL: https://link.blogmura.com/out/?ch=10698944&item=62685086&url=https%3A%2F%2Fplaza.rakuten.co.jp%2Fnekoninaritae%2Fdiary%2F202109270000%2F

URL: https://blogmura.com/profiles/10698944/
Title: 楓さん

URL: https://link.blogmura.com/out/?ch=10970235&item=62684515&url=https%3A%2F%2Fameblo.jp%2Flaruco%2Fentry-12700465236.html

URL: https://blogmura.com/profiles/10970235/
Title: larucoさん

URL: https://link.blogmura.com/out/?ch=10021120&item=62684505&url=https%3A%2F%2Fmphot.exblog.jp%2F32319907%2F

URL: https://blogmura.com/profiles/10021120/
Title: miriyunさん

URL: https://link.blogmura.com/out/?ch=10392241&item=62685385&url=https%3A%2F%2Fdrunkhorse.exblog.jp%2F32319906%2F

URL: https://blogmura.com/profiles/10392241/
Title: オバチャンさん

URL: https://link.blogmura.com/out/?ch=10547270&item=62684328&url=https%3A%2F%2Fbbauckland.exblog.jp%2F29675165%2F

URL: https://blogmura.com/profiles/10547270/
Title: B＆Bパインバレーさん

URL: https://link.blogmura.com/out/?ch=10997200&item=62684725&url=https%3A%2F%2Fdaytoday-shioriko.blogto.jp%2Farchives%2F27521494.html

URL: https://blogmura.com/profiles/10997200/
Title: 栞子さん

URL: https://link.blogmura.com/out/?ch=10378324&item=62686594&url=https%3A%2F%2Fplaza.rakuten.co.jp%2Fgcity%2Fdiary%2F202109270000%2F

URL: https://blogmura.com/profiles/10378324/
Title: ホテルグリーンシティさん

URL: https://link.blogmura.com/out/?ch=11099578&item=62684326&url=https%3A%2F%2Fameblo.jp%2Fexywind13%2Fentry-12700464076.html

URL: https://blogmura.com/profiles/11099578/
Title: ケイさん

URL: https://link.blogmura.com/out/?ch=10754358&url=https%3A%2F%2Fameblo.jp%2Fmomonoricopin%2F
Title: 2

URL: https://link.blogmura.com/out/?ch=10471369&url=https%3A%2F%2Fameblo.jp%2F800149jyjcy%2F
Title: 3

URL: https://blogmura.com/profiles/10471369/
Title: ミルクティさん

URL: https://link.blogmura.com/out/?ch=10424413&url=https%3A%2F%2Fameblo.jp%2Fwaimanalobeach%2F
Title: 4

URL: https://blogmura.com/profiles/10424413/
Title: HALE さん

URL: https://link.blogmura.com/out/?ch=10429712&url=https%3A%2F%2Fameblo.jp%2F0818otake0818%2F
Title: 6

URL: https://blogmura.com/profiles/10429712/
Title: おたけさんさん

URL: https://link.blogmura.com/out/?ch=10510549&url=https%3A%2F%2Fameblo.jp%2Ftakatoro%2F
Title: 7

URL: https://blogmura.com/profiles/10510549/
Title: takatoroさん

URL: https://link.blogmura.com/out/?ch=10475835&url=https%3A%2F%2Fameblo.jp%2Fjiji22730%2F
Title: 8

URL: https://blogmura.com/profiles/10475835/
Title: JIJIママさん

URL: https://link.blogmura.com/out/?ch=10952310&url=https%3A%2F%2Fmy-last-adventure.com%2F
Title: 9

URL: https://blogmura.com/profiles/10952310/
Title: メリさん

URL: https://link.blogmura.com/out/?ch=10921911&url=https%3A%2F%2Fsizumura-not-at.work%2F
Title: 10

URL: https://blogmura.com/profiles/10921911/
Title: 静村さん

URL: https://link.blogmura.com/out/?ch=11001496&url=https%3A%2F%2Fzizitabi.com%2F
Title: 1

URL: https://blogmura.com/profiles/11001496/
Title: zizichan1103さん

URL: https://link.blogmura.com/out/?ch=10954641&url=https%3A%2F%2Fryotawada.com%2F
Title: 2

URL: https://blogmura.com/profiles/10954641/
Title: リョウタさん

URL: https://link.blogmura.com/out/?ch=10790059&url=https%3A%2F%2Fblog.shirokumachan.com%2F
Title: 3

URL: https://blogmura.com/profiles/10790059/
Title: しろくまちゃんこづれさん

URL: https://link.blogmura.com/out/?ch=11045602&url=https%3A%2F%2Fameblo.jp%2Fwriter-komeko%2F
Title: 4

URL: https://blogmura.com/profiles/11045602/
Title: writer-komekoさん

URL: https://link.blogmura.com/out/?ch=10693795&url=https%3A%2F%2Fwairaiku.com
Title: 5

URL: https://blogmura.com/profiles/10693795/
Title: ylikeさん

URL: https://link.blogmura.com/out/?ch=10436523&url=http%3A%2F%2Fwww.tabetaiwan.com%2F
Title: 7

URL: https://blogmura.com/profiles/10436523/
Title: Aiwanさん

URL: https://link.blogmura.com/out/?ch=11076490&url=https%3A%2F%2Fwww.judi-travel.tokyo
Title: 8

URL: https://blogmura.com/profiles/11076490/
Title: Judiさん

URL: https://link.blogmura.com/out/?ch=10989526&url=https%3A%2F%2Fameblo.jp%2Fkayorin123%2F
Title: 9

URL: https://blogmura.com/profiles/10989526/
Title: ◆-*かぁっ-*◆さん

URL: https://link.blogmura.com/out/?ch=10646640&url=https%3A%2F%2Fuzakituka.com%2F
Title: 10

URL: https://blogmura.com/profiles/10646640/
Title: 宇崎ツカさん

URL: https://link.blogmura.com/out/?ch=10994309&item=41907505&url=https%3A%2F%2Fameblo.jp%2Fdream-reviews%2Fentry-12627299454.html

URL: https://blogmura.com/profiles/10994309/
Title: memeさん

URL: https://link.blogmura.com/out/?ch=11070466&item=41916327&url=https%3A%2F%2Fdoranekoweb.com%2FJealous-Guy%2F200927h%2F

URL: https://blogmura.com/profiles/11070466/
Title: DoraNekoWebさん

URL: https://link.blogmura.com/out/?ch=11074021&item=41866098&url=http%3A%2F%2Frozetravel.net%2F2020%2F09%2F27%2F%25e4%25b8%258a%25e9%25ab%2598%25e5%259c%25b0%25e2%2591%25a3%25e3%2580%2580%25e3%2583%2590%25e3%2582%25b9%25e3%2582%25bf%25e3%2583%25bc%25e3%2583%259f%25e3%2583%258a%25e3%2583%25ab%25e3%2580%2580%25e8%25b6%25b3%25e6%25b9%25af%2F

URL: https://blogmura.com/profiles/11074021/
Title: ロゼさん

URL: https://link.blogmura.com/out/?ch=11070466&item=41915819&url=https%3A%2F%2Fdoranekoweb.com%2FJealous-Guy%2F200927g%2F

URL: https://link.blogmura.com/out/?ch=11075969&item=41876382&url=http%3A%2F%2Fniconico88888.livedoor.blog%2Farchives%2F7453362.html

URL: https://blogmura.com/profiles/11075969/
Title: ニコさん

URL: https://link.blogmura.com/out/?ch=11071747&item=41863139&url=https%3A%2F%2Fcamper-van-fun.blogspot.com%2F2020%2F09%2Fblog-post_26.html

URL: https://blogmura.com/profiles/11071747/
Title: こみちさん

URL: https://link.blogmura.com/out/?ch=11072622&item=41923244&url=https%3A%2F%2Fameblo.jp%2Fnomo18matsui55%2Fentry-12627825589.html

URL: https://blogmura.com/profiles/11072622/
Title: 投稿侯爵さん

URL: https://link.blogmura.com/out/?ch=10755803&item=41897278&url=https%3A%2F%2Fameblo.jp%2Fkahakai0613%2Fentry-12620262935.html

URL: https://blogmura.com/profiles/10755803/
Title: Rainbow Showerさん

URL: https://link.blogmura.com/out/?ch=11070466&item=41915820&url=https%3A%2F%2Fdoranekoweb.com%2FJealous-Guy%2F200927f%2F

URL: https://link.blogmura.com/out/?ch=10624409&item=41891988&url=https%3A%2F%2Ffj100rist.at.webry.info%2F202009%2Farticle_17.html

URL: https://blogmura.com/profiles/10624409/
Title: OZMAさん

URL: https://link.blogmura.com/out/?ch=10786515&item=41909133&url=https%3A%2F%2Fameblo.jp%2Fthaimassage-salon%2Fentry-12627823957.html

URL: https://blogmura.com/profiles/10786515/
Title: ゴットハンドセラピストさん

URL: https://link.blogmura.com/out/?ch=10945604&item=41862767&url=https%3A%2F%2Fwww.tabi-log.net%2Fentry%2F2020%2F09%2F27%2F142823

URL: https://blogmura.com/profiles/10945604/
Title: ばんきえーるさん

URL: https://link.blogmura.com/out/?ch=10718015&item=41862753&url=http%3A%2F%2Fmrchildrenakinabi.blog.jp%2Farchives%2F7107032.html

URL: https://link.blogmura.com/out/?ch=10431966&item=41873401&url=https%3A%2F%2Fameblo.jp%2Fshinsuibeya%2Fentry-12627797592.html

URL: https://blogmura.com/profiles/10431966/
Title: Rinkoさん

URL: https://link.blogmura.com/out/?ch=10269285&item=41862595&url=https%3A%2F%2Fameblo.jp%2Fjp-airport%2Fentry-12627822808.html

URL: https://blogmura.com/profiles/10269285/
Title: jpairportさん

URL: https://link.blogmura.com/out/?ch=10177731&item=41862586&url=https%3A%2F%2Fameblo.jp%2Frainbow---heart%2Fentry-12627819649.html

URL: https://blogmura.com/profiles/10177731/
Title: ちえさん

URL: https://link.blogmura.com/out/?ch=10925021&item=41898149&url=http%3A%2F%2Fsekaitravel.net%2Fputrajaya-challenge-park%2F

URL: https://blogmura.com/profiles/10925021/
Title: Yasurさん

URL: https://link.blogmura.com/out/?ch=11020113&item=41916469&url=https%3A%2F%2Fwww.imagical.net%2Fentry%2FYokohama%25E2%2580%2597baysheraton%25E2%2580%2597room

URL: https://blogmura.com/profiles/11020113/
Title: にあぽんさん

URL: https://link.blogmura.com/out/?ch=11049044&item=41957017&url=https%3A%2F%2Fmiyabinakokoro.com%2Ftrainer-battle%2F

URL: https://blogmura.com/profiles/11049044/
Title: みやっちさん

URL: https://link.blogmura.com/out/?ch=10692455&item=41862713&url=https%3A%2F%2Fameblo.jp%2Ftoday555travel%2Fentry-12627458016.html

URL: https://blogmura.com/profiles/10692455/
Title: るるさん

URL: https://link.blogmura.com/out/?ch=10764173&item=41883719&url=https%3A%2F%2Fameblo.jp%2Faoiumino%2Fentry-12627821630.html

URL: https://blogmura.com/profiles/10764173/
Title: aoiさん

URL: https://link.blogmura.com/out/?ch=11001149&item=41862367&url=https%3A%2F%2Focchi-blog.com%2Fpinetwork%2F

URL: https://blogmura.com/profiles/11001149/
Title: こーんさん

URL: https://link.blogmura.com/out/?ch=11017305&item=41862523&url=https%3A%2F%2Fblog.goo.ne.jp%2Fmegurumi520%2Fe%2F948d43cefbb97f8f9b94ae0778cf37d5

URL: https://blogmura.com/profiles/11017305/
Title: ぶんきちさん

URL: https://link.blogmura.com/out/?ch=10920184&item=41862295&url=https%3A%2F%2Fplaza.rakuten.co.jp%2Fstonystyle%2Fdiary%2F202009270000%2F

URL: https://blogmura.com/profiles/10920184/
Title: stonystyleさん

URL: https://link.blogmura.com/out/?ch=10698944&item=41862322&url=https%3A%2F%2Fplaza.rakuten.co.jp%2Fnekoninaritae%2Fdiary%2F202009270000%2F

URL: https://link.blogmura.com/out/?ch=11007404&item=41862255&url=https%3A%2F%2Fbaabanotano.muragon.com%2Fentry%2F1369.html

URL: https://blogmura.com/profiles/11007404/
Title: ｂａａｂａさん

URL: https://link.blogmura.com/out/?ch=10199000&item=41863027&url=https%3A%2F%2Fblog.goo.ne.jp%2Ftsureduresyasinntyou%2Fe%2F767f03a0f4c8c91e8b1e41e95a151248

URL: https://blogmura.com/profiles/10199000/
Title: 徒然写真帳管理人さん

URL: https://link.blogmura.com/out/?ch=11001772&item=41862253&url=https%3A%2F%2Fwww.mi-cha34.com%2Fentry%2F2020%2F09%2F27%2F141215

URL: https://blogmura.com/profiles/11001772/
Title: ぶらりすと＊みーちゃさん

URL: https://link.blogmura.com/out/?ch=10983056&item=41892103&url=https%3A%2F%2Fminkara.carview.co.jp%2Fuserid%2F1805142%2Fblog%2F44427546%2F

URL: https://blogmura.com/profiles/10983056/
Title: イイネさん

URL: https://link.blogmura.com/out/?ch=10292034&item=41874463&url=https%3A%2F%2Fameblo.jp%2Fkazeokastay0407%2Fentry-12627821069.html

URL: https://blogmura.com/profiles/10292034/
Title: 風のこみちさん

URL: https://blogmura.com/inquiry#faq-location

URL: https://blogmura.com/locations/1156/blogs
Title: 芽室町

URL: https://blogmura.com/locations/1235/blogs
Title: 岩手町

URL: https://blogmura.com/locations/1473/blogs
Title: 那須町

URL: https://blogmura.com/locations/1589/blogs
Title: 市原市

URL: https://blogmura.com/locations/1653/blogs
Title: 三鷹市

URL: https://blogmura.com/locations/1693/blogs
Title: 平塚市

URL: https://blogmura.com/locations/1804/blogs
Title: 富士吉田市

URL: https://blogmura.com/locations/1917/blogs
Title: 美濃加茂市

URL: https://blogmura.com/locations/1940/blogs
Title: 坂祝町

URL: https://blogmura.com/locations/1001017/blogs
Title: 南スーダン

URL: https://mypage.blogmura.com/blog/profile/require
Title: 出身・住所を変更(登録)する

URL: https://mypage.blogmura.com/signup/?utm_source=blogmura&utm_medium=pc&utm_campaign=bnr_reader

URL: https://twitter.com/share?url=https://travel.blogmura.com/&text=%E6%97%85%E8%A1%8C%E3%83%96%E3%83%AD%E3%82%B0%20%E4%BA%BA%E6%B0%97%E3%83%96%E3%83%AD%E3%82%B0%E3%83%A9%E3%83%B3%E3%82%AD%E3%83%B3%E3%82%B0%E3%81%A8%E3%83%96%E3%83%AD%E3%82%B0%E6%A4%9C%E7%B4%A2%20-%20%E3%81%AB%E3%81%BB%E3%82%93%E3%83%96%E3%83%AD%E3%82%B0%E6%9D%91&hashtags=%E3%83%96%E3%83%AD%E3%82%B0%E6%9D%91

URL: http://www.facebook.com/sharer.php?u=https://travel.blogmura.com/

URL: https://social-plugins.line.me/lineit/share?url=https://travel.blogmura.com/&text=%E6%97%85%E8%A1%8C%E3%83%96%E3%83%AD%E3%82%B0%20%E4%BA%BA%E6%B0%97%E3%83%96%E3%83%AD%E3%82%B0%E3%83%A9%E3%83%B3%E3%82%AD%E3%83%B3%E3%82%B0%E3%81%A8%E3%83%96%E3%83%AD%E3%82%B0%E6%A4%9C%E7%B4%A2%20-%20%E3%81%AB%E3%81%BB%E3%82%93%E3%83%96%E3%83%AD%E3%82%B0%E6%9D%91

URL: https://www.murauchi.com/MCJ-front-web/index.html

URL: https://inkrich.com/

URL: https://muragon.com/

URL: https://spolete.jp/

URL: https://www.murauchi.co.jp/company/
Title: 運営会社

URL: https://www.murauchi.co.jp/recruit/jobs/
Title: 採用情報

URL: https://blogmura-help.muragon.com/entry/417.html
Title: 利用規約

URL: https://blogmura.muragon.com/
Title: お知らせ

URL: https://blogmura.com/inquiry
Title: お問い合わせ

URL: https://docs.google.com/forms/d/e/1FAIpQLSd5nVqUMyE3vtzv4zNNQk40LtqCu19H-UQvwZiw0Z5jGXYO2A/viewform
Title: 広告問い合わせ

ec2-52-197-159-16.ap-northeast-1.compute.amazonaws.com

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://travel.blogmura.com/ HTTP 301
https://travel.blogmura.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 168

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Ftravel.blogmura.com%2F&domain=travel.blogmura.com&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=WJGz3Xw5UC9WeGRoeVA2SU8vY05VR0RHMXpTczJwR1dZcnNmTERNc0RBQVVyNHpPNWVlSUdIb1hGdmZtRmZNeW9TaG10UnNXUHNyMlN4WmkwaXMwWTROaWxsTHdhTHR2RGRXY2d6dkhpUm9nWktzZjREWGJIcUZQZkhlSjZscVozTS96eGNDbEs5b0RPM3pOb2lDMEkwam1WMmFRVFhWWlB6ci85V0hQWDFHL0J6clQ2NWQ0ejFBaG0vck9wcHFHczU4MGR2Znk1L3k4WTZlZ3RHWWxWTG9xOXBUTGd6K2d3NysvNVB6ZHp5THkybjgxS0VxUVNZNG5qQVBFNlAvOXJzZFJUfA&cppv=2

Request Chain 255

https://pixel.adsafeprotected.com/rfw/st/741547/55522419/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd= HTTP 302
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=

Request Chain 303

https://pixel.adsafeprotected.com/rfw/st/741547/55522707/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd= HTTP 302
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=

Request Chain 320

https://pixel.adsafeprotected.com/rfw/st/741547/55522417/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd= HTTP 302
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=

Request Chain 328

https://pixel.adsafeprotected.com/rfw/st/741547/55522417/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd= HTTP 302
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=

Request Chain 362

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

Request Chain 363

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVFaV1lVfZkywdes9eLIRwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

Request Chain 364

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFRjZXzU05fVAsZFnQpae1U%26google_cver%3D1

Request Chain 365

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

Request Chain 369

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

Request Chain 370

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVFaV1lVfZkywdes9eLIRwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

Request Chain 371

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFRjZXzU05fVAsZFnQpae1U%26google_cver%3D1

Request Chain 372

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

Request Chain 376

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

Request Chain 377

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVFaV1lVfZkywdes9eLIRwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

Request Chain 378

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

Request Chain 379

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

Request Chain 380

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

Request Chain 381

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVFaV1lVfZkywdes9eLIRwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

Request Chain 382

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

Request Chain 383

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

Request Chain 387

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

Request Chain 388

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVFaV1lVfZkywdes9eLIRwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

Request Chain 389

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

Request Chain 390

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTM5NTQ4MjA4NzQyMDQzMDI3Ng%3D%3D

Request Chain 391

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

Request Chain 392

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVFaV1lVfZkywdes9eLIRwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

Request Chain 393

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

Request Chain 394

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTM5NTQ4MjA4NzQyMDQzMDI3Ng%3D%3D

Request Chain 434

https://gcdn.2mdn.net/videoplayback/id/674ae099102b2807/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3773920563/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/signature/785342B13A5287A68EAD70B395E9E16B676FE0AA.1BBBCD1116DFE510BE8A03B5B2D271219D4EDA0F/key/ck2/file/file.mp4 HTTP 302
https://r3---sn-4g5ednd7.c.2mdn.net/videoplayback/id/674ae099102b2807/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3773920563/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/1443AA975C2E6E44646EDC99B0DA40A70A6DBE6F.6812B2CA008D7DC736ED3EEB092EEDB01B0C215D/key/cms1/cms_redirect/yes/mh/JZ/mip/2a0f:9441:5:0:e4::1/mm/42/mn/sn-4g5ednd7/ms/onc/mt/1632720891/mv/u/mvi/3/pl/48/file/file.mp4

Request Chain 436

https://gcdn.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signature/5C5A26F684F9DD681405E55FF29E4BE7F8F7D833.A7C6479AE61B70FEA0932605E831CA39079992DA/key/ck2/file/file.mp4 HTTP 302
https://r1---sn-4g5ednsy.c.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/4B3A105B8D44A4C1B12B8B759BE6F3A14710FFAA.7354F7868A2B63D88A2A32E6D40D1401BB0CBE6C/key/cms1/cms_redirect/yes/mh/ZC/mip/2a0f:9441:5:0:e4::1/mm/42/mn/sn-4g5ednsy/ms/onc/mt/1632720891/mv/u/mvi/1/pl/48/file/file.mp4 HTTP 302
https://r5---sn-4g5ednsy.c.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/4B3A105B8D44A4C1B12B8B759BE6F3A14710FFAA.7354F7868A2B63D88A2A32E6D40D1401BB0CBE6C/key/cms1/cms_redirect/yes/mh/ZC/mip/2a0f:9441:5:0:e4::1/mm/42/mn/sn-4g5ednsy/ms/onc/mt/1632720891/mv/u/mvi/1/pl/48/ir/1/rr/12/file/file.mp4

Request Chain 438

https://gcdn.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signature/3F08087F2C8179C5A41A7119AF7B6E7AF2AF5283.A550D1F569424F5B426841147251A05D55EAF520/key/ck2/file/file.mp4 HTTP 302
https://r1---sn-4g5ednsy.c.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/658F8C14CCB805ABD0DC57366E41A95A91569AE9.2C8DDF81699AC10C38DE2B43855DEC8EC73D5E8E/key/cms1/cms_redirect/yes/mh/ZC/mip/2a0f:9441:5:0:e4::1/mm/42/mn/sn-4g5ednsy/ms/onc/mt/1632720891/mv/u/mvi/1/pl/48/file/file.mp4 HTTP 302
https://r5---sn-4g5ednsy.c.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/658F8C14CCB805ABD0DC57366E41A95A91569AE9.2C8DDF81699AC10C38DE2B43855DEC8EC73D5E8E/key/cms1/cms_redirect/yes/mh/ZC/mip/2a0f:9441:5:0:e4::1/mm/42/mn/sn-4g5ednsy/ms/onc/mt/1632720891/mv/u/mvi/1/pl/48/ir/1/rr/12/file/file.mp4

Request Chain 475

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

Request Chain 476

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVFaV1lVfZkywdes9eLIRwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

Request Chain 477

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

Request Chain 478

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

Request Chain 479

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHLE9ii3u3ItMfH21QLBiRI&google_cver=1

Request Chain 480

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NzA3ODgzZWItNWM2Zi0yMmQ0LWVlZjEtNWFjMmNiZjZlYmU2

Request Chain 481

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEKWG9AQ14B92QdJotoOmiEE&google_cver=1

Request Chain 483

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHLE9ii3u3ItMfH21QLBiRI&google_cver=1

Request Chain 484

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NzA3ODgzZWItNWM2Zi0yMmQ0LWVlZjEtNWFjMmNiZjZlYmU2

Request Chain 485

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEKWG9AQ14B92QdJotoOmiEE&google_cver=1

Request Chain 487

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

Request Chain 488

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVFaV1lVfZkywdes9eLIRwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

Request Chain 489

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

Request Chain 490

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

Request Chain 495

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306717467&d_campaign=26006000&d_bust=3494960417&gdpr=&gdpr_consent= HTTP 302
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306717467&d_campaign=26006000&d_bust=3494960417&gdpr=&gdpr_consent=

Request Chain 499

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306796677&d_campaign=26005997&d_bust=1999892317&gdpr=&gdpr_consent= HTTP 302
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306796677&d_campaign=26005997&d_bust=1999892317&gdpr=&gdpr_consent=

Request Chain 504

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=131961474&d_placement=306717470&d_campaign=26006000&d_bust=3276752196&gdpr=&gdpr_consent= HTTP 302
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=131961474&d_placement=306717470&d_campaign=26006000&d_bust=3276752196&gdpr=&gdpr_consent=

Request Chain 525

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306717467&d_campaign=26006000&d_bust=2352617156&gdpr=&gdpr_consent= HTTP 302
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306717467&d_campaign=26006000&d_bust=2352617156&gdpr=&gdpr_consent=

Request Chain 566

https://hal90001.redintelligence.net/request.php?zone=mz3e4ljusno6&nw=20&renderingType=javascript&namespace=9b2ef5839a&subid=&uid=e6e8f55901ab4720&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsoVLVlpRYf7tGc_ngQeyvJjoD4_g-IZT3bWLpMoM99KivcABEAEggdWcJGCVgoCAsAfIAQmpAqia_ovzqbM-qAMBqgTXAU_QaK_xHQe489oyccVTgGOa5yroVSWEYNmq9XAN5LlQQFNE_ZTOz5HXACeps5iHRP6llApqKy-cfSHcwQoF7j-IZhbRodpDp2BWv4CBQGwJ5l0ajFHBuGPblechlkqcprgfE2YAqh4eszr6FWMiBDOfEMG5PWIiclOlbiCD6G0LV9KS-Z6r644m91NvTS04RblSjR3aGyiCEdzPWwk2UD8EOUiwURQDVXFpE_qNaAqjCjGFqRomeMvqdUyAhMouxR5OM_RYYzmuCUUPf82npcJHB8f2FNewwAS78ajAzwHgBAOQBgGgBk2AB-vn6F6oB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoLqUYfwHBZ1q4hhlS4MjKyHRLjA%26sig%3DAOD64_3nVg9Z3CQCbtK2bmCb71DEuGSRoQ%26client%3Dca-pub-9252416192348979%26dbm_c%3DAKAmf-Cjh-rPkja75vtBqNY-lLTgSno66ImKtYcMXByxwINNJT9ygTkZFEVvuKqnIJZkzxtSbKeAFknGLTExxEb8UsAzwNNev5H9UdgfEJG03sQ881BmU3_uD8VXYeK20sL0VaapBj4Bazx4uQFZW0YPnOJX4O-ztA%26cry%3D1%26dbm_d%3DAKAmf-Aq_UGeMyQ-KU3XhJxwKkYC_0DrTiW2PDh-NK7bEdx2EkNgOC1uwoP-graVvysNg0MXUITe-Upq0ticT6NurZWvd8OtLciMypH1HgJ5QFVpqcc5_vNr4UwGkHWj6mN4Hak5--U5DBu2-Vt8mKCpz7yWEuCiOx2Y_rBw6RWDrSzALmLuYp94-F0tIPikvlmCQvPasXohFhqUNxsDfhXeLA9Ssrek5QHCNTvwAa6FuwHUV6AlS_gX7mqc4ZDKTvhk0qFAm-SZASX2AijgpR_-zSpmDlI8IfA0VqTJOwDXf0FoRdlUCsmjsMrP2Y94-mkkT0cixPxUmFZlkt0mLcaZut7B3L8d-HrJGl8xIhN7pV90t-tmyFpUIWSwHZy8_ZgQlVoo7ZAYFjRZUqsjvDWLy-294id7g9XRjS-Y4x1646z3IoOAznec18rxT3cRRDMLOxiPr80Z%26adurl%3D&documentReferer=https%3A%2F%2Ftravel.blogmura.com%2F&ancestorOrigins=https%3A%2F%2Ftravel.blogmura.com&random=3589232508605&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal90001.redintelligence.net/request.php?zone=mz3e4ljusno6&nw=20&renderingType=javascript&namespace=9b2ef5839a&subid=&uid=e6e8f55901ab4720&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsoVLVlpRYf7tGc_ngQeyvJjoD4_g-IZT3bWLpMoM99KivcABEAEggdWcJGCVgoCAsAfIAQmpAqia_ovzqbM-qAMBqgTXAU_QaK_xHQe489oyccVTgGOa5yroVSWEYNmq9XAN5LlQQFNE_ZTOz5HXACeps5iHRP6llApqKy-cfSHcwQoF7j-IZhbRodpDp2BWv4CBQGwJ5l0ajFHBuGPblechlkqcprgfE2YAqh4eszr6FWMiBDOfEMG5PWIiclOlbiCD6G0LV9KS-Z6r644m91NvTS04RblSjR3aGyiCEdzPWwk2UD8EOUiwURQDVXFpE_qNaAqjCjGFqRomeMvqdUyAhMouxR5OM_RYYzmuCUUPf82npcJHB8f2FNewwAS78ajAzwHgBAOQBgGgBk2AB-vn6F6oB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoLqUYfwHBZ1q4hhlS4MjKyHRLjA%26sig%3DAOD64_3nVg9Z3CQCbtK2bmCb71DEuGSRoQ%26client%3Dca-pub-9252416192348979%26dbm_c%3DAKAmf-Cjh-rPkja75vtBqNY-lLTgSno66ImKtYcMXByxwINNJT9ygTkZFEVvuKqnIJZkzxtSbKeAFknGLTExxEb8UsAzwNNev5H9UdgfEJG03sQ881BmU3_uD8VXYeK20sL0VaapBj4Bazx4uQFZW0YPnOJX4O-ztA%26cry%3D1%26dbm_d%3DAKAmf-Aq_UGeMyQ-KU3XhJxwKkYC_0DrTiW2PDh-NK7bEdx2EkNgOC1uwoP-graVvysNg0MXUITe-Upq0ticT6NurZWvd8OtLciMypH1HgJ5QFVpqcc5_vNr4UwGkHWj6mN4Hak5--U5DBu2-Vt8mKCpz7yWEuCiOx2Y_rBw6RWDrSzALmLuYp94-F0tIPikvlmCQvPasXohFhqUNxsDfhXeLA9Ssrek5QHCNTvwAa6FuwHUV6AlS_gX7mqc4ZDKTvhk0qFAm-SZASX2AijgpR_-zSpmDlI8IfA0VqTJOwDXf0FoRdlUCsmjsMrP2Y94-mkkT0cixPxUmFZlkt0mLcaZut7B3L8d-HrJGl8xIhN7pV90t-tmyFpUIWSwHZy8_ZgQlVoo7ZAYFjRZUqsjvDWLy-294id7g9XRjS-Y4x1646z3IoOAznec18rxT3cRRDMLOxiPr80Z%26adurl%3D&documentReferer=https%3A%2F%2Ftravel.blogmura.com%2F&ancestorOrigins=https%3A%2F%2Ftravel.blogmura.com&random=3589232508605&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 604

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9374031701078.326 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=CI3p7sa5nvMCFZ4Y0wodgkINIw;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9374031701078.326

Request Chain 658

https://cr-p31.ladsp.jp/cookiesender/31 HTTP 302
https://cr-pall.ladsp.com/cookiesender/31 HTTP 302
https://cr-pall.ladsp.com/cookiesender/31?cr=true

Request Chain 676

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=2135750410233654712

Request Chain 678

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=BPUorA7mQTuGAkqwioliCg%3D%3D HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

Request Chain 679

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=ad7b6151-5a5a-4e00-83b5-dce5d7e17a52

Request Chain 680

https://pixel.onaudience.com/?partner=214&mapped=04F528AC-0EE6-413B-8602-4AB08A89620A HTTP 302
https://spl.zeotap.com/?zdid=1332&zcluid=ad5034878012b3a7 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=04c10f37-ce0b-40fb-7be7-89c6543a9824&reqId=49d90849-0fad-4512-5bbd-fefe587f9c61&zcluid=ad5034878012b3a7&zdid=1332 HTTP 302
https://mwzeom.zeotap.com/mw?google_gid=CAESEJjy2x5duiUk4Z9CMimvJIY&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=04c10f37-ce0b-40fb-7be7-89c6543a9824&reqId=49d90849-0fad-4512-5bbd-fefe587f9c61&zcluid=ad5034878012b3a7&zdid=1332

Request Chain 681

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MDRGNTI4QUMtMEVFNi00MTNCLTg2MDItNEFCMDhBODk2MjBB&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 682

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEGz8Yc5pj4TSZxoMtgjGraI&google_cver=1

Request Chain 684

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=fae62bf2-d1d2-44d7-82c2-edc21cba8efe

Request Chain 685

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=4809311964065044449

Request Chain 686

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:e5a06151-5a5a-4e00-bc29-0b8db2cf524a&gdpr=0&gdpr_consent=

Request Chain 687

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=5196315965399627359&gdpr=0&gdpr_consent=

Request Chain 688

https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=VKvDqFf7w_hPrcSuAPvboFSolKpP-cL_WvmroMa1

Request Chain 708

https://gum.criteo.com/sid/json?origin=publishertag&domain=blogmura.com&sn=ChromeSyncframe&so=3&topUrl=travel.blogmura.com&bundle=Cnb3Ml9VUEh5TUFKaURnMlpRJTJGMFAlMkJ3Q203cWxyQm5TUmJkaVh2c0k5dHpXWkx3bUZsd1YzSzhvbUI2QnRaQmJSanhEQjIzRFdOMHo3T3JMQWRwM2JHb3NrNzg1TDNRaCUyQjJvMjFYRSUyQmFnc01JS0VQbDlqSUpuZHVINmxaMUZTemZPaGFM&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=k56k2nxHc2wzZE5WN0NTS0dTeTZjTFh1bVlFN2VONm4vSGF0QkRnbkc0TTM5ZElNZEpDVWRCdkI5OGlmUm56Q21GdWNaUmRBeHdRK3ROOVkxb2FUWkVUcGh0M3BjMmNDeEJ5RzF6Rkx3OFZ5OTRINUFFMU9nU2pwaktNNTlJT3doMGdRR245T1QyeTlsaUYvYW9TVjJTSjIzS1NDV1p1ejNtVWJKcEhDTitlOWJWM1E2V1EvV3NjUUUwamNNUDBRc3UzR0ViZVJ5bkRYN0FFeUhaSjBwb1Y0MExrRGxrK0VhSllvMjJXWWpXVUQzRVlCZ3Z4akVNRW5oczU4ZFhWWjRVSXduL3YvSnc2Y0dEdXdLTSs0VkpJL3Uvemo2R3ZvSC9EQWE4dmpJRnh4aUVhUT18&cppv=2

702 HTTP transactions
16 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
travel.blogmura.com/
Redirect Chain

http://travel.blogmura.com/
https://travel.blogmura.com/

292 KB
47 KB

1270ms
761ms

Document
text/html

52.197.159.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://travel.blogmura.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.197.159.16 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

16a269b4427d19947ed3f2a0a6b932b4ae9fcb897593f2435268201627a85fe9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: travel.blogmura.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Mon, 27 Sep 2021 05:44:51 GMT
content-type: text/html;charset=UTF-8
set-cookie: category_history=WzJd; Max-Age=31536000; Expires=Tue, 27-Sep-2022 05:44:51 GMT; Domain=blogmura.com; Path=/; Secure; HttpOnly buid=1e23fd5c-432d-4808-9322-016b93ba71f1; Max-Age=86400; Expires=Tue, 28-Sep-2021 05:44:51 GMT; Domain=blogmura.com; Path=/; Secure; HttpOnly
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
vary: accept-encoding
content-encoding: gzip
content-language: de-DE

Redirect headers

Server: awselb/2.0
Date: Mon, 27 Sep 2021 05:44:50 GMT
Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Location: https://travel.blogmura.com:443/

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 97 KB
39 KB 40ms
18ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-1238852-1

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

72c3f866b3599e7ea1994b99a045f401d84ae151ceea92b4eb4ebde605e8e269

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39213
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 27 Sep 2021 05:44:52 GMT

GET
H2 200 uvq4qfx.css
use.typekit.net/ 5 KB
1 KB 100ms
38ms Stylesheet
text/css 2a02:26f0:6c00::210:ba0b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/uvq4qfx.css

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00::210:ba0b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

63a506c6fa2f359f424f87944aee07d98deaaa7ac7ab998e439c6642c8e20961

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
server: nginx
date: Mon, 27 Sep 2021 05:44:52 GMT
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 833

GET
H2 200 top-fe9419988bab3c106b85f63b72ab8040.css
static.blogmura.com/css/normal/ 69 KB
10 KB 52ms
8ms Stylesheet
text/css 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.blogmura.com/css/normal/top-fe9419988bab3c106b85f63b72ab8040.css

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-197-159-16.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

d3c681f153411b1095ea5ed019dcbd831af6aa36b3a4ba7d6c30a220b23d82e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 01:33:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 08 Sep 2021 01:29:09 GMT
age: 1656693
x-frame-options: DENY
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: text/css
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C1
vary: Accept-Encoding
x-amz-cf-id: yNPGoWjGytNXrOJZEvT-OURRkbY-nbaSHnoZWer8AZek25ptQwbbPw==
x-xss-protection: 1; mode=block

GET
H2 200 material-icons-c5941eed2e20a509114128aab1e96edf.css
travel.blogmura.com/vendor/material-icons/ 1 KB
1 KB 473ms
470ms Stylesheet
text/css 52.197.159.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://travel.blogmura.com/vendor/material-icons/material-icons-c5941eed2e20a509114128aab1e96edf.css

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.197.159.16 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

d45b741ce46bcc20f8ee6d537171a19aa734831357091accbcf4368c29f113a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

:path: /vendor/material-icons/material-icons-c5941eed2e20a509114128aab1e96edf.css
pragma: no-cache
cookie: category_history=WzJd; buid=1e23fd5c-432d-4808-9322-016b93ba71f1
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: travel.blogmura.com
referer: https://travel.blogmura.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 27 Sep 2021 01:52:27 GMT
x-frame-options: DENY
content-type: text/css
cache-control: max-age=31536000
strict-transport-security: max-age=31536000 ; includeSubDomains
accept-ranges: bytes
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
content-length: 1194
x-xss-protection: 1; mode=block

GET
H2 200 jquery.min-eb73f7ac1329262bef84ee1fa6f894be.js Show response
static.blogmura.com/vendor/jquery/ 85 KB
30 KB 52ms
8ms Script
application/javascript 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.blogmura.com/vendor/jquery/jquery.min-eb73f7ac1329262bef84ee1fa6f894be.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

4657daff6c58fd50f163892062f537e40715a7acd0394b7fb877c74d8a7362d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 00:13:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5549489
x-cache: Hit from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Fri, 23 Jul 2021 00:51:48 GMT
x-frame-options: DENY
etag: W/"eb73f7ac1329262bef84ee1fa6f894be"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: application/javascript
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: oDVnbsxnCvG9075WGK3ZKatpftw_u9pQC0pOGCxJ-NGyEGw-BGSlNg==

GET
H2 200 jquery-ui.min-d8ce160c88057b1b201f0a3f29fac841.js Show response
static.blogmura.com/vendor/jquery/ 31 KB
10 KB 60ms
16ms Script
application/javascript 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.blogmura.com/vendor/jquery/jquery-ui.min-d8ce160c88057b1b201f0a3f29fac841.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-197-159-16.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

217ea10692f609f4b8f420fa43d8a25b467644adbd2ad57b89daeca5fd6cde0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 23:11:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2961197
x-cache: Hit from cloudfront
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Mon, 23 Aug 2021 00:50:35 GMT
x-frame-options: DENY
etag: W/"d8ce160c88057b1b201f0a3f29fac841"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: application/javascript
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: gyn-AfW_BWEcIxo0I3P7liILgHTZb7Mgu5bz-HwLFDDXLpaDYHOkwQ==

GET
H2 200 stickyfill.min-6d5324ca2d034d18a25ff090df5ed1ec.js Show response
travel.blogmura.com/vendor/stickyfill/ 6 KB
7 KB 501ms
499ms Script
application/javascript 52.197.159.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://travel.blogmura.com/vendor/stickyfill/stickyfill.min-6d5324ca2d034d18a25ff090df5ed1ec.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.197.159.16 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0eecf491241f39dda128866d96677cc58baa42500a10426748f61849f2daad54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

:path: /vendor/stickyfill/stickyfill.min-6d5324ca2d034d18a25ff090df5ed1ec.js
pragma: no-cache
cookie: category_history=WzJd; buid=1e23fd5c-432d-4808-9322-016b93ba71f1
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: travel.blogmura.com
referer: https://travel.blogmura.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 27 Sep 2021 01:52:27 GMT
etag: "6d5324ca2d034d18a25ff090df5ed1ec"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000 ; includeSubDomains
accept-ranges: bytes
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
content-length: 6500
x-xss-protection: 1; mode=block

GET
H2 200 object-fit-9a3297a6a2203e7eb84ce33058e1d387.js Show response
travel.blogmura.com/vendor/object-fit/ 3 KB
4 KB 507ms
505ms Script
application/javascript 52.197.159.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://travel.blogmura.com/vendor/object-fit/object-fit-9a3297a6a2203e7eb84ce33058e1d387.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.197.159.16 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-197-159-16.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

126efbcdc48a9eef57a0de949224a0ba971cd391e759ef1bd79520571b731de1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

:path: /vendor/object-fit/object-fit-9a3297a6a2203e7eb84ce33058e1d387.js
pragma: no-cache
cookie: category_history=WzJd; buid=1e23fd5c-432d-4808-9322-016b93ba71f1
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: travel.blogmura.com
referer: https://travel.blogmura.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 27 Sep 2021 01:52:27 GMT
etag: "9a3297a6a2203e7eb84ce33058e1d387"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000 ; includeSubDomains
accept-ranges: bytes
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
content-length: 3285
x-xss-protection: 1; mode=block

GET
H2 200 common-1a9f7c8f8970b6cfb8f8dfb6f3615623.js Show response
travel.blogmura.com/js/normal/ 4 KB
5 KB 501ms
500ms Script
application/javascript 52.197.159.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://travel.blogmura.com/js/normal/common-1a9f7c8f8970b6cfb8f8dfb6f3615623.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.197.159.16 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-197-159-16.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

a4c76d2c4b503bcd47e956f3fb4835140a0e2094c1277af812bdbfb24ea6e4fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

:path: /js/normal/common-1a9f7c8f8970b6cfb8f8dfb6f3615623.js
pragma: no-cache
cookie: category_history=WzJd; buid=1e23fd5c-432d-4808-9322-016b93ba71f1
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: travel.blogmura.com
referer: https://travel.blogmura.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 27 Sep 2021 01:52:27 GMT
etag: "1a9f7c8f8970b6cfb8f8dfb6f3615623"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000 ; includeSubDomains
accept-ranges: bytes
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
content-length: 4381
x-xss-protection: 1; mode=block

GET
H2 200 suggestion-11553013c7091e15d81d25d0465ef781.js Show response
travel.blogmura.com/js/normal/ 19 KB
19 KB 501ms
500ms Script
application/javascript 52.197.159.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://travel.blogmura.com/js/normal/suggestion-11553013c7091e15d81d25d0465ef781.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.197.159.16 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-197-159-16.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

75d2b14fa9b435eae2866a1ae70d6f208a27b93c91fd843f2798d0ec7a897b2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

:path: /js/normal/suggestion-11553013c7091e15d81d25d0465ef781.js
pragma: no-cache
cookie: category_history=WzJd; buid=1e23fd5c-432d-4808-9322-016b93ba71f1
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: travel.blogmura.com
referer: https://travel.blogmura.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 27 Sep 2021 01:52:27 GMT
etag: "11553013c7091e15d81d25d0465ef781"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000 ; includeSubDomains
accept-ranges: bytes
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
content-length: 19309
x-xss-protection: 1; mode=block

GET
H2 200 topic-c52acb282ccec4a59c73cf3fba403323.js Show response
travel.blogmura.com/js/normal/ 2 KB
2 KB 506ms
505ms Script
application/javascript 52.197.159.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://travel.blogmura.com/js/normal/topic-c52acb282ccec4a59c73cf3fba403323.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.197.159.16 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-197-159-16.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

029d7c2f3eaa98901f8697ae3d16869f6b7ec06175b0837a1f822b270c11cca6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

:path: /js/normal/topic-c52acb282ccec4a59c73cf3fba403323.js
pragma: no-cache
cookie: category_history=WzJd; buid=1e23fd5c-432d-4808-9322-016b93ba71f1
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: travel.blogmura.com
referer: https://travel.blogmura.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 27 Sep 2021 01:52:27 GMT
etag: "c52acb282ccec4a59c73cf3fba403323"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000 ; includeSubDomains
accept-ranges: bytes
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
content-length: 1976
x-xss-protection: 1; mode=block

GET
H2 200 follow-4bc04956bf927dbecd1033481ff5da9b.js Show response
travel.blogmura.com/js/normal/ 4 KB
4 KB 505ms
504ms Script
application/javascript 52.197.159.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://travel.blogmura.com/js/normal/follow-4bc04956bf927dbecd1033481ff5da9b.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.197.159.16 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-197-159-16.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

c0d4016131d2c3a2687d331da824d0b214f0d8549bcee7f13d0fbcca0be001a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

:path: /js/normal/follow-4bc04956bf927dbecd1033481ff5da9b.js
pragma: no-cache
cookie: category_history=WzJd; buid=1e23fd5c-432d-4808-9322-016b93ba71f1
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: travel.blogmura.com
referer: https://travel.blogmura.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 27 Sep 2021 01:52:27 GMT
etag: "4bc04956bf927dbecd1033481ff5da9b"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000 ; includeSubDomains
accept-ranges: bytes
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
content-length: 4235
x-xss-protection: 1; mode=block

GET
H2 200 point-b2151d6804dffdae9b272522a3f32167.js Show response
travel.blogmura.com/js/common/ 1 KB
2 KB 505ms
505ms Script
application/javascript 52.197.159.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://travel.blogmura.com/js/common/point-b2151d6804dffdae9b272522a3f32167.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.197.159.16 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-197-159-16.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

d80e5a27d9ac575966b4f76b9a7f25a6a42525a3aa22d6ef615ea6757f06d8d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

:path: /js/common/point-b2151d6804dffdae9b272522a3f32167.js
pragma: no-cache
cookie: category_history=WzJd; buid=1e23fd5c-432d-4808-9322-016b93ba71f1
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: travel.blogmura.com
referer: https://travel.blogmura.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 27 Sep 2021 01:52:27 GMT
etag: "b2151d6804dffdae9b272522a3f32167"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000 ; includeSubDomains
accept-ranges: bytes
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
content-length: 1396
x-xss-protection: 1; mode=block

GET
H2 200 flux_blogmura_TM_AT.min.js Show response
flux-cdn.com/client/murauchi/ 242 KB
69 KB 60ms
20ms Script
application/x-javascript 13.225.78.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-105.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 34d083791d7368c3d71e9e8e3a13c8675bae0ceeb93e21f26fbc65566ceb873b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
content-encoding: br
last-modified: Fri, 17 Sep 2021 09:44:22 GMT
server: AmazonS3
x-edge-origin-shield-skipped: 0
etag: W/"43c87f5449fc222a3654a4bf0a1e543b"
x-cache: Hit from cloudfront
content-type: application/x-javascript
via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: 1hO9XLuDq4RWoHCk7q97pzodYLcfbIg-LMF4CSBd61_MQWS_4Mx-ew==

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 73 KB
26 KB 46ms
24ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29e98b5129841e60ea479aa1a5ac0509c39db46d406e2791929b0c29652c5ec8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "999 / 663 of 1000 / last-modified: 1632522815"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25703
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 27 Sep 2021 05:44:52 GMT

GET
H2 200 logo-blogmura-4737f9f7c5bcc50beaa0e095bb60d960.svg
static.blogmura.com/image/ 8 KB
8 KB 10ms
4ms Image
image/svg+xml 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.blogmura.com/image/logo-blogmura-4737f9f7c5bcc50beaa0e095bb60d960.svg

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

c3500bba21c3c28cb4f7c369a722162be0a0a6d0de9670e8556cc04ca4e1fee2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 20:54:14 GMT
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 5043038
x-cache: Hit from cloudfront
content-length: 7701
x-xss-protection: 1; mode=block
last-modified: Fri, 30 Jul 2021 00:51:42 GMT
x-frame-options: DENY
etag: "4737f9f7c5bcc50beaa0e095bb60d960"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: image/svg+xml
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: 1wMAQIJutgQFp5NoxwZB3T1z5HT1qrfQiBh3dXvKKoh5UWXTx5L5cg==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 29ms
6ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-1238852-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 3172
date: Mon, 27 Sep 2021 04:52:00 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Mon, 27 Sep 2021 06:52:00 GMT

GET
H2 200 p.css
p.typekit.net/ 5 B
162 B 82ms
7ms Stylesheet
text/css 2a02:26f0:6c00:2ae::19fd
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p.typekit.net/p.css?s=1&k=uvq4qfx&ht=tk&f=10881.10882.10884.10885.10875.32265&a=26101760&app=typekit&e=css
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/uvq4qfx.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2ae::19fd Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://use.typekit.net/uvq4qfx.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
last-modified: Thu, 05 Nov 2020 13:49:42 GMT
server: nginx
etag: "5fa402f6-5"
content-type: text/css
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 5

GET
H2 200 100x100
img.blogmura.com/profiles/10995793/789449/crop/ 3 KB
3 KB 69ms
21ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10995793/789449/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 7f8ccd57f5507bb840f699c85816c2e95cf5cad498277c3b3595c12ecd77e1c0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 02:43:36 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 05 May 2019 23:21:45 GMT
server: nginx/1.18.0
age: 10876
etag: W/"e2391b250bebddae71eac45e0ca38812"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3099
x-amz-cf-id: Y0l0nvUJIMgL3Qs1krpe92LO5esd0fizcvyIpFTS-kmDS361FWAJkQ==

GET
H2 200 no-image-user-9684e228a9723aed84f40c967c79fb3c.png
static.blogmura.com/image/ 3 KB
3 KB 16ms
8ms Image
image/png 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.blogmura.com/image/no-image-user-9684e228a9723aed84f40c967c79fb3c.png

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

83a94030961677a0a2b2250fdcc0aa3335a9b32d3a153eb7b96381ddba8a5c97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 21:05:13 GMT
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 2623179
x-cache: Hit from cloudfront
content-length: 3124
x-xss-protection: 1; mode=block
last-modified: Fri, 27 Aug 2021 00:51:47 GMT
x-frame-options: DENY
etag: "9684e228a9723aed84f40c967c79fb3c"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: KY9SuRKU-Og-sK1YF0wrDmL3KohczT21hufJ52MpVBpXz51MtpY5mg==

GET
H2 200 100x100
img.blogmura.com/profiles/11028985/820915/crop/ 10 KB
10 KB 65ms
18ms Image
image/png 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/11028985/820915/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 681a982a4f972a2e385b4ec3275d5cd71f746da9e5cc410f444bf87ecb269a0b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 02:43:36 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 06 Dec 2019 16:08:49 GMT
server: nginx/1.18.0
age: 10876
etag: W/"1be98c725f3dbf8e5815e62b2b84e24a"
x-edge-origin-shield-skipped: 0
content-type: image/png
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 9873
x-amz-cf-id: TTCXWu4WynX_VLY4REMqO-O7xT_6jDHl5L-0KXJ9wQVAaoq1XmW8Vg==

GET
H2 200 100x100
img.blogmura.com/profiles/10980044/785496/crop/ 3 KB
4 KB 58ms
11ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10980044/785496/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 336f38e0bf5c6a09bc87994985a6f06efca8db064a3d74a5cbd0c4fae700bc17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 22:34:21 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 12 Apr 2019 08:50:50 GMT
server: nginx/1.18.0
age: 6419430
etag: W/"eee27308e3df8ef3d25ae0c4cc44ae24"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3506
x-amz-cf-id: GtTW6ryL4SsuTNiDObB_oxwp0XTWB4dRSu9TMRW4mpCxnwH0Adx5EQ==

GET
H2 200 100x100
img.blogmura.com/profiles/11056856/846497/crop/ 18 KB
18 KB 64ms
17ms Image
image/png 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/11056856/846497/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: bc08d28ef394d4641699220a4d6a42fa36a5e591aed7fe415c615b4cec9d2e68

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 06:06:18 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 18 May 2020 04:33:08 GMT
server: nginx/1.18.0
age: 171514
etag: W/"220312e5384d42e7ae95a1c818e30ae7"
x-edge-origin-shield-skipped: 0
content-type: image/png
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 18168
x-amz-cf-id: v0I0b0jPtOudvomBWjzT3swL1RUT5VIjfiBiJuqFZdqsRroulFyQRw==

GET
H2 200 100x100
img.blogmura.com/profiles/10945217/740832/crop/ 4 KB
4 KB 59ms
12ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10945217/740832/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 6d32824b4a515d641b110606fc2866b3f2fdd5524ed0afb9e2a8db8cb6f4963c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 15:18:18 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 09:29:16 GMT
server: nginx/1.18.0
age: 9296793
etag: W/"84293fdd50d4687c4452972683e20a46"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4118
x-amz-cf-id: gLuvfeKbQIlE_tBHpRZQnWN-OKUYyT9I8BU4s0tvFVoiTL1btCa5dQ==

GET
H2 200 100x100
img.blogmura.com/profiles/10860474/687533/crop/ 3 KB
3 KB 59ms
12ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10860474/687533/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: c7a2608dda9dcde27bbeaab4c83f62aebaa9dc177a80f196b8ef69d3093aba49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 20 Apr 2021 15:11:23 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 08:54:12 GMT
server: nginx/1.18.0
age: 13790009
etag: W/"542fff35b8506d4dd68ec431b12e3800"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3029
x-amz-cf-id: kGkEahH00uB0UX3tPqyHBI7xs0k6R-OJJk1-854gDgwOrNxCMGapTg==

GET
H2 200 100x100
img.blogmura.com/profiles/10271186/252711/crop/ 3 KB
3 KB 17ms
11ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10271186/252711/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: e8e13448f5b022cb52a77b16adc59bc1ec343114fb4cfd021b420282a34a02f3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 12 Feb 2021 02:40:45 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 06:51:52 GMT
server: nginx/1.18.0
age: 19623847
etag: W/"ffebf895920d78acff1b8ff74ee945f1"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3008
x-amz-cf-id: ce-jfbY4yXPqKO_y8eUAcCazXaFcW9CEMwhDVs_J-LGbcHW5TCkXWw==

GET
H2 200 100x100
img.blogmura.com/profiles/11058207/847853/crop/ 4 KB
4 KB 18ms
12ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/11058207/847853/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 54f352a85d9a18429bb9ffa604105f3af5a93d85d67808262a9c6bea07a8aff9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 13 Feb 2021 16:26:55 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 24 May 2020 23:52:21 GMT
server: nginx/1.18.0
age: 19487877
etag: W/"4d474818773b28e1fe3f2ea0fcecc592"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3779
x-amz-cf-id: lAMDsTD4xYxm0B1y8DWuqDe9aZKJFadpaivRWRmbRdscOWaSeCc4ng==

GET
H2 200 100x100
img.blogmura.com/profiles/10977619/772341/crop/ 4 KB
4 KB 18ms
11ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10977619/772341/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 0d3089e145416f6e67e6bfddb044321217264b2094b63522bc1287064a1d2898

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 08:38:00 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 09:30:54 GMT
server: nginx/1.18.0
age: 19948012
etag: W/"37f704b4fd59f2bedfe840a0f8593a77"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4134
x-amz-cf-id: ieko9tJoplQR8i04JMZCO2cYpHK3fVZTW6oGUP7VKvqCa4oNnOHb5Q==

GET
H2 200 100x100
img.blogmura.com/profiles/10577221/830354/crop/ 3 KB
3 KB 19ms
13ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10577221/830354/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 9ebc377aef385c5a49ff596aaa3d8d8e91f625a3b8f04191261951e068a2ba5b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 17:58:04 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sat, 08 Feb 2020 11:10:21 GMT
server: nginx/1.18.0
age: 2116007
etag: W/"a7b5fa7ba7d32d79615b9f7bb9b3db3b"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3107
x-amz-cf-id: ykZKmIby-yWdafm6v_Q0gu4VXBrt442P_tWqzHe1RvHMMeFRvNa0iw==

GET
H2 200 100x100
img.blogmura.com/profiles/10460250/411388/crop/ 3 KB
3 KB 20ms
14ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10460250/411388/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 750acddf56e4bdf40e043a20de719bb288da41951899eef6931eb496271b8af2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 31 Jan 2021 08:55:38 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 07:32:20 GMT
server: nginx/1.18.0
age: 20638154
etag: W/"62e32d5f4bfe9f9b6229764ff36dac88"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3149
x-amz-cf-id: srQLdXzYAEEfbaGlG7VHmLWPfFSxegxfuQqnH47s5OnzHu-JaFGk0Q==

GET
H2 200 100x100
img.blogmura.com/profiles/10556209/483233/crop/ 3 KB
3 KB 19ms
13ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10556209/483233/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: f5c39ffe8b8da7a27f776d8fc5e7f6f7d0da0056b3a8217fdfd1ace39d1c83ab

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 26 Mar 2021 00:07:54 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 07:49:39 GMT
server: nginx/1.18.0
age: 16004218
etag: W/"c05cefe9923a3a4d6f023cdce68c58a3"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2833
x-amz-cf-id: rVxzC87NRtN_zZ7PWblOY9XwrSVMGJKQEl2P0QEboWNAjsYupQ2BBw==

GET
H2 200 no-image-33bfeb78dffd04a06b7428ecd1949c35.png
static.blogmura.com/image/ 3 KB
3 KB 13ms
7ms Image
image/png 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.blogmura.com/image/no-image-33bfeb78dffd04a06b7428ecd1949c35.png

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-197-159-16.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

c8f731cca0be608a29a7a7c03403a5964e364074c5e78ac3bbc50d335d061d5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 23:43:33 GMT
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 2095279
x-cache: Hit from cloudfront
content-length: 2807
x-xss-protection: 1; mode=block
last-modified: Thu, 02 Sep 2021 01:06:51 GMT
x-frame-options: DENY
etag: "33bfeb78dffd04a06b7428ecd1949c35"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: xh-ZRvYG-tLCiTnEJRAHvOjAPcPOWYEOuNcIn5jsIsiU0T6v1WGCaQ==

GET
H2 200 100x100
img.blogmura.com/sites/1074694/post-images/35639433/crop/ 3 KB
3 KB 20ms
14ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1074694/post-images/35639433/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 9678565af897cb04958d11e6fec82b26c4e800d871ab317c19c4383aa9791654

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 14:26:24 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sat, 25 Sep 2021 14:25:33 GMT
server: nginx/1.18.0
age: 141508
etag: W/"4b31aad1f7289f83556d2abcc3f67682"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2766
x-amz-cf-id: 1crdwZ5tSgC0nJFn4uouF-g1lxUHWB44twPcYn-UxD9gs8LEvsYhQw==
expires: Sun, 25 Sep 2022 14:25:32 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1015122/post-images/35651326/crop/ 3 KB
3 KB 21ms
15ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1015122/post-images/35651326/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: c2b71aafe697dbaae7a0414f55cdff3fcb9bdf058702413806e9d20a165578a8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 01:39:28 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 26 Sep 2021 01:12:15 GMT
server: nginx/1.18.0
age: 101124
etag: W/"c3cd080b7dec111988e70270a766c16a"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3004
x-amz-cf-id: 81MHLdDt5hQ4sFaJamtJm6eRO1GOuo4MWfLKvUJ07W7UXKwVO-5cvw==
expires: Mon, 26 Sep 2022 01:12:14 GMT

GET
H2 200 100x100
img.blogmura.com/sites/754250/post-images/35643926/crop/ 11 KB
11 KB 21ms
15ms Image
image/gif 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/754250/post-images/35643926/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: c2ee1f6afb99e37e676d1d511d42a62a5ef5f76fa694369fd61ebd5d5b640754

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 20:01:30 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sat, 25 Sep 2021 18:50:30 GMT
server: nginx/1.18.0
age: 121402
etag: W/"b1be511a4592d48b4352db55f9f6dd4f"
x-edge-origin-shield-skipped: 0
content-type: image/gif
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 11026
x-amz-cf-id: cOoAgjgfUK9F3YTANnHjdA5tyU1yXz6YGKJJoB2n6oSLkRvLwJBhfA==
expires: Sun, 25 Sep 2022 18:50:29 GMT

GET
H2 200 100x100
img.blogmura.com/sites/115213/post-images/1492653/crop/ 3 KB
3 KB 21ms
15ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/115213/post-images/1492653/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 386f1d88212deac1018d753143dcbaef51b13c10e1a8af2b571cf285575e0259

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 16:23:27 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Tue, 15 Jan 2019 22:21:41 GMT
server: nginx/1.18.0
age: 48084
etag: W/"5e5b36db3e28ebd0bc3f4759b963f5c1"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2589
x-amz-cf-id: jBogwEbAJfpMXniSo0JKHyUqcbjyXbew9QEzVZ3hOQiIu0KfT2pyiA==

GET
H2 200 100x100
img.blogmura.com/sites/918622/post-images/35641441/crop/ 3 KB
3 KB 22ms
16ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/918622/post-images/35641441/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: e601d1e7ce0a9878635b6e9c295b9069ca6d0c8339f509eb8043a62ad9defa71

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 15:51:06 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sat, 25 Sep 2021 15:48:04 GMT
server: nginx/1.18.0
age: 136426
etag: W/"38cd7fcd6f18c47c2a50c64a65a4d3dd"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2787
x-amz-cf-id: 3C3dJK07KbCRElKCnch3ugJ2cQQ3s7XkkbCAr77A0pPO8fqwwl1ojQ==
expires: Sun, 25 Sep 2022 15:48:03 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1056113/post-images/35634400/crop/ 4 KB
5 KB 22ms
16ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1056113/post-images/35634400/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 429355efc8a38d2e438a26bd5b4857c19e3f48d2ab31585edf96e0ae5c78172a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 22:21:34 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sat, 25 Sep 2021 11:01:24 GMT
server: nginx/1.18.0
age: 112998
etag: W/"749c28a0f7fc13f519af51fa13e52e3f"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4415
x-amz-cf-id: Y0Qms76kBYsk8cSyHQblNTuUNh55GD6r7JHijqwxT4v2vxd32BZOtg==
expires: Sun, 25 Sep 2022 11:01:23 GMT

GET
H2 200 100x100
img.blogmura.com/sites/104679/post-images/35642352/crop/ 4 KB
4 KB 44ms
38ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/104679/post-images/35642352/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 78f46b578deb2bc407216e5fea7cbfb88c3440a6fd8834bd8dffcf0903857c88

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 13:36:04 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sat, 25 Sep 2021 16:41:13 GMT
server: nginx/1.18.0
age: 58128
etag: W/"ec574f278da4fd7d6631893146f7e6b8"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3728
x-amz-cf-id: KXTsggJQS6rdFVln7vyewvhqsM3MKEKZ8MlGDifrj5HPzBgJ9w3FkQ==
expires: Sun, 25 Sep 2022 16:41:12 GMT

GET
H2 200 100x100
img.blogmura.com/themes/15835/7062/crop/ 12 KB
12 KB 328ms
322ms Image
image/gif 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/themes/15835/7062/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: dc5e18eb199ea78a4fbb825d3c61a5047d561e5bf1238819b794786efce29b3c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 09:40:08 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"d35f0cf30551b6a20326d7608a066385"
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 11808
x-amz-cf-id: xUGFmQsgdefRD8o3O_ZG4EsKqZ2z-s3Oj933Fl-4aUDAWL-szqsZcw==

GET
H2 200 100x100
img.blogmura.com/themes/15837/7064/crop/ 2 KB
3 KB 769ms
764ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/themes/15837/7064/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 79428656a19d2a3e6684b730a257720d5cee990a2ed99f223444626e5613ab79

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 09:40:08 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"d9ddb3e6c5fae1c74b7f98a8b446af3c"
x-cache: Miss from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2320
x-amz-cf-id: zJRbtdpK2llUapPuwCRQMElsxcJ6qOBSricC2CtY4aZ-QEe4Z7n-xA==

GET
H2 200 100x100
img.blogmura.com/themes/15909/7091/crop/ 3 KB
4 KB 790ms
784ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/themes/15909/7091/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 658ec96b919fef6ff0a6ccd7d61939cf0e56e16cd017fec381d07bc13f666b9c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 09:40:08 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"98e4c3c34c8c0dfc62cd18b2ea6c6c74"
x-cache: Miss from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3305
x-amz-cf-id: UNKfKdteCKl97xQqgzJw5fCYFpIB6dfVi__x9BHClNRhhYU6pJP4tg==

GET
H2 200 100x100
img.blogmura.com/themes/15951/7100/crop/ 13 KB
13 KB 774ms
769ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/themes/15951/7100/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 4cf3f2e820782c21933416d9259294f10d086d328d94895965257298a3e0007f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 09:40:08 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: "f7db5722fe663782cd033dce82b045d5"
x-cache: Miss from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 13164
x-amz-cf-id: 6UDSVPaLMPhcgD4uG4dpxhuW20alwIbih5EYiz0jklyPQAi3BlGg-g==

GET
H2 200 100x100
img.blogmura.com/themes/15954/7104/crop/ 2 KB
3 KB 47ms
42ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/themes/15954/7104/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 82de31010bcd7f2e2fc0a7fa547dde1e72a81eedda1a43308044e73f8fb9578d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 15:38:54 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 09:40:08 GMT
server: nginx/1.18.0
age: 396358
etag: W/"9b8d3c2435608215b756047d014bcb3d"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2534
x-amz-cf-id: 1DwQ1tgIRTS9ytVAKBuQ_eDAePwwi7uci07XuiMEVvovkvdteM9mVA==

GET
H2 200 100x100
img.blogmura.com/themes/16013/7137/crop/ 4 KB
5 KB 47ms
41ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/themes/16013/7137/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 1912155cddde9d62a166a59ebe0bab576509c26f43fa99dba9cd314d943bd089

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 06:21:56 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 09:40:08 GMT
server: nginx/1.18.0
age: 602576
etag: W/"a804886964cf3c6cba6815127363fe57"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4296
x-amz-cf-id: fJMucLBg2if_x9td52j-JAOmiAHZ9l-3D6vfA4FYQSSulIdEWRfdjQ==

GET
H2 200 100x100
img.blogmura.com/sites/1165747/post-images/35688984/crop/ 3 KB
4 KB 785ms
780ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1165747/post-images/35688984/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: ec994744f1744e5d421e6cf44ab26f0b777e2ab8ecf9acd04a646062cdd7fa78

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:41:43 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"1b775abef82be10dbdb3bec6996e93be"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3181
x-amz-cf-id: 9YBInOPWe0lP7mGlY3VmUOwoKpgj8psrRgX05L7pMq8JmYMTm0qzfQ==
expires: Tue, 27 Sep 2022 05:41:42 GMT

GET
H2 200 100x100
img.blogmura.com/sites/428925/post-images/35688910/crop/ 3 KB
4 KB 802ms
796ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/428925/post-images/35688910/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: b7e3d0fcde40107c0c64fcb36beda9a716ae103a10d4882d200e17b045b76673

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:37:39 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"eb6d17ca3dc8c51f6beaedba799cd0a1"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3300
x-amz-cf-id: bGkM9RGfIt_iWzBmIAUEKpyKbrcUoqwTGeAIpjzdeFKb7Iejmdx1Jg==
expires: Tue, 27 Sep 2022 05:37:38 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1166088/post-images/35688891/crop/ 4 KB
4 KB 48ms
42ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1166088/post-images/35688891/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 79450781bb9885046f2852d4640d4efc6ee6bc9d8e20ac570ffd1f942d6dc329

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:36:57 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:36:07 GMT
server: nginx/1.18.0
age: 475
etag: W/"a98ec4a569e9949259acbd10e17d21ed"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4088
x-amz-cf-id: 0cgDIz5DZqlalvylcgk7EFVbo3H-62a5Pk5EUeIR1CB2K1_pDyUDCA==
expires: Tue, 27 Sep 2022 05:36:06 GMT

GET
H2 200 100x100
img.blogmura.com/sites/421131/post-images/35688754/crop/ 3 KB
3 KB 907ms
901ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/421131/post-images/35688754/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 48d7e8a845cb8ff1dd693c19143c84bdf494ecfa88209bcd3e02315bbe7df55f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:30:32 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"4041401c6d51ffbc18e7045c76406890"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3052
x-amz-cf-id: 1VLnJe0truAUKwQt4YgSg3J6M8OQUE7P8E2bxcafIVWw84X3s1_ErQ==
expires: Tue, 27 Sep 2022 05:30:31 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1113949/post-images/35688730/crop/ 3 KB
4 KB 823ms
818ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1113949/post-images/35688730/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: f3c062339b5bb64c7ba968bf0da8273cf9a131edbd1a635d6087b17d813b6745

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:29:08 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"1f2b7ce711ab4399c693587a5de0781d"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3294
x-amz-cf-id: zwUNiGWpYGdVi6OerfV7v8VqJECZtRwQMjG2uikNFibBOp-VDOCRWw==
expires: Tue, 27 Sep 2022 05:29:07 GMT

GET
H2 200 100x100
img.blogmura.com/profiles/11119185/905136/crop/ 10 KB
10 KB 45ms
40ms Image
image/png 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/11119185/905136/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 804d1318847c0fee40bc7c71a1cf6e25bcd555f90eacb68e3274b07a93f23a02

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 22:01:57 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 26 Sep 2021 21:06:46 GMT
server: nginx/1.18.0
age: 27775
etag: W/"59a74488348368b5329af3b125880155"
x-edge-origin-shield-skipped: 0
content-type: image/png
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 10000
x-amz-cf-id: SVGbzdTMh3G7urnT1YBxRq0ralf7s1MnrWGWGhsuO1DYw2bhJZ_R5g==

GET
H2 200 100x100
img.blogmura.com/profiles/11119129/905100/crop/ 4 KB
4 KB 46ms
40ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/11119129/905100/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: c40886ffb9fc0e61ae89452a411159b172abd5b62b17baf08deb4e4d41369a62

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 10:36:25 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 26 Sep 2021 09:48:04 GMT
server: nginx/1.18.0
age: 68907
etag: W/"5c88b0b9ea02cb0d8f4eaecfec71fae2"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3635
x-amz-cf-id: m4j1n8LIvjNsVBNmee2Eqc9xsyS8OdPMEnCUrU_n2G46_-hLC8mFjg==

GET
H2 200 100x100
img.blogmura.com/themes/21225/9623/crop/ 4 KB
5 KB 322ms
317ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/themes/21225/9623/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 7ab1eb562ecf12e1b95eacad5dd421d1e7e60a7949288df6df70530ccc89058d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 09:40:20 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"6643d17b2e3b3b7f1ce20bd91cdabbb2"
x-cache: Miss from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4387
x-amz-cf-id: y0dKZJZHoHwn3Ftqzcw6U9XvT1rJbPzpEWsbTh_gwigrQXgmHzFnpw==

GET
H2 200 100x100
img.blogmura.com/themes/21384/9690/crop/ 2 KB
3 KB 62ms
57ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/themes/21384/9690/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: aaad866a53e628cf4131fb017b669265d00215edc16d55924edb2e32db426646

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 20:10:47 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 09:40:20 GMT
server: nginx/1.18.0
age: 120845
etag: W/"431ff660767fbdda346e22403ac1bccc"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2294
x-amz-cf-id: ABCOYSoctwrTWAY5cVsSwsfWWqZ4QxHm6qKivTcDO0Uv6RUlk3JSFQ==

GET
H2 200 100x100
img.blogmura.com/themes/21393/9692/crop/ 4 KB
4 KB 307ms
301ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/themes/21393/9692/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 51200a3f60ad2d8ea659bac4f45765c449865c876a1ebcbc7414c81f716956bb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 09:40:20 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"d2faefd179d9b1e066828ebaf479b135"
x-cache: Miss from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3869
x-amz-cf-id: zJBA5Hz8UeGO6uaDKMPtnASfaMTGGdlLWQfV11L_rn7iNmJHa2VVIA==

GET
H2 200 100x100
img.blogmura.com/themes/21537/9766/crop/ 1 KB
2 KB 786ms
781ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/themes/21537/9766/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: cd5d74fd2bace7746524322583c2cfbab3cc43eb87ed46cebbde276babb84132

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 09:40:21 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"778c9dae1ebdd49b8710bb33608dc6ea"
x-cache: Miss from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 1535
x-amz-cf-id: hsBZbDmTYQvQHTWze4PiGe5yvIgFCb9ALvuuK5qu4lfRWXnsFOlCYQ==

GET
H2 200 100x100
img.blogmura.com/themes/21560/24222/crop/ 3 KB
4 KB 47ms
42ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/themes/21560/24222/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: a9d9af0d28f9b60f13d83a7bb89dc94c01ca1421c4d1a69277b508e6aa40014c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 10:55:36 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 21 Sep 2020 22:17:08 GMT
server: nginx/1.18.0
age: 67755
etag: W/"e6e6946bfd22167b694cb98cea3bbc8c"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3512
x-amz-cf-id: rQ0a0lsupUDfzBxOxcVYmSIeJYbeuxTmcd2ROh32MTIgeZaZlU2b4g==

GET
H2 200 100x100
img.blogmura.com/themes/21575/9780/crop/ 3 KB
3 KB 46ms
41ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/themes/21575/9780/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: fecbe7660d6037b46ac33242fd6d2ef18b883306584489b84a1de0cc8af3a616

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 10:55:36 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 09:40:21 GMT
server: nginx/1.18.0
age: 67756
etag: W/"4fc11af34f7e1f6aac1a33892593e9f7"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3097
x-amz-cf-id: j_OQ24MJRylHpJq0rSq497b3ok6Ybr1PLiXCEh2HbMFJE3i0yw2mhg==

GET
H2 200 100x100
img.blogmura.com/sites/1170453/post-images/35688610/crop/ 3 KB
4 KB 795ms
790ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1170453/post-images/35688610/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: df34123ddcb2c9931302dbc5db25f0e63e9581037cef9109f3c9186163023e22

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:21:27 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"2bc78f3ee090da4a526b802203170ae5"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3316
x-amz-cf-id: C5ZUCPo4ieVtQtnKDbQiIke8EGw7sSNxUvVPVjUsFe8zK7h6m0yk3Q==
expires: Tue, 27 Sep 2022 05:21:26 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1107728/post-images/35688574/crop/ 3 KB
3 KB 766ms
761ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1107728/post-images/35688574/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: bac4f704198a922748e0404c03c291c5411a99a60d4da3109703ddfb7ad81c9e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:19:04 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"dbc2dd756e9196f4f7e0606220bb7e84"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2783
x-amz-cf-id: LMOKRimgShQ9PSZlP4zUSJX0w2JLPWJjrEVf7vPYKKGBHkZr67F1CQ==
expires: Tue, 27 Sep 2022 05:19:03 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1147157/post-images/35688475/crop/ 4 KB
4 KB 863ms
858ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1147157/post-images/35688475/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 3973422c656716436cec70e12ec942fcdd24eb19b860b8d746e25b07a2052421

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:13:58 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"42acb82b96a5d71ed3dfadece70b5d1e"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3807
x-amz-cf-id: NdiCXAvZK3kMkgyXJw_hy98nsyQXcs-2-jJHwgiMjq2Mmk6rftHFow==
expires: Tue, 27 Sep 2022 05:13:57 GMT

GET
H2 200 100x100
img.blogmura.com/sites/424085/post-images/35688456/crop/ 4 KB
5 KB 870ms
864ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/424085/post-images/35688456/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: fe3f103c64b64117d1a761cd1b909562eb9f70a741e1d68ae127cb5006da9f73

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:12:36 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"d244a8d2e0d30f8eefde418340588841"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4425
x-amz-cf-id: 2Ipr_DHhOo3YnTLOgIW3g1Zw-7rPeN1GxUVwT1Xc4i6lwnE-4cXEvQ==
expires: Tue, 27 Sep 2022 05:12:35 GMT

GET
H2 200 100x100
img.blogmura.com/sites/252325/post-images/35688674/crop/ 3 KB
4 KB 840ms
834ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/252325/post-images/35688674/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 7b17521ef11c3a69140147d0faad855624e2d23083859b7f70625e192457f60f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:25:14 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"840c8752fc15a1f87c6c6a00e6154460"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3329
x-amz-cf-id: yb4o2WiHH3MixcEP4MFQQ89EhmiScCw0QrVNofxjYyiLu6E3At0_IQ==
expires: Tue, 27 Sep 2022 05:25:13 GMT

GET
H2 200 100x100
img.blogmura.com/sites/802514/post-images/35688229/crop/ 3 KB
4 KB 762ms
757ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/802514/post-images/35688229/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 0e870fa0c0f64957894998d561b4eb394ba57915d025afdeb2a81b336b298dd2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:01:11 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"59b2bc45baad6352dcee476ebeec265c"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3291
x-amz-cf-id: vAO30sdUDkvd5WgGizK91uUtEHplubX0ouW8SlJbYPWFihOD217vFA==
expires: Tue, 27 Sep 2022 05:01:10 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1102793/post-images/35688189/crop/ 3 KB
4 KB 857ms
852ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1102793/post-images/35688189/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: bb76b2d502a5d05e3950cd80edf0c017f30d4f195b848d0fa95a79a71a9b8256

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:59:53 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"a6d2808ecab3840edef30e574e4e00ad"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3404
x-amz-cf-id: eNcT0W_d8Uuiz8xSSzP6OqPKE725S1Z0tN4l8iNKLfaaxqmblnRjcg==
expires: Tue, 27 Sep 2022 04:59:52 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1087554/post-images/35688145/crop/ 3 KB
3 KB 315ms
310ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1087554/post-images/35688145/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 5a56208a6e72f021e68dc0b60f1a1650c4c9d0908a8cc4d2ceabe56224258a1b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:56:59 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"191209543a687d305a7520700db3d8d7"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3151
x-amz-cf-id: lqqsHDnJXxZPWnM_ycSc1GqPkAvTY-MW-3GNO2MlxRzDETOTroMDXg==
expires: Tue, 27 Sep 2022 04:56:58 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1157749/post-images/33791933/crop/ 13 KB
13 KB 850ms
845ms Image
image/png 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1157749/post-images/33791933/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 7c4cafd144456b4a41e17ead610c7a2b1ab19e6423d45bbe81ccaae705a24621

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 26 Jul 2021 23:49:33 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"1e30ca8cf998adacbdc1f10c8f753933"
x-cache: Miss from cloudfront
content-type: image/png
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 12973
x-amz-cf-id: 5DrQ_UxtGOpxTRUx1F4ZU0GWuHInoFRE_2xRrqclezAAZ8vVCnOCqQ==
expires: Tue, 26 Jul 2022 23:49:32 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1058603/post-images/35687861/crop/ 2 KB
3 KB 55ms
50ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1058603/post-images/35687861/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: d24eee66ab7505201f2ef7c2dc76e9611661f7be91f358277ed3da97cf7f4f0f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 04:48:18 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:43:10 GMT
server: nginx/1.18.0
age: 3394
etag: W/"2be27b5161db942fc98b9afdee8a7d85"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2255
x-amz-cf-id: 3iNIoergGuSX_r-AYiRw_ACO7Je9z_YFodQmUy2lbVuuvgnQjYRPzA==
expires: Tue, 27 Sep 2022 04:43:09 GMT

GET
H2 200 100x100
img.blogmura.com/sites/103563/post-images/35687846/crop/ 2 KB
2 KB 48ms
43ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/103563/post-images/35687846/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 101cfda33f7075f6cfa0ba697cfb76b053c55a239f59b9aae8115fb0bedbc70a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 04:48:18 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:42:20 GMT
server: nginx/1.18.0
age: 3394
etag: W/"3c726e8f99c1ffc7169177f7f676a44c"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 1861
x-amz-cf-id: a6Y13I_u3hbyiKojBLCr65i4rszpegSHqQs8xqN2cfoS9dGrKoeRgQ==
expires: Tue, 27 Sep 2022 04:42:19 GMT

GET
H2 200 100x100
img.blogmura.com/sites/774189/post-images/35687762/crop/ 4 KB
5 KB 900ms
895ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/774189/post-images/35687762/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 68a0bb77da509fa30bf8031355035722858eadf0315cfcbc2c77b741c4c90af8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:37:22 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"21e6f25e41110d4a06eda13402720431"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4555
x-amz-cf-id: kaVIQALs1y3lYbz6GYyxDjPY21hREMJ1AZnk8JzWQYtEEyEjEPb6PA==
expires: Tue, 27 Sep 2022 04:37:21 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1119179/post-images/20884202/crop/ 4 KB
4 KB 776ms
771ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1119179/post-images/20884202/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 1bf23e50293086615a8a8a3d1bf63d9c1e255bec49d4f3b3806b08b9acd2a3bf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Tue, 07 Jul 2020 05:17:20 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"9cabdbeb09e5c4cea9dd23d409406000"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3771
x-amz-cf-id: o1pvvxmCNg90pBx6cTtadi4B2NERN-HsayYo-5Wu_DXCU3vnTp3Oxg==
expires: Wed, 07 Jul 2021 05:17:19 GMT

GET
H2 200 100x100
img.blogmura.com/sites/901563/post-images/35687622/crop/ 4 KB
4 KB 1005ms
1000ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/901563/post-images/35687622/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: bf6f3cdc6f09980b862d299feecb04ba5d62b710568b4003584275afd8ff4ad5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:30:52 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"d5b95529597b8ce235b56b4deac790db"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3650
x-amz-cf-id: 6TJzC4szob2nOYHruDNwVSt5x1EiW4sNZ4fUt_-OpKSuZdvOaWjsfw==
expires: Tue, 27 Sep 2022 04:30:51 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1082837/post-images/35687529/crop/ 4 KB
5 KB 786ms
781ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1082837/post-images/35687529/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: b3075463a5782fe236f7b49fd0441b1fa30ecba4c3c83506c63e970283587c51

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:25:27 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"d8a51872b84ab7b0326021855e84c3da"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4323
x-amz-cf-id: js7xj5WNE-3j4IUNCmqMd1goQ9s5xtq_Fw4-6RLdvM5nNbRswrLRrw==
expires: Tue, 27 Sep 2022 04:25:26 GMT

GET
H2 200 100x100
img.blogmura.com/sites/697236/post-images/35687770/crop/ 4 KB
4 KB 982ms
977ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/697236/post-images/35687770/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 336a0ffd8dffe52899aa53bfffb39d077edabf63df5e7f2a999d347b08d66284

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:37:35 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"58ffdc5c0c8bc7cc5d0e995bd0faa4ba"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3800
x-amz-cf-id: hjO3y_jSX-5X-yguiV4jmcd0MO4Xfd5AHoHej9MynfUSs3pbh2SGmw==
expires: Tue, 27 Sep 2022 04:37:34 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1005825/post-images/35687414/crop/ 4 KB
5 KB 966ms
961ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1005825/post-images/35687414/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 212348dc35ff63f303e5a0add51e3efbf08caabb0c4192cd0bf635473bd324f8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:21:19 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"5d12bf41833d3a4f74de64f87b5de719"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4560
x-amz-cf-id: A7sFgm7QEEktnXipoBmWGAkWFryJ1ds-PgMSw7yBlUfyyJAW3OWAyg==
expires: Tue, 27 Sep 2022 04:21:18 GMT

GET
H2 200 100x100
img.blogmura.com/sites/21056/post-images/35687403/crop/ 5 KB
5 KB 871ms
866ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/21056/post-images/35687403/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: c1d3724238516e81061871a10a862efadd171111abb78c3e493b64aa40b38b9a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:20:50 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"c25de36b7c63e981a20e6fed5c87aee7"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4695
x-amz-cf-id: jkSbYFCJBd_zDg4cwG5e8aBNx7dhB9CoB9uo6w6nKzBoo06Df61ltQ==
expires: Tue, 27 Sep 2022 04:20:49 GMT

GET
H2 200 100x100
img.blogmura.com/sites/391504/post-images/35687946/crop/ 4 KB
4 KB 891ms
886ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/391504/post-images/35687946/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 2befcf0a56bc567c3f074b4c7c28683b129e95c5e1924bf3454e2ab238498800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:47:25 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"44f5fa063379790aa8b9347a12120de9"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3676
x-amz-cf-id: pEgWXyXo4HCJWp_yPM3YWaRm9p8XYTDRx6AjEfJ5x4cF7WivGwKmiA==
expires: Tue, 27 Sep 2022 04:47:24 GMT

GET
H2 200 100x100
img.blogmura.com/sites/546160/post-images/35687321/crop/ 3 KB
4 KB 966ms
961ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/546160/post-images/35687321/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 19e91600415df3b81f94b7b99c2ca2180383c5afaba6a0d889934631cdac49ed

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:14:39 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"be37e4789b3432c0d93d2cd480568666"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3518
x-amz-cf-id: A7NhOg0yrvbZACDSh6HZEaZO8NRmeVkYRpa7SvS27lhbx5dSMZk_uw==
expires: Tue, 27 Sep 2022 04:14:38 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1038729/post-images/35687551/crop/ 3 KB
3 KB 61ms
56ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1038729/post-images/35687551/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 9e6c102c56b1233f3a7f70678798cf1f1fd1626f3c8c9cf3b6cffb5f49502d77

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 04:50:22 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:26:55 GMT
server: nginx/1.18.0
age: 3270
etag: W/"61ee4ebacdd7b5a4af34d40cea9bd614"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2857
x-amz-cf-id: WTEZndk_jl7Do-wzs2RD1Sdw0zOpz9FoVIRW2uQ6fHqQU61xY9_H_A==
expires: Tue, 27 Sep 2022 04:26:54 GMT

GET
H2 200 100x100
img.blogmura.com/sites/377603/post-images/35688671/crop/ 3 KB
4 KB 810ms
805ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/377603/post-images/35688671/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: ecf98148f7ed556b00355ccb5f58885a8c029ba4fa0db0dae5c3db92dfbbb6ea

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:25:12 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"9d3a555769ba2ba252e0245317b7a486"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3528
x-amz-cf-id: vcTr3ER8yoSz3aK45-MY9AVE0wI3dlFKOQqELmVEXwNxrKG_88MXfg==
expires: Tue, 27 Sep 2022 05:25:11 GMT

GET
H2 200 100x100
img.blogmura.com/profiles/10754358/620639/crop/ 4 KB
4 KB 50ms
45ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10754358/620639/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 444e8a305f4706d70316986c624be8553e0dc227f638a4d2a886ca7e6594a00a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 14:29:55 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 08:36:43 GMT
server: nginx/1.18.0
age: 1264497
etag: W/"090aa928f55436dcb71ed287f4db5855"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3938
x-amz-cf-id: LziRZIKBp-SAeUWrA3l2VFBuA37lbGtFKzJR3naBZ_1lwVCqBpDfCg==

GET
H2 200 100x100
img.blogmura.com/profiles/10471369/419898/crop/ 3 KB
3 KB 49ms
44ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10471369/419898/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 3577d3d38fca81de62aaf2b45d26af0582bcd7c0a1ad1dfc19830a5b66c19b78

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:34:50 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 07:32:50 GMT
server: nginx/1.18.0
age: 20146202
etag: W/"7168b5ee5c2acad5067e4ed631c9b661"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2583
x-amz-cf-id: 5PukZCDJ6dcEAEQ1YxJc9FnxfHqsrQcxXSmrvVpFHDt_16fkMgryyw==

GET
H2 200 100x100
img.blogmura.com/profiles/10424413/382496/crop/ 2 KB
3 KB 49ms
44ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10424413/382496/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: fa0bd5e2ab181db9d54ae7166bff1c80b19a49160eac7d299004c14b46c8228a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 03:10:32 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 07:30:27 GMT
server: nginx/1.18.0
age: 20313260
etag: W/"88fc0cfa2a07dff01bc51f7353c87cd7"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2543
x-amz-cf-id: TupWvYOPjtWc0LpE-MKWXvsAaXRTCsJa-c4lP4rasUQcPUiFoeOKVg==

GET
H2 200 100x100
img.blogmura.com/profiles/10429712/386903/crop/ 3 KB
3 KB 51ms
46ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10429712/386903/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: a088fd82b4fe29c5bd6249b457d211c5824cfdecee82f4eb68da767c24aa2e2e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 01 Jul 2021 04:36:56 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 07:30:46 GMT
server: nginx/1.18.0
age: 7607276
etag: W/"6d6913dbd0321d962f23e90b04a6401e"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3108
x-amz-cf-id: uIliPgk_FPX0RJR3sO3GIewqgYHVdjeK7LL0ID9tDESq0JiaXg3_6A==

GET
H2 200 100x100
img.blogmura.com/profiles/10510549/449860/crop/ 4 KB
4 KB 50ms
45ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10510549/449860/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: df6f863a28ac1100349d342101f5ef3b59a35490d25ad849222c65a1b73cf90d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 01 Sep 2021 14:45:21 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 07:47:36 GMT
server: nginx/1.18.0
age: 2213971
etag: W/"c5e94c32b7e1c55a8a176f03192d369d"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4077
x-amz-cf-id: xn2W0OXsJiHXS_26wK2MaeDqBWAJPqXJ_J_OW7-efsCNyf-hr9GhLA==

GET
H2 200 100x100
img.blogmura.com/profiles/10475835/423302/crop/ 3 KB
3 KB 51ms
46ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10475835/423302/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 73562fcbb5fa86eb56f0c54eea3b4d5b495761bacf783c06520430b0eb500e81

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 07:06:10 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 07:33:03 GMT
server: nginx/1.18.0
age: 16756721
etag: W/"062a9261cb3009cbb7f25403aed4b08d"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3168
x-amz-cf-id: pwE-ykcOTV6o5-B15lqZIO9DSUvhUb69C9pVIckPENv83_bwqLmxjg==

GET
H2 200 100x100
img.blogmura.com/profiles/10952310/745402/crop/ 3 KB
3 KB 50ms
46ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10952310/745402/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 30c6591b72473824fc6f37ebac44780741a745236eef5b057a998f639b847759

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 23 Sep 2021 05:06:09 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 09:29:36 GMT
server: nginx/1.18.0
age: 347922
etag: W/"4f3043ee5615954249cc05f008ac6c5f"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2868
x-amz-cf-id: eUQlpfh3vxcpRSfwFwDRr-xWvzXufogh5xJ0EeyEPvn6Dvd06QqUpQ==

GET
H2 200 100x100
img.blogmura.com/profiles/10921911/725166/crop/ 4 KB
4 KB 51ms
47ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10921911/725166/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: de49894eaf8bca430e841ef73508e924f7cfccc95d4e0422ea4cd50996b209c9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 05:48:05 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 09:28:22 GMT
server: nginx/1.18.0
age: 9935806
etag: W/"e8414262974221a8a0a0a02135116be4"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3998
x-amz-cf-id: N8ZN5eaXbLaoGY4qTp6iwYtB45keBUoykdfL4AuULmYer30BFi6Hyw==

GET
H2 200 100x100
img.blogmura.com/profiles/11001496/794512/crop/ 5 KB
5 KB 52ms
47ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/11001496/794512/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: bd1bc33817d3a79aa57692e9348b0c31a5e52b03cb677366e90e24d26f42de8e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 22:02:13 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sat, 08 Jun 2019 06:29:41 GMT
server: nginx/1.18.0
age: 27758
etag: W/"ac5ce4a56d3b99abbf12fa89deb5959a"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4674
x-amz-cf-id: uHAdLJ5JVYnDXBxE67WuNwNKRFFNbDbjF0_c0yj7QPqX7Qbq6MjkTQ==

GET
H2 200 100x100
img.blogmura.com/profiles/10954641/747603/crop/ 3 KB
3 KB 52ms
47ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10954641/747603/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 0edea41c22712c8c6d53ef69c41e18728929ef0440870d4d8239d2ad94c4d673

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 22:02:13 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 09:29:43 GMT
server: nginx/1.18.0
age: 27758
etag: W/"829be78b74c4f4f92f6986d6efabac7b"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3058
x-amz-cf-id: fXaqVJqoPMXiWJkFhecNoqGY1MJ947vt-LxdWlKPzpzczKwWnVgEXw==

GET
H2 200 100x100
img.blogmura.com/profiles/10790059/643780/crop/ 3 KB
3 KB 60ms
56ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10790059/643780/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: c4305a40ac0350100c84eede7e798f40e82aeed9282694f08eebdec02b37dc6d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 02:43:38 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 08:38:48 GMT
server: nginx/1.18.0
age: 10874
etag: W/"32dadeacc11f7fdbad470c59ddae33d5"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3144
x-amz-cf-id: Tm_57A-4EZMrq1Dwya0QG2FP0DD0mRz7XQyzjTU7ILW60pOWZXohcQ==

GET
H2 200 100x100
img.blogmura.com/profiles/11045602/835449/crop/ 25 KB
25 KB 54ms
49ms Image
image/png 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/11045602/835449/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 62ae52dfc3655e8f4f464d3fda5b985f55a5882dc8548f65ec790f09b08c2ad0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 08:53:20 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Thu, 12 Mar 2020 23:59:35 GMT
server: nginx/1.18.0
age: 161492
etag: W/"43931cbcaba530d56f4b41cfdaf79d22"
x-edge-origin-shield-skipped: 0
content-type: image/png
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 25412
x-amz-cf-id: yDTPrHFIqnStDVxbeJHZ4XoQWaBlp1pnvLNNfKF8ZsOKyDUT4mYhzA==

GET
H2 200 100x100
img.blogmura.com/profiles/10693795/579122/crop/ 3 KB
3 KB 52ms
48ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10693795/579122/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 62d610e4707a05de30d9ea92a0abf2233d6e65fdef129fd87dd471c9046c7645

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 22:02:13 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 08:08:07 GMT
server: nginx/1.18.0
age: 27758
etag: W/"4f8601075cce7b37b778de8d5017e12e"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2704
x-amz-cf-id: dah5etl5KMfmaNWfvzCCz-k82rwUEyONsiBv5HYY7-q0juaeWBN0NQ==

GET
H2 200 100x100
img.blogmura.com/profiles/10436523/392506/crop/ 4 KB
4 KB 54ms
49ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10436523/392506/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: b047e3e2971d837aca3a043ebc44fc8ed46dcd46dc15899495fa0e91704c30b8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 22:02:13 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 07:31:08 GMT
server: nginx/1.18.0
age: 27758
etag: W/"c433830e6340e8f55a66677173910ca7"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3931
x-amz-cf-id: t2dAh7QRHBCXo0MJ3XpG8cTO_Nc0V7uo1nzWtIY4kbCIBZfPiTSRYw==

GET
H2 200 100x100
img.blogmura.com/profiles/11076490/873505/crop/ 2 KB
3 KB 55ms
51ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/11076490/873505/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 26361e00afb6e539f7f64cfa2add2990cecd0ada19874349465d882a709220c2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 08:43:19 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 11 Dec 2020 04:52:41 GMT
server: nginx/1.18.0
age: 162093
etag: W/"2cc570d818f0c484c00ded927ee453d3"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2406
x-amz-cf-id: ZDZTCKGBD02HLV3xDqBcDBjqbnax_NBm6Cv1NaSP6iq73qeFvgGsWQ==

GET
H2 200 100x100
img.blogmura.com/profiles/10989526/784097/crop/ 4 KB
5 KB 54ms
50ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10989526/784097/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 2e63854a891f73f7ac36e20c9ee9c0b4c9a849f4cd32843f8cfae4e057c55542

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 23 Sep 2021 06:28:23 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Thu, 04 Apr 2019 12:42:01 GMT
server: nginx/1.18.0
age: 342988
etag: W/"f4350da092a34df1b9d229f29574e0b8"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4291
x-amz-cf-id: IR64zqmUdm5P-nzvcRy56Q5RBkn0OpPJ8r4wX2olDbkWBZ19ARXj4g==

GET
H2 200 100x100
img.blogmura.com/profiles/10646640/546941/crop/ 3 KB
4 KB 54ms
50ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/profiles/10646640/546941/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 3cb7bbe7428d6ac352af9c964d1eacc31e6929f030d2556fea2b329757a45aee

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 22:02:13 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 29 Mar 2019 08:05:47 GMT
server: nginx/1.18.0
age: 27758
etag: W/"5688054d9db7f9caa463b8f029701a2a"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
cache-control: public, max-age=31536000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3512
x-amz-cf-id: G1jQOPnDitM1swi_kEX01v6sR_0YeAJtS9ygBeauGz86zLYM2gUMPA==

GET
H2 200 100x100
img.blogmura.com/sites/1035300/post-images/23915686/crop/ 3 KB
4 KB 938ms
934ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1035300/post-images/23915686/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 7888f04b720abe810f615a53b17eff537d3b09655bfd25251aa0fbb89f1d00d7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 23:01:28 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"be7b6412436d1390dd4dcaa6041bea0b"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3349
x-amz-cf-id: mFfHxWUkNf50xFx8peSx8qOKKmQPbz3MuE6GJmK-fce6aVkFbSgReQ==
expires: Mon, 27 Sep 2021 23:01:27 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1125370/post-images/23920465/crop/ 3 KB
4 KB 1079ms
1075ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1125370/post-images/23920465/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 089ac2c16e638df7f7623b9fbd13601bf2506a8695f40bebf19744f960100766

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 28 Sep 2020 02:10:13 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"60d891f9b13f4c3e9ebfdd66db2e4fe3"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3309
x-amz-cf-id: 7fUPtqTAWdvTM6zrbk4-Nwb6qFcjlpBme_FBWeIo5BSaNWC6ko2IkQ==
expires: Tue, 28 Sep 2021 02:10:12 GMT

GET
H2 200 no-image.png
travel.blogmura.com/image/ 3 KB
3 KB 257ms
256ms Image
image/png 52.197.159.16
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://travel.blogmura.com/image/no-image.png

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.197.159.16 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

c8f731cca0be608a29a7a7c03403a5964e364074c5e78ac3bbc50d335d061d5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

:path: /image/no-image.png
pragma: no-cache
cookie: category_history=WzJd; buid=1e23fd5c-432d-4808-9322-016b93ba71f1
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: travel.blogmura.com
referer: https://travel.blogmura.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 27 Sep 2021 01:52:27 GMT
x-frame-options: DENY
content-type: image/png
cache-control: max-age=31536000
strict-transport-security: max-age=31536000 ; includeSubDomains
accept-ranges: bytes
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
content-length: 2807
x-xss-protection: 1; mode=block

GET
H2 200 000000 Show response
link.blogmura.com/link/c/ Frame 6911 2 B
95 B 784ms
255ms Document
text/html 13.113.155.185
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://link.blogmura.com/link/c/000000?ref=&agent=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/93.0.4577.63%20Safari/537.36&newinp=1&d=1632721492568&uri=https%3A//travel.blogmura.com/
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/js/common/point-b2151d6804dffdae9b272522a3f32167.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.113.155.185 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-113-155-185.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

:method: GET
:authority: link.blogmura.com
:scheme: https
:path: /link/c/000000?ref=&agent=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/93.0.4577.63%20Safari/537.36&newinp=1&d=1632721492568&uri=https%3A//travel.blogmura.com/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
cookie: category_history=WzJd; buid=1e23fd5c-432d-4808-9322-016b93ba71f1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-type: text/html;charset=UTF-8
content-length: 2
cache-control: no-store

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 133 KB
36 KB 82ms
9ms Script
application/javascript 13.224.186.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.186.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-186-4.fra2.r.cloudfront.net
Software: Server /
Resource Hash: 975b62423e82390a1b54f47625f46f5b4451a8ea69945b2e85008a194bb55edd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: 8N42zakBwOFy.ZF9LMqjmgZs3f2_X5lT
content-encoding: gzip
etag: 3900a2c2d757386fb762bfd86288f882
age: 885
x-edge-origin-shield-skipped: 0
x-cache: Hit from cloudfront
server: Server
x-amz-rid: 179W72XQKJQC18TDEN86
date: Mon, 27 Sep 2021 05:30:07 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: rL4Um-qXBH_eYH-fDuowI0wLtYVnr65nE1mfsDxJDVb0pqYo4YBM6g==

GET
H2 200 MaterialIcons-Regular-570eb83859dc23dd0eec423a49e147fe.woff2
travel.blogmura.com/vendor/material-icons/ 43 KB
44 KB 257ms
256ms Font
application/font-woff2 52.197.159.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://travel.blogmura.com/vendor/material-icons/MaterialIcons-Regular-570eb83859dc23dd0eec423a49e147fe.woff2

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/vendor/material-icons/material-icons-c5941eed2e20a509114128aab1e96edf.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.197.159.16 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-197-159-16.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-fetch-mode: cors
origin: https://travel.blogmura.com
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: category_history=WzJd; buid=1e23fd5c-432d-4808-9322-016b93ba71f1
:path: /vendor/material-icons/MaterialIcons-Regular-570eb83859dc23dd0eec423a49e147fe.woff2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept: */*
cache-control: no-cache
:authority: travel.blogmura.com
referer: https://travel.blogmura.com/vendor/material-icons/material-icons-c5941eed2e20a509114128aab1e96edf.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://travel.blogmura.com/vendor/material-icons/material-icons-c5941eed2e20a509114128aab1e96edf.css
Origin: https://travel.blogmura.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
x-content-type-options: nosniff
last-modified: Mon, 27 Sep 2021 01:52:27 GMT
etag: "570eb83859dc23dd0eec423a49e147fe"
x-frame-options: DENY
content-type: application/font-woff2
cache-control: max-age=31536000
strict-transport-security: max-age=31536000 ; includeSubDomains
accept-ranges: bytes
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
content-length: 44300
x-xss-protection: 1; mode=block

GET
H2 200 100x100
img.blogmura.com/sites/1125370/post-images/23920163/crop/ 4 KB
4 KB 1006ms
993ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1125370/post-images/23920163/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 5233734315db798c2ebec717a45645efc974c50ed64f0fb27ec375c36f2e302c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 28 Sep 2020 01:58:41 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"f70bf3c05f24256b1ff72d40f60d9b3d"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3750
x-amz-cf-id: Dm5I0m1iTTlk6PYoc5EMI2ga90Up3SCpmBfSNZDc0tr0EzdNcxLRIA==
expires: Tue, 28 Sep 2021 01:58:40 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1131547/post-images/23897849/crop/ 4 KB
5 KB 775ms
762ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1131547/post-images/23897849/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: eee838e3b38e4f1349df77c497e9d6df5dd831da338730a976a9509357d045b7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 10:52:55 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"244c8d761bdc0aa88f72d3f29488a819"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4424
x-amz-cf-id: h8ekQ9Q4zFIg0pCEYcFMi0o6d5D9GNxvPbOd64rfI8FJlgQdg7QBjA==
expires: Mon, 27 Sep 2021 10:52:54 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1127795/post-images/23924224/crop/ 4 KB
5 KB 1049ms
1036ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1127795/post-images/23924224/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: eadbd1ad9f9dbf59fd0f6e431f8375134ce7f24e3ab651891dd01bbbae031f63

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 28 Sep 2020 04:36:00 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"b7033cc81f41fc97d93bac9f7f47fee4"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4265
x-amz-cf-id: MDgHNsTaHk7tA3-rIPjCrVg-slCReBA1Hr9dflHFCzgVqSg5WYFxhA==
expires: Tue, 28 Sep 2021 04:35:59 GMT

GET
H2 200 100x100
img.blogmura.com/sites/755681/post-images/538739/crop/ 4 KB
5 KB 1026ms
1013ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/755681/post-images/538739/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 13579cf90e2d262676af64ed52a6c839e897e82db428b6185194dedd039d89ab

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Fri, 14 Dec 2018 22:56:39 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"a381a0ee8f844c3b70a59f98fee5730a"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4280
x-amz-cf-id: mwMayckTrpRuSuYgV_jufdRaU07QTNKLXZN_enCUGbcZdnzB7zwCiQ==

GET
H2 200 100x100
img.blogmura.com/sites/1125370/post-images/23920164/crop/ 3 KB
4 KB 1100ms
1087ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1125370/post-images/23920164/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: e87b01203ff9ff925e07cd97b20c2682eba53b8ceacfac5bf76e4ef0188b494d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 28 Sep 2020 01:58:47 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"18fadfce86620a1cd511b2fd7a210dc2"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3448
x-amz-cf-id: y9tAreEhAgZHYQRcrdazGiP1ctGVabXp0wHdha9hOl_O-q8SPNzECg==
expires: Tue, 28 Sep 2021 01:58:46 GMT

GET
H2 200 100x100
img.blogmura.com/sites/623038/post-images/23907131/crop/ 2 KB
3 KB 823ms
810ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/623038/post-images/23907131/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 3535e8f60d9127a846ed7c9fe454277433b6d9d6790440308e08f1726b8e869c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 16:04:59 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"cb57263beccb46ab605ead0eb798337d"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2488
x-amz-cf-id: EdwjVzNG0E0TRSSplFNoGeN6f8ISVDGQs9w9LfslSuFAH4O0owZy-w==
expires: Mon, 27 Sep 2021 16:04:58 GMT

GET
H2 200 100x100
img.blogmura.com/sites/941261/post-images/23889611/crop/ 4 KB
4 KB 1166ms
1154ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/941261/post-images/23889611/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: d2b4bee052471c2acc410e5575be9ec4f9a2490696f18cd87c6b92e6002f3e5b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 05:29:26 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"fcbec6be8e9a3f7f5f6752e216ed2433"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3788
x-amz-cf-id: nJXp6CJvwmkfR_PvVhyF4329AOFFJ6UvkHIjkLP-hHv1agbaTfUt4g==
expires: Mon, 27 Sep 2021 05:29:25 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1113949/post-images/23889609/crop/ 3 KB
4 KB 916ms
903ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1113949/post-images/23889609/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 78c1c5b3d372fe30a3f6c2fe7c754a6a60c06409f3978dcdb4f7a9cf2cd2f667

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 05:29:19 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"f12bec751556bb4abfe5d9debe4fd0cb"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3335
x-amz-cf-id: 4AWfSckHE3jFhPYy8hITIicB009i482MY1GV1DLwvOC7Q2RATnk06A==
expires: Mon, 27 Sep 2021 05:29:18 GMT

GET
H2 200 100x100
img.blogmura.com/sites/431154/post-images/23895955/crop/ 3 KB
4 KB 872ms
859ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/431154/post-images/23895955/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: d3d829fc64ecbfbc3da83c8f5d6125c1af3fb8cb3d87ae94e741430417ab11ba

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 09:54:44 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"9c2ce38da7629632435e4c1278dfd082"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3429
x-amz-cf-id: 8b8DN6Rpr568trwNM82ohy0_l9kJAFmgOeFOo2QvQEdHKbgx-xIUCg==
expires: Mon, 27 Sep 2021 09:54:43 GMT

GET
H2 200 100x100
img.blogmura.com/sites/177388/post-images/23889505/crop/ 3 KB
4 KB 1013ms
1000ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/177388/post-images/23889505/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: f4e369939f363ab57c9adc498a5cba37183f3794d77ad5d682aa3ed919ead708

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 05:25:01 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"67f7758aca9bd082750bd6eba48035ad"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3352
x-amz-cf-id: Q0wh3ih2s5Tm4cngrpMEKyEnWQB4Y-aH1ZPz_iP__5Zv3q6GIeISsg==
expires: Mon, 27 Sep 2021 05:25:00 GMT

GET
H2 200 100x100
img.blogmura.com/sites/921312/post-images/23910513/crop/ 3 KB
4 KB 918ms
905ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/921312/post-images/23910513/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: bcfc42be6fd1409598b2959f548b1e8d5ca6cd55a8a311cfa72e77e0fe8c2616

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 19:12:42 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"4533f3230477c4b60abf6c187098c744"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3334
x-amz-cf-id: 6QPnGP6VoUgeY17UZVy2YZJJAtEdOyqaeG1r3cLJFN851_sUuDoefw==
expires: Mon, 27 Sep 2021 19:12:41 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1067172/post-images/23920508/crop/ 3 KB
4 KB 842ms
829ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1067172/post-images/23920508/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: d0cf6cd97896bfef6ef9b4a98e9c38d9a86046b792a1df9d8b028ab8a240bf71

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 28 Sep 2020 02:12:54 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"09a7a795839be28d1d4518b753cdc7f4"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3206
x-amz-cf-id: RylVD4HQ1Bzp1S-j7do5hrKfmfbmkHb6qL73nDuI8-Q7jExOJ0WbWw==
expires: Tue, 28 Sep 2021 02:12:53 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1101074/post-images/22598874/crop/ 4 KB
5 KB 952ms
939ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1101074/post-images/22598874/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 5b8309e175159ba8d1c219a41024f2f2ebbfab6318541cee3b48f7c250b51218

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sat, 22 Aug 2020 13:48:41 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"35960dc4bfe534584f5e63f8492cc10f"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4491
x-amz-cf-id: 4yTIUehjBF-9ukRapVhvgZjZuS8jPz5RZQblha6w4ju4KTSv706D7w==
expires: Sun, 22 Aug 2021 13:48:40 GMT

GET
H2 200 100x100
img.blogmura.com/sites/690778/post-images/23889574/crop/ 3 KB
3 KB 2141ms
2128ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/690778/post-images/23889574/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 4a83f99e96f80db6c2cde7a4cd4b97a96244c86f7f6036faaba37288440f174a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:54 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 05:28:22 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"9b2aa4531534bb5ae9e5acd5d30a9344"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3072
x-amz-cf-id: 7uQ41ncW8WIQI4FkmqsGl2rqz7MAzayvoqvpvlsFTPPoa6d6cAJbXA==
expires: Mon, 27 Sep 2021 05:28:21 GMT

GET
H2 200 100x100
img.blogmura.com/sites/763996/post-images/23902332/crop/ 3 KB
4 KB 937ms
924ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/763996/post-images/23902332/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 4733a12801fa5adc2b60fd1a12a41acd34cbfba2d257fd3f01f7954a3cee59c4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 13:16:45 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"51c21adb0efd5817b1b64e33ad2c5e4d"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3524
x-amz-cf-id: GpsWVWq_P_GfdNaGo_ATHtJbPC_eNYwsGsbR0D-LmpFxG90nkv6bUA==
expires: Mon, 27 Sep 2021 13:16:44 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1043376/post-images/23889359/crop/ 3 KB
3 KB 793ms
781ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1043376/post-images/23889359/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: ef7cacc44009becfc62fed13e2fce26e1936fbea24821a3041890def379a0655

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 05:18:11 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"098b6c8400f3106656f7e71754e8dece"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3072
x-amz-cf-id: KfgBj-nCbPprWDVBTvFLmFywoj8hGkDZNSpTCjMnF-6Kg3fGKSeYEg==
expires: Mon, 27 Sep 2021 05:18:10 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1063712/post-images/23889467/crop/ 2 KB
3 KB 891ms
878ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1063712/post-images/23889467/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 9bef6aa05f763199d5f44d3419b3e3a27eaa9b5ac9bf7f8dc5a0cc571b20bf46

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 05:23:13 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"1bebe7358d148605292fe2110d7e1b47"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2446
x-amz-cf-id: mlueYX4tfYSBDVt-NJDZdcp9HIxc7NHyAUDCDC0in2qBWnL9X1toNw==
expires: Mon, 27 Sep 2021 05:23:12 GMT

GET
H2 200 100x100
img.blogmura.com/sites/697236/post-images/23889335/crop/ 4 KB
5 KB 1019ms
1007ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/697236/post-images/23889335/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: d27d915a0fc0dadd498d2cf2b5ff5ea50850d6bd713714d48ec4e5501466f854

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 05:17:02 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"04a28fd6384d3f57d3962317a1247cad"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4321
x-amz-cf-id: XnIqqtC0_W0xeOab-rJNbdqK_Uvp1G4Zgp314B1k_abwXnODUWErdA==
expires: Mon, 27 Sep 2021 05:17:01 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1051462/post-images/23889302/crop/ 3 KB
4 KB 1262ms
1250ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1051462/post-images/23889302/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: c02ee783ae016549a80f2a58cf838a90625ea2b32fb098b18db7191577bccb85

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 05:15:23 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"7f65790a5c083339dadd878c16922c23"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3516
x-amz-cf-id: SUsw9jtBEx-ReG_K8pyVTInu_Q7Ihz_V26AfVuejYxOTJPvZSHN2VQ==
expires: Mon, 27 Sep 2021 05:15:22 GMT

GET
H2 200 100x100
img.blogmura.com/sites/198619/post-images/23889756/crop/ 2 KB
3 KB 799ms
788ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/198619/post-images/23889756/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 592113747270be53136ed305a537b3e6d571091cc84554e994c1f250397cc747

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 05:36:27 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"90726b1e380f66df3c3dfbfae7e0a596"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2339
x-amz-cf-id: 9pCTE0A9W1oKajjr_sKR_CZMwC3B0Sb9wk0RkovV1GV-K-CnouUPUw==
expires: Mon, 27 Sep 2021 05:36:26 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1044228/post-images/23889299/crop/ 4 KB
4 KB 1085ms
1073ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1044228/post-images/23889299/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: ae2accc457858d66564713d4a163917d63d52deec70cf63dade38845de69ddeb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 05:15:02 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"8b2475f17b36168b8f9ca08cf142c323"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3701
x-amz-cf-id: uEy5HnF-B6keo3TYTJBscfbDwWjxNtTFkHmPt9zwgKcb6cv2MjXsrg==
expires: Mon, 27 Sep 2021 05:15:01 GMT

GET
H2 200 100x100
img.blogmura.com/sites/1021918/post-images/23907198/crop/ 4 KB
4 KB 840ms
829ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1021918/post-images/23907198/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 67538b8fce9b7a37c5f32eb12f2059727f0ae4b68b9f796aa7dff859e87e80f9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 16:08:09 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"7a695db2ed40e15adb1568d6ca169f25"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3884
x-amz-cf-id: UpIs8dSnmFBK-B1OJvwbOl0Kjl_pWdQnmf2gqpOti6qLTve7mYrkJQ==
expires: Mon, 27 Sep 2021 16:08:08 GMT

GET
H2 200 100x100
img.blogmura.com/sites/291495/post-images/23896624/crop/ 3 KB
3 KB 925ms
914ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/291495/post-images/23896624/crop/100x100
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 4a229220dc36918d34985d688cb06736b390fe58f7c75818d34c067049857117

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Sun, 27 Sep 2020 10:15:10 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"2585d9b17e06e3146f474a061e2a2f8a"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2921
x-amz-cf-id: E4n9hqULtr-etIZ--KFJwGSv0Aw01p9OTAt8yUA5aJ_B17MReUqENQ==
expires: Mon, 27 Sep 2021 10:15:09 GMT

GET
H2 200 banner-reader-cf2e43b37f839a4f0f32f9e3484459f9.png
static.blogmura.com/image/normal/ 20 KB
21 KB 16ms
7ms Image
image/png 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.blogmura.com/image/normal/banner-reader-cf2e43b37f839a4f0f32f9e3484459f9.png

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

54aa72ad7c03b8d65fa94ec48ef9bf8e7550ece2764cdf195a35db427310c3e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 23:59:52 GMT
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 2612700
x-cache: Hit from cloudfront
content-length: 20552
x-xss-protection: 1; mode=block
last-modified: Fri, 27 Aug 2021 00:51:47 GMT
x-frame-options: DENY
etag: "cf2e43b37f839a4f0f32f9e3484459f9"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: uORloERXCRoyE9ZLTeB65M5_DoMFK4uPaidGYB1eyqWj_nlV9zy1jw==

GET
H2 200 rank01-911e8994595f78b8f0c388e3fd554984.svg
static.blogmura.com/image/normal/icon/ 1 KB
2 KB 12ms
9ms Image
image/svg+xml 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.blogmura.com/image/normal/icon/rank01-911e8994595f78b8f0c388e3fd554984.svg

Requested by

Host: static.blogmura.com
URL: https://static.blogmura.com/css/normal/top-fe9419988bab3c106b85f63b72ab8040.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

13304ccc5dda202cde28892fc6845790f04a7a3d04ddf7a730a529f147d60b83

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://static.blogmura.com/css/normal/top-fe9419988bab3c106b85f63b72ab8040.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 22:55:04 GMT
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 9269388
x-cache: Hit from cloudfront
content-length: 1219
x-xss-protection: 1; mode=block
last-modified: Fri, 11 Jun 2021 00:44:08 GMT
x-frame-options: DENY
etag: "911e8994595f78b8f0c388e3fd554984"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: image/svg+xml
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: IRVxoxau6QuiYHZd4N7XQM0Hyv7JyuONo61mWq2XWlXsctNYN1GuaQ==

GET
H2 200 rank02-0c65c2abc69fe0503ba954fb655ac731.svg
static.blogmura.com/image/normal/icon/ 1 KB
2 KB 10ms
8ms Image
image/svg+xml 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.blogmura.com/image/normal/icon/rank02-0c65c2abc69fe0503ba954fb655ac731.svg

Requested by

Host: static.blogmura.com
URL: https://static.blogmura.com/css/normal/top-fe9419988bab3c106b85f63b72ab8040.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

f7ad5437775bd44e8a16b806c8eacf117ec31d55962192f65f43b0ed4c77ccb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://static.blogmura.com/css/normal/top-fe9419988bab3c106b85f63b72ab8040.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 09 Jul 2021 00:49:52 GMT
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 6929700
x-cache: Hit from cloudfront
content-length: 1178
x-xss-protection: 1; mode=block
last-modified: Wed, 07 Jul 2021 00:51:38 GMT
x-frame-options: DENY
etag: "0c65c2abc69fe0503ba954fb655ac731"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: image/svg+xml
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: ma9WRsbEqe7WAd6hB9hmbKFn3kQZcGBhdnoN3cM8nRmGZ0Pf8W6lpw==

GET
H2 200 rank03-609e2a6a6a8d3dc607ab6a84c85e7e92.svg
static.blogmura.com/image/normal/icon/ 1 KB
2 KB 10ms
8ms Image
image/svg+xml 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.blogmura.com/image/normal/icon/rank03-609e2a6a6a8d3dc607ab6a84c85e7e92.svg

Requested by

Host: static.blogmura.com
URL: https://static.blogmura.com/css/normal/top-fe9419988bab3c106b85f63b72ab8040.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

xml.affiliate.rakuten.co.jp

Software

Resource Hash

5769b7afafa616b0e25ceebab74bb92caec43dc99d6664d17a0fdba78ff0825b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://static.blogmura.com/css/normal/top-fe9419988bab3c106b85f63b72ab8040.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 01:00:45 GMT
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 5546647
x-cache: Hit from cloudfront
content-length: 1307
x-xss-protection: 1; mode=block
last-modified: Fri, 23 Jul 2021 00:51:48 GMT
x-frame-options: DENY
etag: "609e2a6a6a8d3dc607ab6a84c85e7e92"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: image/svg+xml
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: l_Blt45mRiq3CLIsBuOFqouR3MP79inR7vmuju2dkCUDe3iioBPYvQ==

GET
H2 200 l
use.typekit.net/af/309dfe/000000000000000000010091/27/ 42 KB
42 KB 25ms
10ms Font
application/font-woff2 2a02:26f0:6c00::210:ba0b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/309dfe/000000000000000000010091/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/uvq4qfx.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00::210:ba0b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 6d4a0784c2c235c723466def715d53fd223024601c3c54bbc3944e27697b8b7d

Request headers

Referer: https://use.typekit.net/uvq4qfx.css
Origin: https://travel.blogmura.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
server: nginx
etag: "e7811049bfa1845589c42f0b31c9740a16cee93a"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 43068

GET
H2 200 l
use.typekit.net/af/9b05f3/000000000000000000013365/27/ 50 KB
51 KB 35ms
19ms Font
application/font-woff2 2a02:26f0:6c00::210:ba0b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/9b05f3/000000000000000000013365/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/uvq4qfx.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00::210:ba0b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 81dc8f18ee8963fb2044f24d94196da40185e1387ccf9cfc46c3183594109868

Request headers

Referer: https://use.typekit.net/uvq4qfx.css
Origin: https://travel.blogmura.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
server: nginx
etag: "22520917f01d8d34c0dcc1417c749962b8a47011"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 51500

GET
H/1.1 200
OK rakuten_widget.js Show response
xml.affiliate.rakuten.co.jp/widget/js/ 21 KB
5 KB 1279ms
243ms Script
application/javascript 133.237.16.123
RAKUTEN Rakuten

General

Check archive.org

Show headers Download Go to

Full URL

https://xml.affiliate.rakuten.co.jp/widget/js/rakuten_widget.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

133.237.16.123 Setagaya-ku, Japan, ASN23820 (RAKUTEN Rakuten,Inc., JP),

Reverse DNS

Software

Apache /

Resource Hash

ee6e89b7e5d992960f9c23b66d139da87d0f308f2582cdf38e54dcf602ad9d4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 05:44:53 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 29 Jun 2021 03:34:02 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 4291
X-XSS-Protection: 1; mode=block

GET
H2 200 logo-blogmura-mono-071447af048315a5affef131b37a4cde.svg
static.blogmura.com/image/ 7 KB
8 KB 9ms
8ms Image
image/svg+xml 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.blogmura.com/image/logo-blogmura-mono-071447af048315a5affef131b37a4cde.svg

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

7ea6ad29a5ab3933731717da8ee76c6ede9b0a7d8616f9e3cbb2c8ac9683a1e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 23:20:46 GMT
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 2960646
x-cache: Hit from cloudfront
content-length: 7347
x-xss-protection: 1; mode=block
last-modified: Mon, 23 Aug 2021 00:50:35 GMT
x-frame-options: DENY
etag: "071447af048315a5affef131b37a4cde"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: image/svg+xml
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: jYompa3ThI37qMXjwYNgMZ1e0CsbHsZQ7132Zza7i2SfPY31sIKU7A==

GET
H2 200 logo-twitter-2d8eb5e342327bf974b8d519780eb0b2.svg
static.blogmura.com/image/ 1 KB
2 KB 9ms
8ms Image
image/svg+xml 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.blogmura.com/image/logo-twitter-2d8eb5e342327bf974b8d519780eb0b2.svg

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

6a0ba7e38b8cce4ac154aedef12a88945ca9dd6eb93b3c50413f9b403d7bbe30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 22 Jul 2021 22:46:11 GMT
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 5727521
x-cache: Hit from cloudfront
content-length: 1127
x-xss-protection: 1; mode=block
last-modified: Wed, 21 Jul 2021 00:52:15 GMT
x-frame-options: DENY
etag: "2d8eb5e342327bf974b8d519780eb0b2"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: image/svg+xml
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: VkJU3tU0FmBAm_wPi8FKHXbwAaIirePas3QwUGzPRm1_YBwyrn1OmQ==

GET
H2 200 logo-facebook-27fe1afc25fac9e584b8cbbbd021e9e0.svg
static.blogmura.com/image/ 685 B
1 KB 9ms
8ms Image
image/svg+xml 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.blogmura.com/image/logo-facebook-27fe1afc25fac9e584b8cbbbd021e9e0.svg

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

fd561ad9cccbb94cb9fa557fbafc08a99314ecb5642a9d0fbceafc270e7ff868

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 00:00:16 GMT
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 3044676
x-cache: Hit from cloudfront
content-length: 685
x-xss-protection: 1; mode=block
last-modified: Sun, 22 Aug 2021 00:52:13 GMT
x-frame-options: DENY
etag: "27fe1afc25fac9e584b8cbbbd021e9e0"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: image/svg+xml
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: _mc7KR63VmFoTj5rAWffokiHaQSyrtudfNb4lZ6oJrkVJvYFOTBD2Q==

GET
H2 200 logo-line-ed6c55e4ac7a34f90d1b63fbd493ac8e.png
static.blogmura.com/image/ 4 KB
4 KB 13ms
11ms Image
image/png 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.blogmura.com/image/logo-line-ed6c55e4ac7a34f90d1b63fbd493ac8e.png

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

69708962d5aa7331fa85da344e8567212f37bf18fc7828743365ccad1490c287

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 23:59:52 GMT
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 2612700
x-cache: Hit from cloudfront
content-length: 3746
x-xss-protection: 1; mode=block
last-modified: Fri, 27 Aug 2021 00:51:47 GMT
x-frame-options: DENY
etag: "ed6c55e4ac7a34f90d1b63fbd493ac8e"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: image/png
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: o8QBzm4b2Z662EGrX9ZmC6fcqi3U63_b-wwF11_mUwohH_NaoNjtLQ==

GET
H2 200 logo-murauchi-mono-3f468abadd422b7f00b4c092f4932ca8.svg
static.blogmura.com/image/ 4 KB
4 KB 12ms
11ms Image
image/svg+xml 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.blogmura.com/image/logo-murauchi-mono-3f468abadd422b7f00b4c092f4932ca8.svg

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

301e700a1f674c884f96d255a44ff98b18ceaa8e467fe64054448d1858072119

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 22 Jul 2021 15:55:50 GMT
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 5752142
x-cache: Hit from cloudfront
content-length: 4001
x-xss-protection: 1; mode=block
last-modified: Wed, 21 Jul 2021 00:52:15 GMT
x-frame-options: DENY
etag: "3f468abadd422b7f00b4c092f4932ca8"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: image/svg+xml
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: ZFBmpJzeQ7Mgu8sbBKkA43z5QkoDFFFoW0hXacs-DDaWXWZFwSA3Cg==

GET
H2 200 logo-inkrich-mono-f7e03ff5e35082df2d7e33bfb572fbad.svg
static.blogmura.com/image/ 815 B
1 KB 10ms
10ms Image
image/svg+xml 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.blogmura.com/image/logo-inkrich-mono-f7e03ff5e35082df2d7e33bfb572fbad.svg

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

2d70789fd33cced1cab8fb52f0c118c346b4723ec1dbc117512c438ab707db52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 23:20:46 GMT
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 2960646
x-cache: Hit from cloudfront
content-length: 815
x-xss-protection: 1; mode=block
last-modified: Mon, 23 Aug 2021 00:50:35 GMT
x-frame-options: DENY
etag: "f7e03ff5e35082df2d7e33bfb572fbad"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: image/svg+xml
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: By19VqNNKzIDpZK2Z90ecT3a_BLSA9wPUmX-5po68I_O-rb5ADqCpA==

GET
H2 200 logo-muragon-mono-99b1af77b3f3a3f43f1e6ec836cf0b50.svg
static.blogmura.com/image/ 3 KB
3 KB 11ms
10ms Image
image/svg+xml 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.blogmura.com/image/logo-muragon-mono-99b1af77b3f3a3f43f1e6ec836cf0b50.svg

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e4e907b43bfdac563caccc3f2cc312a5d10be8d53e9059d3670974275ec7b61b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 22 Jun 2021 00:20:45 GMT
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 8400247
x-cache: Hit from cloudfront
content-length: 2776
x-xss-protection: 1; mode=block
last-modified: Mon, 21 Jun 2021 04:18:50 GMT
x-frame-options: DENY
etag: "99b1af77b3f3a3f43f1e6ec836cf0b50"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: image/svg+xml
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: cll6VjTL0VFwcopZnJznR0E-4DJh_IkLwnbpzUxkXDSK3SMptaHaZg==

GET
H2 200 logo-spolete-mono-ab843e5996db98a347b087f8c3fad984.svg
static.blogmura.com/image/ 6 KB
6 KB 11ms
11ms Image
image/svg+xml 13.224.193.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.blogmura.com/image/logo-spolete-mono-ab843e5996db98a347b087f8c3fad984.svg

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.120 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e94a45589a938438fbc55b2958c6c974bbffa81c8c4517d79808b575f6e953f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 00:50:02 GMT
via: 1.1 0e75d8f2d484ce463fc04f5c422aa179.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 2696090
x-cache: Hit from cloudfront
content-length: 5734
x-xss-protection: 1; mode=block
last-modified: Wed, 25 Aug 2021 00:51:45 GMT
x-frame-options: DENY
etag: "ab843e5996db98a347b087f8c3fad984"
strict-transport-security: max-age=31536000 ; includeSubDomains
content-type: image/svg+xml
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: OZBTOV5PjHBqJ5MTvbuxvMt1nXHNEndt0yl9b9mvPITIBrwweNhW2A==

GET
H2 200 latest.json Show response
currency.prebid.org/ 2 KB
2 KB 59ms
7ms XHR
application/octet-stream 2600:9000:20eb:9000:19:2cf2:a900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://currency.prebid.org/latest.json
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:9000:19:2cf2:a900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a8b3143de04f77d3743ca3d94a0b4c462e9178b2a65ffb119d2d6f88aea95a6a

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 26 Sep 2021 15:07:57 GMT
via: 1.1 5076c8187f430eebe5e26fc594d6125a.cloudfront.net (CloudFront)
vary: Origin
age: 52616
x-edge-origin-shield-skipped: 0
x-cache: Hit from cloudfront
content-length: 1685
last-modified: Sun, 26 Sep 2021 15:00:55 GMT
server: AmazonS3
etag: "3e124f016e9090f18bdcbe6ae6eb70db"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/octet-stream
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: CM-zZU_8u7Az0xF1aTn0X9UT-zM_9m7JWSg-QsEqcXNwEDvH4-i1hw==
expires: Mon, 27 Sep 2021 15:00:52 GMT

GET
H2 200 600x600
img.blogmura.com/sites/1165747/post-images/35688984/crop/ 47 KB
48 KB 1082ms
1080ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1165747/post-images/35688984/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 795ccc6b8cb2a09f295c9818cbfdd948ef651b6636b468c99839771bec5193eb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:41:43 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"1b775abef82be10dbdb3bec6996e93be"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 48584
x-amz-cf-id: lGjELMwxIv92FSshLeQOEiGJ6jAiA8iHd4xePtil9nG8EAlTFNOxyA==
expires: Tue, 27 Sep 2022 05:41:42 GMT

GET
H2 200 600x600
img.blogmura.com/sites/428925/post-images/35688910/crop/ 38 KB
38 KB 1113ms
1109ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/428925/post-images/35688910/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 0c0d668efaefd6c2ca9f5d766c60af98b5a230d5c01c4c15404b99de0410811e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:37:39 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"eb6d17ca3dc8c51f6beaedba799cd0a1"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 38469
x-amz-cf-id: zRVn736rMneklgKg0h2YG7QwxtN9X4grAbVsizk2A08xYBKj9-G3KA==
expires: Tue, 27 Sep 2022 05:37:38 GMT

GET
H2 200 600x600
img.blogmura.com/sites/1166088/post-images/35688891/crop/ 63 KB
63 KB 2382ms
2379ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1166088/post-images/35688891/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 319eb083d9f019724ed4502ef8de05f49cc284f7822e6525b98e4ccccf8e55fd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:54 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:36:07 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"a98ec4a569e9949259acbd10e17d21ed"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 64337
x-amz-cf-id: w1ieYP69QUg6zpCartlDMrUblYGnDsO4i_fBvTUFKGmKKv1vA0BMAA==
expires: Tue, 27 Sep 2022 05:36:06 GMT

GET
H2 200 600x600
img.blogmura.com/sites/421131/post-images/35688754/crop/ 40 KB
40 KB 1275ms
1271ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/421131/post-images/35688754/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 35907c80e69a6c49595c66d05f0b9f8de55ebbd6e1c039e61e83d3036c5a4609

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:30:32 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"4041401c6d51ffbc18e7045c76406890"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 40653
x-amz-cf-id: f5eSF7IJLiVEY8F20soXGGcRNN0i4HdNlQzjyBjCjlHyqs0wp9Yntw==
expires: Tue, 27 Sep 2022 05:30:31 GMT

GET
H2 200 600x600
img.blogmura.com/sites/1113949/post-images/35688730/crop/ 64 KB
65 KB 1190ms
1187ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1113949/post-images/35688730/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: a3b052a94755136b464e50c7bb8d4d89e01a9494da1505f45e144a0c22481c68

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:29:08 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"1f2b7ce711ab4399c693587a5de0781d"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 65741
x-amz-cf-id: Yp5pklfphDup9CUm0zSuXy1iTYySuLnp9yCZInj-DuFhVlnjbaigOw==
expires: Tue, 27 Sep 2022 05:29:07 GMT

GET
H2 200 600x600
img.blogmura.com/sites/1170453/post-images/35688610/crop/ 33 KB
34 KB 1071ms
1068ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1170453/post-images/35688610/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: a8c8793a24e51ce249a9de562e60fd9a8b5f806914a3d0ef3ecbd8949515ac37

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:21:27 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"2bc78f3ee090da4a526b802203170ae5"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 34048
x-amz-cf-id: zfr2fdhGE7iS9TSZuiY11daIp1WgmPun_3tzpDS6-rCTlS5TlK8sow==
expires: Tue, 27 Sep 2022 05:21:26 GMT

GET
H2 200 600x600
img.blogmura.com/sites/1107728/post-images/35688574/crop/ 12 KB
13 KB 945ms
942ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1107728/post-images/35688574/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 1b27880c96b51c908be0c410a3566a03647781b153c0c34747e347662cfa19fe

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:19:04 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: "dbc2dd756e9196f4f7e0606220bb7e84"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 12428
x-amz-cf-id: ZaXyKVxokTw2hL_blfr3ZR4O90YOUCemUMtERCprQQ5KsEyxPB7BaA==
expires: Tue, 27 Sep 2022 05:19:03 GMT

GET
H2 200 600x600
img.blogmura.com/sites/1147157/post-images/35688475/crop/ 60 KB
60 KB 1164ms
1161ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1147157/post-images/35688475/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 42f40cc52ea69947b9b38e75b8afcd1d34bd5c059807bc54d69be87d7fbdd27c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:13:58 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"42acb82b96a5d71ed3dfadece70b5d1e"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 61087
x-amz-cf-id: gPWccGji8Q6PVJu_-tLwCiNKRhSMJB8dy-jjJ61s0ujvndxWuGrO6A==
expires: Tue, 27 Sep 2022 05:13:57 GMT

GET
H2 200 600x600
img.blogmura.com/sites/424085/post-images/35688456/crop/ 82 KB
82 KB 1345ms
1342ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/424085/post-images/35688456/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: a7b8b20b6223c10fc52630ebfd65f7d197c5d453090c648c73da24e293cb9fe2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:12:36 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"d244a8d2e0d30f8eefde418340588841"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 83470
x-amz-cf-id: dS-z3ucocD16jNwH1-GU23kC1wi5Av3vDqBGWH1DEn9KvI-hWU-CaQ==
expires: Tue, 27 Sep 2022 05:12:35 GMT

GET
H2 200 600x600
img.blogmura.com/sites/252325/post-images/35688674/crop/ 43 KB
44 KB 1306ms
1304ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/252325/post-images/35688674/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: d6232e1d22895a618e35c10c6519a191d1fcfb0c6cd79f7903f509ed378bf047

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:25:14 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"840c8752fc15a1f87c6c6a00e6154460"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 44319
x-amz-cf-id: olKL0oA_AjEW6xg55uHPu5aHreUPc58M-4rjeH3xOYxD3Nc_Yd5p5Q==
expires: Tue, 27 Sep 2022 05:25:13 GMT

GET
H2 200 600x600
img.blogmura.com/sites/802514/post-images/35688229/crop/ 37 KB
37 KB 1029ms
1026ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/802514/post-images/35688229/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 789631689b161981bfb3b744e82713d2087656f6a376fc292d627457b803dfd4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 05:01:11 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: "59b2bc45baad6352dcee476ebeec265c"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 37962
x-amz-cf-id: GTWi6FAg7wNgIaUBotuLghKLpJbstiBw7-TSVTluvACbMvxtoazaow==
expires: Tue, 27 Sep 2022 05:01:10 GMT

GET
H2 200 600x600
img.blogmura.com/sites/1102793/post-images/35688189/crop/ 68 KB
69 KB 1225ms
1222ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1102793/post-images/35688189/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: d90efbad3f85435791d8d4e16d70525eab00504afd809f79b91e3fc726278dc8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:59:53 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"a6d2808ecab3840edef30e574e4e00ad"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 69993
x-amz-cf-id: 2i8QTr7zeruOnEklfewkA6C4d0vJfcKl8zF1mtS0xDLQviCRfoFvMw==
expires: Tue, 27 Sep 2022 04:59:52 GMT

GET
H2 200 600x600
img.blogmura.com/sites/1087554/post-images/35688145/crop/ 36 KB
37 KB 1235ms
1233ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1087554/post-images/35688145/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 7a0935bf0cb4eb3ca33e64a86bfdbf46bce3562b4c55802eb22b1fa0753301e0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:56:59 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"191209543a687d305a7520700db3d8d7"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 37269
x-amz-cf-id: aghR11O8rEpL-g9tNbLpOaou0qt_qkacdbdXmPY9Z6I47hTgIvRHKQ==
expires: Tue, 27 Sep 2022 04:56:58 GMT

GET
H2 200 600x600
img.blogmura.com/sites/1157749/post-images/33791933/crop/ 156 KB
156 KB 1237ms
1235ms Image
image/png 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1157749/post-images/33791933/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: d08261c5c729971300719122a3bf62d10ba7a20735c40a83af995bc3e0b1faa1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 26 Jul 2021 23:49:33 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: "1e30ca8cf998adacbdc1f10c8f753933"
x-cache: Miss from cloudfront
content-type: image/png
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 159444
x-amz-cf-id: RTce_a448tbhHY9WQrnPiZm3rL1u6O5v3smxkjSqMspJMqTjvIATeg==
expires: Tue, 26 Jul 2022 23:49:32 GMT

GET
H2 200 600x600
img.blogmura.com/sites/1058603/post-images/35687861/crop/ 32 KB
32 KB 18ms
16ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1058603/post-images/35687861/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 6f4aeca19534598d45f6d7edb63b6a9ddb84c0eb1f7f27443a22a00e091b9b70

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 04:48:18 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:43:10 GMT
server: nginx/1.18.0
age: 3394
etag: W/"2be27b5161db942fc98b9afdee8a7d85"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 32424
x-amz-cf-id: OOzKqHRSgbWjSoDwcOi-HcGlANiylADqC1KU-PLVAY8W9ktcWpUBKA==
expires: Tue, 27 Sep 2022 04:43:09 GMT

GET
H2 200 600x600
img.blogmura.com/sites/103563/post-images/35687846/crop/ 23 KB
23 KB 17ms
16ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/103563/post-images/35687846/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 36125333a65ff70a9f07ab396795f62fb80d0a64afb0587c8730d62c30e6b804

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 04:48:18 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:42:20 GMT
server: nginx/1.18.0
age: 3394
etag: W/"3c726e8f99c1ffc7169177f7f676a44c"
x-edge-origin-shield-skipped: 0
content-type: image/jpeg
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 23185
x-amz-cf-id: 8J9_mBcXAx7BbQTFp-SLwSRwYW-nB4XHOcxWX9fS1PuXp-2kP97GuA==
expires: Tue, 27 Sep 2022 04:42:19 GMT

GET
H2 200 600x600
img.blogmura.com/sites/774189/post-images/35687762/crop/ 109 KB
110 KB 1220ms
1219ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/774189/post-images/35687762/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 699da125d19b696f91682ccb826f2aa3c684b1d020ecb7a90ac3fc59375977ff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 04:37:22 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: W/"21e6f25e41110d4a06eda13402720431"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 111685
x-amz-cf-id: 1XPCmA1hElxF7KUtsE488uVm7kp3sjtIBD9s53FVoGfaBVdNEza_ZA==
expires: Tue, 27 Sep 2022 04:37:21 GMT

GET
H2 200 600x600
img.blogmura.com/sites/1119179/post-images/20884202/crop/ 11 KB
11 KB 837ms
836ms Image
image/jpeg 13.225.78.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.blogmura.com/sites/1119179/post-images/20884202/crop/600x600
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-127.fra2.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: 748abfb4c3d4899bf70717ab7e18c8791b523a0e44abd17190e132ce0fcdb0ba

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
via: 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
last-modified: Tue, 07 Jul 2020 05:17:20 GMT
server: nginx/1.18.0
x-edge-origin-shield-skipped: 0
etag: "9cabdbeb09e5c4cea9dd23d409406000"
x-cache: Miss from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-robots-tag: noindex
content-length: 10788
x-amz-cf-id: VLbQlvc9VNN3lOO6VZXZVh79B925Sm9LdDk7hf4ZA0tFj-XiTzcR-g==
expires: Wed, 07 Jul 2021 05:17:19 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
210 B 15ms
13ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=616908066&t=pageview&_s=1&dl=https%3A%2F%2Ftravel.blogmura.com%2F&ul=en-us&de=UTF-8&dt=%E6%97%85%E8%A1%8C%E3%83%96%E3%83%AD%E3%82%B0%20%E4%BA%BA%E6%B0%97%E3%83%96%E3%83%AD%E3%82%B0%E3%83%A9%E3%83%B3%E3%82%AD%E3%83%B3%E3%82%B0%E3%81%A8%E3%83%96%E3%83%AD%E3%82%B0%E6%A4%9C%E7%B4%A2%20-%20%E3%81%AB%E3%81%BB%E3%82%93%E3%83%96%E3%83%AD%E3%82%B0%E6%9D%91&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=242086598&gjid=11896148&cid=1919064953.1632721493&tid=UA-1238852-1&_gid=1203330722.1632721493&_r=1&gtm=2ou9m0&z=2070641244

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://travel.blogmura.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_2021092201.js Show response
securepubads.g.doubleclick.net/gpt/ 336 KB
118 KB 16ms
16ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a9a466cd927c64b4e9b81e29beec7d80422fb985b26a1ec038abea10c74c1eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 120420
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 08:37:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 27 Sep 2021 05:44:52 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 119 B
128 B 31ms
15ms XHR
application/json 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=travel.blogmura.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a104-75-89-215.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

4d2c963b3c937d556dae8805e85334ec1af871c03bd200ca3862664f7a8ac782

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 05:44:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 103
x-xss-protection: 0
expires: Mon, 27 Sep 2021 05:44:52 GMT

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
336 B 13ms
11ms XHR
text/plain 13.224.186.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3907&u=https%3A%2F%2Ftravel.blogmura.com%2F
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.186.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-186-4.fra2.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 02:43:36 GMT
via: 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
server: Server
age: 10876
x-edge-origin-shield-skipped: 0
access-control-allow-origin: https://travel.blogmura.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: uRawwJIFDrSU9eYGu5pxKkN2o4-GoGKmLmPKemi1AUMSwS3KqJugUQ==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
370 B 45ms
44ms XHR
text/javascript 13.224.186.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=3907&u=https%3A%2F%2Ftravel.blogmura.com%2F&pid=RzMkfBZJF77BG&cb=0&ws=1600x1200&v=7.69.01&t=2000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F4330865%2Fblogmura%2Fbm_PC_Header_Billboard_ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F4330865%2Fblogmura%2Fbm_PC_Footer_Billboard_BTF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22250x250%22%2C%22336x280%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F4330865%2Fblogmura%2Fbm_PC_1st_Rectangle_L_BTF%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22250x250%22%2C%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F4330865%2Fblogmura%2Fbm_PC_1st_Rectangle_R_BTF%22%7D%2C%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22300x250%22%2C%22250x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F4330865%2Fblogmura%2Fbm_PC_2nd_Rectangle_L_BTF%22%7D%2C%7B%22sd%22%3A%225%22%2C%22s%22%3A%5B%22336x280%22%2C%22250x250%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F4330865%2Fblogmura%2Fbm_PC_2nd_Rectangle_R_BTF%22%7D%2C%7B%22sd%22%3A%226%22%2C%22s%22%3A%5B%22300x250%22%2C%22250x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F4330865%2Fblogmura%2Fbm_PC_3rd_Rectangle_L_BTF%22%7D%2C%7B%22sd%22%3A%227%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%2C%22250x250%22%5D%2C%22sn%22%3A%22%2F4330865%2Fblogmura%2Fbm_PC_3rd_Rectangle_R_BTF%22%7D%2C%7B%22sd%22%3A%228%22%2C%22s%22%3A%5B%22250x250%22%2C%22336x280%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F4330865%2Fblogmura%2Fbm_PC_4th_Rectangle_L_BTF%22%7D%2C%7B%22sd%22%3A%229%22%2C%22s%22%3A%5B%22250x250%22%2C%22336x280%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F4330865%2Fblogmura%2Fbm_PC_4th_Rectangle_R_BTF%22%7D%2C%7B%22sd%22%3A%2210%22%2C%22s%22%3A%5B%22300x250%22%2C%22250x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F4330865%2Fblogmura%2Fbm_PC_5th_Rectangle_L_BTF%22%7D%2C%7B%22sd%22%3A%2211%22%2C%22s%22%3A%5B%22300x250%22%2C%22250x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F4330865%2Fblogmura%2Fbm_PC_5th_Rectangle_R_BTF%22%7D%2C%7B%22sd%22%3A%2212%22%2C%22s%22%3A%5B%22300x600%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F4330865%2Fblogmura%2Fbm_PC_Side_Top_Skyscraper_ATF%22%7D%2C%7B%22sd%22%3A%2213%22%2C%22s%22%3A%5B%22300x1050%22%2C%22300x600%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F4330865%2Fblogmura%2Fbm_PC_Side_Bottom_Skyscraper_BTF%22%7D%2C%7B%22sd%22%3A%2214%22%2C%22s%22%3A%5B%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F4330865%2Fblogmura%2Fbm_PC_overlay_banner_ATF%22%7D%5D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.186.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-186-4.fra2.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
via: 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA2-C1
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://travel.blogmura.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: kiB81A9_Z7eP8zCaNdl5SsfBa_hPm5V2Zh_R-6c1sVa7diS-Gwp1zA==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 24ms
8ms XHR
application/javascript 13.224.186.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.186.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-186-4.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: S8kNCKkikutwvs4V44q0sFuZ4JNc9Ate
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 82139
x-edge-origin-shield-skipped: 0
access-control-max-age: 3000
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Tue, 07 Sep 2021 22:15:56 GMT
server: AmazonS3
date: Sun, 26 Sep 2021 06:55:53 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 3aed5a4f89d72775aaf2cc5a5f642386.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: c8vtWGEhbpJ-yf3rhLoqJLbuKffUT5LBII5xkGtQYSxUOojUUo1qqg==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
463 B 42ms
13ms XHR
text/plain 2a00:1450:400c:c08::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-1238852-1&cid=1919064953.1632721493&jid=242086598&gjid=11896148&_gid=1203330722.1632721493&_u=YEBAAUAAAAAAAC~&z=813815676

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 27 Sep 2021 05:44:52 GMT
content-type: text/plain
access-control-allow-origin: https://travel.blogmura.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 50ms
17ms Preflight
application/json 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Ftravel.blogmura.com%2F&domain=travel.blogmura.com&cw=1&lsw=1

Protocol

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://travel.blogmura.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: https://travel.blogmura.com
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1459
date: Mon, 27 Sep 2021 05:44:52 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Ftravel.blogmura.com%2F&domain=travel.blogmura.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=WJGz3Xw5UC9WeGRoeVA2SU8vY05VR0RHMXpTczJwR1dZcnNmTERNc0RBQVVyNHpPNWVlSUdIb1hGdmZtRmZNeW9TaG10UnNXUHNyMlN4WmkwaXMwWTROaWxsTHdhTHR2RGRXY2d6dkhpUm9nWktzZjREWGJIcUZQZkhlSj...

342 B
603 B

47ms
17ms

XHR
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=WJGz3Xw5UC9WeGRoeVA2SU8vY05VR0RHMXpTczJwR1dZcnNmTERNc0RBQVVyNHpPNWVlSUdIb1hGdmZtRmZNeW9TaG10UnNXUHNyMlN4WmkwaXMwWTROaWxsTHdhTHR2RGRXY2d6dkhpUm9nWktzZjREWGJIcUZQZkhlSjZscVozTS96eGNDbEs5b0RPM3pOb2lDMEkwam1WMmFRVFhWWlB6ci85V0hQWDFHL0J6clQ2NWQ0ejFBaG0vck9wcHFHczU4MGR2Znk1L3k4WTZlZ3RHWWxWTG9xOXBUTGd6K2d3NysvNVB6ZHp5THkybjgxS0VxUVNZNG5qQVBFNlAvOXJzZFJUfA&cppv=2

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

b4c071d7f478e0f0ab5aa295075cfa67be087a0ff1d123b32d8084f0eedb65d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Mon, 27 Sep 2021 05:44:52 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2683
expires: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 27 Sep 2021 05:44:52 GMT
location: https://mug.criteo.com/sid?cpp=WJGz3Xw5UC9WeGRoeVA2SU8vY05VR0RHMXpTczJwR1dZcnNmTERNc0RBQVVyNHpPNWVlSUdIb1hGdmZtRmZNeW9TaG10UnNXUHNyMlN4WmkwaXMwWTROaWxsTHdhTHR2RGRXY2d6dkhpUm9nWktzZjREWGJIcUZQZkhlSjZscVozTS96eGNDbEs5b0RPM3pOb2lDMEkwam1WMmFRVFhWWlB6ci85V0hQWDFHL0J6clQ2NWQ0ejFBaG0vck9wcHFHczU4MGR2Znk1L3k4WTZlZ3RHWWxWTG9xOXBUTGd6K2d3NysvNVB6ZHp5THkybjgxS0VxUVNZNG5qQVBFNlAvOXJzZFJUfA&cppv=2
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://travel.blogmura.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2345
content-length: 509
expires: 0

GET
H/1.1 200
OK v1 Show response
d.socdm.com/adsv/ 1 KB
2 KB 740ms
246ms XHR
application/json 124.146.215.46
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.socdm.com/adsv/v1?posall=SSPLOC&id=130391&sdktype=0&hb=true&t=json3&transactionid=ffbab126-d9b7-4ffa-9324-9ea84daebe2a&sizes=728x90%2C970x90%2C970x250&currency=JPY&pbver=4.38.0&sdkname=prebidjs&adapterver=1.0.1&imark=1&tp=https%3A%2F%2Ftravel.blogmura.com%2F
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 124.146.215.46 Toshima, Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 8f647f7b798fbabae18c5c5b628cee18f9fa3963f551f8c38330a483e33e43a9

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 27 Sep 2021 05:44:53 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/adsv\/v1?adapterver=1.0.1&currency=JPY&hb=true&id=130391&imark=1&pbver=4.38.0&posall=SSPLOC&sdkname=prebidjs&sdktype=0&sizes=728x90%2C970x90%2C970x250&t=json3&tp=https%3A%2F%2Ftravel.blogmura.com%2F&transactionid=ffbab126-d9b7-4ffa-9324-9ea84daebe2a","cluster_id":3,"gdpr":true,"ipv4":"0.0.0.0","key":"YVFaVcCo8YEAAFIDcfsAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"a-ad40319"}
X-SO-Key: YVFaVcCo8YEAAFIDcfsAAAAA
X-SO-Upstream-ID: a-ad40319
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: a-ad40319.dc2p.scaleout.jp
Connection: keep-alive
Content-Length: 1102
X-SO-IP: 91.199.118.72
X-SO-Cluster-ID: 3
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://travel.blogmura.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-SO-Ads-Time: 5
X-SO-LB-Hostname: m-tgng29.dc4p.scaleout.jp

GET
H/1.1 200
OK v1 Show response
d.socdm.com/adsv/ 1 KB
2 KB 746ms
248ms XHR
application/json 124.146.215.46
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.socdm.com/adsv/v1?posall=SSPLOC&id=130389&sdktype=0&hb=true&t=json3&transactionid=6fe7617d-f0b7-4afc-9bac-ea3d24284578&sizes=728x90%2C970x90%2C970x250&currency=JPY&pbver=4.38.0&sdkname=prebidjs&adapterver=1.0.1&imark=1&tp=https%3A%2F%2Ftravel.blogmura.com%2F
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 124.146.215.46 Toshima, Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 92a71e69587bb53a287efe41c81c0cd53b7a57e3bc56c47d79f3a600704dfb24

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 27 Sep 2021 05:44:53 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/adsv\/v1?adapterver=1.0.1&currency=JPY&hb=true&id=130389&imark=1&pbver=4.38.0&posall=SSPLOC&sdkname=prebidjs&sdktype=0&sizes=728x90%2C970x90%2C970x250&t=json3&tp=https%3A%2F%2Ftravel.blogmura.com%2F&transactionid=6fe7617d-f0b7-4afc-9bac-ea3d24284578","cluster_id":3,"gdpr":true,"ipv4":"0.0.0.0","key":"YVFaVcCo8YUAALpAVrAAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad323"}
X-SO-Key: YVFaVcCo8YUAALpAVrAAAAAA
X-SO-Upstream-ID: m-ad323
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: m-ad323.dc4p.scaleout.jp
Connection: keep-alive
Content-Length: 1096
X-SO-IP: 91.199.118.72
X-SO-Cluster-ID: 3
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://travel.blogmura.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-SO-Ads-Time: 5
X-SO-LB-Hostname: m-tgng33.dc4p.scaleout.jp

GET
H/1.1 200
OK v1 Show response
d.socdm.com/adsv/ 1 KB
2 KB 755ms
254ms XHR
application/json 124.146.215.46
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.socdm.com/adsv/v1?posall=SSPLOC&id=130376&sdktype=0&hb=true&t=json3&transactionid=7f76d7cb-8c8e-42e4-9163-28c0e5c2cacf&sizes=250x250%2C300x250%2C336x280&currency=JPY&pbver=4.38.0&sdkname=prebidjs&adapterver=1.0.1&imark=1&tp=https%3A%2F%2Ftravel.blogmura.com%2F
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 124.146.215.46 Toshima, Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 6329b099072f46fdbd0ae6e87573a85b34e278737a81446b49c3c18ce11bdfa8

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 27 Sep 2021 05:44:53 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/adsv\/v1?adapterver=1.0.1&currency=JPY&hb=true&id=130376&imark=1&pbver=4.38.0&posall=SSPLOC&sdkname=prebidjs&sdktype=0&sizes=250x250%2C300x250%2C336x280&t=json3&tp=https%3A%2F%2Ftravel.blogmura.com%2F&transactionid=7f76d7cb-8c8e-42e4-9163-28c0e5c2cacf","cluster_id":34,"gdpr":true,"ipv4":"0.0.0.0","key":"YVFaVcCo8XgAAOI-Bj8AAAAA","privacy_sensitive":true,"uid":"","upstream_id":"a-ad40038"}
X-SO-Key: YVFaVcCo8XgAAOI-Bj8AAAAA
X-SO-Upstream-ID: a-ad40038
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: a-ad40038.dc2p.scaleout.jp
Connection: keep-alive
Content-Length: 1102
X-SO-IP: 91.199.118.72
X-SO-Cluster-ID: 34
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://travel.blogmura.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-SO-Ads-Time: 9
X-SO-LB-Hostname: m-tgng20.dc4p.scaleout.jp

GET
H/1.1 200
OK v1 Show response
d.socdm.com/adsv/ 1 KB
2 KB 769ms
255ms XHR
application/json 124.146.215.46
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.socdm.com/adsv/v1?posall=SSPLOC&id=130377&sdktype=0&hb=true&t=json3&transactionid=b04713ce-599c-4bc7-8bbe-96523474296b&sizes=250x250%2C300x250%2C336x280&currency=JPY&pbver=4.38.0&sdkname=prebidjs&adapterver=1.0.1&imark=1&tp=https%3A%2F%2Ftravel.blogmura.com%2F
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 124.146.215.46 Toshima, Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: dab53ce0fee4b4f6062d8851845bf3b976b61e2bb07abbadce6eb4a784ceaf7a

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 27 Sep 2021 05:44:53 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/adsv\/v1?adapterver=1.0.1&currency=JPY&hb=true&id=130377&imark=1&pbver=4.38.0&posall=SSPLOC&sdkname=prebidjs&sdktype=0&sizes=250x250%2C300x250%2C336x280&t=json3&tp=https%3A%2F%2Ftravel.blogmura.com%2F&transactionid=b04713ce-599c-4bc7-8bbe-96523474296b","cluster_id":23,"gdpr":true,"ipv4":"0.0.0.0","key":"YVFaVcCo8YQAAG5SfyIAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad147"}
X-SO-Key: YVFaVcCo8YQAAG5SfyIAAAAA
X-SO-Upstream-ID: m-ad147
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: m-ad147.dc4p.scaleout.jp
Connection: keep-alive
Content-Length: 1096
X-SO-IP: 91.199.118.72
X-SO-Cluster-ID: 23
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://travel.blogmura.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-SO-Ads-Time: 5
X-SO-LB-Hostname: m-tgng32.dc4p.scaleout.jp

GET
H/1.1 200
OK v1 Show response
d.socdm.com/adsv/ 1 KB
2 KB 784ms
265ms XHR
application/json 124.146.215.46
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.socdm.com/adsv/v1?posall=SSPLOC&id=130378&sdktype=0&hb=true&t=json3&transactionid=2bf4f57e-71f5-452e-bcb2-cc1c5296c425&sizes=250x250%2C300x250%2C336x280&currency=JPY&pbver=4.38.0&sdkname=prebidjs&adapterver=1.0.1&imark=1&tp=https%3A%2F%2Ftravel.blogmura.com%2F
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 124.146.215.46 Toshima, Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 76ad927e55f1b60216015f89e3bb470b5462d995e259bc5e58498aacf2145c78

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 27 Sep 2021 05:44:53 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/adsv\/v1?adapterver=1.0.1&currency=JPY&hb=true&id=130378&imark=1&pbver=4.38.0&posall=SSPLOC&sdkname=prebidjs&sdktype=0&sizes=250x250%2C300x250%2C336x280&t=json3&tp=https%3A%2F%2Ftravel.blogmura.com%2F&transactionid=2bf4f57e-71f5-452e-bcb2-cc1c5296c425","cluster_id":55,"gdpr":true,"ipv4":"0.0.0.0","key":"YVFaVcCo8X4AAN7hJDQAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"a-ad40099"}
X-SO-Key: YVFaVcCo8X4AAN7hJDQAAAAA
X-SO-Upstream-ID: a-ad40099
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: a-ad40099.dc2p.scaleout.jp
Connection: keep-alive
Content-Length: 1102
X-SO-IP: 91.199.118.72
X-SO-Cluster-ID: 55
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://travel.blogmura.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-SO-Ads-Time: 12
X-SO-LB-Hostname: m-tgng26.dc4p.scaleout.jp

GET
H/1.1 200
OK v1 Show response
d.socdm.com/adsv/ 1 KB
2 KB 787ms
264ms XHR
application/json 124.146.215.46
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.socdm.com/adsv/v1?posall=SSPLOC&id=130379&sdktype=0&hb=true&t=json3&transactionid=471dfebc-221f-45fb-8555-43715b61f2c1&sizes=250x250%2C300x250%2C336x280&currency=JPY&pbver=4.38.0&sdkname=prebidjs&adapterver=1.0.1&imark=1&tp=https%3A%2F%2Ftravel.blogmura.com%2F
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 124.146.215.46 Toshima, Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 4d8802b96ea1cce55f2d0a000414f37a805ab12fd51603ce6f91ed654271d70b

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 27 Sep 2021 05:44:53 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/adsv\/v1?adapterver=1.0.1&currency=JPY&hb=true&id=130379&imark=1&pbver=4.38.0&posall=SSPLOC&sdkname=prebidjs&sdktype=0&sizes=250x250%2C300x250%2C336x280&t=json3&tp=https%3A%2F%2Ftravel.blogmura.com%2F&transactionid=471dfebc-221f-45fb-8555-43715b61f2c1","cluster_id":5,"gdpr":true,"ipv4":"0.0.0.0","key":"YVFaVcCo8XsAAOTro-MAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"a-ad40167"}
X-SO-Key: YVFaVcCo8XsAAOTro-MAAAAA
X-SO-Upstream-ID: a-ad40167
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: a-ad40167.dc2p.scaleout.jp
Connection: keep-alive
Content-Length: 1102
X-SO-IP: 91.199.118.72
X-SO-Cluster-ID: 5
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://travel.blogmura.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-SO-Ads-Time: 7
X-SO-LB-Hostname: m-tgng23.dc4p.scaleout.jp

GET
H/1.1 200
OK v1 Show response
d.socdm.com/adsv/ 1 KB
2 KB 998ms
258ms XHR
application/json 124.146.215.46
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.socdm.com/adsv/v1?posall=SSPLOC&id=130380&sdktype=0&hb=true&t=json3&transactionid=ee867a82-312f-494c-987a-efbce7554924&sizes=250x250%2C300x250%2C336x280&currency=JPY&pbver=4.38.0&sdkname=prebidjs&adapterver=1.0.1&imark=1&tp=https%3A%2F%2Ftravel.blogmura.com%2F
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 124.146.215.46 Toshima, Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: ef647d5e29c0e443e83924ae412926b88e028eb4b3e3672c78e4045941db249f

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 27 Sep 2021 05:44:53 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/adsv\/v1?adapterver=1.0.1&currency=JPY&hb=true&id=130380&imark=1&pbver=4.38.0&posall=SSPLOC&sdkname=prebidjs&sdktype=0&sizes=250x250%2C300x250%2C336x280&t=json3&tp=https%3A%2F%2Ftravel.blogmura.com%2F&transactionid=ee867a82-312f-494c-987a-efbce7554924","cluster_id":31,"gdpr":true,"ipv4":"0.0.0.0","key":"YVFaVcCo8YEAAFIDcg0AAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad223"}
X-SO-Key: YVFaVcCo8YEAAFIDcg0AAAAA
X-SO-Upstream-ID: m-ad223
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: m-ad223.dc4p.scaleout.jp
Connection: keep-alive
Content-Length: 1096
X-SO-IP: 91.199.118.72
X-SO-Cluster-ID: 31
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://travel.blogmura.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-SO-Ads-Time: 20
X-SO-LB-Hostname: m-tgng29.dc4p.scaleout.jp

GET
H/1.1 200
OK v1 Show response
d.socdm.com/adsv/ 1 KB
2 KB 994ms
249ms XHR
application/json 124.146.215.46
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.socdm.com/adsv/v1?posall=SSPLOC&id=130381&sdktype=0&hb=true&t=json3&transactionid=81a1f946-ea31-4a39-8255-9c0120da09c8&sizes=250x250%2C300x250%2C336x280&currency=JPY&pbver=4.38.0&sdkname=prebidjs&adapterver=1.0.1&imark=1&tp=https%3A%2F%2Ftravel.blogmura.com%2F
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 124.146.215.46 Toshima, Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 9fa21cd426732e27cff5acd988c4130b309029db23cf5d41e438c8688a4902f1

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 27 Sep 2021 05:44:53 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/adsv\/v1?adapterver=1.0.1&currency=JPY&hb=true&id=130381&imark=1&pbver=4.38.0&posall=SSPLOC&sdkname=prebidjs&sdktype=0&sizes=250x250%2C300x250%2C336x280&t=json3&tp=https%3A%2F%2Ftravel.blogmura.com%2F&transactionid=81a1f946-ea31-4a39-8255-9c0120da09c8","cluster_id":6,"gdpr":true,"ipv4":"0.0.0.0","key":"YVFaVcCo8YUAALpAVtwAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"a-ad40126"}
X-SO-Key: YVFaVcCo8YUAALpAVtwAAAAA
X-SO-Upstream-ID: a-ad40126
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: a-ad40126.dc2p.scaleout.jp
Connection: keep-alive
Content-Length: 1102
X-SO-IP: 91.199.118.72
X-SO-Cluster-ID: 6
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://travel.blogmura.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-SO-Ads-Time: 7
X-SO-LB-Hostname: m-tgng33.dc4p.scaleout.jp

GET
H/1.1 200
OK v1 Show response
d.socdm.com/adsv/ 1 KB
2 KB 1006ms
251ms XHR
application/json 124.146.215.46
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.socdm.com/adsv/v1?posall=SSPLOC&id=130382&sdktype=0&hb=true&t=json3&transactionid=e76eb91a-be95-49eb-9506-699e3c0d618c&sizes=250x250%2C300x250%2C336x280&currency=JPY&pbver=4.38.0&sdkname=prebidjs&adapterver=1.0.1&imark=1&tp=https%3A%2F%2Ftravel.blogmura.com%2F
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 124.146.215.46 Toshima, Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 1515dcdf759afc5ea7dd572e264c8a53876b3a938a80d45527d09cd1859afd98

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 27 Sep 2021 05:44:53 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/adsv\/v1?adapterver=1.0.1&currency=JPY&hb=true&id=130382&imark=1&pbver=4.38.0&posall=SSPLOC&sdkname=prebidjs&sdktype=0&sizes=250x250%2C300x250%2C336x280&t=json3&tp=https%3A%2F%2Ftravel.blogmura.com%2F&transactionid=e76eb91a-be95-49eb-9506-699e3c0d618c","cluster_id":58,"gdpr":true,"ipv4":"0.0.0.0","key":"YVFaVcCo8XgAAOI-Bl0AAAAA","privacy_sensitive":true,"uid":"","upstream_id":"a-ad40192"}
X-SO-Key: YVFaVcCo8XgAAOI-Bl0AAAAA
X-SO-Upstream-ID: a-ad40192
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: a-ad40192.dc2p.scaleout.jp
Connection: keep-alive
Content-Length: 1102
X-SO-IP: 91.199.118.72
X-SO-Cluster-ID: 58
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://travel.blogmura.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-SO-Ads-Time: 7
X-SO-LB-Hostname: m-tgng20.dc4p.scaleout.jp

GET
H/1.1 200
OK v1 Show response
d.socdm.com/adsv/ 1 KB
2 KB 1031ms
262ms XHR
application/json 124.146.215.46
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.socdm.com/adsv/v1?posall=SSPLOC&id=130383&sdktype=0&hb=true&t=json3&transactionid=21c4a481-caaa-4623-b63d-e251dd6ca44e&sizes=250x250%2C300x250%2C336x280&currency=JPY&pbver=4.38.0&sdkname=prebidjs&adapterver=1.0.1&imark=1&tp=https%3A%2F%2Ftravel.blogmura.com%2F
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 124.146.215.46 Toshima, Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: c0c49da703e706394770525c49d3e452fb5afc15203190e872d4ac9d2573d6d5

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 27 Sep 2021 05:44:53 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/adsv\/v1?adapterver=1.0.1&currency=JPY&hb=true&id=130383&imark=1&pbver=4.38.0&posall=SSPLOC&sdkname=prebidjs&sdktype=0&sizes=250x250%2C300x250%2C336x280&t=json3&tp=https%3A%2F%2Ftravel.blogmura.com%2F&transactionid=21c4a481-caaa-4623-b63d-e251dd6ca44e","cluster_id":11,"gdpr":true,"ipv4":"0.0.0.0","key":"YVFaVcCo8YQAAG5SfycAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad331"}
X-SO-Key: YVFaVcCo8YQAAG5SfycAAAAA
X-SO-Upstream-ID: m-ad331
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: m-ad331.dc4p.scaleout.jp
Connection: keep-alive
Content-Length: 1096
X-SO-IP: 91.199.118.72
X-SO-Cluster-ID: 11
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://travel.blogmura.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-SO-Ads-Time: 11
X-SO-LB-Hostname: m-tgng32.dc4p.scaleout.jp

GET
H/1.1 200
OK v1 Show response
d.socdm.com/adsv/ 1 KB
2 KB 1038ms
254ms XHR
application/json 124.146.215.46
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.socdm.com/adsv/v1?posall=SSPLOC&id=130384&sdktype=0&hb=true&t=json3&transactionid=93b51314-ac24-4c21-94a0-49a18412364d&sizes=250x250%2C300x250%2C336x280&currency=JPY&pbver=4.38.0&sdkname=prebidjs&adapterver=1.0.1&imark=1&tp=https%3A%2F%2Ftravel.blogmura.com%2F
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 124.146.215.46 Toshima, Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: ff0f9df9eb845323ab649a6906ce842518bb0af7247b49817372497fd3b2c1ad

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 27 Sep 2021 05:44:53 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/adsv\/v1?adapterver=1.0.1&currency=JPY&hb=true&id=130384&imark=1&pbver=4.38.0&posall=SSPLOC&sdkname=prebidjs&sdktype=0&sizes=250x250%2C300x250%2C336x280&t=json3&tp=https%3A%2F%2Ftravel.blogmura.com%2F&transactionid=93b51314-ac24-4c21-94a0-49a18412364d","cluster_id":34,"gdpr":true,"ipv4":"0.0.0.0","key":"YVFaVcCo8X4AAN7hJF8AAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad290"}
X-SO-Key: YVFaVcCo8X4AAN7hJF8AAAAA
X-SO-Upstream-ID: m-ad290
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: m-ad290.dc4p.scaleout.jp
Connection: keep-alive
Content-Length: 1096
X-SO-IP: 91.199.118.72
X-SO-Cluster-ID: 34
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://travel.blogmura.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-SO-Ads-Time: 4
X-SO-LB-Hostname: m-tgng26.dc4p.scaleout.jp

GET
H/1.1 200
OK v1 Show response
d.socdm.com/adsv/ 1 KB
2 KB 1050ms
263ms XHR
application/json 124.146.215.46
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.socdm.com/adsv/v1?posall=SSPLOC&id=130385&sdktype=0&hb=true&t=json3&transactionid=4642a803-c5f9-4ea7-9f04-86b634bec12b&sizes=250x250%2C300x250%2C336x280&currency=JPY&pbver=4.38.0&sdkname=prebidjs&adapterver=1.0.1&imark=1&tp=https%3A%2F%2Ftravel.blogmura.com%2F
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 124.146.215.46 Toshima, Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: f4e416faec9ee9aa543f19fbc06a668883b021680299edc251fd3e3ab30ae3bf

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 27 Sep 2021 05:44:53 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/adsv\/v1?adapterver=1.0.1&currency=JPY&hb=true&id=130385&imark=1&pbver=4.38.0&posall=SSPLOC&sdkname=prebidjs&sdktype=0&sizes=250x250%2C300x250%2C336x280&t=json3&tp=https%3A%2F%2Ftravel.blogmura.com%2F&transactionid=4642a803-c5f9-4ea7-9f04-86b634bec12b","cluster_id":30,"gdpr":true,"ipv4":"0.0.0.0","key":"YVFaVcCo8XsAAOTrpAIAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad350"}
X-SO-Key: YVFaVcCo8XsAAOTrpAIAAAAA
X-SO-Upstream-ID: m-ad350
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: m-ad350.dc4p.scaleout.jp
Connection: keep-alive
Content-Length: 1096
X-SO-IP: 91.199.118.72
X-SO-Cluster-ID: 30
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://travel.blogmura.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-SO-Ads-Time: 4
X-SO-LB-Hostname: m-tgng23.dc4p.scaleout.jp

GET
H/1.1 200
OK v1 Show response
d.socdm.com/adsv/ 1 KB
2 KB 1243ms
249ms XHR
application/json 124.146.215.46
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.socdm.com/adsv/v1?posall=SSPLOC&id=130394&sdktype=0&hb=true&t=json3&transactionid=4c939438-8074-4701-96c2-7becdcf3129c&sizes=300x250%2C300x600&currency=JPY&pbver=4.38.0&sdkname=prebidjs&adapterver=1.0.1&imark=1&tp=https%3A%2F%2Ftravel.blogmura.com%2F
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 124.146.215.46 Toshima, Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: a2705acd9325b30a243397f13d929f70ea47b227e2103410012fb351a52c1114

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 27 Sep 2021 05:44:54 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/adsv\/v1?adapterver=1.0.1&currency=JPY&hb=true&id=130394&imark=1&pbver=4.38.0&posall=SSPLOC&sdkname=prebidjs&sdktype=0&sizes=300x250%2C300x600&t=json3&tp=https%3A%2F%2Ftravel.blogmura.com%2F&transactionid=4c939438-8074-4701-96c2-7becdcf3129c","cluster_id":38,"gdpr":true,"ipv4":"0.0.0.0","key":"YVFaVsCo8YUAALpAVvQAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"a-ad40354"}
X-SO-Key: YVFaVsCo8YUAALpAVvQAAAAA
X-SO-Upstream-ID: a-ad40354
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: a-ad40354.dc2p.scaleout.jp
Connection: keep-alive
Content-Length: 1102
X-SO-IP: 91.199.118.72
X-SO-Cluster-ID: 38
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://travel.blogmura.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-SO-Ads-Time: 7
X-SO-LB-Hostname: m-tgng33.dc4p.scaleout.jp

GET
H/1.1 200
OK v1 Show response
d.socdm.com/adsv/ 1 KB
2 KB 1241ms
244ms XHR
application/json 124.146.215.46
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.socdm.com/adsv/v1?posall=SSPLOC&id=130393&sdktype=0&hb=true&t=json3&transactionid=48a07f19-f8c3-492c-a19a-379e50fcc9b1&sizes=300x250%2C300x600%2C300x1050&currency=JPY&pbver=4.38.0&sdkname=prebidjs&adapterver=1.0.1&imark=1&tp=https%3A%2F%2Ftravel.blogmura.com%2F
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 124.146.215.46 Toshima, Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 0dc312d9b88fa43754ae0459ea27ea4baa7080b8586052653e92c7a4a985c8b6

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 27 Sep 2021 05:44:54 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/adsv\/v1?adapterver=1.0.1&currency=JPY&hb=true&id=130393&imark=1&pbver=4.38.0&posall=SSPLOC&sdkname=prebidjs&sdktype=0&sizes=300x250%2C300x600%2C300x1050&t=json3&tp=https%3A%2F%2Ftravel.blogmura.com%2F&transactionid=48a07f19-f8c3-492c-a19a-379e50fcc9b1","cluster_id":51,"gdpr":true,"ipv4":"0.0.0.0","key":"YVFaVsCo8YEAAFIDciQAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad128"}
X-SO-Key: YVFaVsCo8YEAAFIDciQAAAAA
X-SO-Upstream-ID: m-ad128
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: m-ad128.dc4p.scaleout.jp
Connection: keep-alive
Content-Length: 1096
X-SO-IP: 91.199.118.72
X-SO-Cluster-ID: 51
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://travel.blogmura.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-SO-Ads-Time: 4
X-SO-LB-Hostname: m-tgng29.dc4p.scaleout.jp

GET
H/1.1 200
OK v1 Show response
d.socdm.com/adsv/ 1 KB
2 KB 1302ms
297ms XHR
application/json 124.146.215.46
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.socdm.com/adsv/v1?posall=SSPLOC&id=130392&sdktype=0&hb=true&t=json3&transactionid=e42a34a6-2cc4-4288-8c74-8748451b98d6&sizes=728x90%2C970x90&currency=JPY&pbver=4.38.0&sdkname=prebidjs&adapterver=1.0.1&imark=1&tp=https%3A%2F%2Ftravel.blogmura.com%2F
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 124.146.215.46 Toshima, Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 93036954215768f10a5d8b142ad16922e189b15e7ae349e7038cecc1c11e7650

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 27 Sep 2021 05:44:54 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/adsv\/v1?adapterver=1.0.1&currency=JPY&hb=true&id=130392&imark=1&pbver=4.38.0&posall=SSPLOC&sdkname=prebidjs&sdktype=0&sizes=728x90%2C970x90&t=json3&tp=https%3A%2F%2Ftravel.blogmura.com%2F&transactionid=e42a34a6-2cc4-4288-8c74-8748451b98d6","cluster_id":42,"gdpr":true,"ipv4":"0.0.0.0","key":"YVFaVsCo8XgAAOI-BoUAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad362"}
X-SO-Key: YVFaVsCo8XgAAOI-BoUAAAAA
X-SO-Upstream-ID: m-ad362
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName: m-ad362.dc4p.scaleout.jp
Connection: keep-alive
Content-Length: 1096
X-SO-IP: 91.199.118.72
X-SO-Cluster-ID: 42
Server: nginx
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://travel.blogmura.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-SO-Ads-Time: 54
X-SO-LB-Hostname: m-tgng20.dc4p.scaleout.jp

POST
H2 200 prebid Show response
pb.ladsp.com/adrequest/ 90 B
475 B 783ms
258ms XHR
application/json 52.68.27.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.ladsp.com/adrequest/prebid
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.27.193 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-27-193.ap-northeast-1.compute.amazonaws.com
Software: Logicad/DADServer /
Resource Hash: abad0cadaed2c2e92df5d56d60dcdd21b82343797a43d73af49381aa1abfb047

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
server: Logicad/DADServer
vary: Accept-Encoding, User-Agent
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
access-control-allow-origin: https://travel.blogmura.com
cache-control: private, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 104
expires: -1

POST
H2 200 prebid Show response
pb.ladsp.com/adrequest/ 90 B
475 B 782ms
257ms XHR
application/json 52.68.27.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.ladsp.com/adrequest/prebid
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.27.193 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-27-193.ap-northeast-1.compute.amazonaws.com
Software: Logicad/DADServer /
Resource Hash: abad0cadaed2c2e92df5d56d60dcdd21b82343797a43d73af49381aa1abfb047

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
server: Logicad/DADServer
vary: Accept-Encoding, User-Agent
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
access-control-allow-origin: https://travel.blogmura.com
cache-control: private, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 104
expires: -1

POST
H2 200 prebid Show response
pb.ladsp.com/adrequest/ 90 B
475 B 1019ms
494ms XHR
application/json 52.68.27.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.ladsp.com/adrequest/prebid
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.27.193 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-27-193.ap-northeast-1.compute.amazonaws.com
Software: Logicad/DADServer /
Resource Hash: abad0cadaed2c2e92df5d56d60dcdd21b82343797a43d73af49381aa1abfb047

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
server: Logicad/DADServer
vary: Accept-Encoding, User-Agent
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
access-control-allow-origin: https://travel.blogmura.com
cache-control: private, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 104
expires: -1

POST
H2 200 prebid Show response
pb.ladsp.com/adrequest/ 90 B
476 B 780ms
255ms XHR
application/json 52.68.27.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.ladsp.com/adrequest/prebid
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.27.193 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-27-193.ap-northeast-1.compute.amazonaws.com
Software: Logicad/DADServer /
Resource Hash: abad0cadaed2c2e92df5d56d60dcdd21b82343797a43d73af49381aa1abfb047

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
server: Logicad/DADServer
vary: Accept-Encoding, User-Agent
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
access-control-allow-origin: https://travel.blogmura.com
cache-control: private, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 104
expires: -1

POST
H2 200 prebid Show response
pb.ladsp.com/adrequest/ 90 B
475 B 781ms
257ms XHR
application/json 52.68.27.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.ladsp.com/adrequest/prebid
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.27.193 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-27-193.ap-northeast-1.compute.amazonaws.com
Software: Logicad/DADServer /
Resource Hash: abad0cadaed2c2e92df5d56d60dcdd21b82343797a43d73af49381aa1abfb047

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
server: Logicad/DADServer
vary: Accept-Encoding, User-Agent
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
access-control-allow-origin: https://travel.blogmura.com
cache-control: private, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 104
expires: -1

POST
H2 200 prebid Show response
pb.ladsp.com/adrequest/ 90 B
475 B 1019ms
495ms XHR
application/json 52.68.27.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.ladsp.com/adrequest/prebid
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.27.193 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-27-193.ap-northeast-1.compute.amazonaws.com
Software: Logicad/DADServer /
Resource Hash: abad0cadaed2c2e92df5d56d60dcdd21b82343797a43d73af49381aa1abfb047

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
server: Logicad/DADServer
vary: Accept-Encoding, User-Agent
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
access-control-allow-origin: https://travel.blogmura.com
cache-control: private, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 104
expires: -1

POST
H2 200 prebid Show response
pb.ladsp.com/adrequest/ 90 B
475 B 1017ms
493ms XHR
application/json 52.68.27.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.ladsp.com/adrequest/prebid
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.27.193 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-27-193.ap-northeast-1.compute.amazonaws.com
Software: Logicad/DADServer /
Resource Hash: abad0cadaed2c2e92df5d56d60dcdd21b82343797a43d73af49381aa1abfb047

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
server: Logicad/DADServer
vary: Accept-Encoding, User-Agent
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
access-control-allow-origin: https://travel.blogmura.com
cache-control: private, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 104
expires: -1

POST
H2 200 prebid Show response
pb.ladsp.com/adrequest/ 90 B
475 B 1020ms
496ms XHR
application/json 52.68.27.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.ladsp.com/adrequest/prebid
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.27.193 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-27-193.ap-northeast-1.compute.amazonaws.com
Software: Logicad/DADServer /
Resource Hash: abad0cadaed2c2e92df5d56d60dcdd21b82343797a43d73af49381aa1abfb047

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
server: Logicad/DADServer
vary: Accept-Encoding, User-Agent
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
access-control-allow-origin: https://travel.blogmura.com
cache-control: private, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 104
expires: -1

POST
H2 200 prebid Show response
pb.ladsp.com/adrequest/ 90 B
475 B 1017ms
493ms XHR
application/json 52.68.27.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.ladsp.com/adrequest/prebid
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.27.193 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-27-193.ap-northeast-1.compute.amazonaws.com
Software: Logicad/DADServer /
Resource Hash: abad0cadaed2c2e92df5d56d60dcdd21b82343797a43d73af49381aa1abfb047

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
server: Logicad/DADServer
vary: Accept-Encoding, User-Agent
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
access-control-allow-origin: https://travel.blogmura.com
cache-control: private, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 104
expires: -1

POST
H2 200 prebid Show response
pb.ladsp.com/adrequest/ 90 B
475 B 1017ms
494ms XHR
application/json 52.68.27.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.ladsp.com/adrequest/prebid
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.27.193 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-27-193.ap-northeast-1.compute.amazonaws.com
Software: Logicad/DADServer /
Resource Hash: abad0cadaed2c2e92df5d56d60dcdd21b82343797a43d73af49381aa1abfb047

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
server: Logicad/DADServer
vary: Accept-Encoding, User-Agent
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
access-control-allow-origin: https://travel.blogmura.com
cache-control: private, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 104
expires: -1

POST
H2 200 prebid Show response
pb.ladsp.com/adrequest/ 90 B
475 B 1017ms
493ms XHR
application/json 52.68.27.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.ladsp.com/adrequest/prebid
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.27.193 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-27-193.ap-northeast-1.compute.amazonaws.com
Software: Logicad/DADServer /
Resource Hash: abad0cadaed2c2e92df5d56d60dcdd21b82343797a43d73af49381aa1abfb047

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
server: Logicad/DADServer
vary: Accept-Encoding, User-Agent
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
access-control-allow-origin: https://travel.blogmura.com
cache-control: private, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 104
expires: -1

POST
H2 200 prebid Show response
pb.ladsp.com/adrequest/ 90 B
475 B 1018ms
495ms XHR
application/json 52.68.27.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.ladsp.com/adrequest/prebid
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.27.193 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-27-193.ap-northeast-1.compute.amazonaws.com
Software: Logicad/DADServer /
Resource Hash: abad0cadaed2c2e92df5d56d60dcdd21b82343797a43d73af49381aa1abfb047

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
server: Logicad/DADServer
vary: Accept-Encoding, User-Agent
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
access-control-allow-origin: https://travel.blogmura.com
cache-control: private, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 104
expires: -1

POST
H2 200 prebid Show response
pb.ladsp.com/adrequest/ 90 B
475 B 1015ms
492ms XHR
application/json 52.68.27.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.ladsp.com/adrequest/prebid
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.27.193 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-27-193.ap-northeast-1.compute.amazonaws.com
Software: Logicad/DADServer /
Resource Hash: abad0cadaed2c2e92df5d56d60dcdd21b82343797a43d73af49381aa1abfb047

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
server: Logicad/DADServer
vary: Accept-Encoding, User-Agent
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
access-control-allow-origin: https://travel.blogmura.com
cache-control: private, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 104
expires: -1

POST
H2 200 prebid Show response
pb.ladsp.com/adrequest/ 90 B
475 B 1017ms
495ms XHR
application/json 52.68.27.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.ladsp.com/adrequest/prebid
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.27.193 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-27-193.ap-northeast-1.compute.amazonaws.com
Software: Logicad/DADServer /
Resource Hash: abad0cadaed2c2e92df5d56d60dcdd21b82343797a43d73af49381aa1abfb047

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
server: Logicad/DADServer
vary: Accept-Encoding, User-Agent
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
access-control-allow-origin: https://travel.blogmura.com
cache-control: private, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 104
expires: -1

POST
H2 200 prebid Show response
pb.ladsp.com/adrequest/ 90 B
475 B 1020ms
498ms XHR
application/json 52.68.27.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.ladsp.com/adrequest/prebid
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.27.193 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-27-193.ap-northeast-1.compute.amazonaws.com
Software: Logicad/DADServer /
Resource Hash: abad0cadaed2c2e92df5d56d60dcdd21b82343797a43d73af49381aa1abfb047

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
server: Logicad/DADServer
vary: Accept-Encoding, User-Agent
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
access-control-allow-origin: https://travel.blogmura.com
cache-control: private, no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 104
expires: -1

POST
H2 200 translator Show response
hbopenbid.pubmatic.com/ 4 KB
2 KB 146ms
73ms XHR
application/json 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 1862f6cd11a3edb6d34c1e5ecb020e6c2cbef3e362e8dbb0dd0945138b01a24a

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
content-encoding: gzip
x-openrtb-version: 2.3
content-type: application/json
access-control-allow-origin: https://travel.blogmura.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 1974

POST
H2 204 bids Show response
prebid-asia.creativecdn.com/bidder/prebid/ 0
181 B 497ms
175ms XHR
text/plain 103.132.192.30
RTBHOUSE-AS-AP RT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-asia.creativecdn.com/bidder/prebid/bids
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.132.192.30 , Singapore, ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG),
Reverse DNS: ip-103-132-192-30.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://travel.blogmura.com
date: Mon, 27 Sep 2021 05:44:53 GMT
access-control-allow-credentials: true
access-control-max-age: 3600
vary: Origin
access-control-allow-methods: POST

GET
H2 200 prebid Show response
s-rtb-pb.send.microad.jp/ 47 B
399 B 737ms
236ms XHR
application/json 202.233.84.2
MICROAD MicroAd

General

Check archive.org

Show headers Download Go to

Full URL

https://s-rtb-pb.send.microad.jp/prebid?spot=5ce47f4d3c2d58b62b96d15d4bfce70a&url=https%3A%2F%2Ftravel.blogmura.com%2F&referrer=https%3A%2F%2Ftravel.blogmura.com%2F&bid_id=66320d6206d6d0d&transaction_id=ffbab126-d9b7-4ffa-9324-9ea84daebe2a&media_types=1&cbt=8fffc2b37ee92017c25c8dbe4

Requested by

Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

202.233.84.2 , Japan, ASN131957 (MICROAD MicroAd, Inc., JP),

Reverse DNS

Software

nginx /

Resource Hash

eafb4bf577f5c3be774b5a16fb3729c76c6487f5e210b2a55b962d2acee40638

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
strict-transport-security: max-age=86400
p3p: policyref="http://www.microad.jp/w3c/p3p.xml",CP="NOI DSP COR NID DEVo PSAo OUR STP STA PRE
access-control-allow-origin: https://travel.blogmura.com
access-control-allow-credentials: true
content-type: application/json;charset=UTF-8
x-xss-protection: 1; mode=block

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
288 B 99ms
55ms XHR
application/json 178.250.0.165
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?profileId=207&av=33&wv=4.38.0&cb=33765736449
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: bidder.par.vip.prod.criteo.com
Software: Finatra /
Resource Hash: ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:52 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://travel.blogmura.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 44

GET
H2 200 prebid Show response
ad.as.amanad.adtdp.com/v2/ 69 B
586 B 274ms
238ms XHR
application/json 13.225.78.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.as.amanad.adtdp.com/v2/prebid?asi=gZufFXcGR&skt=5&prebid_id=8477712dcbb149e&prebid_ver=4.38.0&page_url=https%3A%2F%2Ftravel.blogmura.com%2F&
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-42.fra2.r.cloudfront.net
Software: /
Resource Hash: 696f2ae2d6b10bc9948443a31844a85224d226a656529154c28c6df92e8a9fa0

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 92
pragma: no-cache
access-control-allow-origin: https://travel.blogmura.com
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-amz-cf-id: f0lX1O8yf52uqgYBzydGZwSR5x4GY6iDa-nIT1kJ8w6EEMJMo2uc8A==
expires: Thu, 01 Jan 1970 09:00:00 GMT

GET
H2 200 prebid Show response
ad.as.amanad.adtdp.com/v2/ 69 B
587 B 275ms
240ms XHR
application/json 13.225.78.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.as.amanad.adtdp.com/v2/prebid?asi=iIG-KX5MR&skt=5&prebid_id=85a1446f098cea5&prebid_ver=4.38.0&page_url=https%3A%2F%2Ftravel.blogmura.com%2F&
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-42.fra2.r.cloudfront.net
Software: /
Resource Hash: 696f2ae2d6b10bc9948443a31844a85224d226a656529154c28c6df92e8a9fa0

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 92
pragma: no-cache
access-control-allow-origin: https://travel.blogmura.com
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-amz-cf-id: 5QyE2aVRS7F4Ckl5Z5AIWIMMTW-5xblY6sSIMxK5F8NQ6iMiWPz1OQ==
expires: Thu, 01 Jan 1970 09:00:00 GMT

GET
H2 200 prebid Show response
ad.as.amanad.adtdp.com/v2/ 69 B
586 B 274ms
239ms XHR
application/json 13.225.78.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.as.amanad.adtdp.com/v2/prebid?asi=qSNnFX5GR&skt=5&prebid_id=862f4b49f2fcc&prebid_ver=4.38.0&page_url=https%3A%2F%2Ftravel.blogmura.com%2F&
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-42.fra2.r.cloudfront.net
Software: /
Resource Hash: 696f2ae2d6b10bc9948443a31844a85224d226a656529154c28c6df92e8a9fa0

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 92
pragma: no-cache
access-control-allow-origin: https://travel.blogmura.com
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-amz-cf-id: XxsPP5P_FecvwgjnqU3Al6oG2TD3Ut4SSOkTkdTm8zgdDr3tvkU29Q==
expires: Thu, 01 Jan 1970 09:00:00 GMT

GET
H2 200 prebid Show response
ad.as.amanad.adtdp.com/v2/ 69 B
586 B 275ms
239ms XHR
application/json 13.225.78.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.as.amanad.adtdp.com/v2/prebid?asi=pDF4KucMg&skt=5&prebid_id=879d9860272e03a&prebid_ver=4.38.0&page_url=https%3A%2F%2Ftravel.blogmura.com%2F&
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-42.fra2.r.cloudfront.net
Software: /
Resource Hash: 696f2ae2d6b10bc9948443a31844a85224d226a656529154c28c6df92e8a9fa0

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 92
pragma: no-cache
access-control-allow-origin: https://travel.blogmura.com
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-amz-cf-id: HC5XNm_lqsrfZFYt2BXsByDBFtsBc4douH3wL9ojE7zMZ4dODioAwA==
expires: Thu, 01 Jan 1970 09:00:00 GMT

GET
H2 200 prebid Show response
ad.as.amanad.adtdp.com/v2/ 69 B
586 B 501ms
466ms XHR
application/json 13.225.78.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.as.amanad.adtdp.com/v2/prebid?asi=kKBSKXcMg&skt=5&prebid_id=8875a97b8ef4162&prebid_ver=4.38.0&page_url=https%3A%2F%2Ftravel.blogmura.com%2F&
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-42.fra2.r.cloudfront.net
Software: /
Resource Hash: 696f2ae2d6b10bc9948443a31844a85224d226a656529154c28c6df92e8a9fa0

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 92
pragma: no-cache
access-control-allow-origin: https://travel.blogmura.com
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-amz-cf-id: _fe0xMazAhV0f6HKshq3I0dJIVj6Li6FlbV-ynNckRijBI1zzwRVOw==
expires: Thu, 01 Jan 1970 09:00:00 GMT

GET
H2 200 prebid Show response
ad.as.amanad.adtdp.com/v2/ 69 B
585 B 275ms
240ms XHR
application/json 13.225.78.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.as.amanad.adtdp.com/v2/prebid?asi=7UYNKu5Gg&skt=5&prebid_id=89c818d5c5976a9&prebid_ver=4.38.0&page_url=https%3A%2F%2Ftravel.blogmura.com%2F&
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-42.fra2.r.cloudfront.net
Software: /
Resource Hash: 696f2ae2d6b10bc9948443a31844a85224d226a656529154c28c6df92e8a9fa0

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 92
pragma: no-cache
access-control-allow-origin: https://travel.blogmura.com
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-amz-cf-id: i0To4yq1b1GwaezphRoNi3i7kiGYo5pVMfCmrTyOXpTWOe7Pp1YcEg==
expires: Thu, 01 Jan 1970 09:00:00 GMT

GET
H2 200 prebid Show response
ad.as.amanad.adtdp.com/v2/ 69 B
587 B 504ms
469ms XHR
application/json 13.225.78.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.as.amanad.adtdp.com/v2/prebid?asi=gulvFX5MR&skt=5&prebid_id=9029a87193f4d64&prebid_ver=4.38.0&page_url=https%3A%2F%2Ftravel.blogmura.com%2F&
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-42.fra2.r.cloudfront.net
Software: /
Resource Hash: 696f2ae2d6b10bc9948443a31844a85224d226a656529154c28c6df92e8a9fa0

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 92
pragma: no-cache
access-control-allow-origin: https://travel.blogmura.com
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-amz-cf-id: B8ZWWnTtJHk52ScUJCci6lTnK80vO4XVZrZMC20UopBRkk7VQ8mbjg==
expires: Thu, 01 Jan 1970 09:00:00 GMT

GET
H2 200 prebid Show response
ad.as.amanad.adtdp.com/v2/ 69 B
587 B 507ms
472ms XHR
application/json 13.225.78.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.as.amanad.adtdp.com/v2/prebid?asi=JY7FFXcMg&skt=5&prebid_id=910089e5c272628&prebid_ver=4.38.0&page_url=https%3A%2F%2Ftravel.blogmura.com%2F&
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-42.fra2.r.cloudfront.net
Software: /
Resource Hash: 696f2ae2d6b10bc9948443a31844a85224d226a656529154c28c6df92e8a9fa0

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 92
pragma: no-cache
access-control-allow-origin: https://travel.blogmura.com
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-amz-cf-id: 8VemOMRJEmBYbFvz8IdFYdEm5_zNoPhzkpt0oBmEdsXlZnHRcIAFCw==
expires: Thu, 01 Jan 1970 09:00:00 GMT

GET
H2 200 prebid Show response
ad.as.amanad.adtdp.com/v2/ 69 B
588 B 507ms
472ms XHR
application/json 13.225.78.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.as.amanad.adtdp.com/v2/prebid?asi=yxn5FucMg&skt=5&prebid_id=920bd81645f32d&prebid_ver=4.38.0&page_url=https%3A%2F%2Ftravel.blogmura.com%2F&
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-42.fra2.r.cloudfront.net
Software: /
Resource Hash: 696f2ae2d6b10bc9948443a31844a85224d226a656529154c28c6df92e8a9fa0

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 92
pragma: no-cache
access-control-allow-origin: https://travel.blogmura.com
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-amz-cf-id: or3P1hJXW--vzZgYHv1OWztOED-JWVSR7daHWFNPTKZM4W0x4IbQJw==
expires: Thu, 01 Jan 1970 09:00:00 GMT

GET
H2 200 prebid Show response
ad.as.amanad.adtdp.com/v2/ 69 B
586 B 502ms
468ms XHR
application/json 13.225.78.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.as.amanad.adtdp.com/v2/prebid?asi=hbGtFucMg&skt=5&prebid_id=9329005844a35cd&prebid_ver=4.38.0&page_url=https%3A%2F%2Ftravel.blogmura.com%2F&
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-42.fra2.r.cloudfront.net
Software: /
Resource Hash: 696f2ae2d6b10bc9948443a31844a85224d226a656529154c28c6df92e8a9fa0

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 92
pragma: no-cache
access-control-allow-origin: https://travel.blogmura.com
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-amz-cf-id: bThv_7y9XXi4Eh_dbH-9B_cpvFJ8vZnR_Rbpok0ACE6jPCT7d73Rxw==
expires: Thu, 01 Jan 1970 09:00:00 GMT

GET
H2 200 prebid Show response
ad.as.amanad.adtdp.com/v2/ 69 B
586 B 506ms
473ms XHR
application/json 13.225.78.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.as.amanad.adtdp.com/v2/prebid?asi=J0M2FX5Mg&skt=5&prebid_id=94842b754de6545&prebid_ver=4.38.0&page_url=https%3A%2F%2Ftravel.blogmura.com%2F&
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-42.fra2.r.cloudfront.net
Software: /
Resource Hash: 696f2ae2d6b10bc9948443a31844a85224d226a656529154c28c6df92e8a9fa0

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 92
pragma: no-cache
access-control-allow-origin: https://travel.blogmura.com
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-amz-cf-id: BR_SlX36QmEmXpXZfwRhkOsbJAl-tanS8hqi5YdG1vIDkDN6S8u2-g==
expires: Thu, 01 Jan 1970 09:00:00 GMT

GET
H2 200 prebid Show response
ad.as.amanad.adtdp.com/v2/ 69 B
586 B 503ms
469ms XHR
application/json 13.225.78.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.as.amanad.adtdp.com/v2/prebid?asi=veioKu5MR&skt=5&prebid_id=95b8b63e2b3a8b2&prebid_ver=4.38.0&page_url=https%3A%2F%2Ftravel.blogmura.com%2F&
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-42.fra2.r.cloudfront.net
Software: /
Resource Hash: 696f2ae2d6b10bc9948443a31844a85224d226a656529154c28c6df92e8a9fa0

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 92
pragma: no-cache
access-control-allow-origin: https://travel.blogmura.com
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-amz-cf-id: SXWIwwz2RdzDYeLeRKCwhFcJekcd9Ohpr_JIop2-O0UHIqBhrtLh7A==
expires: Thu, 01 Jan 1970 09:00:00 GMT

GET
H2 200 prebid Show response
ad.as.amanad.adtdp.com/v2/ 69 B
587 B 500ms
466ms XHR
application/json 13.225.78.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.as.amanad.adtdp.com/v2/prebid?asi=kUz9FucGR&skt=5&prebid_id=964871fce9d953d&prebid_ver=4.38.0&page_url=https%3A%2F%2Ftravel.blogmura.com%2F&
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-42.fra2.r.cloudfront.net
Software: /
Resource Hash: 696f2ae2d6b10bc9948443a31844a85224d226a656529154c28c6df92e8a9fa0

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 92
pragma: no-cache
access-control-allow-origin: https://travel.blogmura.com
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-amz-cf-id: w_BijvyiVnudLoTVf_wBRpURCfVOnXWFlpCQFLAB0czwFHQlPG99vw==
expires: Thu, 01 Jan 1970 09:00:00 GMT

GET
H2 200 prebid Show response
ad.as.amanad.adtdp.com/v2/ 69 B
586 B 271ms
237ms XHR
application/json 13.225.78.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.as.amanad.adtdp.com/v2/prebid?asi=3ymuFu5Gg&skt=5&prebid_id=973f31859fec7e5&prebid_ver=4.38.0&page_url=https%3A%2F%2Ftravel.blogmura.com%2F&
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-42.fra2.r.cloudfront.net
Software: /
Resource Hash: 696f2ae2d6b10bc9948443a31844a85224d226a656529154c28c6df92e8a9fa0

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 92
pragma: no-cache
access-control-allow-origin: https://travel.blogmura.com
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-amz-cf-id: uNUTEF5ARK-WiZ3d2UKEU1S_eLB0CbLc17O5dcWS4JiHuGRPA8ntJw==
expires: Thu, 01 Jan 1970 09:00:00 GMT

GET
H2 200 prebid Show response
ad.as.amanad.adtdp.com/v2/ 69 B
586 B 504ms
471ms XHR
application/json 13.225.78.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.as.amanad.adtdp.com/v2/prebid?asi=2jBYFucMR&skt=5&prebid_id=9818f092df61a&prebid_ver=4.38.0&page_url=https%3A%2F%2Ftravel.blogmura.com%2F&
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-42.fra2.r.cloudfront.net
Software: /
Resource Hash: 696f2ae2d6b10bc9948443a31844a85224d226a656529154c28c6df92e8a9fa0

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 05:44:53 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 92
pragma: no-cache
access-control-allow-origin: https://travel.blogmura.com
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
vary: Accept-Encoding
content-type: application/json; charset=UTF-8
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-amz-cf-id: FBdejNgPz-_vaxkkKBOtAzWcfM7XlnhrJK7ck76tQxHJN-90zqNVvg==
expires: Thu, 01 Jan 1970 09:00:00 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 78ms
15ms Preflight
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: null
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1056
date: Mon, 27 Sep 2021 05:44:52 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H/1.1 200
OK mw_dynamic_view.html Show response
static.affiliate.rakuten.co.jp/widget/html/ Frame 826B 9 KB
3 KB 146ms
7ms Document
text/html 104.75.89.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://static.affiliate.rakuten.co.jp/widget/html/mw_dynamic_view.html?rakuten_design=slide&rakuten_affiliateId=10c3fda8.d5ba32e3.10c3fda9.3e43e297&rakuten_items=ctsmatch&rakuten_genreId=0&rakuten_size=728x200&rakuten_pattern=H1C&rakuten_target=_blank&rakuten_theme=gray&rakuten_border=on&rakuten_auto_mode=off&rakuten_genre_title=off&rakuten_pointbackId=_RTmtlk20011595&rakuten_no_link=off&rakuten_no_afl=off&rakuten_no_logo=off&rakuten_undispGenre=off&rakuten_wmode=off&rakuten_noScrollButton=off&rakuten_bgColor=FFFFFF&rakuten_txtColor=1D54A7&rakuten_captionColor=000000&rakuten_moverColor=C00000&rakuten_recommend=on&rakuten_service_flag=ichiba&rakuten_adNetworkId=&rakuten_adNetworkUrl=&rakuten_searchKeyword=&rakuten_disableLogo=&rakuten_moverItembgColor=&rakuten_moverCaptionColor=&rakuten_slideSpeed=250&rakuten_moreInfoColor=red&rakuten_subTxtColor=&rakuten_loadingImage=auto&rakuten_imageDisplay=auto&rakuten_txtDisplay=auto&rakuten_captionDisplay=auto&rakuten_moreInfoDisplay=auto&rakuten_txtRow=auto&rakuten_captionRow=auto&rakuten_auto_interval=6000&rakuten_imageSize=auto&rakuten_slideCell=auto&rakuten_slideDirection=auto&rakuten_order=0,1,2,3&rakuten_loadingTimeout=0&rakuten_mediaId=&rakuten_measurementId=-_ver--new_18_-&rakuten_pointSiteId=&rakuten_isAdvanced=false&rakuten_isIE=false&rakuten_deviceType=PC&rakuten_itemAmount=20&rakuten_tLogFrequency=10&rakuten_timestamp=1632721494008&rakuten_optout=off&rakuten_deeplink=on&rakuten_pUrl=https%3A%2F%2Ftravel.blogmura.com%2F&rakuten_version=20200323&rakuten_datatype=json

Requested by

Host: xml.affiliate.rakuten.co.jp
URL: https://xml.affiliate.rakuten.co.jp/widget/js/rakuten_widget.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

104.75.89.215 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

4681e86d0d657a36639f067b3204438f68a575752ff12bbc57f3b607fa9fcff3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: static.affiliate.rakuten.co.jp
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://travel.blogmura.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

Server: Apache
Last-Modified: Tue, 29 Jun 2021 02:30:28 GMT
Accept-Ranges: bytes
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Type: text/html
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Mon, 27 Sep 2021 05:44:54 GMT
Content-Length: 2896
Connection: keep-alive

GET
H/1.1 200
OK pc_pcview_all.css
static.affiliate.rakuten.co.jp/widget/html/stylesheets/ Frame 826B 111 KB
8 KB 10ms
9ms Stylesheet
text/css 104.75.89.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://static.affiliate.rakuten.co.jp/widget/html/stylesheets/pc_pcview_all.css?20140611

Requested by

Host: static.affiliate.rakuten.co.jp
URL: https://static.affiliate.rakuten.co.jp/widget/html/mw_dynamic_view.html?rakuten_design=slide&rakuten_affiliateId=10c3fda8.d5ba32e3.10c3fda9.3e43e297&rakuten_items=ctsmatch&rakuten_genreId=0&rakuten_size=728x200&rakuten_pattern=H1C&rakuten_target=_blank&rakuten_theme=gray&rakuten_border=on&rakuten_auto_mode=off&rakuten_genre_title=off&rakuten_pointbackId=_RTmtlk20011595&rakuten_no_link=off&rakuten_no_afl=off&rakuten_no_logo=off&rakuten_undispGenre=off&rakuten_wmode=off&rakuten_noScrollButton=off&rakuten_bgColor=FFFFFF&rakuten_txtColor=1D54A7&rakuten_captionColor=000000&rakuten_moverColor=C00000&rakuten_recommend=on&rakuten_service_flag=ichiba&rakuten_adNetworkId=&rakuten_adNetworkUrl=&rakuten_searchKeyword=&rakuten_disableLogo=&rakuten_moverItembgColor=&rakuten_moverCaptionColor=&rakuten_slideSpeed=250&rakuten_moreInfoColor=red&rakuten_subTxtColor=&rakuten_loadingImage=auto&rakuten_imageDisplay=auto&rakuten_txtDisplay=auto&rakuten_captionDisplay=auto&rakuten_moreInfoDisplay=auto&rakuten_txtRow=auto&rakuten_captionRow=auto&rakuten_auto_interval=6000&rakuten_imageSize=auto&rakuten_slideCell=auto&rakuten_slideDirection=auto&rakuten_order=0,1,2,3&rakuten_loadingTimeout=0&rakuten_mediaId=&rakuten_measurementId=-_ver--new_18_-&rakuten_pointSiteId=&rakuten_isAdvanced=false&rakuten_isIE=false&rakuten_deviceType=PC&rakuten_itemAmount=20&rakuten_tLogFrequency=10&rakuten_timestamp=1632721494008&rakuten_optout=off&rakuten_deeplink=on&rakuten_pUrl=https%3A%2F%2Ftravel.blogmura.com%2F&rakuten_version=20200323&rakuten_datatype=json

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

104.75.89.215 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-89-215.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

84dbb2e17cdca526a253123a8b6ab0c734db2ffaafe8acc091e63c4aa07122ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://static.affiliate.rakuten.co.jp/widget/html/mw_dynamic_view.html?rakuten_design=slide&rakuten_affiliateId=10c3fda8.d5ba32e3.10c3fda9.3e43e297&rakuten_items=ctsmatch&rakuten_genreId=0&rakuten_size=728x200&rakuten_pattern=H1C&rakuten_target=_blank&rakuten_theme=gray&rakuten_border=on&rakuten_auto_mode=off&rakuten_genre_title=off&rakuten_pointbackId=_RTmtlk20011595&rakuten_no_link=off&rakuten_no_afl=off&rakuten_no_logo=off&rakuten_undispGenre=off&rakuten_wmode=off&rakuten_noScrollButton=off&rakuten_bgColor=FFFFFF&rakuten_txtColor=1D54A7&rakuten_captionColor=000000&rakuten_moverColor=C00000&rakuten_recommend=on&rakuten_service_flag=ichiba&rakuten_adNetworkId=&rakuten_adNetworkUrl=&rakuten_searchKeyword=&rakuten_disableLogo=&rakuten_moverItembgColor=&rakuten_moverCaptionColor=&rakuten_slideSpeed=250&rakuten_moreInfoColor=red&rakuten_subTxtColor=&rakuten_loadingImage=auto&rakuten_imageDisplay=auto&rakuten_txtDisplay=auto&rakuten_captionDisplay=auto&rakuten_moreInfoDisplay=auto&rakuten_txtRow=auto&rakuten_captionRow=auto&rakuten_auto_interval=6000&rakuten_imageSize=auto&rakuten_slideCell=auto&rakuten_slideDirection=auto&rakuten_order=0,1,2,3&rakuten_loadingTimeout=0&rakuten_mediaId=&rakuten_measurementId=-_ver--new_18_-&rakuten_pointSiteId=&rakuten_isAdvanced=false&rakuten_isIE=false&rakuten_deviceType=PC&rakuten_itemAmount=20&rakuten_tLogFrequency=10&rakuten_timestamp=1632721494008&rakuten_optout=off&rakuten_deeplink=on&rakuten_pUrl=https%3A%2F%2Ftravel.blogmura.com%2F&rakuten_version=20200323&rakuten_datatype=json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 05:44:54 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 11 Jun 2014 04:51:42 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8155
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK front_merged.js Show response
static.affiliate.rakuten.co.jp/widget/html/javascripts/ Frame 826B 135 KB
44 KB 26ms
15ms Script
application/javascript 104.75.89.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://static.affiliate.rakuten.co.jp/widget/html/javascripts/front_merged.js?20140911

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

104.75.89.215 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-89-215.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

9e08978792f1773719a3676a24d7d6527917bd44c2dc6665d0ed894fd9aa8b2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://static.affiliate.rakuten.co.jp/widget/html/mw_dynamic_view.html?rakuten_design=slide&rakuten_affiliateId=10c3fda8.d5ba32e3.10c3fda9.3e43e297&rakuten_items=ctsmatch&rakuten_genreId=0&rakuten_size=728x200&rakuten_pattern=H1C&rakuten_target=_blank&rakuten_theme=gray&rakuten_border=on&rakuten_auto_mode=off&rakuten_genre_title=off&rakuten_pointbackId=_RTmtlk20011595&rakuten_no_link=off&rakuten_no_afl=off&rakuten_no_logo=off&rakuten_undispGenre=off&rakuten_wmode=off&rakuten_noScrollButton=off&rakuten_bgColor=FFFFFF&rakuten_txtColor=1D54A7&rakuten_captionColor=000000&rakuten_moverColor=C00000&rakuten_recommend=on&rakuten_service_flag=ichiba&rakuten_adNetworkId=&rakuten_adNetworkUrl=&rakuten_searchKeyword=&rakuten_disableLogo=&rakuten_moverItembgColor=&rakuten_moverCaptionColor=&rakuten_slideSpeed=250&rakuten_moreInfoColor=red&rakuten_subTxtColor=&rakuten_loadingImage=auto&rakuten_imageDisplay=auto&rakuten_txtDisplay=auto&rakuten_captionDisplay=auto&rakuten_moreInfoDisplay=auto&rakuten_txtRow=auto&rakuten_captionRow=auto&rakuten_auto_interval=6000&rakuten_imageSize=auto&rakuten_slideCell=auto&rakuten_slideDirection=auto&rakuten_order=0,1,2,3&rakuten_loadingTimeout=0&rakuten_mediaId=&rakuten_measurementId=-_ver--new_18_-&rakuten_pointSiteId=&rakuten_isAdvanced=false&rakuten_isIE=false&rakuten_deviceType=PC&rakuten_itemAmount=20&rakuten_tLogFrequency=10&rakuten_timestamp=1632721494008&rakuten_optout=off&rakuten_deeplink=on&rakuten_pUrl=https%3A%2F%2Ftravel.blogmura.com%2F&rakuten_version=20200323&rakuten_datatype=json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 05:44:54 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 23 Aug 2017 01:46:35 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK / Show response
mtwidget04.affiliate.rakuten.co.jp/ Frame 826B 2 KB
2 KB 1560ms
271ms XHR
application/javascript 133.237.61.100
RAKUTEN Rakuten

General

Check archive.org

Show headers Download Go to

Full URL: https://mtwidget04.affiliate.rakuten.co.jp/?rakuten_design=slide&rakuten_affiliateId=10c3fda8.d5ba32e3.10c3fda9.3e43e297&rakuten_items=ctsmatch&rakuten_genreId=0&rakuten_size=728x200&rakuten_pattern=H1C&rakuten_target=_blank&rakuten_theme=gray&rakuten_border=on&rakuten_auto_mode=off&rakuten_genre_title=off&rakuten_pointbackId=_RTmtlk20011595&rakuten_no_link=off&rakuten_no_afl=off&rakuten_no_logo=off&rakuten_undispGenre=off&rakuten_wmode=off&rakuten_noScrollButton=off&rakuten_bgColor=FFFFFF&rakuten_txtColor=1D54A7&rakuten_captionColor=000000&rakuten_moverColor=C00000&rakuten_recommend=on&rakuten_service_flag=ichiba&rakuten_adNetworkId=&rakuten_adNetworkUrl=&rakuten_searchKeyword=&rakuten_disableLogo=&rakuten_moverItembgColor=&rakuten_moverCaptionColor=&rakuten_slideSpeed=250&rakuten_moreInfoColor=red&rakuten_subTxtColor=&rakuten_loadingImage=auto&rakuten_imageDisplay=auto&rakuten_txtDisplay=auto&rakuten_captionDisplay=auto&rakuten_moreInfoDisplay=auto&rakuten_txtRow=auto&rakuten_captionRow=auto&rakuten_auto_interval=6000&rakuten_imageSize=auto&rakuten_slideCell=auto&rakuten_slideDirection=auto&rakuten_order=0,1,2,3&rakuten_loadingTimeout=0&rakuten_mediaId=&rakuten_measurementId=-_ver--new_18_-&rakuten_pointSiteId=&rakuten_isAdvanced=false&rakuten_isIE=false&rakuten_deviceType=PC&rakuten_itemAmount=20&rakuten_tLogFrequency=10&rakuten_timestamp=1632721494008&rakuten_optout=off&rakuten_deeplink=on&rakuten_pUrl=https%3A%2F%2Ftravel.blogmura.com%2F&rakuten_version=20200323&rakuten_datatype=json
Requested by: Host: static.affiliate.rakuten.co.jp
URL: https://static.affiliate.rakuten.co.jp/widget/html/mw_dynamic_view.html?rakuten_design=slide&rakuten_affiliateId=10c3fda8.d5ba32e3.10c3fda9.3e43e297&rakuten_items=ctsmatch&rakuten_genreId=0&rakuten_size=728x200&rakuten_pattern=H1C&rakuten_target=_blank&rakuten_theme=gray&rakuten_border=on&rakuten_auto_mode=off&rakuten_genre_title=off&rakuten_pointbackId=_RTmtlk20011595&rakuten_no_link=off&rakuten_no_afl=off&rakuten_no_logo=off&rakuten_undispGenre=off&rakuten_wmode=off&rakuten_noScrollButton=off&rakuten_bgColor=FFFFFF&rakuten_txtColor=1D54A7&rakuten_captionColor=000000&rakuten_moverColor=C00000&rakuten_recommend=on&rakuten_service_flag=ichiba&rakuten_adNetworkId=&rakuten_adNetworkUrl=&rakuten_searchKeyword=&rakuten_disableLogo=&rakuten_moverItembgColor=&rakuten_moverCaptionColor=&rakuten_slideSpeed=250&rakuten_moreInfoColor=red&rakuten_subTxtColor=&rakuten_loadingImage=auto&rakuten_imageDisplay=auto&rakuten_txtDisplay=auto&rakuten_captionDisplay=auto&rakuten_moreInfoDisplay=auto&rakuten_txtRow=auto&rakuten_captionRow=auto&rakuten_auto_interval=6000&rakuten_imageSize=auto&rakuten_slideCell=auto&rakuten_slideDirection=auto&rakuten_order=0,1,2,3&rakuten_loadingTimeout=0&rakuten_mediaId=&rakuten_measurementId=-_ver--new_18_-&rakuten_pointSiteId=&rakuten_isAdvanced=false&rakuten_isIE=false&rakuten_deviceType=PC&rakuten_itemAmount=20&rakuten_tLogFrequency=10&rakuten_timestamp=1632721494008&rakuten_optout=off&rakuten_deeplink=on&rakuten_pUrl=https%3A%2F%2Ftravel.blogmura.com%2F&rakuten_version=20200323&rakuten_datatype=json
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 133.237.61.100 , Japan, ASN23820 (RAKUTEN Rakuten,Inc., JP),
Reverse DNS: any.pub.jpe2.rpaas.net
Software: / Express
Resource Hash: 563c6e1205bde1fa3a6f1b57dcdfa9ce936884ea3f6ba2dd9089d61285affff3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://static.affiliate.rakuten.co.jp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 05:44:55 GMT
X-Powered-By: Express
Vary: Origin
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: https://static.affiliate.rakuten.co.jp
X-Vcap-Request-Id: 5cdfe562-6f48-41e8-435f-99e16f877928
Connection: keep-alive
Content-Length: 1744

GET
H/1.1 200
OK getMWConf.php Show response
xml.affiliate.rakuten.co.jp/widget/conf/ Frame 826B 35 B
325 B 676ms
226ms Script
text/javascript 133.237.16.123
RAKUTEN Rakuten

General

Check archive.org

Show headers Download Go to

Full URL

https://xml.affiliate.rakuten.co.jp/widget/conf/getMWConf.php?time=1632721494179

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

133.237.16.123 Setagaya-ku, Japan, ASN23820 (RAKUTEN Rakuten,Inc., JP),

Reverse DNS

xml.affiliate.rakuten.co.jp

Software

Apache /

Resource Hash

ffa0c516b15f890efae5ac5a88d63d9f87a234ed431e599fa603c09c9359626e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://static.affiliate.rakuten.co.jp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 05:44:54 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Connection: close
Content-Length: 55
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK loading.gif
static.affiliate.rakuten.co.jp/widget/html/images/ Frame 826B 17 KB
17 KB 8ms
7ms Image
image/gif 104.75.89.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.affiliate.rakuten.co.jp/widget/html/images/loading.gif

Requested by

Host: static.affiliate.rakuten.co.jp
URL: https://static.affiliate.rakuten.co.jp/widget/html/stylesheets/pc_pcview_all.css?20140611

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

104.75.89.215 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-89-215.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

69a984093a6529657bc8a168865a77c7f3dc6613313464bdac5538c6713b4d71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://static.affiliate.rakuten.co.jp/widget/html/stylesheets/pc_pcview_all.css?20140611
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 05:44:54 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 30 Jul 2012 09:57:54 GMT
Server: Apache
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 17591
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK buttons.gif
static.affiliate.rakuten.co.jp/widget/html/images/ Frame 826B 6 KB
6 KB 6ms
6ms Image
image/gif 104.75.89.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.affiliate.rakuten.co.jp/widget/html/images/buttons.gif

Requested by

Host: static.affiliate.rakuten.co.jp
URL: https://static.affiliate.rakuten.co.jp/widget/html/stylesheets/pc_pcview_all.css?20140611

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

104.75.89.215 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-89-215.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

48b9db4b0432bdebb0e6772f033d8a04a77712c973ce9d774ce7710e2dc73fd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://static.affiliate.rakuten.co.jp/widget/html/stylesheets/pc_pcview_all.css?20140611
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 05:44:54 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 01 Jul 2018 15:20:50 GMT
Server: Apache
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6306
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK loading.gif
static.affiliate.rakuten.co.jp/widget/html/images/ Frame 826B 17 KB
17 KB 7ms
6ms Image
image/gif 104.75.89.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.affiliate.rakuten.co.jp/widget/html/images/loading.gif

Requested by

Host: static.affiliate.rakuten.co.jp
URL: https://static.affiliate.rakuten.co.jp/widget/html/stylesheets/pc_pcview_all.css?20140611

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

104.75.89.215 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-89-215.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

69a984093a6529657bc8a168865a77c7f3dc6613313464bdac5538c6713b4d71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://static.affiliate.rakuten.co.jp/widget/html/stylesheets/pc_pcview_all.css?20140611
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 05:44:54 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 30 Jul 2012 09:57:54 GMT
Server: Apache
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 17591
X-XSS-Protection: 1; mode=block

OPTIONS
H2 200 bid
prebid.flux-analytics.com/analytics/v1/ Frame 0
0 281ms
243ms Preflight
text/html 35.186.217.60
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.flux-analytics.com/analytics/v1/bid
Protocol: H2
Server: 35.186.217.60 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 60.217.186.35.bc.googleusercontent.com
Software: / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://travel.blogmura.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

x-powered-by: Express
access-control-allow-origin: https://travel.blogmura.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, set-cookie
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
allow: POST
content-type: text/html; charset=utf-8
content-length: 4
etag: W/"4-Yf+Bwwqjx254r+pisuO9HfpJ6FQ"
date: Mon, 27 Sep 2021 05:44:54 GMT
via: 1.1 google
alt-svc: clear

POST
H2 200 bid Show response
prebid.flux-analytics.com/analytics/v1/ 75 B
391 B 397ms
383ms XHR
text/html 35.186.217.60
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.flux-analytics.com/analytics/v1/bid
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.217.60 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 60.217.186.35.bc.googleusercontent.com
Software: / Express
Resource Hash: a45484c0d590a4743f2b34157d5a287d1aa15e378c28608f3e0f58742c238935

Request headers

Referer: https://travel.blogmura.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 27 Sep 2021 05:44:54 GMT
via: 1.1 google
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, set-cookie
x-powered-by: Express
etag: W/"4b-y7cH8U1woTAzEcrnkqNJxyWsaQk"
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://travel.blogmura.com
access-control-allow-credentials: true
alt-svc: clear
content-length: 75

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 98ms
15ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=travel.blogmura.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 05:44:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 81ms
15ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=travel.blogmura.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 05:44:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 493 KB
101 KB 639ms
639ms XHR
text/plain 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1852737733792991&correlator=192457725819955&output=ldjh&impl=fifs&eid=31062918%2C21068030%2C44750532&vrg=2021092201&ptt=17&sc=1&sfv=1-0-38&ecs=20210927&iu_parts=4330865%2Cblogmura%2Cbm_PC_Interstitial_BTF%2Cbm_PC_Header_Billboard_ATF%2Cbm_PC_Footer_Billboard_BTF%2Cbm_PC_1st_Rectangle_L_BTF%2Cbm_PC_1st_Rectangle_R_BTF%2Cbm_PC_2nd_Rectangle_L_BTF%2Cbm_PC_2nd_Rectangle_R_BTF%2Cbm_PC_3rd_Rectangle_L_BTF%2Cbm_PC_3rd_Rectangle_R_BTF%2Cbm_PC_4th_Rectangle_L_BTF%2Cbm_PC_4th_Rectangle_R_BTF%2Cbm_PC_5th_Rectangle_L_BTF%2Cbm_PC_5th_Rectangle_R_BTF%2Cbm_PC_Side_Top_Skyscraper_ATF%2Cbm_PC_Side_Bottom_Skyscraper_BTF%2Cbm_PC_overlay_banner_ATF&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F5%2C%2F0%2F1%2F6%2C%2F0%2F1%2F7%2C%2F0%2F1%2F8%2C%2F0%2F1%2F9%2C%2F0%2F1%2F10%2C%2F0%2F1%2F11%2C%2F0%2F1%2F12%2C%2F0%2F1%2F13%2C%2F0%2F1%2F14%2C%2F0%2F1%2F15%2C%2F0%2F1%2F16%2C%2F0%2F1%2F17&prev_iu_szs=1x1%2C728x90%7C970x90%7C970x250%2C728x90%7C970x90%7C970x250%2C250x250%7C336x280%7C300x250%2C250x250%7C300x250%7C336x280%2C300x250%7C250x250%7C336x280%2C336x280%7C250x250%7C300x250%2C300x250%7C250x250%7C336x280%2C300x250%7C336x280%7C250x250%2C250x250%7C336x280%7C300x250%2C250x250%7C336x280%7C300x250%2C300x250%7C250x250%7C336x280%2C300x250%7C250x250%7C336x280%2C300x600%7C300x250%2C300x1050%7C300x600%7C300x250%2C970x90%7C728x90&ists=32768&fas=8%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0&prev_scp=%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D336x280%26hb_pb%3D18.00%26hb_adid%3D9954ef303cd4968%26hb_bidder%3Dpubmatic%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=abtest_hb%3Dtam-prebid%26category%3Dtravel%26device%3Dpc&cookie_enabled=1&bc=31&abxe=1&lmt=1632721494&dt=1632721494295&dlt=1632721492033&idt=904&frm=20&biw=1600&bih=1200&oid=3&adxs=-9%2C436%2C436%2C105%2C365%2C105%2C415%2C105%2C415%2C105%2C365%2C105%2C415%2C1280%2C1280%2C315&adys=-9%2C177%2C9278%2C969%2C969%2C2418%2C2418%2C3877%2C3877%2C6013%2C6013%2C7561%2C7561%2C482%2C6157%2C1105&adks=1246697698%2C3140484414%2C3219216500%2C2319159430%2C2797201280%2C2664935606%2C3517598743%2C3535481503%2C1107358289%2C914517906%2C1109615438%2C3003953882%2C916485146%2C1598733420%2C234340304%2C1070556060&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd%7Ce%7Cf%7Cg&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftravel.blogmura.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x-1%7C1600x250%7C1600x300%7C250x250%7C250x250%7C300x250%7C336x250%7C300x250%7C300x250%7C250x250%7C250x250%7C300x250%7C300x250%7C300x250%7C300x250%7C1600x-1&msz=0x-1%7C1600x0%7C1600x0%7C250x0%7C250x0%7C300x0%7C336x0%7C300x0%7C300x0%7C250x0%7C250x0%7C300x0%7C300x0%7C300x0%7C300x250%7C1600x-1&ga_vid=1919064953.1632721493&ga_sid=1632721494&ga_hid=616908066&ga_fc=false&fws=2%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C516%2C516&ohw=0%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600&btvi=-1%7C0%7C1%7C0%7C0%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7C0%7C10%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

77e2053349514aad5f1d67223ec3266879ac3233b4f8d8111f8023d916f231f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:54 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 103305
x-xss-protection: 0
google-lineitem-id: -2,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://travel.blogmura.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame FFE6 6 KB
4 KB 89ms
14ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 05:44:54 GMT
expires: Tue, 27 Sep 2022 05:44:54 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 pubads_impl_page_level_ads_2021092201.js Show response
securepubads.g.doubleclick.net/gpt/ 36 KB
13 KB 15ms
15ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2021092201.js?cb=31062918

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cb65b794ca7bcd5c99bcfd408253f50ad8d271b9a488436e1dc537b36a9c605f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13582
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 08:37:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 27 Sep 2021 05:44:54 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 85 KB
27 KB 60ms
25ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.js
Requested by: Host: flux-cdn.com
URL: https://flux-cdn.com/client/murauchi/flux_blogmura_TM_AT.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: e6969b69570c743952ab51b9fba22410be503db91b0566753d6da10894e76dad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:54 GMT
content-encoding: gzip
last-modified: Wed, 08 Sep 2021 12:50:28 GMT
server: nginx
etag: W/"6138b194-1532d"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 28 Sep 2021 05:44:54 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 85 KB
27 KB 43ms
20ms XHR
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.js
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: e6969b69570c743952ab51b9fba22410be503db91b0566753d6da10894e76dad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:54 GMT
content-encoding: gzip
last-modified: Wed, 08 Sep 2021 12:50:28 GMT
server: nginx
etag: W/"6138b194-1532d"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 28 Sep 2021 05:44:54 GMT

GET
H2 200 container.html Show response
b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame FC4C 6 KB
3 KB 310ms
8ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 05:44:54 GMT
expires: Tue, 27 Sep 2022 05:44:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 3612 6 KB
3 KB 315ms
13ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 05:44:54 GMT
expires: Tue, 27 Sep 2022 05:44:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 18D0 6 KB
3 KB 311ms
12ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 05:44:54 GMT
expires: Tue, 27 Sep 2022 05:44:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 0B19 6 KB
3 KB 309ms
13ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 05:44:54 GMT
expires: Tue, 27 Sep 2022 05:44:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
28 KB 69ms
21ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a7ad5974f3d165d1a83149795afe792e241b0e6a41078c6e14bcecc5449934e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27652
x-xss-protection: 0
server: sffe
etag: "1632310961004595"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 container.html Show response
b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E451 6 KB
3 KB 275ms
14ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 05:44:54 GMT
expires: Tue, 27 Sep 2022 05:44:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C3D5 6 KB
3 KB 271ms
14ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 05:44:54 GMT
expires: Tue, 27 Sep 2022 05:44:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame BB3C 6 KB
3 KB 268ms
13ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 05:44:54 GMT
expires: Tue, 27 Sep 2022 05:44:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6985 6 KB
3 KB 258ms
7ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 05:44:54 GMT
expires: Tue, 27 Sep 2022 05:44:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 15D1 6 KB
3 KB 255ms
7ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 05:44:54 GMT
expires: Tue, 27 Sep 2022 05:44:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 07E0 6 KB
3 KB 252ms
6ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 05:44:54 GMT
expires: Tue, 27 Sep 2022 05:44:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame DCD7 6 KB
3 KB 254ms
12ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 05:44:54 GMT
expires: Tue, 27 Sep 2022 05:44:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 301D 6 KB
3 KB 248ms
9ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 05:44:54 GMT
expires: Tue, 27 Sep 2022 05:44:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C63C 6 KB
3 KB 248ms
12ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 05:44:54 GMT
expires: Tue, 27 Sep 2022 05:44:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame BE53 6 KB
3 KB 240ms
8ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 05:44:54 GMT
expires: Tue, 27 Sep 2022 05:44:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame D09F 6 KB
3 KB 236ms
8ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092201.js?31062918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://travel.blogmura.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://travel.blogmura.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 05:44:54 GMT
expires: Tue, 27 Sep 2022 05:44:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A24C 624 B
558 B 53ms
23ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJHu6K0BMAE&v=APEucNUBYKiGMB40LEFJ7EYZCIG7devHEl5O6Rg-ScvCdW2IvOK8fCj1eX45dtmgGVdUa78SFLQN5mpqWW5t0lb9eZBDHpLZx8Zt6CZ9qyP1gn22kwog8sLBMzPhKYce194eAmxYAuKIYGbmXzxLyu4QEaE5CnnUWre1lpmN187UzxadHpxOupk

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=COWiHhDhjN4CGJHu6K0BMAE&v=APEucNUBYKiGMB40LEFJ7EYZCIG7devHEl5O6Rg-ScvCdW2IvOK8fCj1eX45dtmgGVdUa78SFLQN5mpqWW5t0lb9eZBDHpLZx8Zt6CZ9qyP1gn22kwog8sLBMzPhKYce194eAmxYAuKIYGbmXzxLyu4QEaE5CnnUWre1lpmN187UzxadHpxOupk
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 27 Sep 2021 05:44:55 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUlFBBtGxCvohQNe2vNvupd_XX0eE55NZkukm8o_7U_inCmv3Nl99LDb_948; expires=Sat, 22-Oct-2022 05:44:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame FC4C 87 KB
32 KB 84ms
56ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AuBpeXTojKqOagPhBps8fwIQtQnkiyGF3ACf7lsJ9cfCSoIJAEktbHEhi1mXRSx2_OvWowQzpa7rZSPS4We9XLR7VMo9wygj1_ikLChf4rs090qNR0fu6BvDtDHhozEkyzL18QEWAIJZJaUZE20HpbEbz8Pg&dbm_d=AKAmf-DX35r2WH91mo6MahRIC-eq3PP3YcLKYZK4IyROJI-f8g8f5TwGX08X3L8UvmrX7tJkA5qN_MK_nOagooLQDVr30Q1RJ_c5T8bvHJ-izp6j6hfkbW2ni8lRahIha02FDxAY0R7Th28s6LXBZdUvAMuzwkQNXuCCZ26m9vo14BrorwQTfd5FiaawWSMeQx7kFeGNb2tFtzm4TGnWVWsp21Gh9l69lOr5MRkusub2pyWb5oIJxv3yaaKKwv4pJ9eBmG2Tl3rZQ1ntKk5kdEiB6YvSl29cmJtoD4Vgzst00ITzePK1hYWHVWPMMgbscd0AtALWSBSaTJ6FxE1UNe9J5LueECpgLvt8jxCnUG8ecn29BA6V5i3_6tRHR51_orOcFfTYaRlBr_-cEhSXEnF5RBVqdJ8Hm3-v4ltG3ZZ14g_MIEq_VRl83YWOAHV-92KO20kqwlgU8GAcWQjpCGEbPf_u03ByngB2z3gifsyBHdIJQhQoaCkOsqIBHlLAjZYvfwGqa4RjXhWucJEra6r7h95F3IOBViFAQp7EZzNDeSwsnctvlQKLhumJRejU977RRpAqwZjnQYbmUjjP-DhYa9jVHvHX7eqz3G7ZOOYfhRW44Czz2AylI_NeNXVlkKSab_y87zodOJaNuxuB3HiC_q503kwELhd-Dx6ceRCfKK2fxH6Pv6zDf4pcshdtdt8ySZNEr5TFDCjaA5IgCtFRo6oQWGXdXEUw1c8XcopMOaIfhJsY-fC9US8pnIZhOuvuQe3-5ORkMazYMli-QU8t8IGQ8OQSmz1qqfQGDSTlLs-H6d-Mr_0GHHIh6WQP7oM5YnUPxThawD5qBDJRE1mWp31MVDBaT_C3ENmGBemuaxLfqyVkOO6psvVnDZ8csPW2D7rA8LXMsTtp3tCnTkssq41xXjZK2TMR-piT-BVst5ryeAHUkfoXBKnsuTeq5qv62oKPMW0UonGbYhlaDMRryYNpRxAHWzlKAGyK8_Sxkfc9FALl0CXUvCnPNWe6rATrPGIfMTFjrATexeCSsZ2UDiDHVG2roKTC5D1Ela1jKVPIesImlTvY-OvEDeg-rWSd6o2b09RfFZMNLLzDN1UWQJ58yH7ufQSaKzv8_RzpIU0a53dj9S2H41mkrnoWYUxByDEB1E37Zimk80X64zJhNdzP9UDwhjzrwLjGCjNQG6sc2rtuda9LCS2sXlrSJB05ClcFraZ059KNx3R5AIMomINaRtL90fB1O9UM2Y2XuKNvVq1Y_XocGdVWdgOmRyHHogxfJot5xIIarTCKbtOx7zxPJUyQ3lbUXA03beMBe3pQKEzTW13lzhz4XcEWeotG36PlahqvPaK7ednooEXEZWrxB4RDfo4lzxNTx-F97h7gPpVQFeYKGYQDKoQ3AouZkLhMEn3BCsmTqapk58u8Ms7jTyXUDaVApPae2POSLSNIicQJUV2EGXw1UVr3wBwBFlErMRWLQBK-4FKqM5LUcWXTWfXuvNFA_HFo8Id2iLfAE_CcnNoBAyAdKjAAPxyo8d9i4f5MIN297NO1-R2y9B-L2IBcKz1_fw6bqQrZDlmWEAd9xBdKirvp-Bq2jI-HWjTkmvB4K3G2U7mzL7_ldJwPQph-9srXSXjxjwzcMSJH6TQ3bZmgT9mZo2lQz_34-GpfU3UHWGMKwL9oEaMuIlthYZ41-qm2-N65Tz0CJzvdLBLqsQ3ypFm4d37QflxQtJjJoJGdTF5Wf_92uZBL5K6dUXELGSIfVk9EgjCt5_4uU09pew2Hb4EY7p8GujW44a7K0XFJLR35F21LMR2uUQeLp3ZZeyEzdXqI-p79InPsaY35-ge5zh-0QK-cULGgCyeDg21Dtz-nBld082awSlYTzPpUZ4TW4GIXkg852e1dmHzjO7QxBQFkd0xI1ezV-RSb_EeEMHbDpGdE_iOk9oYYhZiThczmFxUr3iUHgg8G5UzfaT8QhYrZf5ZYyvWS9zEx3yKs1b8q43m0RL4oozQ076zJdF2p3-uwHIWEe0MF3Bp00QD9chIG6KFIY0dH2751ZJqjNV_fmOPSKt3hnaDPZrxx0avLrUGZKb9CTGJY5ab3PeRtL6o-Ep9HX68JiyTOZ0ZR9FOWZAAB6bwMsDB_u5ZeoWwQj3rQJHUMrBSZKvkMisyAFV4GbuT4e22gqxB6gQu9mLvPeyzsdGXKJYAHxusG7BEQbeu9AmkMAqTbayYpB6dy48AM8i_-WLJv2F0bkd4Cvhz9sw4Wf0fD4E6hNIXZaW5FTpuniwhtOOdweaYmj7jB6ECBuLzQMi8Db1wtVAbUFTZ7DFM9cFqPUej7TZGyoE5EH950ouOag7gV_qXRviLxt9cCWNCYWsp9yHIsTdizhEzOGHJmY2TcRUvg_7uqymadXCi2YNzykfHQOhpD_uX2rYcU5ETmi9BO1j_gpKWXMvfMwArBbOIeX0-hijhV7bjLyJ-nXXoWY9xyrGCdRx0Vw7KZH75w3GvaHZ1dIxlJXP3kDnF2JZ3Z3TMe_ii0wg9AjUO3RXllszT3qr1UcHHWd3yqCVBzmRAGcFGowZPYSG18RuqXXKWkLZPWD5opGYVjAp_tYDTQi2ohzy3wGQ7lMcpqzXI_PBAecC2AmxwK3NQvDM-g3ZdXGs4ejr2U7rgGtdg-6LRyUfVBOEEo6KUQgYIgsil9xw5zVUga_emRhWiPNcGu9H1ktCNF88arGWuLdHHsOxFW5ZDmMc4CH_oAvNoGqxu9ZsXb1FFORA1wawlR24Ov_uPVgzxXBoG6t8BLNOumO-y_NSuqAOvRgmtha0PdAd5nHBtEkSm9KXHmFKYLaIwJHDdH4Tj92pqNiw_mvZ6AKdmV6vtCG6tuL_VSkxmF077Z5Xfy4CqnXv7jAmBZvz9Cj-L1NYWFoCOsgTx80XEfmMWfT7nN6r_MHDlNmlCWCa2uOGMux63TRp_pEZeGaaTOdNJcr5si-KAzCujwYYv4Zpv6CYYZqb3OhUxRRjcgaczzTA9xHZO7xMgrQoe8gtOwNad9QJlf1pobjzLbv6D0tICuDlT1O5G8fUpzHyjm31WYN9iExSRRfHGoVBpDf27aNZr1l6vwv-lzlpCuuWR8JobRfYpYDCm0yG0G28-NDjeubLt_eVa72VC11uATmo9oBsRslJjW7_H9sn4npZZt6Q-BUdYR5T-GvCLUicP3JSuVu0IplLKccpJkuhawu84WAg-kGnKZYqY0HkeoOhBGcKBwfkhg9HaWatXufQmieMPmtYKZbo5AWagO&cid=CAASFeRo85fCS4W8kU-2qPxUIHSBWVByQA&rfl=1%2Chttps%253A%252F%252Ftravel.blogmura.com%252F%240

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a15b3353484963ce595f0a0b95dc8e5a5ba913664b057de8f915ec5c1e853f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32821
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame FC4C 42 B
173 B 95ms
9ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CNZmx-A37gQ3JC7crGvyvp08W9zKnVRxQaBTw3RvINGlNNkBsC4VEVSQ2lDnlH_zW9wLf6lBOT9JkNzhS7D0DrakjwJvttGp-xlxOgXVKh3fDzTg0

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

skeleton.gif
static.adsafeprotected.com/ Frame FC4C
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/741547/55522419/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=

43 B
258 B

112ms
28ms

Image
image/gif

52.209.62.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.62.127 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-62-127.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: nginx/1.16.1
age: 16115587
etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-cache-status: HIT
content-type: image/gif
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 43

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-server-name: app04.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame FC4C 3 KB
1 KB 109ms
2ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/window_focus_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 688
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:33:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FC4C 128 KB
39 KB 348ms
47ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2918d0edea50f453e2143087cb6f5b232a6fef8b687e228496629f0739fc809

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39662
x-xss-protection: 0
server: sffe
etag: "1632310973010379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame FC4C 14 KB
7 KB 90ms
1ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:41:56 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame FC4C 0
0 45ms
15ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR1mZeCKfYtNI3ZeMlx3eG0_W9pBreL1NGbxNjxW6cjLL8wDzyyNk5v-aqgnKEAr1s2KcLf-94yoEA_bfIAf-_6SwRtOg
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A82A 624 B
558 B 47ms
22ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiR7OioATAB&v=APEucNWeMiP2qI3jhXDdxrpGOk7o6oaIEJ5YgWskOXpvyE4wF6eyaf-6XgnGp-RewIKexO3FpaSq08Q6ug5OyVqSuQGwfZKkdcSjKy0uJPrDvGKo5LmK4rdeSxltOD1U6s2LU35QIsPsCbgDaPuxUeSAqKv82NNO8X-Or0xwIqqECzC-84WclqI

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CPvjgQEQ_aOOARiR7OioATAB&v=APEucNWeMiP2qI3jhXDdxrpGOk7o6oaIEJ5YgWskOXpvyE4wF6eyaf-6XgnGp-RewIKexO3FpaSq08Q6ug5OyVqSuQGwfZKkdcSjKy0uJPrDvGKo5LmK4rdeSxltOD1U6s2LU35QIsPsCbgDaPuxUeSAqKv82NNO8X-Or0xwIqqECzC-84WclqI
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 27 Sep 2021 05:44:55 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUn71s7n37eDlIBohqKO8elIpn9oqxsivuk3TV3Sn5e7HvfRP8RwHuCeVDwI; expires=Sat, 22-Oct-2022 05:44:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 07E0 74 KB
29 KB 71ms
47ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DCuOFVCUfYItQrOtd6IFHfdul4rGah4hGfsw9eaV5zrKxJKf7fxvmSHsaL5dzux_LKIwDPpB_HdLNG0IEcSUlzik_K-vFgTSid4_R1fYCtNXpkvadJazD554DLPIsbXWgJJXGR0D2zZsjBdnZCHs9LctIw5Q&dbm_d=AKAmf-Ba9-BYyr4bANr1YNaE7Hw0HdujYVhmj2k86_ENHpZw4MPOH2ckvOWg7ikJ3Z0u-YtPFoxemxm3puryY-6-oI7iMnNXc5fm7LBTCzSfgISXWlnBLdzyRWmFNpxsccoOHlJ6r1J8911SiPFCxjXQRu78Dh2G9m1yo-pFJbkXkTiYFTfwtO0k9Z5W7Jdptd1WMaXk5G0Ez2H_ox_-BS-8BiD7uwqeKzh5EWmizEcZvLnMxoELpgG_tmXYPvvfFpla4ER3DzBa8euYq4sHpECHQgzjKG0AsSLmFnLknp3ln0iR5Hljg04Lf0q1eltMK-ExPW0RvojVriaYeISvT0O25M2IXmJSnO7pHzC_JBDDtYvPcDUtRrM7gH8GkfLTsQifvzwG5rSXKnTdGHjnTNCHBNnfnRUUKHUJxr9uA49Tw5LrdtqfaORvi2YeW156X7-ROWTpwDmyzqbLab6SEyHvswHNpyuVp-e_Gq2w8wU1PwI3h3VuYg23z509lAnbRmjUsZBV5wYh69eiaItQGSjoq6Hj97cygl5Uw3fRyKGNzQ6qbGgyn5saaHOfipjK_SvrjvX1VOOsl0yifTVjENG0UqNKk6Us7rG9TwQG_3I76ouQbh06EWr0adWkgBYXSVdyXDNMOmKtBNo-6MlVXCKvMhNKm_2Uag8Ad9fe1vLeBDAwkhLZSRODZ68kJb9ZlPAhaTCBjsu3TsP1orp2X69FnR12cR9QS71G4zucY-8tZzt_aaYnjninYtE-wsF-vjL4_F5lrjKH-m2tcrQtezw_tfOvSexd7w35P9j4aayj0tgPsNBuDiVIIkDyZevoOJD9FrZSyKcvzfH2R-907LwlsRAQokLt9CwvlvyU-E9rxE5ziYxf0kq0WVUFFTGZxwpeAMIjK0UkDmY2Q-xum9GQllSC8Z37kAAne8oswxKzXwFYrMJV0XUwSTZ6CixzYXFUmr-s6WiPQQUfVpSE8Vm4HOQYL304_AxpLWnP9KF3pUs-hK3zFbrtHWyeYUiFrYvNmmCTgkuP1mhwdVoUnZBtGdmLgbulM27e9a5A6Rld5NSPmMJEq6r2eMniDSJczxpkkClyT5M0VGNCDn2yJv4mNb8Eyp7VLiJNrkbQYCaQuoCt6kURmneYhwMHgTM2gIi4-wTy2JCU8bQ0FDc-EU5NL7cSCgzCjp9TMZLLMYYfXLvRRAegkYej00tVwzZUheyCJh3jcdpf2pxdErxrSUmgDwMFUUTP30_FEeCVxs7RdfFlFq93M6UEY0JJWcLJGu0GsJAc74twO5k7LKI_lhTGi_QYWViVInGkRfUtae0j41fQQxeczVhkF8p1RD1X971Hbpd_tt5TJk9_LjVa4NS7imoHGJ-TM-FRQxOGSlky6fpwPxMUCvHm2xA6yvSG9upgucgo7DH-SJtZIBtqnnB_wnR2gIFbteeQYHNBb2OWB1irfzIECTjz83PmX2lNzTI8VuH4ZX1_F7_v05m1gzM_J40oJdWQlE3yLvIzEMjHd3FdY4tJP1HEglpapKr7nlYC1Wwbs_rqcuTBsMsfDTRsym9vFIchChnj64CbNnMaRP0gFRAVeBpc8JuPGUBUcuK30CCuFW3gojIkXG0k-uZFuUq19mdlTBNzYmiNUhq1J1z8pw5UgTRSEgwF0KBw5_DyqeNG2lo8nAfsvRg-wBC2YoBDTiqwub_DDSQ-97gRkTq6U7uf_mqZxvSwauW3oMhh9BkDz2vCC1QxOpxv5GyynJ-9rnBvgZJwdxz4ZfyWKGxfkSMs73xo3KHuB4TlREqF82-CP5vwDUjZ2mkJIK5UuNG2v9UjldkmOfBb9ylRXdPXhAOi3Z1aso1jIXUd9R7njStxmOKwPxUcKCi9pZJg35fMKZBYai1xhj00joFHGxnucLhEaBnnpmJADy79n5mO1vqrle_cf4focIFT4kD0BEuZOUFdySDa6-8U6HV31Su9ryiVqIKq6bQLS46ebF_Sc1xUZqmnZCSZidQu9DiHEd0UcR07V3vq11T-tMt_vDnZ9uh1jjVQKCQVIRmugllXDpBR6s1X29Yke0VyGVjqj-zj5jbNnxDmK_mMDyWzwuXFN4ybPz-dStQMgjx4xdIXbqteLwDg8vg3STz7xmcQw221JAWb3LknriBwIpVXSj5peFW2Fmi_-p6r9xHdECXNOPIXAmFIOsZhknIGzZx5Hog3fZaCfdDv5aO718aptNSO0R-IoDrR_iT4y1QxmF06wUx0fddi5x4TuNDks5GuZpf9e2FOvjY7rNhJmDbWaO-0QGIO8Oat14gxdmu_y6exHH80Vr5hJ2e3iWxnV_NMySL0AVagjWed71k-AA9YWjaIuQehtrfmCgcZXVSwPsjdJhAWxMRt_Sb6ESlhjhg9NiWqqDfYC08ZMXHWjM-e5ROEguPIiWZB3sELQGn1lK8cJFTWUGX5hB3dzyraXha40I1r4q85m1bRGnayCSD3X_Gu72KO7QFR6xFahywsaqQv_PVIhn7RJWrKrNwPvhEQ4DtLgyQWNjOi9OawK5eNyMWxyLMc0E7TlVaTS6XUgsOm5eiod5kgFNg-1M_P2TBCew_X8A6SWkhPampn8wuzGLyX5Q6_SiWT0XnQZ5D88RdahTLIb3x8rMzYKYA-M_kpfg694dZlKoQk5XLV4yAX5VqAvvvLpHER3p43GxDveotHu2bH4fYpMALD3uMR7ALU36Q-GmwoMA2jnil2PKLJdItsyrXWuHDrLy5s6BiDRhV838JsbVhA25J-CfnnDxgaAnY8NzUSmkXlAfpliXhCgEj8rFeMDTJi4fwDEVIF98PPRFcbIOqov7awiZvmixSbbBzIp9UIp7SlAKbliVf8staBLGlF5UqsErzVzl9HfUqQ6pe1kgAyOdR87ltABeQLFSAFFkHYcwuPI2swIrFxKzgCa9U0efPXQnadn5nW_QiZDrfHAxiG3FXYGBMxiPbB5ZpoSWYZinsMnMjXm_0iUV3Gbw8tXQaA7OCmj_aqBSOqam86BBk1tQgxtEy5RCupNdit_-fV9Ana6yQBC9KvhLP-WxcT5VQc49q9q0Mm7vyX35aJ83LM3d4T_6N25rKkntkxw39u6AbVVpwahIkLKx9yMFlIX23BmYCZtVQzzNge_QR2qi1Qk4MaUB-emZpQF3CqunmNlP9MEsjrQkjF4B4BnyspOCIFIKBpyuu7ErEJJLF54rKAUE4nDp1LP6q-EDOudQNBBNvE7QEvXz5j9q7QXdF7aWHOI5sbo3JdY7BWm5dRMcaPYYBKMJTutt7QuwnleoeMxg&cid=CAASFeRo4Rygsx4B1heZ-NKAa9IXFpKo7g&rfl=1%2Chttps%253A%252F%252Ftravel.blogmura.com%252F%240

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f345c5a2d95ad5479210c0e317e4bb87ea2f9715626808b21fe111aeb3044546

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29608
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 07E0 42 B
107 B 92ms
10ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AVpfwk9EBq6ZRp9dtFSTItlpFAq-iKkzDS4b66mef12Eo0OyJ1BgNs9JDLqHvZJ_n8aNRUvN1SOy8zLi2ZddIy1k621vHVvQLFkDaf1WQLCaMnWPc

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 07E0 3 KB
1 KB 106ms
3ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/window_focus_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 688
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:33:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 07E0 128 KB
39 KB 340ms
42ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2918d0edea50f453e2143087cb6f5b232a6fef8b687e228496629f0739fc809

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39662
x-xss-protection: 0
server: sffe
etag: "1632310973010379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 07E0 14 KB
6 KB 90ms
4ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:41:56 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 15D1 0
0 32ms
31ms Fetch
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C6ea2VlpRYYXuGc_ngQeyvJjoD-i-mJRcoKWzyf0IwI23ARABIABglYKAgLAHggEXY2EtcHViLTkyNTI0MTYxOTIzNDg5NznIAQmpAsPjD0-QJoU-4AIAqAMBqgTuAU_Q6OLlK4LKptdR8wf4hAoSuZox6xhKh8VH8yZuR0_mE7VjLmmyYw4-CamkfIsPKcSGmzpC6cX0hrIo9IOnuWW4deudGyUAKfUKt-DpLvU9vJuebKoeEYr3_-Ctv5350s-7Gq6RlwCeMQt1JTVNTsyLk1LTdcK7joGIcy4f2BrHI3UPJoAoe4WAgG8ei4s-LffzrxQtBCjUxsorAnBUMPv0LEWoBSHLKJRJwRIzLRK8BM06w89b-T3Gv5DFixqr1q0p3qkZTfwmMGE6MOmTNT9BgmGtn-gyAx2jLRXNQMJ_CxlXo7ejB9ZQheG_zbngBAGABoa5-tmr2oOhoAGgBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiI4YAQEAGACgP6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItOTI1MjQxNjE5MjM0ODk3ORiJwAs&sigh=j0dikkvMqjg
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s11-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 / Show response
track.adform.net/adfscript/ Frame 15D1 2 KB
2 KB 217ms
86ms Script
text/javascript 37.157.4.41
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfscript/?bn=45192706;rtbwp=YVFaVgAGdwUK4HPPAAYeMiDiI1XqLd4pP5jXaQ;rtbdata=sE7aJDcJuegbfGs3ujAecRKKFDeExmQJO_TPkBbyu4qOQCXjEme0iSUn6yYso3JAQ0E8W6qBsvzqe2mcEfQSdjKPAmfqxm8EkTwIWyoUwA6K_12MCGSzFA1CgEohwu4a92n4qHsaARkv7cRi-l38B4_4B4A0Pe5Ck2hW09tt585LvnfCxQNYE7vGpvX0AsEB9HSyZIj8IVoRx_2tDow_ifP2teoVDEuNHqWs9WmNogH8bx_s1JcHCD1eSkNiOpcjvKYvaiqLMI9w-iQ4hD3WPE87h8d_oaeBw3iI60gHGBc1;nofp=1;click=https://adclick.g.doubleclick.net/aclk?sa=L&ai=CWfYQVlpRYYXuGc_ngQeyvJjoD-i-mJRcoKWzyf0IwI23ARABIABglYKAgLAHggEXY2EtcHViLTkyNTI0MTYxOTIzNDg5NznIAQmpAsPjD0-QJoU-4AIAqAMBqgTxAU_Q6OLlK4LKptdR8wf4hAoSuZox6xhKh8VH8yZuR0_mE7VjLmmyYw4-CamkfIsPKcSGmzpC6cX0hrIo9IOnuWW4deudGyUAKfUKt-DpLvU9vJuebKoeEYr3_-Ctv5350s-7Gq6RlwCeMQt1JTVNTsyLk1LTdcK7joGIcy4f2BrHI3UPJoAoe4WAgG8ei4s-LffzrxQtBCjUxsorAnBUMPv0LEWoBSHLKJRJwRIzLRK8BM06w89b-T3Gv5DFixqr1q0p3qkZTfwmMGE6MOmTNT9BgmGtn-gyAx2jLRWPQs_tl632zx0CIxC4_iB_qa2FVVrgBAGABoa5-tmr2oOhoAGgBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiI4YAQEAH6CwIIAYAMAdAVAYAXAQ&num=1&sig=AOD64_0-1rcNqIFpUH_YQurjv_gw9DajSQ&client=ca-pub-9252416192348979&adurl=

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.41 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

a9332084aa8158ce63275c43130875ce54c8488673a0172ed377627946f014f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 1654
expires: -1

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 15D1 3 KB
1 KB 103ms
3ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/window_focus_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 688
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:33:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 15D1 128 KB
39 KB 331ms
37ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2918d0edea50f453e2143087cb6f5b232a6fef8b687e228496629f0739fc809

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39662
x-xss-protection: 0
server: sffe
etag: "1632310973010379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 15D1 14 KB
6 KB 90ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:41:56 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 15D1 0
0 39ms
15ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRpaVrEr6lIzVrywvh9bgMJK4vxkr2jH07EPma7mUe3DPxcJ7IjOr96l7bgIsbu-WxmPw9c5ppMWJVDFkI_oETA0XMeMg
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 15D1 22 KB
7 KB 101ms
1ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 09:40:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72275
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 26 Sep 2022 09:40:20 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/ Frame 6985 18 KB
8 KB 89ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/abg_lite_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

830527b04ff3e5ae7d8f62ecb5f1aa2ece85a7a741b332051561787b52ddffcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:32:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 716
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7635
x-xss-protection: 0
server: cafe
etag: 15605042170853735879
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:32:59 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 6985 8 KB
1 KB 52ms
17ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32bc7c1c64fd1b755d48d6025b86b7e7a28ad35d1f420cf85cdc1123aa7dfcd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 04:52:31 GMT
server: ESF
date: Mon, 27 Sep 2021 05:44:55 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/ Frame 6985 14 KB
3 KB 81ms
1ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/outstream.min.css

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 23 Sep 2021 00:42:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 363720
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2798
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 00:19:04 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
expires: Fri, 23 Sep 2022 00:42:55 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/ Frame 6985 352 KB
122 KB 84ms
4ms Script
text/javascript 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/outstream.min.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29e2d6b0a0026b3054cf162219c34ad65705c2e33c752fdfcad9a0f5e29cfde2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 12:53:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60686
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 124823
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 00:19:04 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
expires: Mon, 26 Sep 2022 12:53:29 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 6985 14 KB
6 KB 89ms
8ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:41:56 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 6985 0
0 37ms
16ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTLYLyyQ7dGYMR3sII4JFcmzpTped-o7Ysat12XUbgU66fJrXer3aspqhk3U5B-UBs_zHaC8Ax0PVFAZuqSuDyR4eZ_sw
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6ECD 624 B
997 B 36ms
21ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGK3OjLMBMAE&v=APEucNVZOKZD13y8FcKQEK0H0w6rA_omoNAnVqN0jFBnYzBXysFIcWvydnoxIes4o17iypWkEYJ05h4YRvVDO8cPKdk9ceuFnUrgAw8gkJBecRs_SHXLna1fL5A-vdNVDSGkx8N0yWBb9gIO9znK6o9ynKfpC-GywLDZ0ZTZKei6W0ghfAWmAxU

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CIvVChCpn9ACGK3OjLMBMAE&v=APEucNVZOKZD13y8FcKQEK0H0w6rA_omoNAnVqN0jFBnYzBXysFIcWvydnoxIes4o17iypWkEYJ05h4YRvVDO8cPKdk9ceuFnUrgAw8gkJBecRs_SHXLna1fL5A-vdNVDSGkx8N0yWBb9gIO9znK6o9ynKfpC-GywLDZ0ZTZKei6W0ghfAWmAxU
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 27 Sep 2021 05:44:55 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUl1MF9xnOMwU-A_PGMSiq0XClUlZNodL4WkzTaShWCgNFknD9ULgtRuVhLd; expires=Sat, 22-Oct-2022 05:44:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D09F 72 KB
29 KB 63ms
49ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ay2TKGZRJ2G2zMnQMObcpSUhMY-jCExNBWd3sE84-6iWWJSiBYscyX2FSuDcQs_zE_D2DojfMh02dq4e0tocabXlx5cD0uzupvpkYyLFxYy-YHTHE8bvuDimXxqRgdwmf-OePPGyeoR8--FFctYm2Jhe07hA&dbm_d=AKAmf-DPTV2Gv0qW5GUC2ENFJ94Eckla4BBp7e6inm_LKQeL5wTNU4AwvgMDtwmwBZQbaZX6PRbTvSKGErEmeQkyXtB8RiADyLhz9fpO7uODvrZ7wErjrzpu_hQB8qumNfS7SLFzRFb3NSRBuseAKLhDXJWrlt6XvnMVkd8oe8Tnl0nu5ic_J8apCbkEaa84FVxsSC4WEFLfbTnvBzWgW2mkflGABstIlzSZ2asyJP0fHZkNQUnsuxS-d6LoFTL2NBOG3RX3BGHW9wM6E6Q-k-dTqUVYJUm_ZENj0iSj-IvpHBBn9_mNUqCO6ABDuhqUuIIX-p59G7y0O55Tty1oGUhMhZ4-jHz1BZVF7FKD1mZ9tRWOIDfPoK0SV066aUHZ4GobgB8uN8eMbb6acO9GWeDMlYw55jGNdXKi_xIOZnzZat7DYpKIR9CoHAPsFY656auZq3uNa5KN-tGxHQAfDPcDBe46Stgb_Y3w4hIHwPe1AKF0-dVPD8apST3_zNjhYFHxIm65LzKcDbpf4E9eXZiPsRMHRsAMbPZpAJUe1D_zG0uXmz7aALr6ju-A_E0kkB8B_tsAmsPWvZ8MTtI_RGNHfR6IOsj4XWQITCCUVz484qrjnSLIcg91s9tDYHCRITXwb5sz9STViZfk2uFHPtK6IpDhJEfLlFF57DaFKYm0EBKMSwP4db5aZsZiGIs_zhuq7CCjHtm2prce5OyOWzntzZePzcWgkHX0Yznw2Wi3GvNwTuAGNZpwx0gs1ywThgolQe6L2OMxA6hwCajJJii1L_HMoTOt5CXtzbd5c2tR3_q0TqikbI4YZl_BKOmGPCDrTtdLM5XOQo_x0EAkjoCXm9i46T45d8y0Pn3HSGZGczvSj3GH6fhi08AiUeXz-dlLfrWLV7jHH_vHnTucaPuM0QyRKJibyUYQpht3L0jec5Q5b1b_a8LJQiIQ7jTb6nQO0QnXZJh1KyTiQz-xFiwtWCOfXKrShYPcuazW0gM5Oh9LhCPq6Pl0Kgd9rPFJqoYeBdVhuKcXDjK3jtYeKaFntazVdP0xr_YxmKjgw4T-vSGGTEvwOSbqI1rKL0gqH6n6pI7EZmfsnRW3X-DlgtcpAV5J2jZfGMCckLkcoTtVwNoR01hrzx34OiInOGohCGaBx5QQTPYfxwrFfsya0RxjZdge48zSyozKCooQwfrliZG2g0jOnpCCTKzJ2lfyN_xPc_0inlcqmny3jen34AMnAR1TRyhihQrhiuZnR0zP6k2RPtSYhKxPPIn3bZnosp9qf_DEgUyheg2t5voUP2nQyY4SJFgbIbDWzobiRqIeyKr1wOZ7zCHLjv5oBx3o7jixw4z6XxkjTsk-8Si43EpJikU3qaC1cxvROa7CP-oHwP-e9Sjp-Pw8_i0HEnrYsiazqTlWyRSPBWibCi9BPJnBdszROyiRBBuRDrL1VkLBzfPsPqbdR9fVvI67esICpRXdo5jzmqxRT0gmm1RPLA2i5meC5SPoiMX2gr2U4Izs3AeKsibeAZE0tJ5swueghoENb1_bZCdb-9RDQnu3_ulD-25_54U-ZBF23Y56D_-ZWNymeKsoFLx-ZJxuLncoE4ednaVV1ek8wtmRe-CgdJELuBhzR95getwhvpMiKQsiF8HMcOV4z71cHlBG22-m8r5oorJ0yhMy47NB2VIMN86iGjfYiq1N8_mqPesNNungq77mRzmXKoiYyM5jZMFc2gGDVgZuOj1wh3jIjC27XBiO9pLwG4SDxJOesE-GQqawSEJ9B_pP5z3-3_Jy82OiKfLndN_K9GNnaj-eo-BJo6x7zfkV0tsB7tkYcUxXSYzlK3pUF3E5E825VhBmqDOL80rJzSUFLj3e_YW3cnwaKM0SyYasV33xMlxr7a0qGlr9BzuAmbtzh8UBah7dZrKBsrcqsv3e6qoylANmFUo2rNyHBBaJJovNCaqKODgQumTSQHuA4WS247G8Mil8whG7z7ioXVLcemwOz2ZDpd8Z8cVrcvEMLuT1c8GtSMB2phJqpMQRVYzkeWe9DRdqX3_T9lwlPauedbzuCSkXA5oeq6xjbTdQoZ58EcoloBhwWqmwt5RBMAoIkhYrkmstIy_IvMWqoYaBWKJUf5sG_C0Mq9FZ_90aw_BDA5n6iwrg6gTxlnpBPWT36zd_rwwQrPHwdmSjEWrmGeq8Gh6bcJ8PCsHEQaAGSbj6KHifjTK7rxu1_45rnVIrBpzWhO7TT3aBr9Nr7ptlwEDvzHmOhjTUtehOejVRk8esNSz6kBT5FJ2XX1U91dP9bEhrCKSEcMHhW42Z8GjXQjkqv9kIZM7If4q86gB-ZqntxnK4bq-EigH8UaNlet0hViNM-mleuLCNRYGe5RMqQlalzuwxERxWjVr5eABTlgiXg1D5y9RFo3RSjRfYFaF2FWymSD7BWHW5j3lLj1i9qqJmiCF_qlD9dZRDkaFicSkl6ayoabPBrxOUPdjeq3ZiNfhZ17LQ2IuLgCIdMDHhI_CFxO0CyH48Dkz1douXbz1G2Zp0k5UsujEKu5ikE60MLdzkQcVBYXXy7vYkc4yF7DmprjqOh-ncCClEOEsWUwz3f9Xyl0vccU4VAZkoEuvLVczosJjXyvykoid3dpqafIgjxHYoGBqRufGaQr-Oi14ecBJdeQX0SVzS6x0Wroj9Q4cK6cUgUCVXxJ-KMCct4dge9M57XF9e1CyverzQEum_Zo9p5D0jyB7jQ5Mq9oFTTMR4Nfp3yQwIo8DwEpwfCTqzdMfLU0OUXcBdlP-EbFpgqvVWSICXMpIzlIdOkiZJ6PtInG4zrayH9O62lqOBv0f9tb0BQjDqaGbZF89lHmYWw4b_8_DxuBhUnf2Ieat4RlNy5G1x8H2bpwTBTeqLQLt8ZkMk0ZGj7pWixBzggx5QXdVUa1umUCEVS87Hdb_pgqYQykoQ3-3QLGt2NRlSEAfAgYMxdWTlF8dkDbATqJsEL_2y6OrYHcaj8-l8W4Lvmg8w3rGIBW1zaLttgCFCZCmz2nKJURJT-JGvjl-XtdgCGApvvnG_UOtLW7U0fk73F1TFc3lUzmBTRw-mY0Z1--nuKKr_xLz_zgj_HCaKUTg6tsHZRMds37QFqwTmAImqtdKM6sLyDE_a1qOEDUbErfrnvTVbcyZB1gwS2meFu5X_tQOPVogZCBAMFBYFK0jHwWuI-yGpoU0imtqFL5qq5Am-uOZaTIiqW3D1FJGtB3O4TkE7E2Gh8Lm-bND1EVMIA0iMJYrqW7WdtaaHpT3fD_9BOIbJGjIlco70FFC2jl6q6w&cid=CAASFeRoL5qlHXjFBW07-aYfcM6ba3CQTg&rfl=1%2Chttps%253A%252F%252Ftravel.blogmura.com%252F%240

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4d50df0b4d28b0503e4b352428a7b37979d1a78fc4a2448d70ba10900c310ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29257
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D09F 42 B
107 B 81ms
10ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Bujw57qduR7iXTp53dogOmZlmAJKp5qdQ4I5pkqumvqGTY1m43e4q5Aaq33ATOPcU8zt1lNIo2-1WeffLd5PYi3pMxg1xlOnkDmJ-yJXmHqEASjis

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame D09F 3 KB
1 KB 96ms
4ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/window_focus_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 688
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:33:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D09F 128 KB
39 KB 335ms
49ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2918d0edea50f453e2143087cb6f5b232a6fef8b687e228496629f0739fc809

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39662
x-xss-protection: 0
server: sffe
etag: "1632310973010379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame D09F 14 KB
6 KB 84ms
9ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:41:56 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame EEDE 624 B
559 B 32ms
22ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKL5zcYCEOmXj-cCGKWV2rIBMAE&v=APEucNUdEjh3DhRsF2ohmaUK0wOMZ3s_LHsOGjmYtWs9wRD486JYkxHSdms1S7-em54kY1iQkN6bqnAxGups9HByzOT2RWXv_OYSkn04V_Ct0sLF93BBRRRbqte_Ch7-Yin-gQPhAvlZUXYJC1HY_xLwagCi7IoxE3M1BO9RRf_wSvWaHojTq-c

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CKL5zcYCEOmXj-cCGKWV2rIBMAE&v=APEucNUdEjh3DhRsF2ohmaUK0wOMZ3s_LHsOGjmYtWs9wRD486JYkxHSdms1S7-em54kY1iQkN6bqnAxGups9HByzOT2RWXv_OYSkn04V_Ct0sLF93BBRRRbqte_Ch7-Yin-gQPhAvlZUXYJC1HY_xLwagCi7IoxE3M1BO9RRf_wSvWaHojTq-c
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 27 Sep 2021 05:44:55 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUkwzZw_Q5NeYHkNEDpBYdJIV2iqzg0tpjE5Bh_ZGLoq1b9iX5u6CAXL3-S9; expires=Sat, 22-Oct-2022 05:44:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame BE53 114 KB
40 KB 122ms
4ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 18:09:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41697
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40185
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 18:09:58 GMT

GET
H2 200 omrhp_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/ Frame BE53 6 KB
3 KB 69ms
2ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/omrhp_fy2019.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

569411215bdd18d7660a5d2e5385f061c409915fbf4c9058e06ab18b06fb0ad5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:21:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1430
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2646
x-xss-protection: 0
server: cafe
etag: 7823829336074104133
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:21:05 GMT

GET
H2 200 abg_lite_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/ Frame BE53 18 KB
8 KB 64ms
1ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/abg_lite_fy2019.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

830527b04ff3e5ae7d8f62ecb5f1aa2ece85a7a741b332051561787b52ddffcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:24:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1255
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7635
x-xss-protection: 0
server: cafe
etag: 15605042170853735879
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:24:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame BE53 42 B
107 B 76ms
9ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DlP2kW53Wnz5k0cgUVBBWaQmlozYk50SYVasmUR5fAviBrFNvUs34aBj3zS6FNYY1rEWk8YcLeGj7mTvAoQG6BRNYpNnRfpScFtHSPxAhrK1uLWvk

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame BE53 3 KB
1 KB 85ms
3ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/window_focus_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 688
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:33:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame BE53 128 KB
39 KB 323ms
47ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2918d0edea50f453e2143087cb6f5b232a6fef8b687e228496629f0739fc809

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39662
x-xss-protection: 0
server: sffe
etag: "1632310973010379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame BE53 14 KB
6 KB 82ms
0ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:41:56 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame BE53 0
0 22ms
10ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQsHurR9mz1uhVM7hWDnM9kE7EjsrMjRpSO5-uxUT4afafmtnzRplBzJMj7pkZmhPql1qOoh_9W6y0R0u1F9zkQPxxk_Q
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/ Frame 301D 18 KB
8 KB 77ms
0ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/abg_lite_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

830527b04ff3e5ae7d8f62ecb5f1aa2ece85a7a741b332051561787b52ddffcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:32:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 716
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7635
x-xss-protection: 0
server: cafe
etag: 15605042170853735879
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:32:59 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 301D 8 KB
786 B 32ms
18ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32bc7c1c64fd1b755d48d6025b86b7e7a28ad35d1f420cf85cdc1123aa7dfcd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 05:21:45 GMT
server: ESF
date: Mon, 27 Sep 2021 05:44:55 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/ Frame 301D 14 KB
3 KB 60ms
1ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/outstream.min.css

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 23 Sep 2021 00:42:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 363720
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2798
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 00:19:04 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
expires: Fri, 23 Sep 2022 00:42:55 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/ Frame 301D 352 KB
122 KB 69ms
10ms Script
text/javascript 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/outstream.min.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29e2d6b0a0026b3054cf162219c34ad65705c2e33c752fdfcad9a0f5e29cfde2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 12:53:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60686
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 124823
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 00:19:04 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
expires: Mon, 26 Sep 2022 12:53:29 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 301D 14 KB
6 KB 75ms
0ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:41:56 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 301D 0
0 25ms
13ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRNZXOFEMgtZ5Wla7uworK4XiLG7ccFJ1dovia55Nj3mcEdBrGrVsl6QVW0fQEOcKIu7l7LavQOqvkLDK4eYnm0-4KLHw
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2599 624 B
559 B 28ms
21ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGI3u6K0BMAE&v=APEucNUKURBAJR2PAQzs7y8tZ3rgHxCisVgFO6YQGSWFfeAdsK683--scbyDd4mEFYpEt73aXFpp9zqQzw9W_BTPTc_B1ON9oEWOuHttCQR8Bq3yB5VGeFCxFpU74exy08TSeoDzUtXCZGhbGp35bhud5eKlHX1csE6Bwn52_Tn1nAe0FMFLUww

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=COWiHhDhjN4CGI3u6K0BMAE&v=APEucNUKURBAJR2PAQzs7y8tZ3rgHxCisVgFO6YQGSWFfeAdsK683--scbyDd4mEFYpEt73aXFpp9zqQzw9W_BTPTc_B1ON9oEWOuHttCQR8Bq3yB5VGeFCxFpU74exy08TSeoDzUtXCZGhbGp35bhud5eKlHX1csE6Bwn52_Tn1nAe0FMFLUww
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 27 Sep 2021 05:44:55 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUmGDrrAMe0dDF86Q3oe9td6Ed094EwkpX6QRHzGbiQYyi7OooXLJKPtMZGw; expires=Sat, 22-Oct-2022 05:44:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame DCD7 77 KB
30 KB 58ms
50ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ARKZtB6IDDU6fXkd-5NzgA7XRJDdROfkBVLSMvnT8bzlMkZKQ8q-HcsUkvcGmH5zwDhjpEosGPk-WHR9K6JQuQh8xxvGbO3WY60mIcqm1t2h8gFpbkz3nGIENAIBRde-DXaXw39_FlBUhGjPkNELv0BJvsXA&dbm_d=AKAmf-B3y8NjLeWn5pwnGlPc6b4popJPL4XibUzaxHtkhApXCjamELqATE_3rylplGllbOREl5KJTctRABZ1TNy0sWymRF6XSiZZgOKqz20u8LeCND0HwnlG91djGmVbB3S2VR1cQB-7kWwu2zfcP7Bo0j8STBANG1mOY2zGuW5weykS01GAR8dwaVBCvALI2-sZMOseNLvr8Wm_-yW62whpRMuxnrqT0x1mmlogWYXSB858Qrzrd-JWLlKv68Vp6v2xetX2BfM7r18UuMX3jRX-GZyP1HBoBen8asntk_U0sef655wQnhfgW5m2p_6x_qQLX_ZR2UQJOPhRzTS-aczMnIBzcZckKVTzUFTaibyrrkiLD_6THxodvjnop1RtWgnpL4XxeqxaTPif2HUqbgLlb3rCR4cnOdu1gx3n7wXTLIWb8UQ9eXhsC9JPIqu5nQ1N0nsJzU81aLWUIb1t_vqCQqlJMq4VeDkYxUReCO6V77n0m4WQ4bjCMaWPe9aUNx9nvsWP1-RUyibkyo-H0HT6y9s2p1pNPH0QVY7uPXjvI3vybV8FWDoh6axUoWzu19jO-IX8JIKPHtJn-9ROrZ285Vxp71n0snSapX_Mi2DPGDeN_Jqs7Jco4TqHJhoBvDgh6PwBHaZZEZLzRH0JOVDuseShW5cCBSC8z_wYELNU6maer10edLPmO3p3_oYcTebpUeeER9nNt8RVb2MrbAXZMpJaIQhE20VB59nqkP1maVrr5RwtmErtr9UjNzwanrIm7h48GDx3ZmRe6ue9J8kUTPmlSF1Uja-QEBXfOwdHG6AGYKl35_I3IY9NVhQYKT9xaqkuxxn1D4o1h_whjZvLYwsUJ5mbR8-GD4HnMnIz-MeDKQb8x3_mfbp4WviBdfVUiAGfeA9Ugl18S0-LuQUA-1HQ8Rvk1g6PQLzU0U1Q-XfmW8S8dXz-ZVs5zuH7Vd_1yh2FXzezIkM5wk9rlsx2Xi_u5oRSCcWOCrT4261mpbG1JyP9M0d6E40CiYfLm3vs0WEx7GJkGbJl5usFBPj9FwEhxia1-h-U4TgzTIv-HYORiFsju59lTZ30iJSA2zy9cUcFNCVufntJLz13fyxcuxLCcvJ-mHp2kjkXMWWHnwyXpP-CdXxq_-TwOufsky-7mhlNgWWFUxJj0Wp-f3MhY4eFjhWEk3lIE9dWjNRL-NqhQecNwiAI5cMc7lxf2VeIsZsycdFuLs1vau6eU-Uk-v8G-GCXhVpKXmUQUDNXUrhg9Wb2qJZeHC2bWT9Prt0njkNcJZlw3fVZF2GTutjqSM9VrI9MXMVM_0V1vCF8sf-5CKne8iFkhGwKVBsZt3DX_PRwiDqHmcEYBpkboRdFwd7qy99hvVyWdPE8epTj4oQdjFB5I6KbWO8j4NLtBGY1Gf1uCjO95LIsKmgxN9WcRpvaZQrHxgp46H21Mu5wngC--AX8N7DfAy0uHis1Kt1ubmWjVZ5RdfwEaDeri2NDmEwRmnLrU91SQSbew8r_gawfQ88oCQixF0HfIMLCLo2OoViB66cxk9wixSozY30j6jgtGbpk4dMM8xOnMdtXA65avUdnqie6VZZz_3_TON_n8N2XvEJtIfQW05NLh1wl37Dfd9J6cRwG0grol7EK3KML6_J0XzIjFhRmu0OuljG1Iyar8yZ27YDMu6RsedTjk8PDj1LThRbJvNvtU9DERfPyZU4H-wwPgJlGH3gGooo89tV_PAsUMNJZqF0NKzhQTkI85BOTV0ExXTDizYiVDGTd6wrmm00jeLJi-QAp8cbr4iI3DrRwFQqniUqO9zjlxdmZgPDmlTNT51KVXUU3YR7L5UXlfe94xc1PN0miLZ2vlAAzOBdRBd1mETsL10NyP7XF7IPKgf32iCzxOI157Su81mEF9PC-9m3ueXms9Tv6aBbsnIelEETcwC6zWyQEkQMSsYjNwPzjLgW8KQbgv7ssHfEEimztoBfj2n_UDb5XSTzMUQL4JxUGU9rWPqZD-RbJzEXUepB5MPI_v3ebX4HQtF2ALzlMGULwZ7u83rK4FeH_6thLOrbn9qhbS0Z71PuCFyQzzJ5o3muhtrvsliIChH8NeDRBF4UI-TR9fSycnG8i27BALxn33zhgznOPYi3Em9pusQxtUFwabYy0_uqh8YvwOig0XcJf1KHxtO0cwwYZSLdSyIwEgQemrUnhISP817srqf7ivgxLMDPAcERf3XQ3AYOPLmEmnsH_EDAHksFFy-j47wxiJIPYR4QWiIJLa9OKV2jycsRR3acYDi00vtO8X4WgES6ITG-_dHY4CmaCTtlzUuZwn99LfBIRakukmBmpmKQ1yTFGTgxf0zCHIgPwZI8yWfVaLIkQ5dPAWFyc2Dl869twyQW9QNO_ePKHiK8LAtbOgHVF11yPl3MNh37oa6KKmRCL2FzXXqM4_40Ygs_XKCk5i9Uf8D9R9zkVwcOWzTfRh4ROsW0rlYRF52DELAPSevxotoL0ZY9MBPXpYBbo13oC9aVQWNB40DSZT3SYJzcGCVNWneqyIRhZNXsfMyyCc9NGL1bRexmEvzCJraLPmDhzEZlSyviHfpMdVROlIMxL6JKl6h9zmrhrU6g5VYLJOeO5-KAeL_4fRWXUm3a4KdyfrAYg180i-xJNSRvjvnlJCVYaGDy6ogYEddXw5oD2N9sS1U5M3zbwa0ZFxBp4NdUfudZTDnT2NesI4HJ0dEtcQDmMLYkrY8I1yyHQhaZg_ESEKV-qe4rW0BvCCKGwl0C5-7TzpougqocoIDJ_VowK6zu4quipzGQYtlf_XVAeXZcfiMDYFos6knUMfkViBdoOLr1UiWB63dB1H5pTferoDxYccehdybsdmaJ6Beh_EG1EYZXWlcmtGhQsfaVfyEWaHo4HVIVCIoXDlIGQDrSdWKlGQSgP_vN0Uz0n0YyP1ndNiJFMj_xDKfClWpb97sxqN9JSo7Hotu0ec6n1gcG09PV-nf4BnibupdBVStGNQDMd6eJWVIpboGOO7wmEOGvWkIXYOvvDu_YzysA3ZdEiOn3tP4GWPGK6PMfXEFqzBVhpDFSGLX5iA8jq5ENnVmMjkmFr-f14xS4D4VR3nvDRJEg-fsbhlZQmWycabUzqQMJxQtQpfTLM014W5YmFRO6Fb5sduXKuUzMrxuzn0cuojaLgG0nveN0qVSdjyUc0fGfIok8P4_U9goIDMnuLF6tOZiLKfqXXfYU5dWOSw_jf6iM0ovlFZY4bYx9yNnkYawdfj5Z44tkSRD5TmzqT&cid=CAASFeRoY7xILE49bRsKaw4jzR87ZZQkJA&rfl=1%2Chttps%253A%252F%252Ftravel.blogmura.com%252F%240

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

021f4d18dba4fb62c4fc14aac4195ba0cb98b1c9e53b2665cbfaae21c8b190e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30190
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame DCD7 42 B
107 B 66ms
10ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BIGILfCW751gfWoMvUaEgJkcbpxyli_z9j9dhxroNlPbZqbONU08est2RpGKvmF1A9ReDAm3rX4QCIYryD3Cc0Jl5cKXxa1IKhGxkmXwmrb6BSyCs

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

skeleton.gif
static.adsafeprotected.com/ Frame DCD7
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/741547/55522707/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=

43 B
258 B

54ms
28ms

Image
image/gif

52.209.62.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.62.127 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-62-127.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: nginx/1.16.1
age: 18557616
etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-cache-status: HIT
content-type: image/gif
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 43

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-server-name: app05.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame DCD7 3 KB
1 KB 73ms
2ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/window_focus_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 688
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:33:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DCD7 128 KB
39 KB 325ms
59ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2918d0edea50f453e2143087cb6f5b232a6fef8b687e228496629f0739fc809

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39662
x-xss-protection: 0
server: sffe
etag: "1632310973010379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame DCD7 14 KB
6 KB 69ms
0ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:41:56 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame DCD7 0
0 23ms
17ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTaF0O8cUqB38tG1s6dR-kyd2WcOMxMDYMHTHheOZqqj6A7eOk_AHJLi0l5ke5NptiycK2EGxhYnxKVygbS7jpr2Of0NA
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 97E5 624 B
559 B 24ms
19ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKL5zcYCEOmXj-cCGOfh2bIBMAE&v=APEucNV4CL5dRCVqEmgD2YpXhOaL5nvQ5sgnJo7Qkccu25373-98UMdbC7n6mW0EaLCppcWDWBZZDEmwjR5fbQXd7J241c-JV0uukku_0cdpd1fYp702piJ76onnB6GRpoC09yNfScLLD_IncfHxiaLTZPkYVvybmcgl6Us-f_4HLXpvsaTLa0k

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CKL5zcYCEOmXj-cCGOfh2bIBMAE&v=APEucNV4CL5dRCVqEmgD2YpXhOaL5nvQ5sgnJo7Qkccu25373-98UMdbC7n6mW0EaLCppcWDWBZZDEmwjR5fbQXd7J241c-JV0uukku_0cdpd1fYp702piJ76onnB6GRpoC09yNfScLLD_IncfHxiaLTZPkYVvybmcgl6Us-f_4HLXpvsaTLa0k
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 27 Sep 2021 05:44:55 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUmofvw2MO4yDzlzE1N2Clfzp5xupcAWnaYgjNVN3GZrdU0zX6KgKyqHCvC9; expires=Sat, 22-Oct-2022 05:44:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame C63C 114 KB
39 KB 108ms
11ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 18:09:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41697
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40185
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 18:09:58 GMT

GET
H2 200 omrhp_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/ Frame C63C 6 KB
3 KB 51ms
0ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/omrhp_fy2019.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

569411215bdd18d7660a5d2e5385f061c409915fbf4c9058e06ab18b06fb0ad5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:21:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1430
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2646
x-xss-protection: 0
server: cafe
etag: 7823829336074104133
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:21:05 GMT

GET
H2 200 abg_lite_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/ Frame C63C 18 KB
8 KB 44ms
2ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/abg_lite_fy2019.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

830527b04ff3e5ae7d8f62ecb5f1aa2ece85a7a741b332051561787b52ddffcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:24:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1255
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7635
x-xss-protection: 0
server: cafe
etag: 15605042170853735879
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:24:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C63C 42 B
107 B 58ms
10ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B_y8MDbOLcxg1UJnSpNPYa6AM55uU-V5nagc2dOAhT3BxFA67M9LBFhy0FWvdnkLo41ix75ff7fM8ztlxqv0aTauptFSDIbRrFqV7Ej4dCFqIenHE

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame C63C 3 KB
1 KB 68ms
4ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/window_focus_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 688
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:33:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C63C 128 KB
39 KB 307ms
48ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2918d0edea50f453e2143087cb6f5b232a6fef8b687e228496629f0739fc809

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39662
x-xss-protection: 0
server: sffe
etag: "1632310973010379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame C63C 14 KB
6 KB 64ms
1ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:41:56 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame C63C 0
0 17ms
16ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSVrmE9ilK8fD5McjB6CxQZM2y7DWAZVp25iKpCCiRWTw446QPcNvpaDvCDZjqNqE00ddnbn-7Q0EIL58H-A5gOd15zWg
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2FB9 624 B
340 B 328ms
16ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGNvs6K0BMAE&v=APEucNV2mwqnyYohoaJLFOq-oT1pUn6-NFp_NCyp9Q8h7egyOsQOiHdUqbarVrf-Jx5z71UDkrrUyXf7dZHluIsHKBDIsIz2ErKUBbXZSoyzeeUcrXTKbbIqirWB0wCZQKUQDZYBegbgccd5KNN4_XNQq9ij5vpk1qzwmFWf8vYquKUP30H7aTA

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=COWiHhDhjN4CGNvs6K0BMAE&v=APEucNV2mwqnyYohoaJLFOq-oT1pUn6-NFp_NCyp9Q8h7egyOsQOiHdUqbarVrf-Jx5z71UDkrrUyXf7dZHluIsHKBDIsIz2ErKUBbXZSoyzeeUcrXTKbbIqirWB0wCZQKUQDZYBegbgccd5KNN4_XNQq9ij5vpk1qzwmFWf8vYquKUP30H7aTA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUm45g9G_wJnwPNIXaOP9kS-6gNYq6a8PlCJ0b-cDy3FoIxMVM07eTuJxsnzF-k
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 27 Sep 2021 05:44:55 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 18D0 87 KB
32 KB 61ms
61ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AMq_t0E1b6xugebJSpmI54TFCoFP7YoOH0mt5NGMzjrlWIhwhnyLzkTv9TY0mCRXee9hs25IfdIh5zu9BIktDVagZnB7PSvdFQF6h166twPWrqUtqJpRzsx7T4aKmZhqJFLM5KLfGV_zLB8P-RWzVU3e0GuA&dbm_d=AKAmf-DU3WfcpUAhkqbZRpWRXpSgTkOtYB9hSewTeEly6BK-1Kte1kNTsxUNTh69rXXtlniD3xIXuCzxujn1GgViuJqHU7m1PTDoe5bBFs2vSRQBqsT5kVCs0sF1XN2ETtf-L9RGb1nULzQdjHx0ex52zqeOqLWpS2JOQH0wJtGkEwaozLcbRDrABEdlVzQ5twoNNs_bDDsL5C0whJHNqr6VPOyqN7hmaRNjQQB-74MytS3iNzr_VRh7AGQ1Amu-Og_OIp_5G1cnyvwChx5Lms25UUClzPt45gLyL8x--3Stefisv2TaJ_zsrljKmavpPOcqh_kSobv51Xr1x-ir01kn2eKsMNcvp9xHcLHsKNo32RlXp1O83R0lKftk5aYBcEWCJQ9FHSi9OfaV_oH101h3kULz2zEv5la-Om4HyJ_YXT2BSpfB2nmNBCmSsPr58CxgEj5l_El6O5s4fDDk2ekWwwPzITR6tv_zIkYa-MVMOFJjT5xrS62ipzzgN833vRwbOMvfiG_vBi8j6UpMG6fY3z1fzh4mx-lhcAtW7MuTRd4Va72jZZwvjQGNIPzBqZlspwwYA1QDywyubw61SUcDONnVDrQTkfbFIydnThY8HpOliHCGN8FZmqxxycUeRSIPGSCLxGbdGPSk-ixA35nnFBcf-lwoTtoPqIxKxpdzt49VMmBDYlXbFXjySJVOHa_sPKc8bkTKsDRLqokQIBK3T6sIZFNr9atVy2mxdiAgfghlog1BcOvEZHNLtBeiDni4SFUUYWVAOSkduQevLhJqgeM-zwZz9Bmw2xUX2_FwpddssINK0gAxi7j1GdvdcF-jocySmQfPuDxoYXDrH-UqInx1D02r6M5OXtyNywgpo6Qh6q14Wx9CQfj-r_fd_StVfDXoc8ndEI_x5FktzIvVrN2WHb-cqm-XBr2O_urm1Wq6zAkg0uzYnms77-5XJXmV1oi4eNOGK242ZoSlu2p02Mc0SJGWQTjr5NKPjC3_P2aPO-c7iw2iqdmkk-MxfrWBIBqdsZeOYDRQuWv_HYwn42fko4_CTDcGMgrzxrbnZ3brvNu9WQuOUb7KG426EcakRoymamGs9sAHjTTpeALFBXRBaBuNnIYy_nmn5R9JGwO0uYoX_9rTOhkCGHBEFENd1RVJzbbvK2xNcHmjpRFPcYK7MRfIxn_SpIn_TZddY37WeN2CkOUZw3XHXTJ6-vhgyLsoj-1mhBoaGRLOrakq2xrYjoGjvfO0Sfq--MOt3izwkx0gdoV-s09hG6_LGjAeuDf7MmgALHAkjuwEeiltMkioKn4NcLOMbBphO-YW8bwCYt6Uf72Q96N73t04nKN5GywCpRUwTe3qar_1BLjIkjD0lYtkx4kWnBoNe4_5t18WuOYQcjTuh1iihA8bRe1EQYShtuyKroINbyC7jGwQ0hsEQuP4wNp-VIaqlLNYrw-PrlmgS9O-xv9lC-emSg8BqHFfUeESS-Wi1LdcKK2nCgN8EwLhS4n3DJwIVslGKZqespTedOZ8JSjBFFujeqyB5mMCUUNcbl5kIOy6o5oKAsLbEKWDmw9aI8w3xxNhR4diuGsxbjJptQEYdLysElkuUAkipJBdZdAlL9gg7dPvg5rwkgrnEWPCAvk7_g497B_WYlLra87DgWTSqDMN0kU7eqmJU0GcPPDzt9lhSfDExV-UwU5QOhi1aVQehbWjOpYKzB70I9BQ0QCcOursT1VEzOr-bHYc-3Q1cf40JI-p8_O8UZhYyNIb0Mwm-UejuSvl6Vu_h9M-kUlWvDOFx0YGu3SGrgO3CVLjz3DuslNIK7sZl2ANgPpvtRVrVSsFoAZ44OGcppWp0y1QG0r8oU47OAkZTCv8dwoOJ2ILqzmlhBDYcbVLAc3lMFJrCfhSIRstsjqFnYRWL9bfV9YVfgDC1Bqins7nanLJtGfL3TUpgmk8KLzDyBuN8P3YxPMp4Au-cdPciqmk8FxfuS5CYlN4Us4IAg0Q9fdog2xf7MtuC9Ufxw5OjMAzn4tFNotkmpna6mAAkQtnMYfejqnnnSjvef5iOlq1S6BThDX-4Yn4MDvFYxIxYEYNEtpvyh5JpOj-ue-nl1CZ0yjb2714h4lFrvpR3G8T4PRVWVqYT_oX8HETHbvR_zaaU-FqXSM2R-HYUL996OVqylm7CwHxS9SYt4qqZC_kqv8srM_qecn7-kWJXIcn1p4tBS-7chFu66-Vij2aThfQg9Dr5Os0_AIuKGqb2LYTJF6nULocZatRK64bdxraIfgzDTq4cjB_LeB3NjLgLGWyfFcU4oZz54-a5AYsqW_7TG4QVihxXBtAenlq8A05_86t_nmOnZX_qBtLi4FhBNwNLNdEPFTxI2HjlBalnGuRuHe8cxxS7mw4w8DKrMaJZ1l-ajlD2bow-3kDuHp9_J46zbguHhqhYY3jEYnfc9fCRbT2S28dRxTkttKPyWgq0q2c170S3hW2bx_Y-GbQqsmfWpURDyhUGTra9dJ3_A0hnzZZhz_4mnAuFuahVAqUbAAEH4NF8r-qJDQmBobFYMcXAiAnkeDS95JCUmeyEPVDUc0Gr2FqoGqVuC1cXhqUBm40YXGNhoAnpJ7rdG1QHe29MHG1dQwAD2iu7AUbPCwG35vXx7HKzCjSQl2Vne3ObqpEgROdr1MJJQgqPLFrjqMXInpDE8uSfOZtNxM4_mviMh7FK29q3t4lJksWK0cj1rDU_8u-565hE3RTYI9aQGCN6ZbeIZ735CPJaq2oiAfTvGYRdT7Vya5IDLeCwhQl77V60WmyVaZXC0pleV1_0C8QdxOYshZW7CAvLoHr3wPKLHQiorCknWEN0Y7mrqygFc15vy-hSDY0Vzzr1iIDMfU1wu1Im2xRzAnZau_02u3TQCT5peKBCKRxSOdOWvnzv-X7gQ6Sa4WF4h2is95AUA92bH5xznn6a25MrbyPsYDW1YBW43KKciZZXK8klYVyFcIpzXcyZXhjag9F6RKbOHLCbAoxJH66BzYVBQStbZigGSw4i2aGURL3-AXOrOdXZ2K_JNQME_ZFVdUleUudK6tSPi7X3aOiGM2Na_5o5U08dnoGhp3wf1k1dZ6l-uzfDD_R7v4gjjY_nsXMUhA2E0SEVnQM5TTxQDiZCXOg6QhlKpO3X8THjg00PckoQZdEVOk_qsfGJlqhqx6HlVWyCAsusT5MllaaM7ow2g31axnL69uHCkBfJQtPLKcekTAG0n_PTL5G9S2upsnvRBBikjN7WO_ECWVY-WRlG9JocrRX&cid=CAASFeRoSJz--7c9Sjq2jFHiA-TOxoFELA&rfl=1%2Chttps%253A%252F%252Ftravel.blogmura.com%252F%240

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

88e232cc67a7bd32ab42395b9db6cf526626c089a6de79c2b0bdab60ce066d3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32984
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 18D0 42 B
107 B 57ms
11ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BhUefeL0HIPddvMvB4PWtyaKRxbEMMzO8CdRDb7U9Kyv1xDrRE-R2Kr0V1qXSyg0h0gGITauqvzuW9Oz1t-qV001jbetDFMAJ6O0MPN8EYFE0Vt1c

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

skeleton.gif
static.adsafeprotected.com/ Frame 18D0
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/741547/55522417/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=

43 B
258 B

113ms
28ms

Image
image/gif

52.209.62.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.62.127 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-62-127.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: nginx/1.16.1
age: 16113824
etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-cache-status: HIT
content-type: image/gif
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 43

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-server-name: app10.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 18D0 3 KB
1 KB 51ms
3ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/window_focus_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 688
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:33:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 18D0 128 KB
39 KB 278ms
36ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2918d0edea50f453e2143087cb6f5b232a6fef8b687e228496629f0739fc809

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39662
x-xss-protection: 0
server: sffe
etag: "1632310973010379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 18D0 14 KB
6 KB 48ms
0ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:41:56 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 18D0 0
0 38ms
10ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT4h9vrtSojgEeBfK2xrOGVfoej7pRokpQn7CK6qb9Hrb-TmmRRke7XgnEh-rf4Io8xe9xuscVcKkEo_BRcrCofo-9YPw
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 7B13 640 B
363 B 322ms
17ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGNvs6K0BMAE&v=APEucNV2CBdxUzwfbUpox6SvEGXEcx-BNzmaO2VK2ptA52ETVMhd2QSb6pQ-ZaXxIqdOtskPWgzyPOvozOuS21TXbATegYQJXCOJ870z34ioRz85IgDdLkDkIOmuw2wTjamQvOWf1HGoPeeUHpl-Zxd2TxgyxQxPA8qLYVcT6q3FOmXm7GILzuo

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=COWiHhDhjN4CGNvs6K0BMAE&v=APEucNV2CBdxUzwfbUpox6SvEGXEcx-BNzmaO2VK2ptA52ETVMhd2QSb6pQ-ZaXxIqdOtskPWgzyPOvozOuS21TXbATegYQJXCOJ870z34ioRz85IgDdLkDkIOmuw2wTjamQvOWf1HGoPeeUHpl-Zxd2TxgyxQxPA8qLYVcT6q3FOmXm7GILzuo
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUlFBBtGxCvohQNe2vNvupd_XX0eE55NZkukm8o_7U_inCmv3Nl99LDb_948
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 27 Sep 2021 05:44:55 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0B19 76 KB
29 KB 347ms
50ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CTf_Lubar_ZfRiYpEU6KoguTX3bgCDngfv_f_U1S_BvHiIrBDhGtE7iUvBv_IiWTegtqyV00Iwv9feIGCOnTnVttqVarHIzgIglTO6bUoOfW1WaLvYu0SbwBTDJqcJSpAvdDXT6JC4qi_Sg7mPflOMr1au0w&dbm_d=AKAmf-B6yoQZP6G8R_LbdxbUCjiSUFwF6VnhSUB_YqYrevUbgwCeXE-AkJN79uUhUUabNItkBYP8nAz4l0MLVf1k9JHbQRMfm_wV5Rt33e4nutla8l0OF5916DoeQ1VqhSaXbe7kVlVsqSj_nx21rkTysHBmhWLdG9pFe_b_MvRAFnZG61WllxuOsTzpjsiPsBvUKpcrGItFCAFsVzVlY6hpQr7476G8iimQqZYGpy_1OUGb_JRceY_Wt_sFJWljobvslS78kfKjQoeIxZ7RECe5JGku6UcLvdHbLgvmqHvmSQ67RZZwJxR_Mlh-BzjesnKX-0Xi_qijFk3ZSQjlg8U8gmC8W0p5hZHmnLDFcU5gA_ce3wAjAvLNju9l9dpP5Ik_m7mdeQ2EKI4rVYxattVqfE7ZF3ypoD6-ceoDP0jahoM9-JcaBZKXxgnGHIPYwAhNlirXP4pyEVOKNk6yT_XrpEIUNaFta1BmPEx4w35fAN2Csj91qCP8CSVgaIpVh8kbO3lGTg-ashkFYBy26EvRZEStsJi_s1fIDDJqOh-rXwpf48kXSln3K8NK8nTLjZHGjPbZ7KXhrvdGLHPNiMUGxzMzrqAEdnUmzblf7abQpiIHhsx_QKtHazd_73Q2VexSrwi310Lh_ktpULPbEZQjBu4rx8r6oTPxoGTO57xddHfrIViNCF4CNlE9xu5ZobjwPN4RY5fROs9o4GQI2c0WJwPmXXpp9OZdbopVw4twmkdUN2WFFu1zyuE5mxdWNCz65rJ6ym9XXgl-ZbeB69pKHLPKdybzQtuD4oKtwU4KxOFmXyAadQXQhEuqXlDv8x8NtSf_t_cchJfLzYVl84b64KY6tzPnZJLz1nAntgg0obgYCc9IOH9hjBbL7vvjLcd4xrkrrTxSqrOEII63YRT9yAwxbwTbqbsGn2oXGxFd0xitSk74cbAqBu-l_ifShekjpYwie7NjX10DSEUMi15RzqVWAGIfAqPOF28MBTFFus7B9MxG6HSkUklQH8iQ4KFFDOUV1tYvzzZ41vUy7nLocuAlvSpwGJkR0jBQCrJ7ui7j0F8flnsL4_M1MVjwfpBfNbiLEkh5-agshTF3ceZ9g_2Dsq2YE14FOShbFLSfpTrtlEqHsBUeUTmIHL3MkPkh6G6vBjlXZrkDTr_V1ykm4OMvCQk-04cL0ky98R1hNy60Ew5AKx63RrmPppWt3dlpZWRS6jKFfNLUqmKJ6MRGIQACaeWKQzsVjayuNWoQ0iqhcWY389H0x3Pqu-aCKWSSuR9aDZ8dGTTNlhfbptepZXEeY_xf9xuGTs6QVhNVxOp_PLau6havLKL4jdhCXzRueNdbXAD-RuJd4L9J7P_zc5t_QRt_VoBwsE08TS8MUMdYTpfQ_IkhUYguSIwLs4jZVruhE4oKubwZyeWPvfdCMYwqrTGwd6mYtS98XudE2yMJ3JCXR2bmM-68smz2FUjt-sfzL2EwK_lUgVL7mvOX--HlH99xHcX_Met7jD3BN4N69WgqD8W19T0PZO29e6BPNQB6mIrbCl4RS1oKzb_ns5WwlIckZgtYvp3mSesWGRYNGljFMdgRYCatZZIt2S297h9ufUeDY0hNivFsKC31lgkaoUaUjVc3_cVc_uqdm8NfG612VQpunyBokraGWLP_2FnzGNESak-YRHxxwr0bNnXIC384EEGpRUhkIX2nZk0gFm3KurLpNpvyyfVzwzDxsuJPzAi90CqNf4DHA2X3ct-U1NKTFgSw6yXuX2NOnBiBYc9fEWauVdeNeEaaywO9k8lqtCJmxA0UnuVFdFcXm6Nyl9X56Y5cwmmk9MRH0xGwnxKLuXo72CsF66ant-n5SvmwSJxXm76bVYkDSp_9Cf585F6oDCntUr_N7CqKvMlXQwlsT5zsSHuwkMilMfvctzGhtcAqPS7At81sOk-FRyKtLT8triBmUDIW4pT7qtWRxbFscoyWVkYI2YOvIN4z-gU7hjKDORrNkRCPSwvA8c7m2kPQyPd2cTHEBp3unsAI7JriskFt5f-l0wIFcCrQ2JWfFF8kiqWuPMV7vE_-WkYzFq2xGWJt727WfiehlRt8yDMg-i-IJdzIY3cs5e4G3l2-2zyaPbTEXbQJO6tF8CS-sf0wAPV6X3neHNtfnjagylF0AmYx-8Bdhe1Ne7vsWgVQ97ROBbpBXeXRcqEktMvJVIZDdJlrK9mxvx-mdzTJZZ9NrDl4KtEMc8E1ykkZz7zGXkgqZVx7cBI_cr2TK1jCGEuSHTARALOplb7aWkFapxuf2TJqHqHPgamPQOTENtECMwhXLUQ0CP1DODti3QPSLgVjwCRV19QRmscx5f32Z1KBWeHzAAvY-kBnDikPV-M5-A6GXMyCexK7KcaASk0o6wHAplrEpg2butRYeyJXRkKEZHKKgiFtkHlGP2GbtsnnnEEtfJosJbzxMwOM1KOIR7XkdyPZOu0c-k1D9A2OG_KI-txyyD8MKemilbUOeOcKcxlSLC3685ZAQGfdht3QnDHtJA3bG0wz76touF-Rv0nsdSsp3rsdDm5cclGEZmxVS6eCsEGCYt-bI5IK_GhG6LwfzwGzSNY7GiGw_U-vL-TD52rmGwnvt1p7fzyS_B2tBE_k7Dw9jD5WULtXzASZ0wkl-TKPUhwUpXU7kwJ43pYO7uLiG1oP6z0af4ZpcvuiVntZmgxcgzgAmZ2hpqjR926tMGd5GpCQuBxBewjst6fvtwfxbWY0Z3OQkWRVp3hy9zaER36BnQ2QPf1amHtA3ZHXwICIhnCABKaf5Vs81lM1ot5SDGhA6PWp5vmfl2-LJxgTGReBBKJJB6aO6V2mKrd4pjPt2_rryyEMEa8tQDR_K1m-xLFUkM4M8KVHFmB8GmFAmwhxXRGfqotC2anP5rh8LsNvqfRPvDo6fx2oVVG2vmvs0FKPoE5w9FLaaksworpdlRvHwq2MfHnVfuN17jG_xJxX6cn8He_dVFkhJ0I171ixpCuysLomZ8KrcFQHAxutwX00l-U9pX2cgS1TQBzVBUN760ox6kYWQWlfS8EjW8MqBU6w3tCBaMWsV4b2F93Ylgb5-WbAhXHRePZIHy4ZZT0vg48GQOJ9a8pnuF4G9DSa_V_71pTNXGxVwduwYFhZ7NV8f30mHG9-CnQsPVH79-SWDWPeqT7v0QFum3k8HmCdw7BKVjJ5PG-Qa8_ABFI3WB4aU5bYO1PcZCs9gGWzfRmiUj4r_9_Nne-054-P67i9RjWIWu663nqx8TrjSgTz&cid=CAASFeRocQ2F3ounzvozhA0oQw_0wMmDPg&rfl=1%2Chttps%253A%252F%252Ftravel.blogmura.com%252F%240

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8505e2b038836806f6a8cfd22b9030e2baa4c35b2d24a1fcca3aff05b90bca43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29599
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0B19 42 B
107 B 34ms
10ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DTtnP38tKrKMcaAwzn-EeYfVylRNJ6s8LYNgqs64WbMNbMRpysrEC_8mrnsYJJ_i5yVzE_D8O9sdc1N2WqmrCC8tfWbSLLp3RrV9flVArDSXNmubY

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

skeleton.gif
static.adsafeprotected.com/ Frame 0B19
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/741547/55522417/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=

43 B
259 B

111ms
27ms

Image
image/gif

52.209.62.127
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.62.127 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-62-127.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: nginx/1.16.1
age: 18554905
etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-cache-status: HIT
content-type: image/gif
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 43

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-server-name: app13.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 0B19 3 KB
1 KB 48ms
2ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/window_focus_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 688
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:33:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0B19 128 KB
39 KB 260ms
21ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2918d0edea50f453e2143087cb6f5b232a6fef8b687e228496629f0739fc809

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39662
x-xss-protection: 0
server: sffe
etag: "1632310973010379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 0B19 14 KB
6 KB 44ms
0ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:41:56 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 0B19 0
0 35ms
9ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTPOQAmeCgX4YOATMuvxavjJSDXllLbqz-qCyzvrUmMrgGFevKxJO6byE7-dqEbXugEBs2jsKFoMvZggFI7RrXNQ0VVJQ
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 50E1 624 B
340 B 313ms
18ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYsqK9lQEwAQ&v=APEucNU895Q_3K811gHeBCkwSr3Uo4Fc5xJypK84sZBJC1F5HQAjytr4Li0cqhhnY76InfdlFkZFae4rj5_vPUCaDv2SksMj1Iuh99z1zhnR5gPsVOc4_9f2Z3JAWvbTGCO0cQq4-NXacH6DNdGAQoUfIQz-Ew070eG1hK0ly8dMdK_rF9i8fwo

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsYsqK9lQEwAQ&v=APEucNU895Q_3K811gHeBCkwSr3Uo4Fc5xJypK84sZBJC1F5HQAjytr4Li0cqhhnY76InfdlFkZFae4rj5_vPUCaDv2SksMj1Iuh99z1zhnR5gPsVOc4_9f2Z3JAWvbTGCO0cQq4-NXacH6DNdGAQoUfIQz-Ew070eG1hK0ly8dMdK_rF9i8fwo
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmofvw2MO4yDzlzE1N2Clfzp5xupcAWnaYgjNVN3GZrdU0zX6KgKyqHCvC9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 27 Sep 2021 05:44:55 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 3612 25 KB
13 KB 331ms
42ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AQKXxHJ8gD9QRNj_8btNRNMZCtFS221L6UJ-JU87fDNeTb72-5ACehK4RBYH02BhDe4edVghvVHATlXUMpRQgwLG8_qPvVm-Ov2xZKzMGF3JfOpeS7kJr5Alku0b_Mj_AKyagM8D6_IKyu5AI53NtmaqGM7A&cry=1&dbm_d=AKAmf-DxCfjub-cz7N3QB6ZyUi-1swTi__N2L_oWzxbSeXQSpWJase5HwaKEo1xXn7yL7c5eHRFN1vBNNeLxC7G8mPeOTa4N0WjibUNJbI80Zqd1zIO9sCiTLYxrD3WRVrjgw0-UeFkuuMbb_vhI7TCeBM0__PPDaWT5i2mOvm2Xq83MG48cOPIlxEWTWWxrlN2iApqiV0Nd_bL6qPQnFUvrkBjjP2ySy5HP0qkLtql9r_qdw3oArQT1oaH2ktNs7oDG66xWYm50zoAyDVFJTgyr-Ue1WNeuxOVzsGw0xxSe0ZPGLRp0RCiF3mpzqUlYRV8zkjH-MHkKEoWa43CDGiSLVx6Lli1Uv8zkmzShwJdjCzWqkSzWmThM5IHEA5qLDfsyZsZMIAIX5HZQj3F7bFgXrBhPHQsN-Kk1WP44JqHAG5aogyRhBqvgRplDcy7x3ZkeVnd2HwAxgYUlVORYpyKzKktijdlipccFjjs5SdICtuJdr84Gus6iFR2lHEQhWZg_8N1xr0_uS9z7845PdANWlxFuUN-1pD7d5aMeWLooxkBsdETBjcSy7NEoLNg895ALDuRmmc5HrfjoXusrZId8fYOa4J6RYmece4M1n3WyOqoZbos-idOLgIwO0nnL65mhejmZx3CuhagTlGk_e8Y0ckQldh49j-ZtbGgvO3crPxgNnMULaHPxyCmX3EdK5EzRiy0BlfhCOaIM5abMOXlP0v-99BEB6WOtLOOPuYv2Q5Rxt62m2NMYHlZkQY8EOPRVK-bUKaXwcej89nvsY-d8yH0VUkL1hKE9WwrHMVe9Hqsajh2WVN0OgpB-Rs98uSgfR4NTqMjKQ6L0nDwTsOqSJcTmgqq8-gIe9Zx6VLmu-EqPGFfxuLeXvb07JITFfNZlfx11nYE9-14seqbKgaNmsep7zsklnDXws9M8TaS769pPhWrIcHcEiJmgMr03L1sFVDBDNkq-QRSgbD0vBp8W112kCOESYMCIvJMZtR9hiVmp9DJMqwSsTjRIZ7GcV6aYPwIMWNh78Toab7LhFgNlHhFuf_DhfzXm1qTniyxuYIi3vY7ki2X1V9pT-BkaOycTaF6G9cDsftUVf57AixH25ga29bff08GwYBF_jnVXzDolGjHIWoOaq0bbn05-vJLas7RC5TII7TN5-CESgVEmIXcs00rkHf_UFQgM5FL8pQY65vCLWV_234qrJqn3brj1NKRfpL1Ugb7xkETEDz3znTmVX5FWr1G-hNmB7_9bOBcK7naqbmu70Ks4LbmoSHLFF59oeGjYbmOSAtAngVWVuhZlgoY5U74BTP3JoJn_iTTGWUPw9BHp3dgIcCKeHaAcfhlHG_SPOCkqHeE0aF2Lokft_DTpmvLaLAdg0C367jpg4EVVDQJylBZ_Yg5lDToxLdvy5lcT6pyWSPwX48PZD-CeKEFFSIkCVfd9l28Qv63Z9Cng91jhBHN-7gvvCAt7qwmbwFNJaBocBsdfr621x7wJC9QDMaUWkTz9fyGrl_GHFitY0GiEF2AApZ3QRmjMUueEDvslpUSJid010tlm78pQTUjPzuy0Oyt-deJhSg71TMGZ2unCEngkd1XlTPyMjt9hXYA5lgYV1k_9rCSMp7INCshLqiLrKAg5_f-8xotDLGMbctz44Mlaim2kugkV7byu_s6Cf0bs3oTkL4VsVhpwR1g4jC2QOeZPU6KW3H90uhg0B2l0qp6D-tWc0Rdzfn1_THGlV2XBg3C4obCYtaEnsoNTfg66QeGkKe4Rhox2Cc1KzRlmTstOmfdIhwDc5NN8uZjdMYJcB_B9CvjOjmeFRy9REZakhlkE7UcqQXFiScinbRUyTwFoNOa7EsR7Zq99vsV0ZSbm0rO-c8TadA01zeaFucW_Fqre7GXxbni8j1zX3FFcEGLxFpLqgqY5KH3GQVJ2Nosd4VP09_4BqYvweZnee0sYz9XMHVkjX_w_VkjlG5Wz2dv5CjzlaCQwaEPy8rd25M84jxXls1WLw2GE0ifarDFhhnc5OAK1qxtxl5tZYI8zS618qOn7Agoy-l7-dHKoaX_mV38Jcc_kDnr7miBxuXE67YBSiKh50N7Cp8WmhP1OjJJneQ4HlxSKFVeolSK6coBfBTlJ5ntxaGsmksR8L3YlAj4SAfALtBSonGEXUByfjtMLFTIY1dXKqQAytAVtUMBfRteJqdthJcSD2bnkTOnhfUfr5t0lglHEjYHCbsYCw3nJ-qiI8yby7OPcqonMg5Are8jY6bcyPx5s9CSipsAw-lb9jzmShtrwNrI9f3ORjuXBMays6-JV2bEKnaxTeS7HqAe0QLsuPegHE-5UARfMk44Wou8CgwXl7ChvjenMPwoENmZKzj9XPMtSWGuMK7n_91jmsdWOrB67nXZAPAmxutoKYf-WCyYZJRqzhIowc38ZSVpc0RNEP3jnxt32QlZrFuQvFSDJjlhwa3s_laLReNeJ5DwdhDSg9rVcv_q_cD03Cmf9p1OaHuhWBKzMFBDx7gW6X4JHD7qScsCkepHgQsi-hKqZagEnX-hMcY_QPMF246TOu8YeIE-c9pst7z9RVjMv1vqOHMFAKJiQbtFl6Yeo4HfHeFWv1VYs0yGoW3NGl9ZhpUzD4TqTy5_S-5JmgUhDumFg1rbbQ8rF67SVJmucnhsyyi7uGBqvbyD9v__NlaGcsEgZdrtD6-N38VGrAffRQ7POqF4_a70DkSrBKek3SXdyW5Ln71pLgLF_oGVTTcuCPj1zrYBziln46HTtpRQS--eH0Kk3I7IBqGnT-howcVBQqqRrmQDSQhRdtDYzNajNsdmqk_xvD29NOBc1Zh6CpbocsJFNugs_fuTBSig47rqr-LblZKPc09MxFMVjdS41sY4YvUfiIMurtAy99SlUmS0wZcAt4Go4GNxwon_YGzhpXqPHLgIUW0wP-EYImHcuuQr3CZPq5mVH2MCtP5SeBdZ-tVj71YizlLXlkGJWrwwsiFcPErf7hfpafoJ8EwTwI_g-YZ8cMolcZGi6HsmIXCWLuGMbl6oQc5z3j4F6VE7M7JHlKbw2I4MQHuCpF4zTAGOJM9CcioCcl3J4Bk84fCm__Weo73EqfMmdjjEFAqRaNYzEIDEqKWF9h-eTqtiYHnR5wqyVeCS2JxPl_ZnbLhiWEN-OeDzS_qlIo67ITtw28-A1Yac09g9Gs_07XsMd6gFUDE7j4SY-XUWicGG-nNj3WslxCR3VZLbE1i8JobFoKybrYcsITKvhLqlEttCRiOPwej9J8xGGEcblb6KlrKLdpNj3Y2k_3A&cid=CAASFeRoLqUYfwHBZ1q4hhlS4MjKyHRLjA&rfl=1%2Chttps%253A%252F%252Ftravel.blogmura.com%252F%240

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2da8c4586c7aa3ff32d4241db03e73e79da0de370d364267ba119cafa10c6a9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13083
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3612 42 B
107 B 33ms
11ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D3k26Uou3OQNW6H5IcK74Afel5OJfZH7dsJPbzkm3uk_u9c0diHxNbADqQ_XXY9zroMqhwyKUwy3g19wXd4Bu-MSAElPZTa_8HokxvUJe0e-iVNvU

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 3612 3 KB
1 KB 35ms
14ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/window_focus_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 688
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:33:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3612 128 KB
39 KB 261ms
29ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2918d0edea50f453e2143087cb6f5b232a6fef8b687e228496629f0739fc809

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39662
x-xss-protection: 0
server: sffe
etag: "1632310973010379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame 3612 14 KB
6 KB 31ms
10ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:41:56 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 3612 0
0 28ms
9ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTzngbHNdVqpoFlsaSi9-4_xhNA01oJFoXQPJHY7h3nflRZTU1UPH2yzR7NM-OO5EIGZS5jetmxwZ51tRzwOsGYY3tSsw
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame BB3C 0
0 57ms
40ms Fetch
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CFMEJVlpRYYPuGc_ngQeyvJjoD-i-mJRcoKWzyf0IwI23ARABIABglYKAgLAHggEXY2EtcHViLTkyNTI0MTYxOTIzNDg5NznIAQmpAsPjD0-QJoU-4AIAqAMBqgTuAU_QaDM40n8FtJTFtH8LgqbdWE-VQKD4sVcXdDh1CkTRThSw3lsI0cI1tgzzj1Px2iivY4bGhbwhzpeiLWcJn4SpGug3eECjXEvoJgrEHEZpsahueQFVKn5hFi9A_3Q7UH72AXPWTbQL4u40pCXuoeesfizmxNEXST-MEdX-4_3ot23o3c-NP8q54NPPABLPIPEiY3DvTJ6MvApr9ablgJDgp4kCPSXIU4X7uAvMjCfMuj0Yl4rMkGmeulymie4hStoum3lWMgQmbvwev2a1ZAveKn-JgskcilNM13NY49V_SzfgBVdz9r4bKD9feL7gBAGABun_2eWa6qLFdqAGIagHpr4bqAfw2RuoB_LZG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAYAKA_oLAggBgAwB0BUBgBcBshccChoSFHB1Yi05MjUyNDE2MTkyMzQ4OTc5GInACw&sigh=Fbyl3zYI9G4
Requested by: Host: travel.blogmura.com
URL: https://travel.blogmura.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s11-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 / Show response
track.adform.net/adfscript/ Frame BB3C 2 KB
2 KB 84ms
19ms Script
text/javascript 37.157.4.41
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfscript/?bn=46470475;rtbwp=YVFaVgAGdwMK4HPPAAYeMl42OZWXoxuNrRYYNw;rtbdata=sE7aJDcJuegbfGs3ujAecaM_E5kYQppY_qZBAluh52TB_gIeuEPqbSUn6yYso3JAQ0E8W6qBsvzqe2mcEfQSdjKPAmfqxm8EkTwIWyoUwA6K_12MCGSzFFH3Dw20aDHV92n4qHsaARkv7cRi-l38B4_4B4A0Pe5CSHLdtUmNyw1LvnfCxQNYE7vGpvX0AsEB9HSyZIj8IVoRx_2tDow_ifP2teoVDEuNHqWs9WmNogH8bx_s1JcHCD1eSkNiOpcjvKYvaiqLMI9w-iQ4hD3WPLptBSlW5ZWPw3iI60gHGBc1;nofp=1;click=https://adclick.g.doubleclick.net/aclk?sa=L&ai=CwwDLVlpRYYPuGc_ngQeyvJjoD-i-mJRcoKWzyf0IwI23ARABIABglYKAgLAHggEXY2EtcHViLTkyNTI0MTYxOTIzNDg5NznIAQmpAsPjD0-QJoU-4AIAqAMBqgTxAU_QaDM40n8FtJTFtH8LgqbdWE-VQKD4sVcXdDh1CkTRThSw3lsI0cI1tgzzj1Px2iivY4bGhbwhzpeiLWcJn4SpGug3eECjXEvoJgrEHEZpsahueQFVKn5hFi9A_3Q7UH72AXPWTbQL4u40pCXuoeesfizmxNEXST-MEdX-4_3ot23o3c-NP8q54NPPABLPIPEiY3DvTJ6MvApr9ablgJDgp4kCPSXIU4X7uAvMjCfMuj0Yl4rMkGmeulymie4hStoum3lWMgQmbvwev2a1ZAveKn-JgskcilNM13Ma4djt14NBaf3S0njzU_6fHKoLdM_gBAGABun_2eWa6qLFdqAGIagHpr4bqAfw2RuoB_LZG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB&num=1&sig=AOD64_2KJgVQ4CQOwCF108jmeN9GWAN-DA&client=ca-pub-9252416192348979&adurl=

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.41 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

a3ad03fa29347751b21a18b90f1e20c72c6bafce96c8367c78d21088910d5f88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 1642
expires: -1

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame BB3C 3 KB
1 KB 32ms
14ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/window_focus_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 688
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:33:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame BB3C 128 KB
39 KB 271ms
42ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2918d0edea50f453e2143087cb6f5b232a6fef8b687e228496629f0739fc809

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39662
x-xss-protection: 0
server: sffe
etag: "1632310973010379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame BB3C 14 KB
6 KB 29ms
11ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:41:56 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame BB3C 0
0 31ms
4ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS7cQZpIfQ0r-aqfV429B1bXvAoHTqCY-3uLUP_uh9TxF6dE-jikYoKIIt50jaaDbaKEGieBXZlLkliSwgDYUFpP36RKw
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame BB3C 22 KB
7 KB 31ms
13ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 09:40:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72275
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 26 Sep 2022 09:40:20 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/ Frame C3D5 18 KB
8 KB 41ms
0ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/abg_lite_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

830527b04ff3e5ae7d8f62ecb5f1aa2ece85a7a741b332051561787b52ddffcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:32:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 716
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7635
x-xss-protection: 0
server: cafe
etag: 15605042170853735879
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:32:59 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame C3D5 8 KB
786 B 30ms
5ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32bc7c1c64fd1b755d48d6025b86b7e7a28ad35d1f420cf85cdc1123aa7dfcd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 03:51:03 GMT
server: ESF
date: Mon, 27 Sep 2021 05:44:55 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/ Frame C3D5 14 KB
3 KB 18ms
4ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/outstream.min.css

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 23 Sep 2021 00:42:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 363720
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2798
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 00:19:04 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
expires: Fri, 23 Sep 2022 00:42:55 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/ Frame C3D5 352 KB
122 KB 27ms
13ms Script
text/javascript 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/outstream.min.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29e2d6b0a0026b3054cf162219c34ad65705c2e33c752fdfcad9a0f5e29cfde2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 12:53:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60686
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 124823
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 00:19:04 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
expires: Mon, 26 Sep 2022 12:53:29 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame C3D5 14 KB
6 KB 29ms
12ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:41:56 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame C3D5 0
0 29ms
5ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSg4Tq94FOa1uno56uUZ-4SOK1hjEc5WOv56eLrbB4UR_UyifUSDr4xZjTwmnD_jaoYmYwK6gk9cK-uSFAp9W52H6Tl1Q
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 98CF 640 B
359 B 303ms
18ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGJLYjLMBMAE&v=APEucNV8Q_5jKIckBeF4-YQa2zBs8RliRkpQn0gLK6wMDs79w8WMD21xO0Zcaz09cekRr7I9NOuvu3HeyK32LePItVxUaY1xqAx6E1UtPWV531YMaNf-05_UhpDVgE8xix6QrHOLJfNivZ1dLsg6KZUyg3hBRXGcDELUz6pkQerTMyCxrhKqiwQ

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CIvVChCpn9ACGJLYjLMBMAE&v=APEucNV8Q_5jKIckBeF4-YQa2zBs8RliRkpQn0gLK6wMDs79w8WMD21xO0Zcaz09cekRr7I9NOuvu3HeyK32LePItVxUaY1xqAx6E1UtPWV531YMaNf-05_UhpDVgE8xix6QrHOLJfNivZ1dLsg6KZUyg3hBRXGcDELUz6pkQerTMyCxrhKqiwQ
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmGDrrAMe0dDF86Q3oe9td6Ed094EwkpX6QRHzGbiQYyi7OooXLJKPtMZGw
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 27 Sep 2021 05:44:55 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E451 72 KB
29 KB 335ms
53ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D_GReZ_KDcJ3N4O_I0a3i4laICD60-D1mcnBCUpfNcwCgCJgpnG1Kj7Az4VeSOW5AcEFoNsRiuGC1jm0rrJfesS1YNpR3nQ4q00F4Z_nXzFyftFaA8UO0PHxrHG-ba6lrk9hQ_SR1uFEkrcyCj1lImyF4Nhw&dbm_d=AKAmf-Dldog1l0o7hvJwANqbDfDsIDDdFuc2ZoA_mtSPMXhgtQHbPY1coq-berET6laalDsBnBPjwQxw5eI7kvs7D_4nhaFGwammybJdq-j3W9U6tCW01cd7UKSJTRTI6Jfg4AQlPFOfdBwd9w-JTMmYypaCgux8IwxuRQJcPLqSl0-R6ify2dqVHGorPEdN2vPoF0X5PIa6sTSPZh-AheS4CL8atfa9vOIErMj6o7ftIbFRE8FsfVbTgxa1AvvEHXU9p6cdzHp0s4U3IWw-Nq8lOq98zcI2wFlTrWlAV3TJETkN91zKPncJAK_dFIdDKjBXRboCx2h4RL579KqfHMmPDAtm_218dvgadFdztoVRHcqaPIGYO6vc_bPgTsP6vVwGQ4sICE7eKeU2f2BwsdGYRg50SXapLkhVfCSskTInBn20IbznIQI23A72LA8xEn8k2nHsBJGiSsCTu9oIyiqVfgSkXgJQNDWp0uL1cUBLMCx7P7_7HWhNG02gYG8psTSyNCJ-_WOSu3IixgcUtza6rEw_P4TSC0b9Fl6GtQkJHs5zP2Zucg4PE3p4bHkCRLKTFQvzNXV4096M42Re0QXYSIZhrSJwdN_UdgU-0Uh2sMDM2cjD-hShH88Ip1E_SY58EPIDyh68RrVyahIJhjMCQ3LP4Pu4EgRHR5v0OJOHi12adXRb2WZNX77B267ZuTnpD4YbVCXQKi4mlfs8ekyE6gEeYFBKCRm27eBWzJIQjrZdWapaHXKCpfrP0LEhXBK7W9WutlUwIYulrnz34gHdiNkT0hy7ftUFkAmoXXlqL73DRhSQrkoXCE90xoPN-W3Hixn4bVz9Edw61v2qp5KtqIGnz1JVbXFMemPB8bKBY78mJ4H3toD-tFfO7Du1sLkXrVlVpUQkdRl5T4bMufoTL0ELPI2ljiFumS9xnc7LRAOgDxZyBbL8rnYwFvUAb7QZC9xwYdBIU3IP3AhsuOBtqMT2lveAUAwZyBd_9zzZJwPdWvwNPFspnQcXlwwvEJ250H3ybRJFIFIhbaeaAEmn0XQCryF8sqSeE-bWjLs6KaFto91twJCZ4hfhiCsVVxeYAM7QhFWeAYuKNHmQHbqj_x6MjQuEqePE4y100Qk_NbjwoxibuH4xll3dFscNUiqMK7N2JfBHr3e5UJyLl9sn0bCypwjLPV-I28tQWm1gcFeItk6vuU10NN_WIyYXazaBK-M57g6EIqY1hbmnQQ-886uprOb77DGHPwE4ITx4dpx939xYfNio6tQp6vgPAFPeVdRM8Y0qfqFIcHCn5bQGH-OvelHmghiS8CnJxkKJi-58MTHHE2cWIKbXvuuJtfICO8m5hPisXmpYCcSfVKTL4fPqmn7s3Ew7-mCAKEvc7x3E6QvoE1PrX0jkKXhRlsj8VBy2dqC4wjR-6SslnrZPdm4E67JnfBnXdysqNcKr5VH2k_xopK-RgY7UyvGjbhG6bLhsarwttHKQxRpr-xeVYeX7xK2uXoGKpYulcgrtfLta3e1pDMv5_fQdMsGLEL9bWtJuf-Z6cS6hg9OEqrM954DCBw73ffcd8GSqY-lHLoqq9DAj78GC22_tOxe3nEEwJu0VliMIQ-9N1BZBGp6BLGLpCURlxBgmtWGVxVdDBsZlOeZDOJIjU1M2bApIxVcFPHNEZI4mo9AYKLoT8426u1urBajnndwxK90KXMNuL5fvXt-0pyf3-i8Gh28F-CTNds91rNPiM9OD3ml7AleJcto1rzEpSXv9pldMgsRHgplL85ubsPdhsnoYZfGuGUGTsg7qzbnrDhD4cXvnKeBd0xIs7o5xcU46iyIT_dZR1eZ-RbkdsIi0M1lMDoF1AATnBgVXLmjh_buPZvVNjuDqNRIn58-hg3QhVNxvHEUKYOiOnmKj3wsdrcX7eDbbob6ffXZt2n7sKNux3d-_djph_BR7reowMCTdZc2p9sDYUFwoYqj67eJAyfUVxK9DvzU2ekVBvntTHpe4faAmVPndPyns6Qa_5O5BGEqXYMhLfnwiAhm0EE5sKuFFb8fj4PcLwSA-4ajakAKWDs3aEeOJK4hsbH5cveO81M-dlgO7JwYRYHivb8ZOZntQbDeCV2MEbOABrJkABlgyQOL1jNkLZnVJuzRBPSk1o-G31TezGV_B6pd5p9iVsjc9uf5dQRDEY7_fcVXI5dRbjYaDc-ZOrj6AjH5E5qpds-1T-Aal-P2kXwwRMWzaBDQxRme9DNjqzSVPTPMVcQb7aRqU4gYiKL-vDg6eju1o4V1Z1FUS_LHbWJcUIZpD1s2ptn4_qGPACwFTCJlaXCddj_520V7V9ema1Ys_feiDsP2ktGAY8xQJB3buVYDo73ZdS-KDbFMW5yB5ZKDF9nLyi6g9zTaYfLXS0oVd0VCtggk3Q7cP7XmiQC6P6rtm3XXWPFxMFb6oRvmOZsLGVdAOYkUFKWxlausTf_RC3j90bYhC-4EGKiFXBzJAKR9SDdFzslOXKI9H6-qrx-DqF2_BDH5RY71T19ak_uxisylT6eOJmI_zgQspJ6cQfAoTJ24Ja6mTTEULlw8mk1nx7qjqNgniBH7zliuBzocU4UnECTP2doYd_ORSju0p-T5Xgbd3HeHHTCZ5a610cdFrH3CBbMMwPlRFnHEgMQBki_vCDincRqaTt2Gv8tQQVQeuMwrJF7eaBgK-yxOkwmDALzp_UaZACsDBHHjhw4rNfPnx3Dav0M83etIkfKBn4q0jG7xb7C8nu1iIVNQL37HiTH51mWVgH7lqBCh-FYlQwYfFWgmARpzJZv5rQzvBxVT3t-bmHo0rsGgcBb4lMQIRZA8SCS7XiOG6zjCfccaqxfGUOyxH5ar-GXU65ZW4yoKU0yYsy6WrkupT2vgBiKn_mmxbCPla4Bh6awh6nRDns8ZvJFJo5IIFzsNtkV5o9Ni-wcIRIo6B4j2sTHT_OJZS2DH67XifwvzwCOHtbfzdTJu0YrP_7i5bHs_MekBrI3Vd6XKDg4-u7PedQe7-HHUOFwBbokTy5hA1UlUo-04QSeANVk11c2sLCCOA5pTl0HdF0i5PohOZVSpaIhtmz31EqtpahzX9oDAtbfTNELslvY1jjwf3Zwlf-8KnmdbeZC2Bq8O6T7rpj_6TwlE3IpMQPqzDhMPshxMBu1Cdi-3lIPoeFSjxuqBqUzqoLe06FvAFBV2ubPgbFakmEVOx35c6J4hmcXAd4PQqeu9Ly10W3wBucmY6SVKO7i5vf1E7xtgJG624tg-jE3dzGZihMKm3lDM0q8d5rrVrpWwwZCDEpuz6td_TeCB5FOe0EXjKWQg&cid=CAASFeRo76KEQ-0UWOlfKe2MDghRfSqIbQ&rfl=1%2Chttps%253A%252F%252Ftravel.blogmura.com%252F%240

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cb4bce0a9de6c4b6e7fb5edce61de681a696b7825183b18e2b7d7f1c50603726

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29120
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E451 42 B
107 B 31ms
0ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DnWhSxdjpxg_3XXt8_Wk_fCN1y4Hbt2QgisWQcwqFAjgUJFx1slHl5_-ygXq9dT5uhC_8QQSxPllqzN-vw49IXBylC2ctsFldrcjbyC0u-yIUNfKY

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame E451 3 KB
1 KB 36ms
4ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/window_focus_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:33:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 688
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:33:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E451 128 KB
39 KB 279ms
54ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2918d0edea50f453e2143087cb6f5b232a6fef8b687e228496629f0739fc809

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39662
x-xss-protection: 0
server: sffe
etag: "1632310973010379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Mon, 27 Sep 2021 05:44:55 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame E451 14 KB
6 KB 32ms
1ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:41:56 GMT

GET
H2 200 html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame 07E0 169 KB
59 KB 22ms
15ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 15:57:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49632
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59842
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 15:57:43 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/ Frame 07E0 8 KB
3 KB 317ms
10ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DCuOFVCUfYItQrOtd6IFHfdul4rGah4hGfsw9eaV5zrKxJKf7fxvmSHsaL5dzux_LKIwDPpB_HdLNG0IEcSUlzik_K-vFgTSid4_R1fYCtNXpkvadJazD554DLPIsbXWgJJXGR0D2zZsjBdnZCHs9LctIw5Q&dbm_d=AKAmf-Ba9-BYyr4bANr1YNaE7Hw0HdujYVhmj2k86_ENHpZw4MPOH2ckvOWg7ikJ3Z0u-YtPFoxemxm3puryY-6-oI7iMnNXc5fm7LBTCzSfgISXWlnBLdzyRWmFNpxsccoOHlJ6r1J8911SiPFCxjXQRu78Dh2G9m1yo-pFJbkXkTiYFTfwtO0k9Z5W7Jdptd1WMaXk5G0Ez2H_ox_-BS-8BiD7uwqeKzh5EWmizEcZvLnMxoELpgG_tmXYPvvfFpla4ER3DzBa8euYq4sHpECHQgzjKG0AsSLmFnLknp3ln0iR5Hljg04Lf0q1eltMK-ExPW0RvojVriaYeISvT0O25M2IXmJSnO7pHzC_JBDDtYvPcDUtRrM7gH8GkfLTsQifvzwG5rSXKnTdGHjnTNCHBNnfnRUUKHUJxr9uA49Tw5LrdtqfaORvi2YeW156X7-ROWTpwDmyzqbLab6SEyHvswHNpyuVp-e_Gq2w8wU1PwI3h3VuYg23z509lAnbRmjUsZBV5wYh69eiaItQGSjoq6Hj97cygl5Uw3fRyKGNzQ6qbGgyn5saaHOfipjK_SvrjvX1VOOsl0yifTVjENG0UqNKk6Us7rG9TwQG_3I76ouQbh06EWr0adWkgBYXSVdyXDNMOmKtBNo-6MlVXCKvMhNKm_2Uag8Ad9fe1vLeBDAwkhLZSRODZ68kJb9ZlPAhaTCBjsu3TsP1orp2X69FnR12cR9QS71G4zucY-8tZzt_aaYnjninYtE-wsF-vjL4_F5lrjKH-m2tcrQtezw_tfOvSexd7w35P9j4aayj0tgPsNBuDiVIIkDyZevoOJD9FrZSyKcvzfH2R-907LwlsRAQokLt9CwvlvyU-E9rxE5ziYxf0kq0WVUFFTGZxwpeAMIjK0UkDmY2Q-xum9GQllSC8Z37kAAne8oswxKzXwFYrMJV0XUwSTZ6CixzYXFUmr-s6WiPQQUfVpSE8Vm4HOQYL304_AxpLWnP9KF3pUs-hK3zFbrtHWyeYUiFrYvNmmCTgkuP1mhwdVoUnZBtGdmLgbulM27e9a5A6Rld5NSPmMJEq6r2eMniDSJczxpkkClyT5M0VGNCDn2yJv4mNb8Eyp7VLiJNrkbQYCaQuoCt6kURmneYhwMHgTM2gIi4-wTy2JCU8bQ0FDc-EU5NL7cSCgzCjp9TMZLLMYYfXLvRRAegkYej00tVwzZUheyCJh3jcdpf2pxdErxrSUmgDwMFUUTP30_FEeCVxs7RdfFlFq93M6UEY0JJWcLJGu0GsJAc74twO5k7LKI_lhTGi_QYWViVInGkRfUtae0j41fQQxeczVhkF8p1RD1X971Hbpd_tt5TJk9_LjVa4NS7imoHGJ-TM-FRQxOGSlky6fpwPxMUCvHm2xA6yvSG9upgucgo7DH-SJtZIBtqnnB_wnR2gIFbteeQYHNBb2OWB1irfzIECTjz83PmX2lNzTI8VuH4ZX1_F7_v05m1gzM_J40oJdWQlE3yLvIzEMjHd3FdY4tJP1HEglpapKr7nlYC1Wwbs_rqcuTBsMsfDTRsym9vFIchChnj64CbNnMaRP0gFRAVeBpc8JuPGUBUcuK30CCuFW3gojIkXG0k-uZFuUq19mdlTBNzYmiNUhq1J1z8pw5UgTRSEgwF0KBw5_DyqeNG2lo8nAfsvRg-wBC2YoBDTiqwub_DDSQ-97gRkTq6U7uf_mqZxvSwauW3oMhh9BkDz2vCC1QxOpxv5GyynJ-9rnBvgZJwdxz4ZfyWKGxfkSMs73xo3KHuB4TlREqF82-CP5vwDUjZ2mkJIK5UuNG2v9UjldkmOfBb9ylRXdPXhAOi3Z1aso1jIXUd9R7njStxmOKwPxUcKCi9pZJg35fMKZBYai1xhj00joFHGxnucLhEaBnnpmJADy79n5mO1vqrle_cf4focIFT4kD0BEuZOUFdySDa6-8U6HV31Su9ryiVqIKq6bQLS46ebF_Sc1xUZqmnZCSZidQu9DiHEd0UcR07V3vq11T-tMt_vDnZ9uh1jjVQKCQVIRmugllXDpBR6s1X29Yke0VyGVjqj-zj5jbNnxDmK_mMDyWzwuXFN4ybPz-dStQMgjx4xdIXbqteLwDg8vg3STz7xmcQw221JAWb3LknriBwIpVXSj5peFW2Fmi_-p6r9xHdECXNOPIXAmFIOsZhknIGzZx5Hog3fZaCfdDv5aO718aptNSO0R-IoDrR_iT4y1QxmF06wUx0fddi5x4TuNDks5GuZpf9e2FOvjY7rNhJmDbWaO-0QGIO8Oat14gxdmu_y6exHH80Vr5hJ2e3iWxnV_NMySL0AVagjWed71k-AA9YWjaIuQehtrfmCgcZXVSwPsjdJhAWxMRt_Sb6ESlhjhg9NiWqqDfYC08ZMXHWjM-e5ROEguPIiWZB3sELQGn1lK8cJFTWUGX5hB3dzyraXha40I1r4q85m1bRGnayCSD3X_Gu72KO7QFR6xFahywsaqQv_PVIhn7RJWrKrNwPvhEQ4DtLgyQWNjOi9OawK5eNyMWxyLMc0E7TlVaTS6XUgsOm5eiod5kgFNg-1M_P2TBCew_X8A6SWkhPampn8wuzGLyX5Q6_SiWT0XnQZ5D88RdahTLIb3x8rMzYKYA-M_kpfg694dZlKoQk5XLV4yAX5VqAvvvLpHER3p43GxDveotHu2bH4fYpMALD3uMR7ALU36Q-GmwoMA2jnil2PKLJdItsyrXWuHDrLy5s6BiDRhV838JsbVhA25J-CfnnDxgaAnY8NzUSmkXlAfpliXhCgEj8rFeMDTJi4fwDEVIF98PPRFcbIOqov7awiZvmixSbbBzIp9UIp7SlAKbliVf8staBLGlF5UqsErzVzl9HfUqQ6pe1kgAyOdR87ltABeQLFSAFFkHYcwuPI2swIrFxKzgCa9U0efPXQnadn5nW_QiZDrfHAxiG3FXYGBMxiPbB5ZpoSWYZinsMnMjXm_0iUV3Gbw8tXQaA7OCmj_aqBSOqam86BBk1tQgxtEy5RCupNdit_-fV9Ana6yQBC9KvhLP-WxcT5VQc49q9q0Mm7vyX35aJ83LM3d4T_6N25rKkntkxw39u6AbVVpwahIkLKx9yMFlIX23BmYCZtVQzzNge_QR2qi1Qk4MaUB-emZpQF3CqunmNlP9MEsjrQkjF4B4BnyspOCIFIKBpyuu7ErEJJLF54rKAUE4nDp1LP6q-EDOudQNBBNvE7QEvXz5j9q7QXdF7aWHOI5sbo3JdY7BWm5dRMcaPYYBKMJTutt7QuwnleoeMxg&cid=CAASFeRo4Rygsx4B1heZ-NKAa9IXFpKo7g&rfl=1%2Chttps%253A%252F%252Ftravel.blogmura.com%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 873
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:30:22 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/ Frame 07E0 23 KB
9 KB 316ms
10ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

289d6e0a0907342fcc661d9944f30ab735754993b96f13f5b59ef4f5269b40fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:40:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 256
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9237
x-xss-protection: 0
server: cafe
etag: 9463376652360951579
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:40:39 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6ECD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

43 B
1014 B

113ms
16ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGK3OjLMBMAE&v=APEucNVZOKZD13y8FcKQEK0H0w6rA_omoNAnVqN0jFBnYzBXysFIcWvydnoxIes4o17iypWkEYJ05h4YRvVDO8cPKdk9ceuFnUrgAw8gkJBecRs_SHXLna1fL5A-vdNVDSGkx8N0yWBb9gIO9znK6o9ynKfpC-GywLDZ0ZTZKei6W0ghfAWmAxU
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 05:44:55 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6ECD
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVFaV1lVfZkywdes9eLIRwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

43 B
894 B

17ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGK3OjLMBMAE&v=APEucNVZOKZD13y8FcKQEK0H0w6rA_omoNAnVqN0jFBnYzBXysFIcWvydnoxIes4o17iypWkEYJ05h4YRvVDO8cPKdk9ceuFnUrgAw8gkJBecRs_SHXLna1fL5A-vdNVDSGkx8N0yWBb9gIO9znK6o9ynKfpC-GywLDZ0ZTZKei6W0ghfAWmAxU
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 05:44:55 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 6ECD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFRjZXzU05fVAsZFnQpae1U%26google_cver%3D1

43 B
1 KB

83ms
69ms

Image
image/gif

185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFRjZXzU05fVAsZFnQpae1U%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGK3OjLMBMAE&v=APEucNVZOKZD13y8FcKQEK0H0w6rA_omoNAnVqN0jFBnYzBXysFIcWvydnoxIes4o17iypWkEYJ05h4YRvVDO8cPKdk9ceuFnUrgAw8gkJBecRs_SHXLna1fL5A-vdNVDSGkx8N0yWBb9gIO9znK6o9ynKfpC-GywLDZ0ZTZKei6W0ghfAWmAxU

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 198b2927-48da-4dba-b026-e193c8d45fda
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: a0392899-8dc5-4233-9e99-1593dff9e009
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFRjZXzU05fVAsZFnQpae1U%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6ECD
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

170 B
188 B

16ms
15ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 80dd317e-e81d-4f71-ba30-7320d39a8f93
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame D09F 169 KB
59 KB 23ms
18ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 15:57:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49632
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59842
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 15:57:43 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/ Frame D09F 8 KB
3 KB 318ms
13ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ay2TKGZRJ2G2zMnQMObcpSUhMY-jCExNBWd3sE84-6iWWJSiBYscyX2FSuDcQs_zE_D2DojfMh02dq4e0tocabXlx5cD0uzupvpkYyLFxYy-YHTHE8bvuDimXxqRgdwmf-OePPGyeoR8--FFctYm2Jhe07hA&dbm_d=AKAmf-DPTV2Gv0qW5GUC2ENFJ94Eckla4BBp7e6inm_LKQeL5wTNU4AwvgMDtwmwBZQbaZX6PRbTvSKGErEmeQkyXtB8RiADyLhz9fpO7uODvrZ7wErjrzpu_hQB8qumNfS7SLFzRFb3NSRBuseAKLhDXJWrlt6XvnMVkd8oe8Tnl0nu5ic_J8apCbkEaa84FVxsSC4WEFLfbTnvBzWgW2mkflGABstIlzSZ2asyJP0fHZkNQUnsuxS-d6LoFTL2NBOG3RX3BGHW9wM6E6Q-k-dTqUVYJUm_ZENj0iSj-IvpHBBn9_mNUqCO6ABDuhqUuIIX-p59G7y0O55Tty1oGUhMhZ4-jHz1BZVF7FKD1mZ9tRWOIDfPoK0SV066aUHZ4GobgB8uN8eMbb6acO9GWeDMlYw55jGNdXKi_xIOZnzZat7DYpKIR9CoHAPsFY656auZq3uNa5KN-tGxHQAfDPcDBe46Stgb_Y3w4hIHwPe1AKF0-dVPD8apST3_zNjhYFHxIm65LzKcDbpf4E9eXZiPsRMHRsAMbPZpAJUe1D_zG0uXmz7aALr6ju-A_E0kkB8B_tsAmsPWvZ8MTtI_RGNHfR6IOsj4XWQITCCUVz484qrjnSLIcg91s9tDYHCRITXwb5sz9STViZfk2uFHPtK6IpDhJEfLlFF57DaFKYm0EBKMSwP4db5aZsZiGIs_zhuq7CCjHtm2prce5OyOWzntzZePzcWgkHX0Yznw2Wi3GvNwTuAGNZpwx0gs1ywThgolQe6L2OMxA6hwCajJJii1L_HMoTOt5CXtzbd5c2tR3_q0TqikbI4YZl_BKOmGPCDrTtdLM5XOQo_x0EAkjoCXm9i46T45d8y0Pn3HSGZGczvSj3GH6fhi08AiUeXz-dlLfrWLV7jHH_vHnTucaPuM0QyRKJibyUYQpht3L0jec5Q5b1b_a8LJQiIQ7jTb6nQO0QnXZJh1KyTiQz-xFiwtWCOfXKrShYPcuazW0gM5Oh9LhCPq6Pl0Kgd9rPFJqoYeBdVhuKcXDjK3jtYeKaFntazVdP0xr_YxmKjgw4T-vSGGTEvwOSbqI1rKL0gqH6n6pI7EZmfsnRW3X-DlgtcpAV5J2jZfGMCckLkcoTtVwNoR01hrzx34OiInOGohCGaBx5QQTPYfxwrFfsya0RxjZdge48zSyozKCooQwfrliZG2g0jOnpCCTKzJ2lfyN_xPc_0inlcqmny3jen34AMnAR1TRyhihQrhiuZnR0zP6k2RPtSYhKxPPIn3bZnosp9qf_DEgUyheg2t5voUP2nQyY4SJFgbIbDWzobiRqIeyKr1wOZ7zCHLjv5oBx3o7jixw4z6XxkjTsk-8Si43EpJikU3qaC1cxvROa7CP-oHwP-e9Sjp-Pw8_i0HEnrYsiazqTlWyRSPBWibCi9BPJnBdszROyiRBBuRDrL1VkLBzfPsPqbdR9fVvI67esICpRXdo5jzmqxRT0gmm1RPLA2i5meC5SPoiMX2gr2U4Izs3AeKsibeAZE0tJ5swueghoENb1_bZCdb-9RDQnu3_ulD-25_54U-ZBF23Y56D_-ZWNymeKsoFLx-ZJxuLncoE4ednaVV1ek8wtmRe-CgdJELuBhzR95getwhvpMiKQsiF8HMcOV4z71cHlBG22-m8r5oorJ0yhMy47NB2VIMN86iGjfYiq1N8_mqPesNNungq77mRzmXKoiYyM5jZMFc2gGDVgZuOj1wh3jIjC27XBiO9pLwG4SDxJOesE-GQqawSEJ9B_pP5z3-3_Jy82OiKfLndN_K9GNnaj-eo-BJo6x7zfkV0tsB7tkYcUxXSYzlK3pUF3E5E825VhBmqDOL80rJzSUFLj3e_YW3cnwaKM0SyYasV33xMlxr7a0qGlr9BzuAmbtzh8UBah7dZrKBsrcqsv3e6qoylANmFUo2rNyHBBaJJovNCaqKODgQumTSQHuA4WS247G8Mil8whG7z7ioXVLcemwOz2ZDpd8Z8cVrcvEMLuT1c8GtSMB2phJqpMQRVYzkeWe9DRdqX3_T9lwlPauedbzuCSkXA5oeq6xjbTdQoZ58EcoloBhwWqmwt5RBMAoIkhYrkmstIy_IvMWqoYaBWKJUf5sG_C0Mq9FZ_90aw_BDA5n6iwrg6gTxlnpBPWT36zd_rwwQrPHwdmSjEWrmGeq8Gh6bcJ8PCsHEQaAGSbj6KHifjTK7rxu1_45rnVIrBpzWhO7TT3aBr9Nr7ptlwEDvzHmOhjTUtehOejVRk8esNSz6kBT5FJ2XX1U91dP9bEhrCKSEcMHhW42Z8GjXQjkqv9kIZM7If4q86gB-ZqntxnK4bq-EigH8UaNlet0hViNM-mleuLCNRYGe5RMqQlalzuwxERxWjVr5eABTlgiXg1D5y9RFo3RSjRfYFaF2FWymSD7BWHW5j3lLj1i9qqJmiCF_qlD9dZRDkaFicSkl6ayoabPBrxOUPdjeq3ZiNfhZ17LQ2IuLgCIdMDHhI_CFxO0CyH48Dkz1douXbz1G2Zp0k5UsujEKu5ikE60MLdzkQcVBYXXy7vYkc4yF7DmprjqOh-ncCClEOEsWUwz3f9Xyl0vccU4VAZkoEuvLVczosJjXyvykoid3dpqafIgjxHYoGBqRufGaQr-Oi14ecBJdeQX0SVzS6x0Wroj9Q4cK6cUgUCVXxJ-KMCct4dge9M57XF9e1CyverzQEum_Zo9p5D0jyB7jQ5Mq9oFTTMR4Nfp3yQwIo8DwEpwfCTqzdMfLU0OUXcBdlP-EbFpgqvVWSICXMpIzlIdOkiZJ6PtInG4zrayH9O62lqOBv0f9tb0BQjDqaGbZF89lHmYWw4b_8_DxuBhUnf2Ieat4RlNy5G1x8H2bpwTBTeqLQLt8ZkMk0ZGj7pWixBzggx5QXdVUa1umUCEVS87Hdb_pgqYQykoQ3-3QLGt2NRlSEAfAgYMxdWTlF8dkDbATqJsEL_2y6OrYHcaj8-l8W4Lvmg8w3rGIBW1zaLttgCFCZCmz2nKJURJT-JGvjl-XtdgCGApvvnG_UOtLW7U0fk73F1TFc3lUzmBTRw-mY0Z1--nuKKr_xLz_zgj_HCaKUTg6tsHZRMds37QFqwTmAImqtdKM6sLyDE_a1qOEDUbErfrnvTVbcyZB1gwS2meFu5X_tQOPVogZCBAMFBYFK0jHwWuI-yGpoU0imtqFL5qq5Am-uOZaTIiqW3D1FJGtB3O4TkE7E2Gh8Lm-bND1EVMIA0iMJYrqW7WdtaaHpT3fD_9BOIbJGjIlco70FFC2jl6q6w&cid=CAASFeRoL5qlHXjFBW07-aYfcM6ba3CQTg&rfl=1%2Chttps%253A%252F%252Ftravel.blogmura.com%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 873
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:30:22 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/ Frame D09F 23 KB
9 KB 313ms
10ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

289d6e0a0907342fcc661d9944f30ab735754993b96f13f5b59ef4f5269b40fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:40:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 256
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9237
x-xss-protection: 0
server: cafe
etag: 9463376652360951579
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:40:39 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame EEDE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

43 B
1014 B

68ms
16ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKL5zcYCEOmXj-cCGKWV2rIBMAE&v=APEucNUdEjh3DhRsF2ohmaUK0wOMZ3s_LHsOGjmYtWs9wRD486JYkxHSdms1S7-em54kY1iQkN6bqnAxGups9HByzOT2RWXv_OYSkn04V_Ct0sLF93BBRRRbqte_Ch7-Yin-gQPhAvlZUXYJC1HY_xLwagCi7IoxE3M1BO9RRf_wSvWaHojTq-c
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 05:44:55 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame EEDE
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVFaV1lVfZkywdes9eLIRwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

43 B
894 B

20ms
18ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKL5zcYCEOmXj-cCGKWV2rIBMAE&v=APEucNUdEjh3DhRsF2ohmaUK0wOMZ3s_LHsOGjmYtWs9wRD486JYkxHSdms1S7-em54kY1iQkN6bqnAxGups9HByzOT2RWXv_OYSkn04V_Ct0sLF93BBRRRbqte_Ch7-Yin-gQPhAvlZUXYJC1HY_xLwagCi7IoxE3M1BO9RRf_wSvWaHojTq-c
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 05:44:55 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame EEDE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFRjZXzU05fVAsZFnQpae1U%26google_cver%3D1

43 B
1 KB

69ms
51ms

Image
image/gif

185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFRjZXzU05fVAsZFnQpae1U%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKL5zcYCEOmXj-cCGKWV2rIBMAE&v=APEucNUdEjh3DhRsF2ohmaUK0wOMZ3s_LHsOGjmYtWs9wRD486JYkxHSdms1S7-em54kY1iQkN6bqnAxGups9HByzOT2RWXv_OYSkn04V_Ct0sLF93BBRRRbqte_Ch7-Yin-gQPhAvlZUXYJC1HY_xLwagCi7IoxE3M1BO9RRf_wSvWaHojTq-c

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: fb753bb3-d7ba-453b-a644-fe091863ad46
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 66e5e934-b644-49a2-bef4-da07dd296e4c
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEFRjZXzU05fVAsZFnQpae1U%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EEDE
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

170 B
188 B

18ms
17ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 864992b0-8a01-4259-a570-a22a8d4656ee
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame FC4C 169 KB
59 KB 315ms
6ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 15:57:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49632
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59842
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 15:57:43 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/ Frame FC4C 8 KB
3 KB 302ms
12ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AuBpeXTojKqOagPhBps8fwIQtQnkiyGF3ACf7lsJ9cfCSoIJAEktbHEhi1mXRSx2_OvWowQzpa7rZSPS4We9XLR7VMo9wygj1_ikLChf4rs090qNR0fu6BvDtDHhozEkyzL18QEWAIJZJaUZE20HpbEbz8Pg&dbm_d=AKAmf-DX35r2WH91mo6MahRIC-eq3PP3YcLKYZK4IyROJI-f8g8f5TwGX08X3L8UvmrX7tJkA5qN_MK_nOagooLQDVr30Q1RJ_c5T8bvHJ-izp6j6hfkbW2ni8lRahIha02FDxAY0R7Th28s6LXBZdUvAMuzwkQNXuCCZ26m9vo14BrorwQTfd5FiaawWSMeQx7kFeGNb2tFtzm4TGnWVWsp21Gh9l69lOr5MRkusub2pyWb5oIJxv3yaaKKwv4pJ9eBmG2Tl3rZQ1ntKk5kdEiB6YvSl29cmJtoD4Vgzst00ITzePK1hYWHVWPMMgbscd0AtALWSBSaTJ6FxE1UNe9J5LueECpgLvt8jxCnUG8ecn29BA6V5i3_6tRHR51_orOcFfTYaRlBr_-cEhSXEnF5RBVqdJ8Hm3-v4ltG3ZZ14g_MIEq_VRl83YWOAHV-92KO20kqwlgU8GAcWQjpCGEbPf_u03ByngB2z3gifsyBHdIJQhQoaCkOsqIBHlLAjZYvfwGqa4RjXhWucJEra6r7h95F3IOBViFAQp7EZzNDeSwsnctvlQKLhumJRejU977RRpAqwZjnQYbmUjjP-DhYa9jVHvHX7eqz3G7ZOOYfhRW44Czz2AylI_NeNXVlkKSab_y87zodOJaNuxuB3HiC_q503kwELhd-Dx6ceRCfKK2fxH6Pv6zDf4pcshdtdt8ySZNEr5TFDCjaA5IgCtFRo6oQWGXdXEUw1c8XcopMOaIfhJsY-fC9US8pnIZhOuvuQe3-5ORkMazYMli-QU8t8IGQ8OQSmz1qqfQGDSTlLs-H6d-Mr_0GHHIh6WQP7oM5YnUPxThawD5qBDJRE1mWp31MVDBaT_C3ENmGBemuaxLfqyVkOO6psvVnDZ8csPW2D7rA8LXMsTtp3tCnTkssq41xXjZK2TMR-piT-BVst5ryeAHUkfoXBKnsuTeq5qv62oKPMW0UonGbYhlaDMRryYNpRxAHWzlKAGyK8_Sxkfc9FALl0CXUvCnPNWe6rATrPGIfMTFjrATexeCSsZ2UDiDHVG2roKTC5D1Ela1jKVPIesImlTvY-OvEDeg-rWSd6o2b09RfFZMNLLzDN1UWQJ58yH7ufQSaKzv8_RzpIU0a53dj9S2H41mkrnoWYUxByDEB1E37Zimk80X64zJhNdzP9UDwhjzrwLjGCjNQG6sc2rtuda9LCS2sXlrSJB05ClcFraZ059KNx3R5AIMomINaRtL90fB1O9UM2Y2XuKNvVq1Y_XocGdVWdgOmRyHHogxfJot5xIIarTCKbtOx7zxPJUyQ3lbUXA03beMBe3pQKEzTW13lzhz4XcEWeotG36PlahqvPaK7ednooEXEZWrxB4RDfo4lzxNTx-F97h7gPpVQFeYKGYQDKoQ3AouZkLhMEn3BCsmTqapk58u8Ms7jTyXUDaVApPae2POSLSNIicQJUV2EGXw1UVr3wBwBFlErMRWLQBK-4FKqM5LUcWXTWfXuvNFA_HFo8Id2iLfAE_CcnNoBAyAdKjAAPxyo8d9i4f5MIN297NO1-R2y9B-L2IBcKz1_fw6bqQrZDlmWEAd9xBdKirvp-Bq2jI-HWjTkmvB4K3G2U7mzL7_ldJwPQph-9srXSXjxjwzcMSJH6TQ3bZmgT9mZo2lQz_34-GpfU3UHWGMKwL9oEaMuIlthYZ41-qm2-N65Tz0CJzvdLBLqsQ3ypFm4d37QflxQtJjJoJGdTF5Wf_92uZBL5K6dUXELGSIfVk9EgjCt5_4uU09pew2Hb4EY7p8GujW44a7K0XFJLR35F21LMR2uUQeLp3ZZeyEzdXqI-p79InPsaY35-ge5zh-0QK-cULGgCyeDg21Dtz-nBld082awSlYTzPpUZ4TW4GIXkg852e1dmHzjO7QxBQFkd0xI1ezV-RSb_EeEMHbDpGdE_iOk9oYYhZiThczmFxUr3iUHgg8G5UzfaT8QhYrZf5ZYyvWS9zEx3yKs1b8q43m0RL4oozQ076zJdF2p3-uwHIWEe0MF3Bp00QD9chIG6KFIY0dH2751ZJqjNV_fmOPSKt3hnaDPZrxx0avLrUGZKb9CTGJY5ab3PeRtL6o-Ep9HX68JiyTOZ0ZR9FOWZAAB6bwMsDB_u5ZeoWwQj3rQJHUMrBSZKvkMisyAFV4GbuT4e22gqxB6gQu9mLvPeyzsdGXKJYAHxusG7BEQbeu9AmkMAqTbayYpB6dy48AM8i_-WLJv2F0bkd4Cvhz9sw4Wf0fD4E6hNIXZaW5FTpuniwhtOOdweaYmj7jB6ECBuLzQMi8Db1wtVAbUFTZ7DFM9cFqPUej7TZGyoE5EH950ouOag7gV_qXRviLxt9cCWNCYWsp9yHIsTdizhEzOGHJmY2TcRUvg_7uqymadXCi2YNzykfHQOhpD_uX2rYcU5ETmi9BO1j_gpKWXMvfMwArBbOIeX0-hijhV7bjLyJ-nXXoWY9xyrGCdRx0Vw7KZH75w3GvaHZ1dIxlJXP3kDnF2JZ3Z3TMe_ii0wg9AjUO3RXllszT3qr1UcHHWd3yqCVBzmRAGcFGowZPYSG18RuqXXKWkLZPWD5opGYVjAp_tYDTQi2ohzy3wGQ7lMcpqzXI_PBAecC2AmxwK3NQvDM-g3ZdXGs4ejr2U7rgGtdg-6LRyUfVBOEEo6KUQgYIgsil9xw5zVUga_emRhWiPNcGu9H1ktCNF88arGWuLdHHsOxFW5ZDmMc4CH_oAvNoGqxu9ZsXb1FFORA1wawlR24Ov_uPVgzxXBoG6t8BLNOumO-y_NSuqAOvRgmtha0PdAd5nHBtEkSm9KXHmFKYLaIwJHDdH4Tj92pqNiw_mvZ6AKdmV6vtCG6tuL_VSkxmF077Z5Xfy4CqnXv7jAmBZvz9Cj-L1NYWFoCOsgTx80XEfmMWfT7nN6r_MHDlNmlCWCa2uOGMux63TRp_pEZeGaaTOdNJcr5si-KAzCujwYYv4Zpv6CYYZqb3OhUxRRjcgaczzTA9xHZO7xMgrQoe8gtOwNad9QJlf1pobjzLbv6D0tICuDlT1O5G8fUpzHyjm31WYN9iExSRRfHGoVBpDf27aNZr1l6vwv-lzlpCuuWR8JobRfYpYDCm0yG0G28-NDjeubLt_eVa72VC11uATmo9oBsRslJjW7_H9sn4npZZt6Q-BUdYR5T-GvCLUicP3JSuVu0IplLKccpJkuhawu84WAg-kGnKZYqY0HkeoOhBGcKBwfkhg9HaWatXufQmieMPmtYKZbo5AWagO&cid=CAASFeRo85fCS4W8kU-2qPxUIHSBWVByQA&rfl=1%2Chttps%253A%252F%252Ftravel.blogmura.com%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 873
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:30:22 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/ Frame FC4C 23 KB
9 KB 299ms
12ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

289d6e0a0907342fcc661d9944f30ab735754993b96f13f5b59ef4f5269b40fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:40:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 256
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9237
x-xss-protection: 0
server: cafe
etag: 9463376652360951579
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:40:39 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A82A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

43 B
1014 B

79ms
27ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiR7OioATAB&v=APEucNWeMiP2qI3jhXDdxrpGOk7o6oaIEJ5YgWskOXpvyE4wF6eyaf-6XgnGp-RewIKexO3FpaSq08Q6ug5OyVqSuQGwfZKkdcSjKy0uJPrDvGKo5LmK4rdeSxltOD1U6s2LU35QIsPsCbgDaPuxUeSAqKv82NNO8X-Or0xwIqqECzC-84WclqI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 05:44:55 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A82A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVFaV1lVfZkywdes9eLIRwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

43 B
894 B

15ms
12ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiR7OioATAB&v=APEucNWeMiP2qI3jhXDdxrpGOk7o6oaIEJ5YgWskOXpvyE4wF6eyaf-6XgnGp-RewIKexO3FpaSq08Q6ug5OyVqSuQGwfZKkdcSjKy0uJPrDvGKo5LmK4rdeSxltOD1U6s2LU35QIsPsCbgDaPuxUeSAqKv82NNO8X-Or0xwIqqECzC-84WclqI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 05:44:55 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame A82A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

43 B
1004 B

67ms
13ms

Image
image/gif

185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiR7OioATAB&v=APEucNWeMiP2qI3jhXDdxrpGOk7o6oaIEJ5YgWskOXpvyE4wF6eyaf-6XgnGp-RewIKexO3FpaSq08Q6ug5OyVqSuQGwfZKkdcSjKy0uJPrDvGKo5LmK4rdeSxltOD1U6s2LU35QIsPsCbgDaPuxUeSAqKv82NNO8X-Or0xwIqqECzC-84WclqI

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 3e7c0717-983b-4fcb-a01c-8b5c49be5f22
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A82A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

170 B
188 B

19ms
19ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f90a6c26-4e6e-423d-b013-c68f0af895db
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A24C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

43 B
1014 B

111ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJHu6K0BMAE&v=APEucNUBYKiGMB40LEFJ7EYZCIG7devHEl5O6Rg-ScvCdW2IvOK8fCj1eX45dtmgGVdUa78SFLQN5mpqWW5t0lb9eZBDHpLZx8Zt6CZ9qyP1gn22kwog8sLBMzPhKYce194eAmxYAuKIYGbmXzxLyu4QEaE5CnnUWre1lpmN187UzxadHpxOupk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 05:44:55 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A24C
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVFaV1lVfZkywdes9eLIRwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

43 B
894 B

14ms
12ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJHu6K0BMAE&v=APEucNUBYKiGMB40LEFJ7EYZCIG7devHEl5O6Rg-ScvCdW2IvOK8fCj1eX45dtmgGVdUa78SFLQN5mpqWW5t0lb9eZBDHpLZx8Zt6CZ9qyP1gn22kwog8sLBMzPhKYce194eAmxYAuKIYGbmXzxLyu4QEaE5CnnUWre1lpmN187UzxadHpxOupk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 05:44:55 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame A24C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

43 B
1004 B

88ms
27ms

Image
image/gif

185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGJHu6K0BMAE&v=APEucNUBYKiGMB40LEFJ7EYZCIG7devHEl5O6Rg-ScvCdW2IvOK8fCj1eX45dtmgGVdUa78SFLQN5mpqWW5t0lb9eZBDHpLZx8Zt6CZ9qyP1gn22kwog8sLBMzPhKYce194eAmxYAuKIYGbmXzxLyu4QEaE5CnnUWre1lpmN187UzxadHpxOupk

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 1d89c0ce-019d-4fe0-875f-fa6a89402a02
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A24C
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

170 B
188 B

21ms
18ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 74ff7bcb-ee55-46b4-86fe-2370e3d7948b
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame DCD7 169 KB
59 KB 303ms
12ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 15:57:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49632
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59842
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 15:57:43 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/ Frame DCD7 8 KB
3 KB 284ms
12ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ARKZtB6IDDU6fXkd-5NzgA7XRJDdROfkBVLSMvnT8bzlMkZKQ8q-HcsUkvcGmH5zwDhjpEosGPk-WHR9K6JQuQh8xxvGbO3WY60mIcqm1t2h8gFpbkz3nGIENAIBRde-DXaXw39_FlBUhGjPkNELv0BJvsXA&dbm_d=AKAmf-B3y8NjLeWn5pwnGlPc6b4popJPL4XibUzaxHtkhApXCjamELqATE_3rylplGllbOREl5KJTctRABZ1TNy0sWymRF6XSiZZgOKqz20u8LeCND0HwnlG91djGmVbB3S2VR1cQB-7kWwu2zfcP7Bo0j8STBANG1mOY2zGuW5weykS01GAR8dwaVBCvALI2-sZMOseNLvr8Wm_-yW62whpRMuxnrqT0x1mmlogWYXSB858Qrzrd-JWLlKv68Vp6v2xetX2BfM7r18UuMX3jRX-GZyP1HBoBen8asntk_U0sef655wQnhfgW5m2p_6x_qQLX_ZR2UQJOPhRzTS-aczMnIBzcZckKVTzUFTaibyrrkiLD_6THxodvjnop1RtWgnpL4XxeqxaTPif2HUqbgLlb3rCR4cnOdu1gx3n7wXTLIWb8UQ9eXhsC9JPIqu5nQ1N0nsJzU81aLWUIb1t_vqCQqlJMq4VeDkYxUReCO6V77n0m4WQ4bjCMaWPe9aUNx9nvsWP1-RUyibkyo-H0HT6y9s2p1pNPH0QVY7uPXjvI3vybV8FWDoh6axUoWzu19jO-IX8JIKPHtJn-9ROrZ285Vxp71n0snSapX_Mi2DPGDeN_Jqs7Jco4TqHJhoBvDgh6PwBHaZZEZLzRH0JOVDuseShW5cCBSC8z_wYELNU6maer10edLPmO3p3_oYcTebpUeeER9nNt8RVb2MrbAXZMpJaIQhE20VB59nqkP1maVrr5RwtmErtr9UjNzwanrIm7h48GDx3ZmRe6ue9J8kUTPmlSF1Uja-QEBXfOwdHG6AGYKl35_I3IY9NVhQYKT9xaqkuxxn1D4o1h_whjZvLYwsUJ5mbR8-GD4HnMnIz-MeDKQb8x3_mfbp4WviBdfVUiAGfeA9Ugl18S0-LuQUA-1HQ8Rvk1g6PQLzU0U1Q-XfmW8S8dXz-ZVs5zuH7Vd_1yh2FXzezIkM5wk9rlsx2Xi_u5oRSCcWOCrT4261mpbG1JyP9M0d6E40CiYfLm3vs0WEx7GJkGbJl5usFBPj9FwEhxia1-h-U4TgzTIv-HYORiFsju59lTZ30iJSA2zy9cUcFNCVufntJLz13fyxcuxLCcvJ-mHp2kjkXMWWHnwyXpP-CdXxq_-TwOufsky-7mhlNgWWFUxJj0Wp-f3MhY4eFjhWEk3lIE9dWjNRL-NqhQecNwiAI5cMc7lxf2VeIsZsycdFuLs1vau6eU-Uk-v8G-GCXhVpKXmUQUDNXUrhg9Wb2qJZeHC2bWT9Prt0njkNcJZlw3fVZF2GTutjqSM9VrI9MXMVM_0V1vCF8sf-5CKne8iFkhGwKVBsZt3DX_PRwiDqHmcEYBpkboRdFwd7qy99hvVyWdPE8epTj4oQdjFB5I6KbWO8j4NLtBGY1Gf1uCjO95LIsKmgxN9WcRpvaZQrHxgp46H21Mu5wngC--AX8N7DfAy0uHis1Kt1ubmWjVZ5RdfwEaDeri2NDmEwRmnLrU91SQSbew8r_gawfQ88oCQixF0HfIMLCLo2OoViB66cxk9wixSozY30j6jgtGbpk4dMM8xOnMdtXA65avUdnqie6VZZz_3_TON_n8N2XvEJtIfQW05NLh1wl37Dfd9J6cRwG0grol7EK3KML6_J0XzIjFhRmu0OuljG1Iyar8yZ27YDMu6RsedTjk8PDj1LThRbJvNvtU9DERfPyZU4H-wwPgJlGH3gGooo89tV_PAsUMNJZqF0NKzhQTkI85BOTV0ExXTDizYiVDGTd6wrmm00jeLJi-QAp8cbr4iI3DrRwFQqniUqO9zjlxdmZgPDmlTNT51KVXUU3YR7L5UXlfe94xc1PN0miLZ2vlAAzOBdRBd1mETsL10NyP7XF7IPKgf32iCzxOI157Su81mEF9PC-9m3ueXms9Tv6aBbsnIelEETcwC6zWyQEkQMSsYjNwPzjLgW8KQbgv7ssHfEEimztoBfj2n_UDb5XSTzMUQL4JxUGU9rWPqZD-RbJzEXUepB5MPI_v3ebX4HQtF2ALzlMGULwZ7u83rK4FeH_6thLOrbn9qhbS0Z71PuCFyQzzJ5o3muhtrvsliIChH8NeDRBF4UI-TR9fSycnG8i27BALxn33zhgznOPYi3Em9pusQxtUFwabYy0_uqh8YvwOig0XcJf1KHxtO0cwwYZSLdSyIwEgQemrUnhISP817srqf7ivgxLMDPAcERf3XQ3AYOPLmEmnsH_EDAHksFFy-j47wxiJIPYR4QWiIJLa9OKV2jycsRR3acYDi00vtO8X4WgES6ITG-_dHY4CmaCTtlzUuZwn99LfBIRakukmBmpmKQ1yTFGTgxf0zCHIgPwZI8yWfVaLIkQ5dPAWFyc2Dl869twyQW9QNO_ePKHiK8LAtbOgHVF11yPl3MNh37oa6KKmRCL2FzXXqM4_40Ygs_XKCk5i9Uf8D9R9zkVwcOWzTfRh4ROsW0rlYRF52DELAPSevxotoL0ZY9MBPXpYBbo13oC9aVQWNB40DSZT3SYJzcGCVNWneqyIRhZNXsfMyyCc9NGL1bRexmEvzCJraLPmDhzEZlSyviHfpMdVROlIMxL6JKl6h9zmrhrU6g5VYLJOeO5-KAeL_4fRWXUm3a4KdyfrAYg180i-xJNSRvjvnlJCVYaGDy6ogYEddXw5oD2N9sS1U5M3zbwa0ZFxBp4NdUfudZTDnT2NesI4HJ0dEtcQDmMLYkrY8I1yyHQhaZg_ESEKV-qe4rW0BvCCKGwl0C5-7TzpougqocoIDJ_VowK6zu4quipzGQYtlf_XVAeXZcfiMDYFos6knUMfkViBdoOLr1UiWB63dB1H5pTferoDxYccehdybsdmaJ6Beh_EG1EYZXWlcmtGhQsfaVfyEWaHo4HVIVCIoXDlIGQDrSdWKlGQSgP_vN0Uz0n0YyP1ndNiJFMj_xDKfClWpb97sxqN9JSo7Hotu0ec6n1gcG09PV-nf4BnibupdBVStGNQDMd6eJWVIpboGOO7wmEOGvWkIXYOvvDu_YzysA3ZdEiOn3tP4GWPGK6PMfXEFqzBVhpDFSGLX5iA8jq5ENnVmMjkmFr-f14xS4D4VR3nvDRJEg-fsbhlZQmWycabUzqQMJxQtQpfTLM014W5YmFRO6Fb5sduXKuUzMrxuzn0cuojaLgG0nveN0qVSdjyUc0fGfIok8P4_U9goIDMnuLF6tOZiLKfqXXfYU5dWOSw_jf6iM0ovlFZY4bYx9yNnkYawdfj5Z44tkSRD5TmzqT&cid=CAASFeRoY7xILE49bRsKaw4jzR87ZZQkJA&rfl=1%2Chttps%253A%252F%252Ftravel.blogmura.com%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 873
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:30:22 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/ Frame DCD7 23 KB
9 KB 281ms
10ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

289d6e0a0907342fcc661d9944f30ab735754993b96f13f5b59ef4f5269b40fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:40:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 256
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9237
x-xss-protection: 0
server: cafe
etag: 9463376652360951579
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:40:39 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 97E5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

43 B
1014 B

32ms
13ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKL5zcYCEOmXj-cCGOfh2bIBMAE&v=APEucNV4CL5dRCVqEmgD2YpXhOaL5nvQ5sgnJo7Qkccu25373-98UMdbC7n6mW0EaLCppcWDWBZZDEmwjR5fbQXd7J241c-JV0uukku_0cdpd1fYp702piJ76onnB6GRpoC09yNfScLLD_IncfHxiaLTZPkYVvybmcgl6Us-f_4HLXpvsaTLa0k
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 05:44:55 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 97E5
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVFaV1lVfZkywdes9eLIRwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

43 B
894 B

14ms
13ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKL5zcYCEOmXj-cCGOfh2bIBMAE&v=APEucNV4CL5dRCVqEmgD2YpXhOaL5nvQ5sgnJo7Qkccu25373-98UMdbC7n6mW0EaLCppcWDWBZZDEmwjR5fbQXd7J241c-JV0uukku_0cdpd1fYp702piJ76onnB6GRpoC09yNfScLLD_IncfHxiaLTZPkYVvybmcgl6Us-f_4HLXpvsaTLa0k
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 05:44:55 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 97E5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

43 B
1004 B

51ms
16ms

Image
image/gif

185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKL5zcYCEOmXj-cCGOfh2bIBMAE&v=APEucNV4CL5dRCVqEmgD2YpXhOaL5nvQ5sgnJo7Qkccu25373-98UMdbC7n6mW0EaLCppcWDWBZZDEmwjR5fbQXd7J241c-JV0uukku_0cdpd1fYp702piJ76onnB6GRpoC09yNfScLLD_IncfHxiaLTZPkYVvybmcgl6Us-f_4HLXpvsaTLa0k

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: ea24240b-b403-4647-ae38-34c0e294de3c
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 97E5
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTM5NTQ4MjA4NzQyMDQzMDI3Ng%3D%3D

170 B
188 B

21ms
19ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTM5NTQ4MjA4NzQyMDQzMDI3Ng%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f606b116-0ba5-4654-bff0-68941dde0299
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTM5NTQ4MjA4NzQyMDQzMDI3Ng%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2599
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

43 B
1014 B

44ms
14ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGI3u6K0BMAE&v=APEucNUKURBAJR2PAQzs7y8tZ3rgHxCisVgFO6YQGSWFfeAdsK683--scbyDd4mEFYpEt73aXFpp9zqQzw9W_BTPTc_B1ON9oEWOuHttCQR8Bq3yB5VGeFCxFpU74exy08TSeoDzUtXCZGhbGp35bhud5eKlHX1csE6Bwn52_Tn1nAe0FMFLUww
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 05:44:55 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2599
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVFaV1lVfZkywdes9eLIRwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

43 B
894 B

13ms
12ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGI3u6K0BMAE&v=APEucNUKURBAJR2PAQzs7y8tZ3rgHxCisVgFO6YQGSWFfeAdsK683--scbyDd4mEFYpEt73aXFpp9zqQzw9W_BTPTc_B1ON9oEWOuHttCQR8Bq3yB5VGeFCxFpU74exy08TSeoDzUtXCZGhbGp35bhud5eKlHX1csE6Bwn52_Tn1nAe0FMFLUww
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 05:44:55 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 2599
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

43 B
1004 B

77ms
21ms

Image
image/gif

185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGI3u6K0BMAE&v=APEucNUKURBAJR2PAQzs7y8tZ3rgHxCisVgFO6YQGSWFfeAdsK683--scbyDd4mEFYpEt73aXFpp9zqQzw9W_BTPTc_B1ON9oEWOuHttCQR8Bq3yB5VGeFCxFpU74exy08TSeoDzUtXCZGhbGp35bhud5eKlHX1csE6Bwn52_Tn1nAe0FMFLUww

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 776c3ac6-449e-4f46-bc1d-bb6655eb1d15
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2599
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTM5NTQ4MjA4NzQyMDQzMDI3Ng%3D%3D

170 B
188 B

21ms
18ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTM5NTQ4MjA4NzQyMDQzMDI3Ng%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:55 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 38f5b4f1-f8bd-4d15-8e89-33b6e6161c09
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTM5NTQ4MjA4NzQyMDQzMDI3Ng%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame 18D0 169 KB
59 KB 284ms
12ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 15:57:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49632
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59842
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 15:57:43 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/ Frame 18D0 8 KB
3 KB 265ms
13ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AMq_t0E1b6xugebJSpmI54TFCoFP7YoOH0mt5NGMzjrlWIhwhnyLzkTv9TY0mCRXee9hs25IfdIh5zu9BIktDVagZnB7PSvdFQF6h166twPWrqUtqJpRzsx7T4aKmZhqJFLM5KLfGV_zLB8P-RWzVU3e0GuA&dbm_d=AKAmf-DU3WfcpUAhkqbZRpWRXpSgTkOtYB9hSewTeEly6BK-1Kte1kNTsxUNTh69rXXtlniD3xIXuCzxujn1GgViuJqHU7m1PTDoe5bBFs2vSRQBqsT5kVCs0sF1XN2ETtf-L9RGb1nULzQdjHx0ex52zqeOqLWpS2JOQH0wJtGkEwaozLcbRDrABEdlVzQ5twoNNs_bDDsL5C0whJHNqr6VPOyqN7hmaRNjQQB-74MytS3iNzr_VRh7AGQ1Amu-Og_OIp_5G1cnyvwChx5Lms25UUClzPt45gLyL8x--3Stefisv2TaJ_zsrljKmavpPOcqh_kSobv51Xr1x-ir01kn2eKsMNcvp9xHcLHsKNo32RlXp1O83R0lKftk5aYBcEWCJQ9FHSi9OfaV_oH101h3kULz2zEv5la-Om4HyJ_YXT2BSpfB2nmNBCmSsPr58CxgEj5l_El6O5s4fDDk2ekWwwPzITR6tv_zIkYa-MVMOFJjT5xrS62ipzzgN833vRwbOMvfiG_vBi8j6UpMG6fY3z1fzh4mx-lhcAtW7MuTRd4Va72jZZwvjQGNIPzBqZlspwwYA1QDywyubw61SUcDONnVDrQTkfbFIydnThY8HpOliHCGN8FZmqxxycUeRSIPGSCLxGbdGPSk-ixA35nnFBcf-lwoTtoPqIxKxpdzt49VMmBDYlXbFXjySJVOHa_sPKc8bkTKsDRLqokQIBK3T6sIZFNr9atVy2mxdiAgfghlog1BcOvEZHNLtBeiDni4SFUUYWVAOSkduQevLhJqgeM-zwZz9Bmw2xUX2_FwpddssINK0gAxi7j1GdvdcF-jocySmQfPuDxoYXDrH-UqInx1D02r6M5OXtyNywgpo6Qh6q14Wx9CQfj-r_fd_StVfDXoc8ndEI_x5FktzIvVrN2WHb-cqm-XBr2O_urm1Wq6zAkg0uzYnms77-5XJXmV1oi4eNOGK242ZoSlu2p02Mc0SJGWQTjr5NKPjC3_P2aPO-c7iw2iqdmkk-MxfrWBIBqdsZeOYDRQuWv_HYwn42fko4_CTDcGMgrzxrbnZ3brvNu9WQuOUb7KG426EcakRoymamGs9sAHjTTpeALFBXRBaBuNnIYy_nmn5R9JGwO0uYoX_9rTOhkCGHBEFENd1RVJzbbvK2xNcHmjpRFPcYK7MRfIxn_SpIn_TZddY37WeN2CkOUZw3XHXTJ6-vhgyLsoj-1mhBoaGRLOrakq2xrYjoGjvfO0Sfq--MOt3izwkx0gdoV-s09hG6_LGjAeuDf7MmgALHAkjuwEeiltMkioKn4NcLOMbBphO-YW8bwCYt6Uf72Q96N73t04nKN5GywCpRUwTe3qar_1BLjIkjD0lYtkx4kWnBoNe4_5t18WuOYQcjTuh1iihA8bRe1EQYShtuyKroINbyC7jGwQ0hsEQuP4wNp-VIaqlLNYrw-PrlmgS9O-xv9lC-emSg8BqHFfUeESS-Wi1LdcKK2nCgN8EwLhS4n3DJwIVslGKZqespTedOZ8JSjBFFujeqyB5mMCUUNcbl5kIOy6o5oKAsLbEKWDmw9aI8w3xxNhR4diuGsxbjJptQEYdLysElkuUAkipJBdZdAlL9gg7dPvg5rwkgrnEWPCAvk7_g497B_WYlLra87DgWTSqDMN0kU7eqmJU0GcPPDzt9lhSfDExV-UwU5QOhi1aVQehbWjOpYKzB70I9BQ0QCcOursT1VEzOr-bHYc-3Q1cf40JI-p8_O8UZhYyNIb0Mwm-UejuSvl6Vu_h9M-kUlWvDOFx0YGu3SGrgO3CVLjz3DuslNIK7sZl2ANgPpvtRVrVSsFoAZ44OGcppWp0y1QG0r8oU47OAkZTCv8dwoOJ2ILqzmlhBDYcbVLAc3lMFJrCfhSIRstsjqFnYRWL9bfV9YVfgDC1Bqins7nanLJtGfL3TUpgmk8KLzDyBuN8P3YxPMp4Au-cdPciqmk8FxfuS5CYlN4Us4IAg0Q9fdog2xf7MtuC9Ufxw5OjMAzn4tFNotkmpna6mAAkQtnMYfejqnnnSjvef5iOlq1S6BThDX-4Yn4MDvFYxIxYEYNEtpvyh5JpOj-ue-nl1CZ0yjb2714h4lFrvpR3G8T4PRVWVqYT_oX8HETHbvR_zaaU-FqXSM2R-HYUL996OVqylm7CwHxS9SYt4qqZC_kqv8srM_qecn7-kWJXIcn1p4tBS-7chFu66-Vij2aThfQg9Dr5Os0_AIuKGqb2LYTJF6nULocZatRK64bdxraIfgzDTq4cjB_LeB3NjLgLGWyfFcU4oZz54-a5AYsqW_7TG4QVihxXBtAenlq8A05_86t_nmOnZX_qBtLi4FhBNwNLNdEPFTxI2HjlBalnGuRuHe8cxxS7mw4w8DKrMaJZ1l-ajlD2bow-3kDuHp9_J46zbguHhqhYY3jEYnfc9fCRbT2S28dRxTkttKPyWgq0q2c170S3hW2bx_Y-GbQqsmfWpURDyhUGTra9dJ3_A0hnzZZhz_4mnAuFuahVAqUbAAEH4NF8r-qJDQmBobFYMcXAiAnkeDS95JCUmeyEPVDUc0Gr2FqoGqVuC1cXhqUBm40YXGNhoAnpJ7rdG1QHe29MHG1dQwAD2iu7AUbPCwG35vXx7HKzCjSQl2Vne3ObqpEgROdr1MJJQgqPLFrjqMXInpDE8uSfOZtNxM4_mviMh7FK29q3t4lJksWK0cj1rDU_8u-565hE3RTYI9aQGCN6ZbeIZ735CPJaq2oiAfTvGYRdT7Vya5IDLeCwhQl77V60WmyVaZXC0pleV1_0C8QdxOYshZW7CAvLoHr3wPKLHQiorCknWEN0Y7mrqygFc15vy-hSDY0Vzzr1iIDMfU1wu1Im2xRzAnZau_02u3TQCT5peKBCKRxSOdOWvnzv-X7gQ6Sa4WF4h2is95AUA92bH5xznn6a25MrbyPsYDW1YBW43KKciZZXK8klYVyFcIpzXcyZXhjag9F6RKbOHLCbAoxJH66BzYVBQStbZigGSw4i2aGURL3-AXOrOdXZ2K_JNQME_ZFVdUleUudK6tSPi7X3aOiGM2Na_5o5U08dnoGhp3wf1k1dZ6l-uzfDD_R7v4gjjY_nsXMUhA2E0SEVnQM5TTxQDiZCXOg6QhlKpO3X8THjg00PckoQZdEVOk_qsfGJlqhqx6HlVWyCAsusT5MllaaM7ow2g31axnL69uHCkBfJQtPLKcekTAG0n_PTL5G9S2upsnvRBBikjN7WO_ECWVY-WRlG9JocrRX&cid=CAASFeRoSJz--7c9Sjq2jFHiA-TOxoFELA&rfl=1%2Chttps%253A%252F%252Ftravel.blogmura.com%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 873
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:30:22 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/ Frame 18D0 23 KB
9 KB 261ms
9ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

289d6e0a0907342fcc661d9944f30ab735754993b96f13f5b59ef4f5269b40fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:40:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 256
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9237
x-xss-protection: 0
server: cafe
etag: 9463376652360951579
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:40:39 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame BE53 41 KB
15 KB 308ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 13:20:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 145458
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 25 Sep 2022 13:20:37 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C63C 41 KB
15 KB 309ms
9ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 13:20:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 145458
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 25 Sep 2022 13:20:37 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 6985 0
348 B 353ms
115ms Ping
image/gif 2607:f8b0:4020:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~ku2880tv&c=2184258788540&slotId=1092129394270&qqid=CITxxMW5nvMCFc9z4AodMh4G_Q&fb=outstream-lima&sei=44729911%2C44730425%2C44730426%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4020:804::2003 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 6985 15 KB
16 KB 31ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 16:31:40 GMT
x-content-type-options: nosniff
age: 393195
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 22 Sep 2022 16:31:40 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 6985 15 KB
15 KB 32ms
10ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 16:31:43 GMT
x-content-type-options: nosniff
age: 393192
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 22 Sep 2022 16:31:43 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6985 0
56 B 220ms
15ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=CaGw9VlpRYYTuGc_ngQeyvJjoD_yh2tFkrpXS5ZcOv-iivcABEAEggdWcJGCVgoCAsAegAaH1-ZkByAEFqQKomv6L86mzPqgDAcgDmwSqBN0BT9DaKNEBIkOwkQOCEaV4OGNXEx3yY7vVFl5lBBJyhjH0vfOWSqsTPONJr9fTqSpqQWuLQLbnu4UdtfzSqEsgFqM0P-IRCVNgl8gAo3DYRn47vnvwrnZ9nKiYqqjtL4IgAneOBI1_yrWRnLm_a8fLEbnjTdEo4nI1XpbUlWgOUEMA-dxovuRWJkZHtezaN1ez17dGXg4F416ojCDd29xJwZjaqs32F2jdsc9EQumRrFYqyWXxzxqfG-QhpczXusuHKoktBjSWkQ7cJy3PFNQTHTJCcK_h5Mn4cuTBj7fABJaImK7RA-AEA5AGAaAGdoAHx4qG5gKoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA8gLAeALAYAMAbATm5uyDMgTgYuA3gPQEwDYEwqIFJ0I2BQB0BUBgBcB&eventType=clickstring&clientTime=1632721495611&ai=CaGw9VlpRYYTuGc_ngQeyvJjoD_yh2tFkrpXS5ZcOv-iivcABEAEggdWcJGCVgoCAsAegAaH1-ZkByAEFqQKomv6L86mzPqgDAcgDmwSqBN0BT9DaKNEBIkOwkQOCEaV4OGNXEx3yY7vVFl5lBBJyhjH0vfOWSqsTPONJr9fTqSpqQWuLQLbnu4UdtfzSqEsgFqM0P-IRCVNgl8gAo3DYRn47vnvwrnZ9nKiYqqjtL4IgAneOBI1_yrWRnLm_a8fLEbnjTdEo4nI1XpbUlWgOUEMA-dxovuRWJkZHtezaN1ez17dGXg4F416ojCDd29xJwZjaqs32F2jdsc9EQumRrFYqyWXxzxqfG-QhpczXusuHKoktBjSWkQ7cJy3PFNQTHTJCcK_h5Mn4cuTBj7fABJaImK7RA-AEA5AGAaAGdoAHx4qG5gKoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA8gLAeALAYAMAbATm5uyDMgTgYuA3gPQEwDYEwqIFJ0I2BQB0BUBgBcB

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 6985 28 KB
14 KB 110ms
44ms XHR
text/xml 142.250.13.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-Dsb0dP8CAOoA45N3fg0Enk0RG8f7zhiRj__nEBrCIUkjRuHHvjEloIzeSR4dqhx91LL56lsP99nQlpOlIMu-eAmL_Fyg&cry=1&dbm_d=AKAmf-CzMndTt4p5LBXKyjZTnvZBv-u10G5fX6XTrWUQCItzC8i5ZlQtX9M-PNZMflKjd2KBPuYFcQlGArlSO4EZf3jIojqlrbk2-hIg9ytr5KSZS03tZ6Txa5DTCEmORWOPR88v7T0oi4TF3hLvSZ_I-tJYgKT-ly4Uwk2RDPazDnBq-7TjROQLvetgJ1Am9OCPu9jUCEHRYqAwlOs4QWtCkfLxNl3cD6LEMxOGd22W5TzvzL_hcnOFfGV7vULXGTqep2Q_scXih-af1PUlLpjschVMNdm7vGm_aEQK6MHKGxfXZHY4O6JpieICcxWsV_Q6SZzLYlt5D-qUj3i-Q9aGNZabkQp0ljdc8N0MiVqrN5v_dsSjG9MEaJFstu1VEO1vA9Rnl_AYTod6PTTpo0ac33QSQd1elbJYhbYpmhUK_Z9mJBSnRqu7obFHxsYAYNQGXYAHUJwF6kK_NVkWHbx0cM8bO8MDqFgJ2bfqV--VxXsXEJ0FrASa9TX2dYES6XYtQokhIWIcxlVe3yW-Cc-06ZN0jWLyTOucdKOhPP_42GCb8IcwI1NvON8shY97Ow9kJ6U3M3vsqSGMwN9XRptK8Ui5_vokFuDCD2QYBRKwK7yOGatZE5eottHZvIMA2EdfG1W8OfsJlORm8NAFHsDmG9eDh3qNuORO1BY7lnZWzm_EjZd3e_drrL8BLpyzNCKlFmV54oWLPOxr0XDf6pPmmzagghdeGaEJwKJxFKxSHsiuJrAkUYa5Q8-Z_wYRH-C_WDi-1ynuey7oqpd9VIrIuuUe_LN7cMRS6964OLjpytLd7kUiEiByt0cI_Nq0m_WEGeyKsYfGwimZ3EzYy9jbEXcfLvaBWq5y0gQBcFgVl_ltijESRDgaT0KEOpgSz0VG5I0GsT4mCReXER5QpPP0L-Y6qTwPkhCeN3AvvVzZy0gM3NXjiPLfE4GczrtBO2GQtHjsQk0kM_NqU4rsrq4j5VsF88bnvpWCgwqOPldZtPDqKqRzj_Wkne0iLPuHml_wniJ4q3aQQrjIMIt4pNPx0RpyhEKt5ROYbK7b1AwsFNqSPMCkkdQ_w6RABGIvTrU3Eo1Drc0HEfkhEBCDbRjtlCnaxI0VpK4IeCMMvucyLcDKAtpglIFmdhnnjAaIRIDHDrd54dS_KE85pdn6MHjoVHmJ0gpM6YdG-KHVuSelaYlkATQ6533CiIGmuuFkonIFl_W91MguixNVR3-9s_LMCHuMmTD5yHjBr0LtlQbVGG-IpcXjimwLDgA-PwH_vYg1PHYO-UQxBwjGKvPRxB1qPT9Yt7jr2Lv_6YyOaqk-BJZe4JEKxROJ3Wr2s-bP5Oyld-yBc0EhzahFoNXu2z4-1f5NJffSBoeeGckGeiisMc6znQuqPRJJ2DPb_q01vsEN05c8Es_hkzQCt6ghJL6TzcqLfUXEszGC8GuELzlOD32wbdwa-WuAfXphNMhF3XEpQrQmeBMrNWF84KBrMWDyMOXc8sfSGwR2uiCVRHCFZy2RXN8SAmTMFRU8ZgsujQ_MG82s0x_iuQJzg3tez-3oC89fxFH8lGBKHHuCYJ9UgTGkY2_c-aFJkLKnWVzRT3bUFzF88uRaFpDpcEQs4WRkZA2ZyNUyCr62TVHujCs4sltXvTQbhadK-DLk6Nm3pa4axQTDzpuK97V3zQ-7EDkJ1xzFX0DYkkwRLoXj74HUaQk-31ytg9-yXLjGkmBgHOs0ciXgu-03upuFrztsuQ8cVxhFMBsIgPiyxz238ss3AJmW3potdNUg9SIS1aqXBbGe_7Vy51FyADNS45zfiQPxg4qs8OmoPctp_bqcN8MHMe6Y9RzCSkGQaTXk1R8B2pG5Z9HQUzE2pF9w0-Drr7vU8Gsoh79oMSWiWWSnG9YP4DMqZE5Ns3qzQ4IUcVNBNBv0PdlAzqNJVh-_Zo6q9yr4rkZG6syI-_OUSRotw-GlUQOM1p-uqOf1ugtgnn805r58viVgnB7aiOrx5QsxHGBbgqTtmM6QjAAMqXvp6ikSrryColHpCiePguNqjXgRjmKUVNg6TXxZ-AEniLRL6Wot6uWJbn4vPNLxqohS2keeNxrTRT7C4IZ6IgIyMLsXWf3NeCm8m4PfJM_sKsw_1ac3PYPSubuq58fQeH4aqQxbVGc1GdeQNs_3ijx4B4mr3E_RP09ysTlVuIMC8sNa3sdUFd8paPhyMTXOOX-IZGCr7xY1mZ92eX7n9UJmLkmCcRctMXkbL_7LhaKXlGuYpqQi1fcHvA6YdjZzQ6j22uOZC2addGGGDUeoZJ8oBm1or70REZG7qs7A5Xzw7Xs1BUtvGBeiJsQj27Fe9luJLPTqQekNcMINkxzvyKke4Vd5QTtknwEhoxSCrXu312CbqqhKS6b5EnreLdARCptbKD91F9zKg-F39f8Dn90FF6Q3lRAfbM3iP-abmBHkNL8_sOl05JTUhEWKheOBSbRludOj8aoL_ik6ok067B0RAaYUhm_zEBzfyQ8hQQaKipxDYI2eKxKm7JvdwpBtPPQbZ-Wl0N_6yZSxKigviUi_z_tKQ-nSnUHQUmK9LjD_L7RVH9a0tOILfPjUS8mdQHVOR53GukB3As5triJuID1g5KOBRF-XBS10ftiyqsznCrsf6Emp9pXFe-kNYaoRD2iznIvtb5C_XgjKSXbCKGARyHoYSwQRgnycnAsG2E3_cwMreBw2kjuByZGitRkfgBLfjCbuFJSkOkis-4c8gCkQZ8_j2F2a9pMrYzwZkxQIzGW-6gyOHuvIX-WbBWK2IktengcUV7b60wzeVm_lOOk-T-b4G2c96ew4Pktk_D-X9QFIOOXlVVlT6nm2KOcz1xwPITrzavpnJWkAFGjX7T5nhdVl4NnVJuukc5A5AkBfTDEY6Y_gJqMPZ_1SWNYY2BxhsDeM7YLNorSigERfVunhrEOPrLqzUufY2xR4UU-lAfxries2mae-OLWH-Pa-VylMPHVt59IrFmy-hyOjdRsKzYAt1nZIxrXMVGSkB32MVR3mxY2d4q7hoIIcONGY9cqhrq3xRnMUm2vwVaJLvxdYIT12sd4aWSQdRSqShKeeqKlHwbz30DScWVJjhjk-9d4b-BA1n0-Idq1Rjyy_2sYdcGb3_HOovqtKZhTq94w5DF29RtNuMDrvi2Co3v11Uf7B7-pl2jQ4IYu79ntV2k8v9fvKQw6maJOO8V5NTRmh9F7XmCSPhdXqBoAYq0WzrMAPPSLE-oc8JRBH0HIYmf4ZqKTdJ5kV3uFklJkzQGhno_Q2X0M_mxu19N52TMgekXUgVFOU1KPXGiYzrCPilKp9guoyXoCH1V68pTM6luIb7POv1DP3pxA2yrbS82o3J4hUHkTKdGyo1sAUp47tc7T7JGUL6tmOxNLAjko2Aj_gQGBfREZVMFKkjlqW8ym5EBWtVFQQUmfml5NA5Y0GTb3qeAGBIdy4xtkuUNP1iqTXNk7pMXAacgcBLdb76OGSFKdqAuaoFRDt6WMZadJaZuxww-qhEdOSM3wrxo2xI65PQlyN6pJqmGRRj0pgtswvC2usVMS6-ek5wctmJRF38q-rkOexekWsjnoG5M5HC4Gbb-K2kake31XU1pshBa8qSVG0WVg02vH6VTKD4QZpww5b2DyJOmxRlvfg-FiZYQ9Dyl1eVcJfWuXbhtC5gw&cid=CAASFeRoSZBmRg2WWdm7Va-J7lZD2QYbpA&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.13.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

we-in-f156.1e100.net

Software

cafe /

Resource Hash

05ab300cd25da98c0e7fd686460c9e3c8cb4e25e97668f85fd2480359cadedc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13775
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 6985 0
0 30ms
30ms Fetch
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cr4M8VlpRYYTuGc_ngQeyvJjoD_yh2tFkrpXS5ZcOv-iivcABEAEggdWcJGCVgoCAsAegAaH1-ZkByAEFqQKomv6L86mzPqgDAcgDmwSqBNoBT9DaKNEBIkOwkQOCEaV4OGNXEx3yY7vVFl5lBBJyhjH0vfOWSqsTPONJr9fTqSpqQWuLQLbnu4UdtfzSqEsgFqM0P-IRCVNgl8gAo3DYRn47vnvwrnZ9nKiYqqjtL4IgAneOBI1_yrWRnLm_a8fLEbnjTdEo4nI1XpbUlWgOUEMA-dxovuRWJkZHtezaN1ez17dGXg4F416ojCDd29xJwZjaqs32F2jdsc9EQumRrFYqyWXxzxqfG-QhpczXupOG2Ce-_A8EOuw4G8ErMmSAG4LRQV001TsFZP3ABJaImK7RA-AEA4gFrNi0tzWSBQYIAxABGAGSBQYIGxACGAGSBQsIIhADGANIvouTAZIFBggdEAQYAZIFBggdEAEYAZIFBggeEAEYAZAGAaAGdoAHx4qG5gKoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4b2AcA8gcKEJScFhib_diyAdIICQiI4YAQEAEYHYAKA8gLAbATm5uyDMgTgYuA3gPQEwDYEwqIFJ0I2BQB0BUBgBcBshceChwIABIUcHViLTkyNTI0MTYxOTIzNDg5NzkYicAL&sigh=DwUxN416gz4&cid=CAQSPwCNIrLMxN6_h9jFTepXYSK8FB12jJHR11mYhe86hcOkX5KGXJ0EyC6yRUZNbH4dVnr0jjPxwRDM9WLzlBikvA&vt=10
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s11-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 6985 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43ddc7f693059d446b8732b2dac5c1511a952c9704a8c330d28a496cece68698

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bootstrap.js Show response
s1.adform.net/stoat/626/s1.adform.net/ Frame BB3C 33 KB
16 KB 100ms
16ms Script
text/javascript 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Requested by: Host: track.adform.net
URL: https://track.adform.net/adfscript/?bn=46470475;rtbwp=YVFaVgAGdwMK4HPPAAYeMl42OZWXoxuNrRYYNw;rtbdata=sE7aJDcJuegbfGs3ujAecaM_E5kYQppY_qZBAluh52TB_gIeuEPqbSUn6yYso3JAQ0E8W6qBsvzqe2mcEfQSdjKPAmfqxm8EkTwIWyoUwA6K_12MCGSzFFH3Dw20aDHV92n4qHsaARkv7cRi-l38B4_4B4A0Pe5CSHLdtUmNyw1LvnfCxQNYE7vGpvX0AsEB9HSyZIj8IVoRx_2tDow_ifP2teoVDEuNHqWs9WmNogH8bx_s1JcHCD1eSkNiOpcjvKYvaiqLMI9w-iQ4hD3WPLptBSlW5ZWPw3iI60gHGBc1;nofp=1;click=https://adclick.g.doubleclick.net/aclk?sa=L&ai=CwwDLVlpRYYPuGc_ngQeyvJjoD-i-mJRcoKWzyf0IwI23ARABIABglYKAgLAHggEXY2EtcHViLTkyNTI0MTYxOTIzNDg5NznIAQmpAsPjD0-QJoU-4AIAqAMBqgTxAU_QaDM40n8FtJTFtH8LgqbdWE-VQKD4sVcXdDh1CkTRThSw3lsI0cI1tgzzj1Px2iivY4bGhbwhzpeiLWcJn4SpGug3eECjXEvoJgrEHEZpsahueQFVKn5hFi9A_3Q7UH72AXPWTbQL4u40pCXuoeesfizmxNEXST-MEdX-4_3ot23o3c-NP8q54NPPABLPIPEiY3DvTJ6MvApr9ablgJDgp4kCPSXIU4X7uAvMjCfMuj0Yl4rMkGmeulymie4hStoum3lWMgQmbvwev2a1ZAveKn-JgskcilNM13Ma4djt14NBaf3S0njzU_6fHKoLdM_gBAGABun_2eWa6qLFdqAGIagHpr4bqAfw2RuoB_LZG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB&num=1&sig=AOD64_2KJgVQ4CQOwCF108jmeN9GWAN-DA&client=ca-pub-9252416192348979&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 5eed273d16f8b9f330c78d58eebc4c1cfb64346a84a9bc8781afe1bc69077d67

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
last-modified: Mon, 30 Aug 2021 07:04:15 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Tue, 28 Sep 2021 08:54:09 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 301D 0
54 B 317ms
116ms Ping
image/gif 2607:f8b0:4020:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~ku2880v2&c=6911441280695&slotId=3455720640347.5&qqid=CIjxxMW5nvMCFc9z4AodMh4G_Q&fb=outstream-lima&sei=44729911%2C44730425%2C44730426%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4020:804::2003 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 301D 15 KB
16 KB 8ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 16:31:40 GMT
x-content-type-options: nosniff
age: 393195
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 22 Sep 2022 16:31:40 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 301D 15 KB
15 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 16:31:43 GMT
x-content-type-options: nosniff
age: 393192
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 22 Sep 2022 16:31:43 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 301D 0
58 B 190ms
14ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=CneVTVlpRYYjuGc_ngQeyvJjoD_yh2tFkrpXS5ZcOv-iivcABEAEggdWcJGCVgoCAsAegAaH1-ZkByAEFqQKomv6L86mzPqgDAcgDmwSqBN0BT9DFehPhZg-GFrBrPtcNfNG5qfL-HD84MfejQ_0aOToAaHVM9gx6bZxgspRCbUF23ooXYcKVuCaISMh8mdQNqmgJUha_X7iFvmBE3qAHcTVyrM6cNxjfBqT8j_v6MdGbbFOgg1TAgm8Qqsp8719Adbm3J25E77rjscWk0EOC-6p4ihc58jqZ08fmbxPjkvq5TqfUFXP85fi_b9YLRQIOE1ShmKhZ4wQdGz5zLFT3qsbxjHpOXUlWwxMLrnogB9vHrDII1kW-UAEBBSk3FdjmgWUHrdV4JzrAvZpEofzABJaImK7RA-AEA5AGAaAGdoAHx4qG5gKoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA8gLAeALAYAMAbATm5uyDMgTgYuA3gPQEwDYEwqIFJ0I2BQB0BUBgBcB&eventType=clickstring&clientTime=1632721495650&ai=CneVTVlpRYYjuGc_ngQeyvJjoD_yh2tFkrpXS5ZcOv-iivcABEAEggdWcJGCVgoCAsAegAaH1-ZkByAEFqQKomv6L86mzPqgDAcgDmwSqBN0BT9DFehPhZg-GFrBrPtcNfNG5qfL-HD84MfejQ_0aOToAaHVM9gx6bZxgspRCbUF23ooXYcKVuCaISMh8mdQNqmgJUha_X7iFvmBE3qAHcTVyrM6cNxjfBqT8j_v6MdGbbFOgg1TAgm8Qqsp8719Adbm3J25E77rjscWk0EOC-6p4ihc58jqZ08fmbxPjkvq5TqfUFXP85fi_b9YLRQIOE1ShmKhZ4wQdGz5zLFT3qsbxjHpOXUlWwxMLrnogB9vHrDII1kW-UAEBBSk3FdjmgWUHrdV4JzrAvZpEofzABJaImK7RA-AEA5AGAaAGdoAHx4qG5gKoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA8gLAeALAYAMAbATm5uyDMgTgYuA3gPQEwDYEwqIFJ0I2BQB0BUBgBcB

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 301D 28 KB
14 KB 95ms
54ms XHR
text/xml 142.250.13.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-CM_LyexoMKkQvbzReY6_aSESezNqDJXi6ItGRAgQl99DIW3ChMMjJCZy1bfCgLzqN0Qh3WbBQOrvQzg8PONkziir_CqQ&cry=1&dbm_d=AKAmf-DhzRjkLjx-GgujCZSvhwrCqe65FAbN_4-iwxm11MqYb0QUtgqH_JPYi8jNpaawAUiCrtDBI9qshobGJE88vlwcEomE_9a1pWHED2K5F6WI96MGn9eR05N50HTiidsVP0Q_OW1ZjAmYt_CChTIadLlZqA8phzJbBik3GP7uy7CMyNXEzMScQnZKEMkgwhH5vzLBxQz2jnUW4Zr0GFsmv-Vg3SC6hz8zX6X0ce89t_3_dQNSvHtz0gvILd4AkBUNa0A22uJuqO3oVbbshqOU6RG38LQBqJiK95NuY0SuauiwPPGrq-0_DzHNCQIJbI72oVcaj6JX5sj9xxc8Vn-MMP1cn26CAd8Z8_iL91RyQKIZ1WJ40kXbvWYdPaxGUX15NZ7XwVHaj7IzUpnFnFXwEKzhTohbRlvh0AbN20LbOek2S_3IVpiA0Y1bmUY-vn9fFEolF4pzsrhQ47TvrxT6ENTKMxc27Xqtl2cqYLdCj-QYQnvjhpxubEEPwwppql284-ZRSeL13xGa0w8FLDCfD0SFFmmPAtWBVg5P8RvL6IjgEILjA2ASGcGbOq1ojwlSIYl-ZbifD3J-3a95crmQ9snXfqmAc4aHSh4Ytu_CqevcKB_Rd0cDJ0bToLwt8e9iMlXthsf8aVnmUjjsRP2NytpYzHhLVS4Sfa1FBclMtx0IMziJgjmtA0N6gnSJSeG4kO-x1OEebLDp6DcLlT7gz_hxVjy-k9FZfTieXxtNVG_Om1-J3iSX2W0Kk3xzWrsadGcSMVEN2AZ5-z_pEyEjZWF8J4eRXvOK8f01TuLNrV-wvNaXqezC7Fzr4uit8aBzV-q5F-JsTewoNrg6dVoWiW7JpAAVAjAodir6wonggmDAXIt7QtgOJlvSM7GQEjZjpnbSmro82WuKD-BsuDHo9GTOW0tiRXjyOpPECeg5vErCqtg9ggManGb8T5es8iIX_eIrDfeVUf5DZkInCJUV2iaA2tHRFbFTRJucWRjXHfJfQ3ReqL6jpNpt2-DQ4OnZhiF65icZ9IvpouLTEwvJF48XjxDfQ0FrIdIu-yW5Lhd6cVh0UM-J-YHO-P2kWLv67Bzn52vlZWSmuNeK2iBqT_ypAIyClo6pGtyAbgcS5wDvFhzcLOA6ivFl0rzWMjqhBU_tcSfOs-Vp57sdI39Krr9u5oEcbC3aLMye6xWcVoSJ--uAnZUet7IWAAZcHzQGSM8SERL5VweHD7Ir4iDD0y-_wYcymMjfUE7USFt1ogJxFCuddfoy-mVDIPmA-rcIh_EbtZUNG2ZeKsTdnrLj1QCOiUiN7R2PZFVxxBkUfAze0SVe5y08P6c9BrcD8RJNbvqYvMo1s8xvbBoszGsrK6CnR1dRnqHRUmM4ChGjstqNrHDu7mSLiN2qzhNcfCHRwGR0X_0bieB6pmkE4JFfd4IAdbFul_xtXmdkmUIdoQ6yXkvt6ncFblG3o0Fr2DwDkXIq7IljW2m3Y4oxmDaZFMJDECHEtWtjmFHQQtCBpd5MZ1R9aHjXsTOjYcTzXDR_BERr04zcn_bRXMsSRyVxosfOaz4iRdMiFjKSlfBpLtVCThPj7ofMkxFySwsD7rHRI_cuEr6nwbIQiLival6QI9kCEvtjn1jDDM_ewgj-A2EFA2y2tdgOyyqkkb_dsaf7zIgvwt2K-7eCbIYTLywGbbGGFfaD9nAw5STjAnQ2UHlHU8Ql8pACLy8d9gGv4XJPgQhr9CI0cyYZ9vDRz2I85iaLROz-rut-AKOZ1WQnxnUxMDLJFGmGVovbLGxzpZ8PaP_Cuv2ek5-M3UQHEdlK5pZvQ4pgpPkDmneFEIqj6F2s4ccTuoxBDCR6RNVIeGG_WZ9e3Qc4va4-HynUv7gA18sC5GqqwE4E7rRvtywrAc2NZw_YI08_TI0QPJhH7Pj1QlPoV4-Q49ctCmjooPZGpRWNqbtI1mmL2ifpFSKlMHOXc3uKH7QXkG-DWiYsQAfb3WJd0IXgezTMYlXcsi2_knxI50KTd51yG-2_Yak9_y36q4nTWQR_j8-5Rscp0yc5ic6Z7-0BTGAS8FtDvRgtP3IpJI_obB5Hx7dmxOe_ZhJDzdhEDItk10kdu82H8YioyvD81KMCXHR3rEXINo_oefjaBr50u6pEHoizUGXJDeSKv-RZYtzD5cAdon2tZQ1fzWRTtYAQOIhf_ezuV_icmdNoiDzvhpFdkQ_lzpkMrmHXAXf3JzIiUQ5v-d4mtIwt7DVGURR5bJFv6GOW5eEiMV6K1cLwhM-F-zYWNBOe2tukGcoaoqA3qUPWjJbmjPITgS8L5uKBasSmKo-JEZSXya9WThOB-CK2-07p4jx6FmJ5Ku71G6iaiu01qAN7zksXRVdPQmhxOH-MHcCwx5zto3SC1eW3cztYDaHmK6e2EKwOfyUioFzckWs7a-ZRNSSfn7enjd-qyj01VOxR-d6f_QKlyhUbwyXe5yDsUaElgVy3h7dCCbglVIZ-l0Ld2llPqT1fJIL3G4thVNonkzeFWobqzbPM6sk2Y8GbEZK7_CtOXECR1ifmQFIDCqAYrjaSZExywrrrMRh4ThdCrmbknFKaE3TGGariPHkh50gJclnA2kk0tLcswZzRLfbN7W3ELOLsOAPnnvJfad-UJrC9ax5191TyzgE2ZcQhdSCm2iseIp5RRTMA7XhVqlDV3V-m2K8rGwvEy-YF7ozcueN7seA3Hy8KTGD5J7grt1ncUU0g5G2r5uIV6u3vjmnf0Vl9SSyWdv86EvYqEkyP4Ky7CQQ4gZTSuHcmb3ySzGj94ROcn4TXC4t_1xrWW8VTU78HmxqTk2GS2IS6ziIMhgWf-oe3R3psvcqgw9HKo-dz2SmN7ji_SX-uEgDDsMXeUd5sBV7GrAfoEQZLCIqMRws-SDV7F31ylkV0WgZ9rKDSCSHbSEjsLKFe1-zT1qY0iOKH2p0RLEm8lwkkWYpxdeF9CS06qmw0v-4fQH28avAZf59Iudr5XuRPNcV-Y2xbrM35uyJ5_aJz1fLK34oUinmvYmcEMIiWi8mcGJJLUh0CYgjgcGimdwpTD3eiu_-Gji9jCPpCWOStrnjdd1acm2--SSQxsAWGI50R-waqZaNuwkIFBImf7so6p8HlOWK5rYzSKB5zNEGwhrKiSpH3v35U2XgLPz-uPFaL3Xfb7vrZfNWMA7Xnk6QD1yLXjK2jVNvhEwJwC4KdAXizkvbp4f1ebk1Kj9QitS7I46Yt6Z1bP9cuiQRUtdrqHRZ-Mc6U2FJJBktVGC0oa1ZI99sQqTnr99I-0nlA1xbtAoB1nFhTE8MiMCnv3MfxdqsOdPS43vSggpAOoyOmfo82t5ryof6WjX_NMb_8cWXvTJWSHqbj2px9XOLF-3F5G_haB4sChHtTOr7GoHgV4vFE-FLjIaNLHpIYwHb2iZ6pT7mQ7UIhrUuRW-QStVCQws4vFkSCXZ1ZHduEKmtXaBUW4BUJTut6InX0VbFCbImDdOAOoFgQybs8I5ZVKEVGKUhRYFT6fs1DgsUvZsc98xpEUaNvNB-mr9QfaI5kZtmvGl2x-aUAWCgBTkjyCZFiYef856_hnnuZ5JoOJ_fw3kLph9soLUO1SoNO3phM9q7J-o0UnYPOAx6yfrQM0GMX_v1mP67H5jCYWG3mhkrj_ZQ6GH1eKhc346iQdxHHBQ&cid=CAASFeRouRO3wLS89lHBuCXyUx7BklfYpg&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.13.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

we-in-f156.1e100.net

Software

cafe /

Resource Hash

44e2a29ab9856a6f1164f3d3e30875f30a85e09a90d417b05a9da5d18bcd6d46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13842
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 301D 0
0 30ms
29ms Fetch
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C05h_VlpRYYjuGc_ngQeyvJjoD_yh2tFkrpXS5ZcOv-iivcABEAEggdWcJGCVgoCAsAegAaH1-ZkByAEFqQKomv6L86mzPqgDAcgDmwSqBNoBT9DFehPhZg-GFrBrPtcNfNG5qfL-HD84MfejQ_0aOToAaHVM9gx6bZxgspRCbUF23ooXYcKVuCaISMh8mdQNqmgJUha_X7iFvmBE3qAHcTVyrM6cNxjfBqT8j_v6MdGbbFOgg1TAgm8Qqsp8719Adbm3J25E77rjscWk0EOC-6p4ihc58jqZ08fmbxPjkvq5TqfUFXP85fi_b9YLRQIOE1ShmKhZ4wQdGz5zLFT3qsbxjHpOXUlWwxMLrnogB4PGXpybLH4s--PlOcXTM2h1h9WUnCetFsg9q4PABJaImK7RA-AEA4gFrNi0tzWSBQYIAxABGAGSBQYIGxACGAGSBQsIIhADGANIvouTAZIFBggdEAQYAZIFBggdEAEYAZIFBggeEAEYAZAGAaAGdoAHx4qG5gKoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4b2AcA8gcKEOf_FRib_diyAdIICQiI4YAQEAEYHYAKA8gLAbATm5uyDMgTgYuA3gPQEwDYEwqIFJ0I2BQB0BUBgBcBshceChwIABIUcHViLTkyNTI0MTYxOTIzNDg5NzkYicAL&sigh=4yd9_g3pidw&cid=CAQSPwCNIrLMxN6_h9jFTepXYSK8FB12jJHR11mYhe86hcOkX5KGXJ0EyC6yRUZNbH4dVnr0jjPxwRDM9WLzlBikvA&vt=10
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s11-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 301D 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 72257d0cb53403f3017f112792cdee81f341a51a185569064d946ec13c82364a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 204 csi
csi.gstatic.com/ Frame C3D5 0
54 B 298ms
116ms Ping
image/gif 2607:f8b0:4020:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~ku2880vk&c=1072193474910&slotId=536096737455&qqid=CILxxMW5nvMCFc9z4AodMh4G_Q&fb=outstream-lima&sei=44729911%2C44730425%2C44730426%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4020:804::2003 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame C3D5 15 KB
16 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 16:31:40 GMT
x-content-type-options: nosniff
age: 393195
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 22 Sep 2022 16:31:40 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame C3D5 15 KB
15 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 16:31:43 GMT
x-content-type-options: nosniff
age: 393192
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 22 Sep 2022 16:31:43 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C3D5 0
56 B 175ms
15ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=Cp8XZVlpRYYLuGc_ngQeyvJjoD7nl2tFksqPri7YO8C4QASCB1ZwkYJWCgICwB6ABofX5mQHIAQWpAqia_ovzqbM-qAMByAObBKoE3QFP0KQYQhQMoNSE8rB64aPRZSO7teYGIQtIWoOUkmCX2Z_Uct7Njjz0YmvkA6Yg3OFBQs-lxzHDGrRQS_FHIz3iPhHiI85xPXoyKEXaeHetxssFQlYaqe8t0-I5GoPJ5wkCVwueTMZYOU1brK60Whrz69IqH4Pm_5zsCqy0J8deIHF-sgjgvXzxxcUjRaztevMw33ANvlwV9DLYWG2LYG767jTQ6HksFz7479OIrqiw2ENP-SoeQSyXHNTQhjnRSg5HorlmSyHjfbKcEsUtH169ZIUV7zri51S3A0l8yMAEqNrhsd8D4AQDkAYBoAZOgAfHiobmAqgH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIjhgBAQARgdgAoDmAsByAsBgAwBsBObm7IMyBOBi4DeA9ATANgTCogUAdgUAdAVAYAXAQ&eventType=clickstring&clientTime=1632721495668&ai=Cp8XZVlpRYYLuGc_ngQeyvJjoD7nl2tFksqPri7YO8C4QASCB1ZwkYJWCgICwB6ABofX5mQHIAQWpAqia_ovzqbM-qAMByAObBKoE3QFP0KQYQhQMoNSE8rB64aPRZSO7teYGIQtIWoOUkmCX2Z_Uct7Njjz0YmvkA6Yg3OFBQs-lxzHDGrRQS_FHIz3iPhHiI85xPXoyKEXaeHetxssFQlYaqe8t0-I5GoPJ5wkCVwueTMZYOU1brK60Whrz69IqH4Pm_5zsCqy0J8deIHF-sgjgvXzxxcUjRaztevMw33ANvlwV9DLYWG2LYG767jTQ6HksFz7479OIrqiw2ENP-SoeQSyXHNTQhjnRSg5HorlmSyHjfbKcEsUtH169ZIUV7zri51S3A0l8yMAEqNrhsd8D4AQDkAYBoAZOgAfHiobmAqgH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIjhgBAQARgdgAoDmAsByAsBgAwBsBObm7IMyBOBi4DeA9ATANgTCogUAdgUAdAVAYAXAQ

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame C3D5 28 KB
14 KB 65ms
41ms XHR
text/xml 142.250.13.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-BZmVIZMyGJGMZbaL2HtP2ZrjCJtgfqgSjVvj4qd-bN5pYjm8k_XTz0B1HbA__sZBByqqa47dj3oneVvfcKzgba_MmPYg&dbm_d=AKAmf-BvjPlR5ExU5pDM40TKuhJHIw3r8pQoIw_KWhvMdH-U8hZUDuxz0rGiltWiuLfSITtjtvHw6Cv-Vj3LJX17BqwnsUt_gKFPNyzoZJJ_zPPdFh82_eNFVs8x3pvaBW9nMZCSrM_kKodpRnU3D6UC-qEX4_f-jUFZWDPmXllhMTQAPtwSZI1CxQZgCPs3_Xt1atB8rtQEkKIRMgSZVwQU2T1c9Xl7-WHHKBoLC49I7YN8c8w8pPOWWR0XYFHYt2P_Mdp9av1gP0kiI32w1SYO_XunVOTrZTfgA8wFN-MlAZmIC5AdXTA0xSkzgkHLHm3jX8Yyg1wpJtCAIPrQ-l0mW-MtQgbKnWZ1vmlmSqoaDost8aWOCgyoo2BCCTYnyoMfurhx4BkQa048EU3GxHBDEarOWOKJiLaVrRH6akQG5cyNP9Ct3ZgKSNyuWnvZYDDr2rsL7FFg3H9PIIPKIw7jyPo9IxPLR0Ncc6SoMuif7BApwyI0sGFbVdco6-fOuLi6g-2TzBeM1RexR0pVNdKBDtWAjsxcMpDcTJNiOq07IAQJ1c2SjOMe6ImpImiX4jdEXXDMyhbo1qxPT1gA855sSh6keOOoBlTNNoBtf6yEK_YQ7IlXl4qLWeyrySqyMfxp5zzdQqI6eir4IhiVxfEDLSD635bJvvQnperPy5jakJv970OI7z8opsfN-JzuCFyOgV_jaAgYNsfw0nmv87EYXsUPTNCFynGi4BbIs1KidBSgtkdhJU3IoG2T3rfZjKTmlHmjTV-LSllVhmed-r5s6Wiv19AeR_1hgJBN1iTOdHPkcF0Nu71EhE9WYLgD-lYs3nU4INz1q0jZNimbI0rneZr63F5jB-poRbvvqY87kLIWEzItsiEqyX40QQ7IX82tM0hO8cIJS6uuYxFlS4ULQwSGp-vTaarYYrqqheq3VqT4q7RozSnTKGyGri-uf9UIiIgbayhs6D5OJVtd0-VZw8eTBzO-_VM8QEwyo1q7MZmTP8zQkbc8_MCAFobTqi7Y1djd3qxJ06X1J42abR4ZLgiTCYE3Sl-U8-xVrbwJ_ai3-OICw0U7c_hmdF494HBu0B07VnhCetB87SQFe-ebwVa15qTubQEjmY0j13Pz-4jKqJfQqV0rBMqZbilxGDn4c_I-esZK6ea6OYXV4yX4m65n7U3d66MSy_0lzX-APkrHOD4fYK2DC4lVVMb2f3FNGKO7yHWDgSCjKXFmUVOoA2is6NurJD6fA1OKaTABip6NXZf8D2Xb1HZBguy2vD5WUSPuep5ejMjMALHyPbH8LK7MepFEt4lPshbc-icI9WczJr_bdDjmWwDBUs2CVm4_uHIbr_WJjRlU5XV8XUkyWh-UoluElxeYGwEeKZ2tWNrJEwdauYVqsqpIY0OYHeIcfN-92pQIF32FhaiLwCQw4v5kQQ-IimhLwBti_Ww36PGfuYly9mPaqAGPS0ir73T-FzyLi4Y2t13l7bsHKCGcuec5TKAXiGDo2QD_fnLaGHGw8hIUyC6hLGLVpAUJnc2nxnXHlDc6DrYlBZgjShjzwayi-3DOiGOvRGm-WVHw0hVbZv1npMO3MFpSMXQHyh7_LXBbowLx0zhjRsoq0PoiW-mWijTnTyz20JYITYa8wMlL7UIk3qyRH-KVqkf3bzFUqlq6jKyFmwceDzVAHNY3uSNCXycimJhaahD-Hj43yiVutPPRFqO9ycslr6Z64nI-K27hueo-aWtp-XusKluQZS5Zl9b0H5zBec_JzXH6f7dzPF3lmYqNfBhoOWnDHGBEGSvcQRLg5skUyvZnPzLU1Xzzv5o8LuPQ7vrjTSI-9tyNM7pFAtK0E6zHYP3189KCzsHCHiu6U8sk8Ua85x4AyLUZqmIH7VxSObevhXVIXBmJ7lefAliAifz3a89ls_IVYSG6j8yIclTE8Srwy8Y0aLXjRdk3v26CQMvg2Y5qzyVobXUC6vRhv2gVKoRiikmtdWZTjcZo-BgJ6_yKgnRom_cWH1hUNyRL4tDOzp8r8ByTqjaFZgCGAQQLYcGQDuET-k8GZdpMJhTPd8nlNE9JgPdS9EQLxogoQhpEDb8OnYzfLwmWRIGE2XLMGfl2dVUwz7rZ46mwm76LnLfMK1PTYIRWzKsYDdu3mxtq2meolAG10czH358j6EAhklUGijUmKt8UgRAHuDZXTA52zHdmX9rIsMcOBr0oLCMVOlQpZdT-6uGm8W1F0kCi1CsWYo0tgv2JU8xei3R8_NJREAWYWIIA4X4FM9X9Tm5dHNQPD1tTilHg6PYVZiuPo2kCXjCASDBYuH7uacRLZSy91EUN_swROFRBLmTWyr_yvhwSTUo9CfW_zawxtl-caOKalgoOQamzCH3UYDxZwq6yz4XJC4ET9M2sCS2mMImEswyLOTj9004-6A802w2aGMc2k-d6UcFhxC0A17ql0HHGZfFjS_vest30yg2tOtpECztxCNSJQKyzx7oGTi76i2wnWHFYGzSCY6_GHCxqBQcntGduYJdgdFW0aQ_1ZlZEBiRodKcPaU_Ulbl7oIf1_NvMbTnJJFvWFVr0D2U01Yx7Hn8dbTaS-IHLlPf6jAkj-QIEZz_Ee82OLhT6ON632jQvHw5xtgZIQQFvfjScwAvCPd7CSjuqjb07-qBbQGrasU5MyLijaUIbuBao2AIJL3GFR3N36z5c4Vko60YJSBXErpn16XTvWqUdQbcl8Sy6oe3bx643Vh8_2o9mOFMwU0cLXL3W7GWhedJfZ_Stb0nYgIgE7dfuO8qc6G0vWj6Y96v7OEqAEjS3-TlBh5v0vG-3NhSVPKlolExdRSlx02WXYIxSaJ2SOUFBRX9aLNv4gIf43elDTbxEzbrh53YiGQU5TkylmFXlbHu-Qz_9qsLJD_4kugOOPRL5GurCVu8Ur4cKvW3xBT1dG8cf9AaFAlDZmA0HKwxE_Ebvz-hhP9s_Zz2aRXP1ow0CLE8r7YpDHZkynfS1EbL7gI9SdhGWMkQdGzKOCJcsi11t6Usnu57FLasFoRlxteGQOOZj85GhuPwVCgCVRZebEcDH3w0qkObGaeS4NT3YhvRe1H8rcYfQHowTFcuwLCqptqA1EonJ_UpsDMzcCwQ7I7TqtwfKKwn1MHF8INP8HWp4YssvIVIkzEOaKuQVh26dRd6ATBzvF4wO1KjnzBoVvxQ2mKJsi8qB9QOGMyvzS_UQ45RohSgSNlrwm1IA461Mj1kWfGYOf5CJxQ8g5oqxWcjymqeW11le-btRDkGkJOg7Xk-1XIZYPP0a7FLzTnmcwqntN4SMP_8NV5AdyfPoGOc&cid=CAASFeRoxVDnP8RIvxNQuAspaZ7d40KaFA&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.13.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

we-in-f156.1e100.net

Software

cafe /

Resource Hash

45fb73e3aac5484e936dae1a72638b17ac259dd9efb6f0325945b9189e6d4f94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13872
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame C3D5 0
0 31ms
30ms Fetch
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CgLp3VlpRYYLuGc_ngQeyvJjoD7nl2tFksqPri7YO8C4QASCB1ZwkYJWCgICwB6ABofX5mQHIAQWpAqia_ovzqbM-qAMByAObBKoE2gFP0KQYQhQMoNSE8rB64aPRZSO7teYGIQtIWoOUkmCX2Z_Uct7Njjz0YmvkA6Yg3OFBQs-lxzHDGrRQS_FHIz3iPhHiI85xPXoyKEXaeHetxssFQlYaqe8t0-I5GoPJ5wkCVwueTMZYOU1brK60Whrz69IqH4Pm_5zsCqy0J8deIHF-sgjgvXzxxcUjRaztevMw33ANvlwV9DLYWG2LYG767jTQ6HksFz7479OIrqiw2ENP-SoeQSyXHNTQhjnREg-1DCqccLNIn1ag_iELr8271BZLeey8caqhGsAEqNrhsd8D4AQDiAXa97S3NZIFBggDEAEYAZIFBggbEAIYAZIFCwgiEAMYA0i-i5MBkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAZOgAfHiobmAqgH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgH1ckbqAemvhvYBwDyBwoQwaoXGO2v2bIB0ggJCIjhgBAQARgdgAoDyAsBsBObm7IMyBOBi4DeA9ATANgTCogUAdgUAdAVAYAXAbIXHgocCAASFHB1Yi05MjUyNDE2MTkyMzQ4OTc5GInACw&sigh=_AAJEYmME2Y&cid=CAQSPwCNIrLMxN6_h9jFTepXYSK8FB12jJHR11mYhe86hcOkX5KGXJ0EyC6yRUZNbH4dVnr0jjPxwRDM9WLzlBikvA&vt=10
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s11-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame C3D5 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fea420fd071b2903addde6d4da626e8ec42315c494c6c764c632de30f2584f59

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 index.html Show response
s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/ Frame 5822 5 KB
2 KB 29ms
8ms Document
text/html 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f10db5ca926522b5afa9f275367f169096c4ae5a1daaa6109b161e7db3d9359a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 1642
date: Tue, 21 Sep 2021 03:59:37 GMT
expires: Wed, 21 Sep 2022 03:59:37 GMT
last-modified: Fri, 20 Aug 2021 18:45:23 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
age: 524718
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame BE53 0
592 B 90ms
30ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu7QaueqzCVdhcHmJxdECb-bBD6K0SnUnpKDlftMEW0yZn2DqqYexeYd96JYUsbBGEMQZcr9Zs6FSbCM1lBRwEGLcqvMjx-HAVyzMy05_Sk3c9TWD8wNta8OYIFS1zxsjRmg1mqdLt6mSbf-vKrH_E3ScdKSecnCDE_mxL-A6F2-HKOqRXg94EMV23yGLDUTW6VC8ri3akXNY3fKglWkYX_JGlSQrcUH6MgFwmV1PxFtWQDpZ_7I0ceX48Qm1VI3Z3R1NQIo6VqYqsOluGSzpA3foSyd5U0VFSKd-ZPcdGzbkFAgsAsGDlFXIny5D_TvRw_R2C8Dtg8YwHJqnwvTUnFETFj26rWTwXhDEXUGSUKqcku1HjtG8YjIAKpSfBp3nPHuANjvAgzDFKCMQ2SpIF1kMBpxH3VKPnphJvJOoT8HpwHgibNzRtO5LQbjfdlhPso6OwHLLEsXefNT6cDXzgaGz2kr6v0SPfOeucJqFfQNJEc3gDNHX7YWm93sAJtvxglQFFlSxU3wGxtDO05qMwo2Yq8em2CeX4b2DY135I4LltfEN1hmop4MxHrdQo8IO3WieIcpS4kH6QeJ4s15M1SNOsq4Q7RY8quGMKisSd0zmcwWL4X8qL9RJX1_RfLTtyBMRKqDaMCec1X1QnSu2uLUkIZN6i_gZjqdVq13K63OjdFDKSslKiYPUY_JHO5rKccoCaVcyB-2s8au_Q515Ah5XyOycuFNuL8rAhgCdfTCekkekFloxlu0OQYA6kvB5HRVHI9tbkwV_lJ46aowFEgnKM3Mb3Y4SI7SZKvCbTnqaZOCNs1E-2glcKgMN0cs6fniOAFm4Ug_KNuv5POwESIM82otn_bxqF364DTtPpVXf4DDZnDClwjS29Sl2iTP_0A1cPOQukgkhKYIIoGjngRIUqBaGseOazDAHGW3r_XNDvY9QRsP-Xlqvtz6IeYZAKp0gHH6mUol-rX7RjlHUNcEdrBWog0OKcNR-ACcpTKbpXkvtXI-GdiPUAA-g12OytwRqgpTRIR6H7SliC9BE79ieVqPpzfa_NGKXyJ6VHYgt6znFF8IOSHTK4RTfGDRu-XXXlsrVeAnUFxNYZm7t7tZaP8i3jV34k1XrP84M_A-v089-LzSeOhLaQ1eXBFIgmQAtTfG26Y9L8Iobg&sai=AMfl-YSwwZSUeXMMAdFq900KPcCxAacaimckD9eOoIgUrt9pXbpMH0eLhueCNOKzsMCu0zppXmhGdtyR9KyBlNQRAtdU_MRlHaHmhErzkutQa0m1IfUgA2lwVDUKj0-2NpmVLfqb8xRroLC3kRQA_4q0BCqmNmMtxwvkI3R7S_eQ9U2b_Mq6TjvmdbQiU9296CIv9DGJV6kYHskc8Uvr4PVw5aSYwZuhxKQ06UgYHW874OWgR99QqOH1EGzC0VihztyhzGCoCYaDnD-UtNNDQranzoTPvupnvrOw2zAYCtNRRLn4QhLVPmI9KCf9D4Q7euqks75DyCItUxf6PyeF_ywyP9IXkqZoFuXeBSDbEy7Ydj8_Qf7fTG5WTgi9E5SSxrl9dlGo6sry&sig=Cg0ArKJSzLNIiAYcEjrGEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=276&cbvp=1&cstd=273&cisv=r20210922.23532&adurl=

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 27 Sep 2021 05:44:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 index.html Show response
s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/ Frame C854 4 KB
2 KB 11ms
7ms Document
text/html 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d2ca50415f8e4ec93aab03c0ba6aa1ce9ff5d173e03cba8437141c8b816392b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 1632
date: Sun, 26 Sep 2021 17:37:05 GMT
expires: Mon, 26 Sep 2022 17:37:05 GMT
last-modified: Fri, 20 Aug 2021 18:43:42 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
age: 43670
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C63C 0
61 B 73ms
31ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstOOcFBAPgv8LGR_dAGh6EhUm4AA9RCjVVaoRXRRNDG-65ekSRcjoKAZalHOttDw26CO_scZfWrfjE7ulROORSW7-Hjjvh_Lg1ENSbwBUvXVo1LZZmw7ZEkDOdnuTRK-V3TZX-cJYTCVljbBVMaIPcIcms55Qw4QMMZZ89X0HIlSXullWPXVyQiWSkdiX3KLr8xXNBZUyqN7FIdlJ6MNIbmn74kfGb9rxSz5FPg6k7AsJ-APmScZ7ebxSe87y0CAYIXBhZqW5ZRpKjw71uDeanbAaSG846F8ONxiihARlBJRivo4ZM2eYDk8VWJC8Pa1k7ZiYQIEnXbFxeG-EzIV3oaR0EYo0edJF_cfwj9aqcKtC5vtBghq3X4_VC1O3oDXpmHxVsXQQ141kluyvO5rnliNJDa1WioroFIMltbVdayr0hkO2dykoLTD-nQYxlZXDoIB2mGsNwPJ6Xd5oSTPhuDVUJneR8OypnMonvlJx5D4vpMA2dXZZSE8sy1ySZSAavmu1IMw2oOe0E7mwHlkJuj1dkSRG7ZIDtBBx9VBHHhDSFKZzhJSFQui4ovFRwnXoXQ2nxmAer7eetCZ0HFzhiufeJbL9iX9kFQeB1njt4QWoGgk-G8VlJmZH1QDxLSrB1tdsiBgjsYdeGaODJd6QYAWyOoFqPvBD-QfUsELZDDesXucmCu2cCOWC_nR3Yh5WfvN_s8b0Wov-qFjg2yp_N6kg5nKKT1drVjhffXEyDHFNRRYBZa8VhWkBb230kWjd2lz8pn8FIKFEbckYhKMkPwJNqwwi7bVedVMgr6wTx2VzCWqcDq7ppxBVO5vbWxiukN7aL6tahA-JN_v6Z2UFfdpNvo7wmU0QkAWvzKW9CNKQ1DSfBUSrckRXU1dK3WKfxRbIK-qduW6YSSJLzxiTskw-LJWYi79Rd7qSVUWTqiBJgJlQJBC3VE2RpEMBvrnrdQQQVYeFO-HOaYNJOoZscmLYuKITqfDO_Tw3QDdkgRK1BJ3K7Gc2KX6CxUYhEdVfzfXP6skLaMb8tMR35GzBN9H5vAJwDJQrdlnErFFWH0A3_4WTVlyOG7MbR3z4kA274_CoGa_n8ew3cprx9HwrSLGGzYSZL1K2mCnRUNQ0qev_xHKYbSUL3CcO-Z4vTDUIqLUrsG7obrTKpJ&sai=AMfl-YScWlOU-cAHBqTS5gpCbkb9tRnf8s_hyNowfAYATrk6aAoglE2fffa1Ae4-ddamGOfS3fUg9ovfW44zpV_obvPrRKSqf3F4r7zjq-4MtEl-WRYtwA8xmQeENA4QdWGm95MGIXYfBQ-5USbIFdap5VDPlGf5T2oVP7KY9YoJcL1nmetIGjmvL1SPbtxf15D1HkSX8uGCQ3ochSqLpaO6m-84jvfs8qyzRfSsgk8OW1E9fo-OMe4WYs3OO6BRuodXTKLUZ9DqOWVxr64tQ003Q1enPM9762K14TZEGvoF2jib597chbSLds1o3ab18ZRjFeL7C906QnWpNZF4N-uNRnpN7oy_0mdjcS3_IWA7Ghxwnkmy2ES6pLgnGO87dRMlJUdptgSH&sig=Cg0ArKJSzOb5vMI6YPTGEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=273&cbvp=1&cstd=272&cisv=r20210922.03345&adurl=

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 27 Sep 2021 05:44:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 728x90.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61886628/20210825081638199/ Frame DCA0 26 KB
9 KB 16ms
14ms Document
text/html 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61886628/20210825081638199/728x90.html?e=69&leftOffset=0&topOffset=0&c=aaYn2UjXrS&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

884260839373db8fc16fc16e6b284048fc93286d6531607f98417eb89accb256

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61886628/20210825081638199/728x90.html?e=69&leftOffset=0&topOffset=0&c=aaYn2UjXrS&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 8734
date: Mon, 27 Sep 2021 05:44:55 GMT
expires: Tue, 28 Sep 2021 05:44:55 GMT
cache-control: public, max-age=86400
last-modified: Wed, 25 Aug 2021 15:16:38 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame D09F 0
24 B 48ms
33ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvmjeWBf3_pQoW6rKoAoC6D6jBe0IyadIkPCpCO1Gfc8zc3-5kLoHBuEG2G70e199jSadILDiCPcR_8fyKV9918dWJohLtpgEuHls572y9yodbx5XiA-ciiyXmSX6GViBmlOXjrwZiJ5uGWQnHwBRAM4c4dWFx51VjZQboWVGAb148PRAKTbMP-qS_M9RVEOM0JXj5MGmuPZWcHAWYipJYLUkTVK7iWzTzzOrCF5x-Nf57vb9YwW5LJBw6nEkInZ9n-1-G8CTJoNE6I_2J9zZDbAk39ffoUXpdwUGx1fa9pkWm6uslnrGAkO4OGvRzrSWuOgZnWRt0_MB25C6ZJJ40-FfZYVExL5NteDVTAJHPOoPTrINSNUAYnK4tVmqw-W0pJzNQSdD4X_kk6StHVtDNZgbJkX4wmkmLEdG-q1iwB9ENqvhG9vGRhqabNqZHIeU_boWNw-tVI0rsdrp6HXrOIxPEvzMiITtonMJnSv_tyQwwmDTF_r9Uyq-ZDxIAF7I0_Gw_ea-_X6FNyHdx-8IRfvvvVYdMahf4nH1yRb2syhjGsJy1XKlS0F5ikQJNovWYGTMo2YG8Q9dq2161BFV3RHugVFPLYTwvnPjKUSyhe0BUNgMIUB1dFnC1k9nhoYoVex9G-3O_SgbNxr_R9zee9KzTyJJ3ZNTi_TEPQvv1tPWMQJUrTrJh1RdhPZkT4xonbgZZmjMp6DyxMTASy__aPJzMyiYpUb20cEEyR6_yc6mYzqqF2ydwH09fDtYU3IgfedlRnR6QGAx04ud82b9eXA88MBHLNxEfnsoC5T-XDkUb8-tYky9wA9b3Iwd-BhMDn5XFDgm7K1bDhwO3WZe37ZgyTyEm-1yKNZMYmadh8WFz4vBEXkEwUpw1MOnNXO2sT1S-3GZb34kI4OwVFMj0pLJDm-5E_kGAGGMyq0OXIFyOtK8OX8h7IAxjv98RRfkv4NHDERGn6u_n4PX-L7eORSjQOcnwRJyUsyoqDpHsFaecwSODbtgFIRuqeXPOb_OFGxZGj4qQDlq475i5njfBXNlL1KoZXFJ5y_1MMxnPigHI6BMEmQvLaMkZhItvanvdTme9N87V8T0-IVkxytOQi5weOjzQjgLO46LEIhDThfcy1vQZtFs5se0NNZSzcu3HL3YMHGcIpupUYohCzecrCq23LMoM&sai=AMfl-YQPgUg_pXWPnKB2j0IGa8faQ4DaMt5Q-y_5VqOyO-YqUHLXQNchdgUlJw-cT77DAOrLkXqK3SIhfHdTQuizqemg4XxsnMJ3ixjz2F6hWcZZ5iUNFXrIVLgNALf3hd2bxrmenkK-ZwIz3BUDT_MO99dwCyysgGnweICmrQQ&sig=Cg0ArKJSzG6xFjAmzq1yEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=254&cbvp=1&cstd=248&cisv=r20210922.61525&adurl=

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 27 Sep 2021 05:44:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 300x250.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61693042/20210610071319456/ Frame 2973 41 KB
10 KB 15ms
15ms Document
text/html 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61693042/20210610071319456/300x250.html?e=69&leftOffset=0&topOffset=0&c=FkncJFXFQ2&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a8c37b891d1d5e805442542f294b9b2ec1a231277a19d65edd8419eb7a60e9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61693042/20210610071319456/300x250.html?e=69&leftOffset=0&topOffset=0&c=FkncJFXFQ2&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 9913
date: Mon, 27 Sep 2021 05:44:55 GMT
expires: Tue, 28 Sep 2021 05:44:55 GMT
cache-control: public, max-age=86400
last-modified: Thu, 10 Jun 2021 14:13:19 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 07E0 0
24 B 43ms
34ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvwh3btbISBkYffa4pzJ4EZ3kIHDawLs24t3jnJ0GBzqS5qhzK-UMTpZqiaj9xqbFDlwyT2PYaHaond5Afa1cVNTuIXZHrHj658fDkExJpKXLp-Z574VoiyqbcjTO9Vsj8cXfuOKFRQJlUrjUECnvXS6VUeZFiE5WdOenClD-85onteHvNZNv4ZsNk0iiBcG35I_C5A9jI7uKp1lhn0vKY-Cn-XTdE5WYTw1AR_JD9WHKJe2Eftd1QcD6jdVZl1QNezo45t47DpxPZiOnFkH-7FFY2D5-Mv2sTSr1tCsX-6DyTjCBidpJwfSpqazQLZgmXygi6LhcBmuruKEXe4R8ovXfLG0QRliDYDkeRx0g6b0RPP6P5ekCvbGrPN24QJGNN8Gr5LYn3PpHYeQq4d9GrpQccPAq_T2LkNdmm6FKl-Xe-CkZvRDB9pSZi3inL54lnipZz1qpRFYEUaXg2ZjaxWFtNzcHNcS1C5DIlZxLTRLeNKs3TjWZukSP93o84COMy5bFTkWA0sQcNSeBs5A5vvKCcsVQRuZQorqlP5jZ-Btsel-QQlB69dI2jyh9jnp_jPVipZcH45JViBeCzLNyOwl2qrqgGH-jG6UA5soU0Os75KTdy6iZf5nfmbrA-YqWg5GJgzR8BTojGzEqJ8ORiBzB8zsLDllkRNcthLx7gPFQnVyVWmyCct5SXtVQDQTNtmfuKUUmSCaSKCcNUhkOcaORFRN9lFPKyAOZfixQyJ406o7YHaLfen6WJ-DUBk80PicO4OS4zGJzbHgwNWvoE8xRksR5GT92cE6ibh2rNvN5Dn7OyZY3VCsJ4wywqYm7DXpiGAoF-cVRTs1qlfKJuFMWtdqCU723cCK0igiQmk3D4kmWjWsMJVdgC25HY53UkLQi426KI2QSlB3ppsKPdW84jJyrlcFaxYNjd_F7DF1OUIkfYK_V163vS7wX1Ofdw3NXCfjSn85rY9_FKnzsMV9S8KP1Taazq6YiYN3PrA2Spm1AygqYUSCpbuW5UFx_cGHSDfVneC43ZQ0ciFlv36_ZKdXY08BKiKAaZflwqMN0MKP20Jw2QffIvU0BvjCJh9kQuwFP_23Icg4VeFItYoT0_OHz_hVdBkmHhckWi-TB2HhZIz2ikrCb4wutU8b8r-84gajDxk6nNJ70fpiOxKmCIIng&sai=AMfl-YTfP-_2a-XXFkxyUapuCOKbirb7R9JbcQ-eS4aCNGURyRh1d3tFTagCyCUyZf9_X8KJQ1VUSNPVnah3HmAfMkUJ769ByB8rM1WpxM5gZ1kYI3Fy29ewhEfFGEc9jBm_g7FboTohDHtmEX_H2ZvWkSuY75VDCmIabt6Z6j4&sig=Cg0ArKJSzOgIf4CSfgLvEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=272&cbvp=1&cstd=269&cisv=r20210922.53997&adurl=

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a104-75-89-215.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 27 Sep 2021 05:44:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 bootstrap.js Show response
s1.adform.net/stoat/626/s1.adform.net/ Frame 15D1 33 KB
16 KB 21ms
21ms Script
text/javascript 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Requested by: Host: track.adform.net
URL: https://track.adform.net/adfscript/?bn=45192706;rtbwp=YVFaVgAGdwUK4HPPAAYeMiDiI1XqLd4pP5jXaQ;rtbdata=sE7aJDcJuegbfGs3ujAecRKKFDeExmQJO_TPkBbyu4qOQCXjEme0iSUn6yYso3JAQ0E8W6qBsvzqe2mcEfQSdjKPAmfqxm8EkTwIWyoUwA6K_12MCGSzFA1CgEohwu4a92n4qHsaARkv7cRi-l38B4_4B4A0Pe5Ck2hW09tt585LvnfCxQNYE7vGpvX0AsEB9HSyZIj8IVoRx_2tDow_ifP2teoVDEuNHqWs9WmNogH8bx_s1JcHCD1eSkNiOpcjvKYvaiqLMI9w-iQ4hD3WPE87h8d_oaeBw3iI60gHGBc1;nofp=1;click=https://adclick.g.doubleclick.net/aclk?sa=L&ai=CWfYQVlpRYYXuGc_ngQeyvJjoD-i-mJRcoKWzyf0IwI23ARABIABglYKAgLAHggEXY2EtcHViLTkyNTI0MTYxOTIzNDg5NznIAQmpAsPjD0-QJoU-4AIAqAMBqgTxAU_Q6OLlK4LKptdR8wf4hAoSuZox6xhKh8VH8yZuR0_mE7VjLmmyYw4-CamkfIsPKcSGmzpC6cX0hrIo9IOnuWW4deudGyUAKfUKt-DpLvU9vJuebKoeEYr3_-Ctv5350s-7Gq6RlwCeMQt1JTVNTsyLk1LTdcK7joGIcy4f2BrHI3UPJoAoe4WAgG8ei4s-LffzrxQtBCjUxsorAnBUMPv0LEWoBSHLKJRJwRIzLRK8BM06w89b-T3Gv5DFixqr1q0p3qkZTfwmMGE6MOmTNT9BgmGtn-gyAx2jLRWPQs_tl632zx0CIxC4_iB_qa2FVVrgBAGABoa5-tmr2oOhoAGgBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiI4YAQEAH6CwIIAYAMAdAVAYAXAQ&num=1&sig=AOD64_0-1rcNqIFpUH_YQurjv_gw9DajSQ&client=ca-pub-9252416192348979&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 5eed273d16f8b9f330c78d58eebc4c1cfb64346a84a9bc8781afe1bc69077d67

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
last-modified: Mon, 30 Aug 2021 07:04:15 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Tue, 28 Sep 2021 08:54:09 GMT

GET
H/1.1 200
OK pc_pcview_all.css
static.affiliate.rakuten.co.jp/widget/html/stylesheets/ Frame 826B 111 KB
8 KB 10ms
9ms Stylesheet
text/css 104.75.89.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://static.affiliate.rakuten.co.jp/widget/html/stylesheets/pc_pcview_all.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

104.75.89.215 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

84dbb2e17cdca526a253123a8b6ab0c734db2ffaafe8acc091e63c4aa07122ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://static.affiliate.rakuten.co.jp/widget/html/mw_dynamic_view.html?rakuten_design=slide&rakuten_affiliateId=10c3fda8.d5ba32e3.10c3fda9.3e43e297&rakuten_items=ctsmatch&rakuten_genreId=0&rakuten_size=728x200&rakuten_pattern=H1C&rakuten_target=_blank&rakuten_theme=gray&rakuten_border=on&rakuten_auto_mode=off&rakuten_genre_title=off&rakuten_pointbackId=_RTmtlk20011595&rakuten_no_link=off&rakuten_no_afl=off&rakuten_no_logo=off&rakuten_undispGenre=off&rakuten_wmode=off&rakuten_noScrollButton=off&rakuten_bgColor=FFFFFF&rakuten_txtColor=1D54A7&rakuten_captionColor=000000&rakuten_moverColor=C00000&rakuten_recommend=on&rakuten_service_flag=ichiba&rakuten_adNetworkId=&rakuten_adNetworkUrl=&rakuten_searchKeyword=&rakuten_disableLogo=&rakuten_moverItembgColor=&rakuten_moverCaptionColor=&rakuten_slideSpeed=250&rakuten_moreInfoColor=red&rakuten_subTxtColor=&rakuten_loadingImage=auto&rakuten_imageDisplay=auto&rakuten_txtDisplay=auto&rakuten_captionDisplay=auto&rakuten_moreInfoDisplay=auto&rakuten_txtRow=auto&rakuten_captionRow=auto&rakuten_auto_interval=6000&rakuten_imageSize=auto&rakuten_slideCell=auto&rakuten_slideDirection=auto&rakuten_order=0,1,2,3&rakuten_loadingTimeout=0&rakuten_mediaId=&rakuten_measurementId=-_ver--new_18_-&rakuten_pointSiteId=&rakuten_isAdvanced=false&rakuten_isIE=false&rakuten_deviceType=PC&rakuten_itemAmount=20&rakuten_tLogFrequency=10&rakuten_timestamp=1632721494008&rakuten_optout=off&rakuten_deeplink=on&rakuten_pUrl=https%3A%2F%2Ftravel.blogmura.com%2F&rakuten_version=20200323&rakuten_datatype=json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 05:44:55 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 11 Jun 2014 04:51:42 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8155
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK front_merged.js Show response
static.affiliate.rakuten.co.jp/widget/html/javascripts/ Frame 826B 135 KB
44 KB 14ms
13ms Script
application/javascript 104.75.89.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://static.affiliate.rakuten.co.jp/widget/html/javascripts/front_merged.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

104.75.89.215 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-89-215.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

9e08978792f1773719a3676a24d7d6527917bd44c2dc6665d0ed894fd9aa8b2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://static.affiliate.rakuten.co.jp/widget/html/mw_dynamic_view.html?rakuten_design=slide&rakuten_affiliateId=10c3fda8.d5ba32e3.10c3fda9.3e43e297&rakuten_items=ctsmatch&rakuten_genreId=0&rakuten_size=728x200&rakuten_pattern=H1C&rakuten_target=_blank&rakuten_theme=gray&rakuten_border=on&rakuten_auto_mode=off&rakuten_genre_title=off&rakuten_pointbackId=_RTmtlk20011595&rakuten_no_link=off&rakuten_no_afl=off&rakuten_no_logo=off&rakuten_undispGenre=off&rakuten_wmode=off&rakuten_noScrollButton=off&rakuten_bgColor=FFFFFF&rakuten_txtColor=1D54A7&rakuten_captionColor=000000&rakuten_moverColor=C00000&rakuten_recommend=on&rakuten_service_flag=ichiba&rakuten_adNetworkId=&rakuten_adNetworkUrl=&rakuten_searchKeyword=&rakuten_disableLogo=&rakuten_moverItembgColor=&rakuten_moverCaptionColor=&rakuten_slideSpeed=250&rakuten_moreInfoColor=red&rakuten_subTxtColor=&rakuten_loadingImage=auto&rakuten_imageDisplay=auto&rakuten_txtDisplay=auto&rakuten_captionDisplay=auto&rakuten_moreInfoDisplay=auto&rakuten_txtRow=auto&rakuten_captionRow=auto&rakuten_auto_interval=6000&rakuten_imageSize=auto&rakuten_slideCell=auto&rakuten_slideDirection=auto&rakuten_order=0,1,2,3&rakuten_loadingTimeout=0&rakuten_mediaId=&rakuten_measurementId=-_ver--new_18_-&rakuten_pointSiteId=&rakuten_isAdvanced=false&rakuten_isIE=false&rakuten_deviceType=PC&rakuten_itemAmount=20&rakuten_tLogFrequency=10&rakuten_timestamp=1632721494008&rakuten_optout=off&rakuten_deeplink=on&rakuten_pUrl=https%3A%2F%2Ftravel.blogmura.com%2F&rakuten_version=20200323&rakuten_datatype=json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 05:44:55 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 23 Aug 2017 01:46:35 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block

GET
H2 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame C3D5 41 KB
15 KB 80ms
13ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 07:23:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80473
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 26 Sep 2022 07:23:42 GMT

HEAD
H/1.1

200
OK

file.mp4
r3---sn-4g5ednd7.c.2mdn.net/videoplayback/id/674ae099102b2807/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3773920563/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame C3D5
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/674ae099102b2807/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3773920563/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/signa...
https://r3---sn-4g5ednd7.c.2mdn.net/videoplayback/id/674ae099102b2807/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3773920563/sparams/acao,ctier,expire,id,ip,ipbits,ita...

0
0

97ms
6ms

Fetch
video/mp4

2a00:1450:4001:16::8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r3---sn-4g5ednd7.c.2mdn.net/videoplayback/id/674ae099102b2807/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3773920563/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/1443AA975C2E6E44646EDC99B0DA40A70A6DBE6F.6812B2CA008D7DC736ED3EEB092EEDB01B0C215D/key/cms1/cms_redirect/yes/mh/JZ/mip/2a0f:9441:5:0:e4::1/mm/42/mn/sn-4g5ednd7/ms/onc/mt/1632720891/mv/u/mvi/3/pl/48/file/file.mp4

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:16::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 05:44:56 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 898944
Last-Modified: Fri, 20 Aug 2021 15:14:18 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Mon, 27 Sep 2021 05:44:56 GMT

Redirect headers

date: Mon, 27 Sep 2021 05:44:55 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 649
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
location: https://r3---sn-4g5ednd7.c.2mdn.net/videoplayback/id/674ae099102b2807/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3773920563/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/1443AA975C2E6E44646EDC99B0DA40A70A6DBE6F.6812B2CA008D7DC736ED3EEB092EEDB01B0C215D/key/cms1/cms_redirect/yes/mh/JZ/mip/2a0f:9441:5:0:e4::1/mm/42/mn/sn-4g5ednd7/ms/onc/mt/1632720891/mv/u/mvi/3/pl/48/file/file.mp4
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 6985 41 KB
15 KB 69ms
11ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 07:23:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80473
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 26 Sep 2022 07:23:42 GMT

HEAD
H/1.1

200
OK

file.mp4
r5---sn-4g5ednsy.c.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 6985
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signa...
https://r1---sn-4g5ednsy.c.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/acao,ctier,expire,id,ip,ipbits,ita...
https://r5---sn-4g5ednsy.c.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/acao,ctier,expire,id,ip,ipbits,ita...

0
0

85ms
7ms

Fetch
video/mp4

2a00:1450:4001::a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r5---sn-4g5ednsy.c.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/4B3A105B8D44A4C1B12B8B759BE6F3A14710FFAA.7354F7868A2B63D88A2A32E6D40D1401BB0CBE6C/key/cms1/cms_redirect/yes/mh/ZC/mip/2a0f:9441:5:0:e4::1/mm/42/mn/sn-4g5ednsy/ms/onc/mt/1632720891/mv/u/mvi/1/pl/48/ir/1/rr/12/file/file.mp4

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001::a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 05:44:56 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 890172
Last-Modified: Fri, 20 Aug 2021 15:16:32 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Mon, 27 Sep 2021 05:44:56 GMT

Redirect headers

Date: Mon, 27 Sep 2021 05:44:56 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 02 May 2007 10:26:10 GMT
Server: gvs 1.0
Location: https://r5---sn-4g5ednsy.c.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/4B3A105B8D44A4C1B12B8B759BE6F3A14710FFAA.7354F7868A2B63D88A2A32E6D40D1401BB0CBE6C/key/cms1/cms_redirect/yes/mh/ZC/mip/2a0f:9441:5:0:e4::1/mm/42/mn/sn-4g5ednsy/ms/onc/mt/1632720891/mv/u/mvi/1/pl/48/ir/1/rr/12/file/file.mp4
Vary: Origin
Content-Type: text/html
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=900
Access-Control-Allow-Credentials: true
Connection: close
Timing-Allow-Origin: null
Content-Length: 0
Expires: Mon, 27 Sep 2021 05:44:56 GMT

GET
H2 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 301D 41 KB
15 KB 58ms
10ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210922_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 07:23:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80473
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 26 Sep 2022 07:23:42 GMT

HEAD
H/1.1

200
OK

https://gcdn.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signa...
https://r1---sn-4g5ednsy.c.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/acao,ctier,expire,id,ip,ipbits,ita...
https://r5---sn-4g5ednsy.c.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/acao,ctier,expire,id,ip,ipbits,ita...

0
0

85ms
7ms

Fetch
video/mp4

2a00:1450:4001::a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r5---sn-4g5ednsy.c.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/658F8C14CCB805ABD0DC57366E41A95A91569AE9.2C8DDF81699AC10C38DE2B43855DEC8EC73D5E8E/key/cms1/cms_redirect/yes/mh/ZC/mip/2a0f:9441:5:0:e4::1/mm/42/mn/sn-4g5ednsy/ms/onc/mt/1632720891/mv/u/mvi/1/pl/48/ir/1/rr/12/file/file.mp4

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001::a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 05:44:56 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 890172
Last-Modified: Fri, 20 Aug 2021 15:16:32 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Mon, 27 Sep 2021 05:44:56 GMT

Redirect headers

Date: Mon, 27 Sep 2021 05:44:56 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 02 May 2007 10:26:10 GMT
Server: gvs 1.0
Location: https://r5---sn-4g5ednsy.c.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/658F8C14CCB805ABD0DC57366E41A95A91569AE9.2C8DDF81699AC10C38DE2B43855DEC8EC73D5E8E/key/cms1/cms_redirect/yes/mh/ZC/mip/2a0f:9441:5:0:e4::1/mm/42/mn/sn-4g5ednsy/ms/onc/mt/1632720891/mv/u/mvi/1/pl/48/ir/1/rr/12/file/file.mp4
Vary: Origin
Content-Type: text/html
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=900
Access-Control-Allow-Credentials: true
Connection: close
Timing-Allow-Origin: null
Content-Length: 0
Expires: Mon, 27 Sep 2021 05:44:56 GMT

GET
H/1.1 200
OK / Show response
mtwidget05.affiliate.ashiato.rakuten.co.jp/ Frame 826B 125 KB
126 KB 1425ms
380ms Script
application/javascript 133.237.61.100
RAKUTEN Rakuten

General

Check archive.org

Show headers Download Go to

Full URL: https://mtwidget05.affiliate.ashiato.rakuten.co.jp/?rakuten_design=slide&rakuten_affiliateId=10c3fda8.d5ba32e3.10c3fda9.3e43e297&rakuten_items=ctsmatch&rakuten_genreId=0&rakuten_size=728x200&rakuten_pattern=H1C&rakuten_target=_blank&rakuten_theme=gray&rakuten_border=on&rakuten_auto_mode=off&rakuten_genre_title=off&rakuten_pointbackId=_RTmtlk20011595&rakuten_no_link=off&rakuten_no_afl=off&rakuten_no_logo=off&rakuten_undispGenre=off&rakuten_wmode=off&rakuten_noScrollButton=off&rakuten_bgColor=FFFFFF&rakuten_txtColor=1D54A7&rakuten_captionColor=000000&rakuten_moverColor=C00000&rakuten_recommend=on&rakuten_service_flag=ichiba&rakuten_adNetworkId=&rakuten_adNetworkUrl=&rakuten_searchKeyword=&rakuten_disableLogo=&rakuten_moverItembgColor=&rakuten_moverCaptionColor=&rakuten_slideSpeed=250&rakuten_moreInfoColor=red&rakuten_subTxtColor=&rakuten_loadingImage=auto&rakuten_imageDisplay=auto&rakuten_txtDisplay=auto&rakuten_captionDisplay=auto&rakuten_moreInfoDisplay=auto&rakuten_txtRow=auto&rakuten_captionRow=auto&rakuten_auto_interval=6000&rakuten_imageSize=auto&rakuten_slideCell=auto&rakuten_slideDirection=auto&rakuten_order=0,1,2,3&rakuten_loadingTimeout=0&rakuten_mediaId=&rakuten_measurementId=-_ver--new_18_-&rakuten_pointSiteId=&rakuten_isAdvanced=false&rakuten_isIE=false&rakuten_deviceType=PC&rakuten_itemAmount=20&rakuten_tLogFrequency=10&rakuten_timestamp=1632721494008&rakuten_optout=off&rakuten_deeplink=on&rakuten_pUrl=https%3A%2F%2Ftravel.blogmura.com%2F&rakuten_version=20200323&rakuten_datatype=json&ruleId=responsive728x200
Requested by: Host: static.affiliate.rakuten.co.jp
URL: https://static.affiliate.rakuten.co.jp/widget/html/mw_dynamic_view.html?rakuten_design=slide&rakuten_affiliateId=10c3fda8.d5ba32e3.10c3fda9.3e43e297&rakuten_items=ctsmatch&rakuten_genreId=0&rakuten_size=728x200&rakuten_pattern=H1C&rakuten_target=_blank&rakuten_theme=gray&rakuten_border=on&rakuten_auto_mode=off&rakuten_genre_title=off&rakuten_pointbackId=_RTmtlk20011595&rakuten_no_link=off&rakuten_no_afl=off&rakuten_no_logo=off&rakuten_undispGenre=off&rakuten_wmode=off&rakuten_noScrollButton=off&rakuten_bgColor=FFFFFF&rakuten_txtColor=1D54A7&rakuten_captionColor=000000&rakuten_moverColor=C00000&rakuten_recommend=on&rakuten_service_flag=ichiba&rakuten_adNetworkId=&rakuten_adNetworkUrl=&rakuten_searchKeyword=&rakuten_disableLogo=&rakuten_moverItembgColor=&rakuten_moverCaptionColor=&rakuten_slideSpeed=250&rakuten_moreInfoColor=red&rakuten_subTxtColor=&rakuten_loadingImage=auto&rakuten_imageDisplay=auto&rakuten_txtDisplay=auto&rakuten_captionDisplay=auto&rakuten_moreInfoDisplay=auto&rakuten_txtRow=auto&rakuten_captionRow=auto&rakuten_auto_interval=6000&rakuten_imageSize=auto&rakuten_slideCell=auto&rakuten_slideDirection=auto&rakuten_order=0,1,2,3&rakuten_loadingTimeout=0&rakuten_mediaId=&rakuten_measurementId=-_ver--new_18_-&rakuten_pointSiteId=&rakuten_isAdvanced=false&rakuten_isIE=false&rakuten_deviceType=PC&rakuten_itemAmount=20&rakuten_tLogFrequency=10&rakuten_timestamp=1632721494008&rakuten_optout=off&rakuten_deeplink=on&rakuten_pUrl=https%3A%2F%2Ftravel.blogmura.com%2F&rakuten_version=20200323&rakuten_datatype=json
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 133.237.61.100 , Japan, ASN23820 (RAKUTEN Rakuten,Inc., JP),
Reverse DNS: any.pub.jpe2.rpaas.net
Software: / Express
Resource Hash: 3437764467647f327403a17e9b91dd683fe1f392d3909bcd1af5d40af69a5a31

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://static.affiliate.rakuten.co.jp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Vcap-Request-Id: e48924b7-5936-4612-797f-9f68a5e29173
Date: Mon, 27 Sep 2021 05:44:57 GMT
Connection: keep-alive
X-Powered-By: Express
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=utf-8

GET
H2 200 / Show response
track.adform.net/adfserve/ Frame BB3C 7 KB
4 KB 22ms
21ms Script
text/javascript 37.157.4.41
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfserve/?CC=1&bn=46470475;rtbwp=YVFaVgAGdwMK4HPPAAYeMl42OZWXoxuNrRYYNw;rtbdata=sE7aJDcJuegbfGs3ujAecaM_E5kYQppY_qZBAluh52TB_gIeuEPqbSUn6yYso3JAQ0E8W6qBsvzqe2mcEfQSdjKPAmfqxm8EkTwIWyoUwA6K_12MCGSzFFH3Dw20aDHV92n4qHsaARkv7cRi-l38B4_4B4A0Pe5CSHLdtUmNyw1LvnfCxQNYE7vGpvX0AsEB9HSyZIj8IVoRx_2tDow_ifP2teoVDEuNHqWs9WmNogH8bx_s1JcHCD1eSkNiOpcjvKYvaiqLMI9w-iQ4hD3WPLptBSlW5ZWPw3iI60gHGBc1;nofp=1;click=https://adclick.g.doubleclick.net/aclk?sa=L&ai=CwwDLVlpRYYPuGc_ngQeyvJjoD-i-mJRcoKWzyf0IwI23ARABIABglYKAgLAHggEXY2EtcHViLTkyNTI0MTYxOTIzNDg5NznIAQmpAsPjD0-QJoU-4AIAqAMBqgTxAU_QaDM40n8FtJTFtH8LgqbdWE-VQKD4sVcXdDh1CkTRThSw3lsI0cI1tgzzj1Px2iivY4bGhbwhzpeiLWcJn4SpGug3eECjXEvoJgrEHEZpsahueQFVKn5hFi9A_3Q7UH72AXPWTbQL4u40pCXuoeesfizmxNEXST-MEdX-4_3ot23o3c-NP8q54NPPABLPIPEiY3DvTJ6MvApr9ablgJDgp4kCPSXIU4X7uAvMjCfMuj0Yl4rMkGmeulymie4hStoum3lWMgQmbvwev2a1ZAveKn-JgskcilNM13Ma4djt14NBaf3S0njzU_6fHKoLdM_gBAGABun_2eWa6qLFdqAGIagHpr4bqAfw2RuoB_LZG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIjhgBAQAfoLAggBgAwB0BUBgBcB&num=1&sig=AOD64_2KJgVQ4CQOwCF108jmeN9GWAN-DA&client=ca-pub-9252416192348979&adurl=;js=1;adfxid=1x;9873;set=en-US|en-US|1600X1200|0|300|250|24|8|3|7|1|;fd=0|0&CREFURL=https%3A%2F%2Ftravel.blogmura.com

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.41 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

861d37e0d32b8d05e3227265b97e562f50855f5e34ec0c84b63fdca262ecddab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:55 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 3115
expires: -1

GET
DATA 200
OK truncated
/ Frame C63C 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c54871d18340ab3221e54c64f617fbab83d6f84786f5bc56c6b67118dfc7884c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame BE53 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fa681278aa6d126ca05e84e1165090bb6d19a8e579a2b80a7f443284f83efb04

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/ Frame 3612 23 KB
9 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AQKXxHJ8gD9QRNj_8btNRNMZCtFS221L6UJ-JU87fDNeTb72-5ACehK4RBYH02BhDe4edVghvVHATlXUMpRQgwLG8_qPvVm-Ov2xZKzMGF3JfOpeS7kJr5Alku0b_Mj_AKyagM8D6_IKyu5AI53NtmaqGM7A&cry=1&dbm_d=AKAmf-DxCfjub-cz7N3QB6ZyUi-1swTi__N2L_oWzxbSeXQSpWJase5HwaKEo1xXn7yL7c5eHRFN1vBNNeLxC7G8mPeOTa4N0WjibUNJbI80Zqd1zIO9sCiTLYxrD3WRVrjgw0-UeFkuuMbb_vhI7TCeBM0__PPDaWT5i2mOvm2Xq83MG48cOPIlxEWTWWxrlN2iApqiV0Nd_bL6qPQnFUvrkBjjP2ySy5HP0qkLtql9r_qdw3oArQT1oaH2ktNs7oDG66xWYm50zoAyDVFJTgyr-Ue1WNeuxOVzsGw0xxSe0ZPGLRp0RCiF3mpzqUlYRV8zkjH-MHkKEoWa43CDGiSLVx6Lli1Uv8zkmzShwJdjCzWqkSzWmThM5IHEA5qLDfsyZsZMIAIX5HZQj3F7bFgXrBhPHQsN-Kk1WP44JqHAG5aogyRhBqvgRplDcy7x3ZkeVnd2HwAxgYUlVORYpyKzKktijdlipccFjjs5SdICtuJdr84Gus6iFR2lHEQhWZg_8N1xr0_uS9z7845PdANWlxFuUN-1pD7d5aMeWLooxkBsdETBjcSy7NEoLNg895ALDuRmmc5HrfjoXusrZId8fYOa4J6RYmece4M1n3WyOqoZbos-idOLgIwO0nnL65mhejmZx3CuhagTlGk_e8Y0ckQldh49j-ZtbGgvO3crPxgNnMULaHPxyCmX3EdK5EzRiy0BlfhCOaIM5abMOXlP0v-99BEB6WOtLOOPuYv2Q5Rxt62m2NMYHlZkQY8EOPRVK-bUKaXwcej89nvsY-d8yH0VUkL1hKE9WwrHMVe9Hqsajh2WVN0OgpB-Rs98uSgfR4NTqMjKQ6L0nDwTsOqSJcTmgqq8-gIe9Zx6VLmu-EqPGFfxuLeXvb07JITFfNZlfx11nYE9-14seqbKgaNmsep7zsklnDXws9M8TaS769pPhWrIcHcEiJmgMr03L1sFVDBDNkq-QRSgbD0vBp8W112kCOESYMCIvJMZtR9hiVmp9DJMqwSsTjRIZ7GcV6aYPwIMWNh78Toab7LhFgNlHhFuf_DhfzXm1qTniyxuYIi3vY7ki2X1V9pT-BkaOycTaF6G9cDsftUVf57AixH25ga29bff08GwYBF_jnVXzDolGjHIWoOaq0bbn05-vJLas7RC5TII7TN5-CESgVEmIXcs00rkHf_UFQgM5FL8pQY65vCLWV_234qrJqn3brj1NKRfpL1Ugb7xkETEDz3znTmVX5FWr1G-hNmB7_9bOBcK7naqbmu70Ks4LbmoSHLFF59oeGjYbmOSAtAngVWVuhZlgoY5U74BTP3JoJn_iTTGWUPw9BHp3dgIcCKeHaAcfhlHG_SPOCkqHeE0aF2Lokft_DTpmvLaLAdg0C367jpg4EVVDQJylBZ_Yg5lDToxLdvy5lcT6pyWSPwX48PZD-CeKEFFSIkCVfd9l28Qv63Z9Cng91jhBHN-7gvvCAt7qwmbwFNJaBocBsdfr621x7wJC9QDMaUWkTz9fyGrl_GHFitY0GiEF2AApZ3QRmjMUueEDvslpUSJid010tlm78pQTUjPzuy0Oyt-deJhSg71TMGZ2unCEngkd1XlTPyMjt9hXYA5lgYV1k_9rCSMp7INCshLqiLrKAg5_f-8xotDLGMbctz44Mlaim2kugkV7byu_s6Cf0bs3oTkL4VsVhpwR1g4jC2QOeZPU6KW3H90uhg0B2l0qp6D-tWc0Rdzfn1_THGlV2XBg3C4obCYtaEnsoNTfg66QeGkKe4Rhox2Cc1KzRlmTstOmfdIhwDc5NN8uZjdMYJcB_B9CvjOjmeFRy9REZakhlkE7UcqQXFiScinbRUyTwFoNOa7EsR7Zq99vsV0ZSbm0rO-c8TadA01zeaFucW_Fqre7GXxbni8j1zX3FFcEGLxFpLqgqY5KH3GQVJ2Nosd4VP09_4BqYvweZnee0sYz9XMHVkjX_w_VkjlG5Wz2dv5CjzlaCQwaEPy8rd25M84jxXls1WLw2GE0ifarDFhhnc5OAK1qxtxl5tZYI8zS618qOn7Agoy-l7-dHKoaX_mV38Jcc_kDnr7miBxuXE67YBSiKh50N7Cp8WmhP1OjJJneQ4HlxSKFVeolSK6coBfBTlJ5ntxaGsmksR8L3YlAj4SAfALtBSonGEXUByfjtMLFTIY1dXKqQAytAVtUMBfRteJqdthJcSD2bnkTOnhfUfr5t0lglHEjYHCbsYCw3nJ-qiI8yby7OPcqonMg5Are8jY6bcyPx5s9CSipsAw-lb9jzmShtrwNrI9f3ORjuXBMays6-JV2bEKnaxTeS7HqAe0QLsuPegHE-5UARfMk44Wou8CgwXl7ChvjenMPwoENmZKzj9XPMtSWGuMK7n_91jmsdWOrB67nXZAPAmxutoKYf-WCyYZJRqzhIowc38ZSVpc0RNEP3jnxt32QlZrFuQvFSDJjlhwa3s_laLReNeJ5DwdhDSg9rVcv_q_cD03Cmf9p1OaHuhWBKzMFBDx7gW6X4JHD7qScsCkepHgQsi-hKqZagEnX-hMcY_QPMF246TOu8YeIE-c9pst7z9RVjMv1vqOHMFAKJiQbtFl6Yeo4HfHeFWv1VYs0yGoW3NGl9ZhpUzD4TqTy5_S-5JmgUhDumFg1rbbQ8rF67SVJmucnhsyyi7uGBqvbyD9v__NlaGcsEgZdrtD6-N38VGrAffRQ7POqF4_a70DkSrBKek3SXdyW5Ln71pLgLF_oGVTTcuCPj1zrYBziln46HTtpRQS--eH0Kk3I7IBqGnT-howcVBQqqRrmQDSQhRdtDYzNajNsdmqk_xvD29NOBc1Zh6CpbocsJFNugs_fuTBSig47rqr-LblZKPc09MxFMVjdS41sY4YvUfiIMurtAy99SlUmS0wZcAt4Go4GNxwon_YGzhpXqPHLgIUW0wP-EYImHcuuQr3CZPq5mVH2MCtP5SeBdZ-tVj71YizlLXlkGJWrwwsiFcPErf7hfpafoJ8EwTwI_g-YZ8cMolcZGi6HsmIXCWLuGMbl6oQc5z3j4F6VE7M7JHlKbw2I4MQHuCpF4zTAGOJM9CcioCcl3J4Bk84fCm__Weo73EqfMmdjjEFAqRaNYzEIDEqKWF9h-eTqtiYHnR5wqyVeCS2JxPl_ZnbLhiWEN-OeDzS_qlIo67ITtw28-A1Yac09g9Gs_07XsMd6gFUDE7j4SY-XUWicGG-nNj3WslxCR3VZLbE1i8JobFoKybrYcsITKvhLqlEttCRiOPwej9J8xGGEcblb6KlrKLdpNj3Y2k_3A&cid=CAASFeRoLqUYfwHBZ1q4hhlS4MjKyHRLjA&rfl=1%2Chttps%253A%252F%252Ftravel.blogmura.com%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

289d6e0a0907342fcc661d9944f30ab735754993b96f13f5b59ef4f5269b40fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:40:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 256
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9237
x-xss-protection: 0
server: cafe
etag: 9463376652360951579
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:40:39 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 3612 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 13:20:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 145458
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 25 Sep 2022 13:20:37 GMT

GET
H2 200 html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame 0B19 169 KB
59 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 15:57:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49632
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59842
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 15:57:43 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/ Frame 0B19 8 KB
3 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CTf_Lubar_ZfRiYpEU6KoguTX3bgCDngfv_f_U1S_BvHiIrBDhGtE7iUvBv_IiWTegtqyV00Iwv9feIGCOnTnVttqVarHIzgIglTO6bUoOfW1WaLvYu0SbwBTDJqcJSpAvdDXT6JC4qi_Sg7mPflOMr1au0w&dbm_d=AKAmf-B6yoQZP6G8R_LbdxbUCjiSUFwF6VnhSUB_YqYrevUbgwCeXE-AkJN79uUhUUabNItkBYP8nAz4l0MLVf1k9JHbQRMfm_wV5Rt33e4nutla8l0OF5916DoeQ1VqhSaXbe7kVlVsqSj_nx21rkTysHBmhWLdG9pFe_b_MvRAFnZG61WllxuOsTzpjsiPsBvUKpcrGItFCAFsVzVlY6hpQr7476G8iimQqZYGpy_1OUGb_JRceY_Wt_sFJWljobvslS78kfKjQoeIxZ7RECe5JGku6UcLvdHbLgvmqHvmSQ67RZZwJxR_Mlh-BzjesnKX-0Xi_qijFk3ZSQjlg8U8gmC8W0p5hZHmnLDFcU5gA_ce3wAjAvLNju9l9dpP5Ik_m7mdeQ2EKI4rVYxattVqfE7ZF3ypoD6-ceoDP0jahoM9-JcaBZKXxgnGHIPYwAhNlirXP4pyEVOKNk6yT_XrpEIUNaFta1BmPEx4w35fAN2Csj91qCP8CSVgaIpVh8kbO3lGTg-ashkFYBy26EvRZEStsJi_s1fIDDJqOh-rXwpf48kXSln3K8NK8nTLjZHGjPbZ7KXhrvdGLHPNiMUGxzMzrqAEdnUmzblf7abQpiIHhsx_QKtHazd_73Q2VexSrwi310Lh_ktpULPbEZQjBu4rx8r6oTPxoGTO57xddHfrIViNCF4CNlE9xu5ZobjwPN4RY5fROs9o4GQI2c0WJwPmXXpp9OZdbopVw4twmkdUN2WFFu1zyuE5mxdWNCz65rJ6ym9XXgl-ZbeB69pKHLPKdybzQtuD4oKtwU4KxOFmXyAadQXQhEuqXlDv8x8NtSf_t_cchJfLzYVl84b64KY6tzPnZJLz1nAntgg0obgYCc9IOH9hjBbL7vvjLcd4xrkrrTxSqrOEII63YRT9yAwxbwTbqbsGn2oXGxFd0xitSk74cbAqBu-l_ifShekjpYwie7NjX10DSEUMi15RzqVWAGIfAqPOF28MBTFFus7B9MxG6HSkUklQH8iQ4KFFDOUV1tYvzzZ41vUy7nLocuAlvSpwGJkR0jBQCrJ7ui7j0F8flnsL4_M1MVjwfpBfNbiLEkh5-agshTF3ceZ9g_2Dsq2YE14FOShbFLSfpTrtlEqHsBUeUTmIHL3MkPkh6G6vBjlXZrkDTr_V1ykm4OMvCQk-04cL0ky98R1hNy60Ew5AKx63RrmPppWt3dlpZWRS6jKFfNLUqmKJ6MRGIQACaeWKQzsVjayuNWoQ0iqhcWY389H0x3Pqu-aCKWSSuR9aDZ8dGTTNlhfbptepZXEeY_xf9xuGTs6QVhNVxOp_PLau6havLKL4jdhCXzRueNdbXAD-RuJd4L9J7P_zc5t_QRt_VoBwsE08TS8MUMdYTpfQ_IkhUYguSIwLs4jZVruhE4oKubwZyeWPvfdCMYwqrTGwd6mYtS98XudE2yMJ3JCXR2bmM-68smz2FUjt-sfzL2EwK_lUgVL7mvOX--HlH99xHcX_Met7jD3BN4N69WgqD8W19T0PZO29e6BPNQB6mIrbCl4RS1oKzb_ns5WwlIckZgtYvp3mSesWGRYNGljFMdgRYCatZZIt2S297h9ufUeDY0hNivFsKC31lgkaoUaUjVc3_cVc_uqdm8NfG612VQpunyBokraGWLP_2FnzGNESak-YRHxxwr0bNnXIC384EEGpRUhkIX2nZk0gFm3KurLpNpvyyfVzwzDxsuJPzAi90CqNf4DHA2X3ct-U1NKTFgSw6yXuX2NOnBiBYc9fEWauVdeNeEaaywO9k8lqtCJmxA0UnuVFdFcXm6Nyl9X56Y5cwmmk9MRH0xGwnxKLuXo72CsF66ant-n5SvmwSJxXm76bVYkDSp_9Cf585F6oDCntUr_N7CqKvMlXQwlsT5zsSHuwkMilMfvctzGhtcAqPS7At81sOk-FRyKtLT8triBmUDIW4pT7qtWRxbFscoyWVkYI2YOvIN4z-gU7hjKDORrNkRCPSwvA8c7m2kPQyPd2cTHEBp3unsAI7JriskFt5f-l0wIFcCrQ2JWfFF8kiqWuPMV7vE_-WkYzFq2xGWJt727WfiehlRt8yDMg-i-IJdzIY3cs5e4G3l2-2zyaPbTEXbQJO6tF8CS-sf0wAPV6X3neHNtfnjagylF0AmYx-8Bdhe1Ne7vsWgVQ97ROBbpBXeXRcqEktMvJVIZDdJlrK9mxvx-mdzTJZZ9NrDl4KtEMc8E1ykkZz7zGXkgqZVx7cBI_cr2TK1jCGEuSHTARALOplb7aWkFapxuf2TJqHqHPgamPQOTENtECMwhXLUQ0CP1DODti3QPSLgVjwCRV19QRmscx5f32Z1KBWeHzAAvY-kBnDikPV-M5-A6GXMyCexK7KcaASk0o6wHAplrEpg2butRYeyJXRkKEZHKKgiFtkHlGP2GbtsnnnEEtfJosJbzxMwOM1KOIR7XkdyPZOu0c-k1D9A2OG_KI-txyyD8MKemilbUOeOcKcxlSLC3685ZAQGfdht3QnDHtJA3bG0wz76touF-Rv0nsdSsp3rsdDm5cclGEZmxVS6eCsEGCYt-bI5IK_GhG6LwfzwGzSNY7GiGw_U-vL-TD52rmGwnvt1p7fzyS_B2tBE_k7Dw9jD5WULtXzASZ0wkl-TKPUhwUpXU7kwJ43pYO7uLiG1oP6z0af4ZpcvuiVntZmgxcgzgAmZ2hpqjR926tMGd5GpCQuBxBewjst6fvtwfxbWY0Z3OQkWRVp3hy9zaER36BnQ2QPf1amHtA3ZHXwICIhnCABKaf5Vs81lM1ot5SDGhA6PWp5vmfl2-LJxgTGReBBKJJB6aO6V2mKrd4pjPt2_rryyEMEa8tQDR_K1m-xLFUkM4M8KVHFmB8GmFAmwhxXRGfqotC2anP5rh8LsNvqfRPvDo6fx2oVVG2vmvs0FKPoE5w9FLaaksworpdlRvHwq2MfHnVfuN17jG_xJxX6cn8He_dVFkhJ0I171ixpCuysLomZ8KrcFQHAxutwX00l-U9pX2cgS1TQBzVBUN760ox6kYWQWlfS8EjW8MqBU6w3tCBaMWsV4b2F93Ylgb5-WbAhXHRePZIHy4ZZT0vg48GQOJ9a8pnuF4G9DSa_V_71pTNXGxVwduwYFhZ7NV8f30mHG9-CnQsPVH79-SWDWPeqT7v0QFum3k8HmCdw7BKVjJ5PG-Qa8_ABFI3WB4aU5bYO1PcZCs9gGWzfRmiUj4r_9_Nne-054-P67i9RjWIWu663nqx8TrjSgTz&cid=CAASFeRocQ2F3ounzvozhA0oQw_0wMmDPg&rfl=1%2Chttps%253A%252F%252Ftravel.blogmura.com%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 873
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:30:22 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/ Frame 0B19 23 KB
9 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

289d6e0a0907342fcc661d9944f30ab735754993b96f13f5b59ef4f5269b40fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:40:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 256
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9237
x-xss-protection: 0
server: cafe
etag: 9463376652360951579
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:40:39 GMT

GET
H2 200 html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame E451 169 KB
59 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 15:57:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49633
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59842
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 15:57:43 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/ Frame E451 8 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D_GReZ_KDcJ3N4O_I0a3i4laICD60-D1mcnBCUpfNcwCgCJgpnG1Kj7Az4VeSOW5AcEFoNsRiuGC1jm0rrJfesS1YNpR3nQ4q00F4Z_nXzFyftFaA8UO0PHxrHG-ba6lrk9hQ_SR1uFEkrcyCj1lImyF4Nhw&dbm_d=AKAmf-Dldog1l0o7hvJwANqbDfDsIDDdFuc2ZoA_mtSPMXhgtQHbPY1coq-berET6laalDsBnBPjwQxw5eI7kvs7D_4nhaFGwammybJdq-j3W9U6tCW01cd7UKSJTRTI6Jfg4AQlPFOfdBwd9w-JTMmYypaCgux8IwxuRQJcPLqSl0-R6ify2dqVHGorPEdN2vPoF0X5PIa6sTSPZh-AheS4CL8atfa9vOIErMj6o7ftIbFRE8FsfVbTgxa1AvvEHXU9p6cdzHp0s4U3IWw-Nq8lOq98zcI2wFlTrWlAV3TJETkN91zKPncJAK_dFIdDKjBXRboCx2h4RL579KqfHMmPDAtm_218dvgadFdztoVRHcqaPIGYO6vc_bPgTsP6vVwGQ4sICE7eKeU2f2BwsdGYRg50SXapLkhVfCSskTInBn20IbznIQI23A72LA8xEn8k2nHsBJGiSsCTu9oIyiqVfgSkXgJQNDWp0uL1cUBLMCx7P7_7HWhNG02gYG8psTSyNCJ-_WOSu3IixgcUtza6rEw_P4TSC0b9Fl6GtQkJHs5zP2Zucg4PE3p4bHkCRLKTFQvzNXV4096M42Re0QXYSIZhrSJwdN_UdgU-0Uh2sMDM2cjD-hShH88Ip1E_SY58EPIDyh68RrVyahIJhjMCQ3LP4Pu4EgRHR5v0OJOHi12adXRb2WZNX77B267ZuTnpD4YbVCXQKi4mlfs8ekyE6gEeYFBKCRm27eBWzJIQjrZdWapaHXKCpfrP0LEhXBK7W9WutlUwIYulrnz34gHdiNkT0hy7ftUFkAmoXXlqL73DRhSQrkoXCE90xoPN-W3Hixn4bVz9Edw61v2qp5KtqIGnz1JVbXFMemPB8bKBY78mJ4H3toD-tFfO7Du1sLkXrVlVpUQkdRl5T4bMufoTL0ELPI2ljiFumS9xnc7LRAOgDxZyBbL8rnYwFvUAb7QZC9xwYdBIU3IP3AhsuOBtqMT2lveAUAwZyBd_9zzZJwPdWvwNPFspnQcXlwwvEJ250H3ybRJFIFIhbaeaAEmn0XQCryF8sqSeE-bWjLs6KaFto91twJCZ4hfhiCsVVxeYAM7QhFWeAYuKNHmQHbqj_x6MjQuEqePE4y100Qk_NbjwoxibuH4xll3dFscNUiqMK7N2JfBHr3e5UJyLl9sn0bCypwjLPV-I28tQWm1gcFeItk6vuU10NN_WIyYXazaBK-M57g6EIqY1hbmnQQ-886uprOb77DGHPwE4ITx4dpx939xYfNio6tQp6vgPAFPeVdRM8Y0qfqFIcHCn5bQGH-OvelHmghiS8CnJxkKJi-58MTHHE2cWIKbXvuuJtfICO8m5hPisXmpYCcSfVKTL4fPqmn7s3Ew7-mCAKEvc7x3E6QvoE1PrX0jkKXhRlsj8VBy2dqC4wjR-6SslnrZPdm4E67JnfBnXdysqNcKr5VH2k_xopK-RgY7UyvGjbhG6bLhsarwttHKQxRpr-xeVYeX7xK2uXoGKpYulcgrtfLta3e1pDMv5_fQdMsGLEL9bWtJuf-Z6cS6hg9OEqrM954DCBw73ffcd8GSqY-lHLoqq9DAj78GC22_tOxe3nEEwJu0VliMIQ-9N1BZBGp6BLGLpCURlxBgmtWGVxVdDBsZlOeZDOJIjU1M2bApIxVcFPHNEZI4mo9AYKLoT8426u1urBajnndwxK90KXMNuL5fvXt-0pyf3-i8Gh28F-CTNds91rNPiM9OD3ml7AleJcto1rzEpSXv9pldMgsRHgplL85ubsPdhsnoYZfGuGUGTsg7qzbnrDhD4cXvnKeBd0xIs7o5xcU46iyIT_dZR1eZ-RbkdsIi0M1lMDoF1AATnBgVXLmjh_buPZvVNjuDqNRIn58-hg3QhVNxvHEUKYOiOnmKj3wsdrcX7eDbbob6ffXZt2n7sKNux3d-_djph_BR7reowMCTdZc2p9sDYUFwoYqj67eJAyfUVxK9DvzU2ekVBvntTHpe4faAmVPndPyns6Qa_5O5BGEqXYMhLfnwiAhm0EE5sKuFFb8fj4PcLwSA-4ajakAKWDs3aEeOJK4hsbH5cveO81M-dlgO7JwYRYHivb8ZOZntQbDeCV2MEbOABrJkABlgyQOL1jNkLZnVJuzRBPSk1o-G31TezGV_B6pd5p9iVsjc9uf5dQRDEY7_fcVXI5dRbjYaDc-ZOrj6AjH5E5qpds-1T-Aal-P2kXwwRMWzaBDQxRme9DNjqzSVPTPMVcQb7aRqU4gYiKL-vDg6eju1o4V1Z1FUS_LHbWJcUIZpD1s2ptn4_qGPACwFTCJlaXCddj_520V7V9ema1Ys_feiDsP2ktGAY8xQJB3buVYDo73ZdS-KDbFMW5yB5ZKDF9nLyi6g9zTaYfLXS0oVd0VCtggk3Q7cP7XmiQC6P6rtm3XXWPFxMFb6oRvmOZsLGVdAOYkUFKWxlausTf_RC3j90bYhC-4EGKiFXBzJAKR9SDdFzslOXKI9H6-qrx-DqF2_BDH5RY71T19ak_uxisylT6eOJmI_zgQspJ6cQfAoTJ24Ja6mTTEULlw8mk1nx7qjqNgniBH7zliuBzocU4UnECTP2doYd_ORSju0p-T5Xgbd3HeHHTCZ5a610cdFrH3CBbMMwPlRFnHEgMQBki_vCDincRqaTt2Gv8tQQVQeuMwrJF7eaBgK-yxOkwmDALzp_UaZACsDBHHjhw4rNfPnx3Dav0M83etIkfKBn4q0jG7xb7C8nu1iIVNQL37HiTH51mWVgH7lqBCh-FYlQwYfFWgmARpzJZv5rQzvBxVT3t-bmHo0rsGgcBb4lMQIRZA8SCS7XiOG6zjCfccaqxfGUOyxH5ar-GXU65ZW4yoKU0yYsy6WrkupT2vgBiKn_mmxbCPla4Bh6awh6nRDns8ZvJFJo5IIFzsNtkV5o9Ni-wcIRIo6B4j2sTHT_OJZS2DH67XifwvzwCOHtbfzdTJu0YrP_7i5bHs_MekBrI3Vd6XKDg4-u7PedQe7-HHUOFwBbokTy5hA1UlUo-04QSeANVk11c2sLCCOA5pTl0HdF0i5PohOZVSpaIhtmz31EqtpahzX9oDAtbfTNELslvY1jjwf3Zwlf-8KnmdbeZC2Bq8O6T7rpj_6TwlE3IpMQPqzDhMPshxMBu1Cdi-3lIPoeFSjxuqBqUzqoLe06FvAFBV2ubPgbFakmEVOx35c6J4hmcXAd4PQqeu9Ly10W3wBucmY6SVKO7i5vf1E7xtgJG624tg-jE3dzGZihMKm3lDM0q8d5rrVrpWwwZCDEpuz6td_TeCB5FOe0EXjKWQg&cid=CAASFeRo76KEQ-0UWOlfKe2MDghRfSqIbQ&rfl=1%2Chttps%253A%252F%252Ftravel.blogmura.com%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 874
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:30:22 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/ Frame E451 23 KB
9 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

289d6e0a0907342fcc661d9944f30ab735754993b96f13f5b59ef4f5269b40fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:40:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 257
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9237
x-xss-protection: 0
server: cafe
etag: 9463376652360951579
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 05:40:39 GMT

GET
H2 200 / Show response
track.adform.net/adfserve/ Frame 15D1 7 KB
3 KB 22ms
20ms Script
text/javascript 37.157.4.41
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfserve/?CC=1&bn=45192706;rtbwp=YVFaVgAGdwUK4HPPAAYeMiDiI1XqLd4pP5jXaQ;rtbdata=sE7aJDcJuegbfGs3ujAecRKKFDeExmQJO_TPkBbyu4qOQCXjEme0iSUn6yYso3JAQ0E8W6qBsvzqe2mcEfQSdjKPAmfqxm8EkTwIWyoUwA6K_12MCGSzFA1CgEohwu4a92n4qHsaARkv7cRi-l38B4_4B4A0Pe5Ck2hW09tt585LvnfCxQNYE7vGpvX0AsEB9HSyZIj8IVoRx_2tDow_ifP2teoVDEuNHqWs9WmNogH8bx_s1JcHCD1eSkNiOpcjvKYvaiqLMI9w-iQ4hD3WPE87h8d_oaeBw3iI60gHGBc1;nofp=1;click=https://adclick.g.doubleclick.net/aclk?sa=L&ai=CWfYQVlpRYYXuGc_ngQeyvJjoD-i-mJRcoKWzyf0IwI23ARABIABglYKAgLAHggEXY2EtcHViLTkyNTI0MTYxOTIzNDg5NznIAQmpAsPjD0-QJoU-4AIAqAMBqgTxAU_Q6OLlK4LKptdR8wf4hAoSuZox6xhKh8VH8yZuR0_mE7VjLmmyYw4-CamkfIsPKcSGmzpC6cX0hrIo9IOnuWW4deudGyUAKfUKt-DpLvU9vJuebKoeEYr3_-Ctv5350s-7Gq6RlwCeMQt1JTVNTsyLk1LTdcK7joGIcy4f2BrHI3UPJoAoe4WAgG8ei4s-LffzrxQtBCjUxsorAnBUMPv0LEWoBSHLKJRJwRIzLRK8BM06w89b-T3Gv5DFixqr1q0p3qkZTfwmMGE6MOmTNT9BgmGtn-gyAx2jLRWPQs_tl632zx0CIxC4_iB_qa2FVVrgBAGABoa5-tmr2oOhoAGgBiGoB6a-G6gH8NkbqAfy2RuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiI4YAQEAH6CwIIAYAMAdAVAYAXAQ&num=1&sig=AOD64_0-1rcNqIFpUH_YQurjv_gw9DajSQ&client=ca-pub-9252416192348979&adurl=;js=1;adfxid=2x;6801;set=en-US|en-US|1600X1200|0|300|250|24|8|3|7|1|;fd=0|0&CREFURL=https%3A%2F%2Ftravel.blogmura.com

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.41 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

aa016ba4a04f697ddd4690359f40b2e4d6090a5300561225252f8a168dcba051

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 3114
expires: -1

GET
H2 200 burst_sprite.png
s0.2mdn.net/creatives/assets/4265994/ Frame DCA0 611 KB
612 KB 11ms
11ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/creatives/assets/4265994/burst_sprite.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886628/20210825081638199/728x90.html?e=69&leftOffset=0&topOffset=0&c=aaYn2UjXrS&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d61fc26a3bd592f513df1a0a3a890c1815a1c443e04367c507118b6444d67c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886628/20210825081638199/728x90.html?e=69&leftOffset=0&topOffset=0&c=aaYn2UjXrS&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:39:33 GMT
x-content-type-options: nosniff
age: 323
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 626083
x-xss-protection: 0
last-modified: Wed, 25 Aug 2021 09:11:05 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 05:54:33 GMT

GET
H2 200 burst_bg.png
s0.2mdn.net/creatives/assets/4265994/ Frame DCA0 16 KB
16 KB 8ms
8ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/creatives/assets/4265994/burst_bg.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886628/20210825081638199/728x90.html?e=69&leftOffset=0&topOffset=0&c=aaYn2UjXrS&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

611a43a6eacca4472e3255af142a12dee9632e30b1da8d7d773f4a9dfe758ebf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886628/20210825081638199/728x90.html?e=69&leftOffset=0&topOffset=0&c=aaYn2UjXrS&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:36:12 GMT
x-content-type-options: nosniff
last-modified: Wed, 18 Aug 2021 08:17:43 GMT
server: sffe
age: 524
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16503
x-xss-protection: 0
expires: Mon, 27 Sep 2021 05:51:12 GMT

GET
H2 200 burst_hl_01.png
s0.2mdn.net/creatives/assets/4265994/ Frame DCA0 4 KB
4 KB 7ms
7ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/creatives/assets/4265994/burst_hl_01.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886628/20210825081638199/728x90.html?e=69&leftOffset=0&topOffset=0&c=aaYn2UjXrS&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

49fd28980e7b8f554dae61f682b50648abad4e767a0c0037d3b158115011f032

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886628/20210825081638199/728x90.html?e=69&leftOffset=0&topOffset=0&c=aaYn2UjXrS&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:36:12 GMT
x-content-type-options: nosniff
last-modified: Wed, 18 Aug 2021 08:17:46 GMT
server: sffe
age: 524
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3723
x-xss-protection: 0
expires: Mon, 27 Sep 2021 05:51:12 GMT

GET
H2 200 pre.min.js Show response
s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/js/ Frame C854 665 B
462 B 9ms
9ms Script
application/x-javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/js/pre.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a488b6eec146cd55817197d2524099ba4a7280fddcc9277418a7bb17ecd537a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:42:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 165
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 350
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:43:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 27 Sep 2022 05:42:11 GMT

GET
H2 200 bg.jpg
s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/images/ Frame C854 170 KB
170 KB 22ms
22ms Image
image/jpeg 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/images/bg.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

214a357189db2876dc0678f3a969bf0d0de652d561850f75409b41375a28ad49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 04:38:48 GMT
x-content-type-options: nosniff
age: 3968
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 174091
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:43:42 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 27 Sep 2022 04:38:48 GMT

GET
H2 200 overlay.svg
s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/images/ Frame C854 567 B
508 B 7ms
7ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/images/overlay.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e1123f0dbae7dcd9fa76d9b4a3e863bdf057d3a0eff034ec05f864d34732a30b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 07:15:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 426565
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 394
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:43:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 22 Sep 2022 07:15:31 GMT

GET
H2 200 stoerer.svg
s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/images/ Frame C854 6 KB
2 KB 8ms
7ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/images/stoerer.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e324ff679867327aebdb0bdf85b77a8d8f74c03d3ec984c9ae8f4bb653a13536

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 22:02:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27772
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2009
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:43:42 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 26 Sep 2022 22:02:04 GMT

GET
H2 200 headline.svg
s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/images/ Frame C854 13 KB
4 KB 9ms
6ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/images/headline.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13f226ae33d3caaa097e4f4ec21fc6392a600f2ea00d4730c561b3977034e781

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 23 Sep 2021 10:22:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 328917
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3847
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:43:42 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 23 Sep 2022 10:22:59 GMT

GET
H2 200 cta.svg
s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/images/ Frame C854 6 KB
2 KB 9ms
7ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/images/cta.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20dc67abd0ba83bdd896645cf1622b4caa1fab80494baed8bbf4d01d2e980ae6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:42:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 165
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2177
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:43:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 27 Sep 2022 05:42:11 GMT

GET
H2 200 circle.svg
s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/images/ Frame C854 17 KB
5 KB 10ms
8ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/images/circle.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ffb19bfd699f86dafcdfb4e1242d1e67358cec025d4124c95667604bea9d999f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:52:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 507163
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4897
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:43:42 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 Sep 2022 08:52:13 GMT

GET
H2 200 logo.svg
s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/images/ Frame C854 1 KB
637 B 9ms
7ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/images/logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

60576232472f68d95df1af2c82ccb71bd4a30e26d6ce0202d3df5449d9a1727b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 17:58:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42377
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 531
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:43:42 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 26 Sep 2022 17:58:39 GMT

GET
H2 200 pre.min.js Show response
s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/js/ Frame 5822 665 B
442 B 26ms
26ms Script
application/x-javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/js/pre.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a488b6eec146cd55817197d2524099ba4a7280fddcc9277418a7bb17ecd537a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 24 Sep 2021 08:02:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 250919
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 350
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:45:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 24 Sep 2022 08:02:57 GMT

GET
H2 200 bg.jpg
s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/images/ Frame 5822 186 KB
186 KB 30ms
30ms Image
image/jpeg 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/images/bg.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7f9e6df264d357f7e7d701d7b3bd2dfe77c6be771bbd75fdd3ad7c82488dd4fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 24 Sep 2021 12:19:15 GMT
x-content-type-options: nosniff
age: 235541
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 190021
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:45:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 24 Sep 2022 12:19:15 GMT

GET
H2 200 overlay.svg
s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/images/ Frame 5822 567 B
496 B 9ms
8ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/images/overlay.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e1123f0dbae7dcd9fa76d9b4a3e863bdf057d3a0eff034ec05f864d34732a30b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 15:49:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50121
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 394
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:45:23 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 26 Sep 2022 15:49:35 GMT

GET
H2 200 stoerer.svg
s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/images/ Frame 5822 7 KB
2 KB 9ms
8ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/images/stoerer.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

238ab816ef823114ea7f39e129ed13094d6ea90e8c3b445b91465c994fb29d2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 24 Sep 2021 05:04:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 261603
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2274
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:45:23 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 24 Sep 2022 05:04:53 GMT

GET
H2 200 headline.svg
s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/images/ Frame 5822 28 KB
7 KB 10ms
9ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/images/headline.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97176844c8aab48cbf7e8485a744243378c94de38b5cebb2df46d1d7d0e7d321

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 17:58:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 387985
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6758
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:45:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 22 Sep 2022 17:58:31 GMT

GET
H2 200 cta.svg
s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/images/ Frame 5822 6 KB
2 KB 9ms
8ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/images/cta.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20dc67abd0ba83bdd896645cf1622b4caa1fab80494baed8bbf4d01d2e980ae6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 06:44:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82832
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2177
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:45:23 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 26 Sep 2022 06:44:24 GMT

GET
H2 200 siegel-1.png
s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/images/ Frame 5822 11 KB
11 KB 9ms
9ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/images/siegel-1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20496d6c3e73bb34805560d37802d8585d0718dca6c8367492f22c454ba4221b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 22:02:01 GMT
x-content-type-options: nosniff
age: 27775
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10893
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:45:23 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 26 Sep 2022 22:02:01 GMT

GET
H2 200 siegel-2.png
s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/images/ Frame 5822 8 KB
8 KB 10ms
10ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/images/siegel-2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f779672e098b6e885a6e5ef13d56bd65955c817fd5cea1a96ffb937a361eefe9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 04:18:08 GMT
x-content-type-options: nosniff
age: 523608
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8188
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:45:23 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 21 Sep 2022 04:18:08 GMT

GET
H2 200 logo.svg
s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/images/ Frame 5822 1 KB
638 B 9ms
9ms Image
image/svg+xml 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/images/logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

60576232472f68d95df1af2c82ccb71bd4a30e26d6ce0202d3df5449d9a1727b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 24 Sep 2021 07:43:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 252095
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 531
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:45:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 24 Sep 2022 07:43:21 GMT

GET
H/1.1 200
OK loading.gif
static.affiliate.rakuten.co.jp/widget/html/images/ Frame 826B 17 KB
17 KB 7ms
7ms Image
image/gif 104.75.89.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.affiliate.rakuten.co.jp/widget/html/images/loading.gif

Requested by

Host: static.affiliate.rakuten.co.jp
URL: https://static.affiliate.rakuten.co.jp/widget/html/stylesheets/pc_pcview_all.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

104.75.89.215 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-89-215.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

69a984093a6529657bc8a168865a77c7f3dc6613313464bdac5538c6713b4d71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://static.affiliate.rakuten.co.jp/widget/html/stylesheets/pc_pcview_all.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 05:44:56 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 30 Jul 2012 09:57:54 GMT
Server: Apache
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 17591
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK buttons.gif
static.affiliate.rakuten.co.jp/widget/html/images/ Frame 826B 6 KB
6 KB 6ms
6ms Image
image/gif 104.75.89.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.affiliate.rakuten.co.jp/widget/html/images/buttons.gif

Requested by

Host: static.affiliate.rakuten.co.jp
URL: https://static.affiliate.rakuten.co.jp/widget/html/stylesheets/pc_pcview_all.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

104.75.89.215 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-89-215.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

48b9db4b0432bdebb0e6772f033d8a04a77712c973ce9d774ce7710e2dc73fd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://static.affiliate.rakuten.co.jp/widget/html/stylesheets/pc_pcview_all.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 05:44:56 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 01 Jul 2018 15:20:50 GMT
Server: Apache
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6306
X-XSS-Protection: 1; mode=block

GET
H2 200 Standard Show response
s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.209/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/ImageTag:types/ Frame BB3C 85 KB
36 KB 22ms
22ms Script
text/javascript 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.209/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/ImageTag:types/Standard
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: ae8a9ee03c283c1394c0996cc74bf700a20e086bc816154f0f2a88c5bf7127d3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: gzip
last-modified: Mon, 30 Aug 2021 07:04:15 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Tue, 28 Sep 2021 08:54:39 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2FB9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

43 B
894 B

13ms
12ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGNvs6K0BMAE&v=APEucNV2mwqnyYohoaJLFOq-oT1pUn6-NFp_NCyp9Q8h7egyOsQOiHdUqbarVrf-Jx5z71UDkrrUyXf7dZHluIsHKBDIsIz2ErKUBbXZSoyzeeUcrXTKbbIqirWB0wCZQKUQDZYBegbgccd5KNN4_XNQq9ij5vpk1qzwmFWf8vYquKUP30H7aTA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:56 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 05:44:56 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2FB9
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVFaV1lVfZkywdes9eLIRwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

43 B
894 B

14ms
14ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGNvs6K0BMAE&v=APEucNV2mwqnyYohoaJLFOq-oT1pUn6-NFp_NCyp9Q8h7egyOsQOiHdUqbarVrf-Jx5z71UDkrrUyXf7dZHluIsHKBDIsIz2ErKUBbXZSoyzeeUcrXTKbbIqirWB0wCZQKUQDZYBegbgccd5KNN4_XNQq9ij5vpk1qzwmFWf8vYquKUP30H7aTA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:56 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 05:44:56 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 2FB9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

43 B
1004 B

14ms
13ms

Image
image/gif

185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGNvs6K0BMAE&v=APEucNV2mwqnyYohoaJLFOq-oT1pUn6-NFp_NCyp9Q8h7egyOsQOiHdUqbarVrf-Jx5z71UDkrrUyXf7dZHluIsHKBDIsIz2ErKUBbXZSoyzeeUcrXTKbbIqirWB0wCZQKUQDZYBegbgccd5KNN4_XNQq9ij5vpk1qzwmFWf8vYquKUP30H7aTA

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:56 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f8ee93fa-5421-494f-8fb7-d3cc689337f7
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2FB9
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:56 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: e01d6258-3825-4737-bf87-93b0156b5fdb
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 7B13
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHLE9ii3u3ItMfH21QLBiRI&google_cver=1

43 B
180 B

16ms
14ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHLE9ii3u3ItMfH21QLBiRI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGNvs6K0BMAE&v=APEucNV2CBdxUzwfbUpox6SvEGXEcx-BNzmaO2VK2ptA52ETVMhd2QSb6pQ-ZaXxIqdOtskPWgzyPOvozOuS21TXbATegYQJXCOJ870z34ioRz85IgDdLkDkIOmuw2wTjamQvOWf1HGoPeeUHpl-Zxd2TxgyxQxPA8qLYVcT6q3FOmXm7GILzuo
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.216.3 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
via: 1.1 google
server: OXGW/16.216.3
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHLE9ii3u3ItMfH21QLBiRI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7B13
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NzA3ODgzZWItNWM2Zi0yMmQ0LWVlZjEtNWFjMmNiZjZlYmU2

170 B
188 B

16ms
16ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NzA3ODgzZWItNWM2Zi0yMmQ0LWVlZjEtNWFjMmNiZjZlYmU2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGNvs6K0BMAE&v=APEucNV2CBdxUzwfbUpox6SvEGXEcx-BNzmaO2VK2ptA52ETVMhd2QSb6pQ-ZaXxIqdOtskPWgzyPOvozOuS21TXbATegYQJXCOJ870z34ioRz85IgDdLkDkIOmuw2wTjamQvOWf1HGoPeeUHpl-Zxd2TxgyxQxPA8qLYVcT6q3FOmXm7GILzuo

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: gzip
server: OXGW/16.216.3
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NzA3ODgzZWItNWM2Zi0yMmQ0LWVlZjEtNWFjMmNiZjZlYmU2
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame 7B13
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEKWG9AQ14B92QdJotoOmiEE&google_cver=1

23 B
172 B

34ms
32ms

Image
image/gif

95.100.64.146
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEKWG9AQ14B92QdJotoOmiEE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGNvs6K0BMAE&v=APEucNV2CBdxUzwfbUpox6SvEGXEcx-BNzmaO2VK2ptA52ETVMhd2QSb6pQ-ZaXxIqdOtskPWgzyPOvozOuS21TXbATegYQJXCOJ870z34ioRz85IgDdLkDkIOmuw2wTjamQvOWf1HGoPeeUHpl-Zxd2TxgyxQxPA8qLYVcT6q3FOmXm7GILzuo
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.64.146 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-64-146.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.6 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 27 Sep 2021 05:44:56 GMT
server: akka-http/10.2.6
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEKWG9AQ14B92QdJotoOmiEE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 7B13 23 B
172 B 122ms
32ms Image
image/gif 95.100.64.146
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGNvs6K0BMAE&v=APEucNV2CBdxUzwfbUpox6SvEGXEcx-BNzmaO2VK2ptA52ETVMhd2QSb6pQ-ZaXxIqdOtskPWgzyPOvozOuS21TXbATegYQJXCOJ870z34ioRz85IgDdLkDkIOmuw2wTjamQvOWf1HGoPeeUHpl-Zxd2TxgyxQxPA8qLYVcT6q3FOmXm7GILzuo
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.64.146 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-64-146.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.6 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 27 Sep 2021 05:44:56 GMT
server: akka-http/10.2.6
content-length: 23
content-type: image/gif

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 98CF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHLE9ii3u3ItMfH21QLBiRI&google_cver=1

43 B
106 B

17ms
16ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHLE9ii3u3ItMfH21QLBiRI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGJLYjLMBMAE&v=APEucNV8Q_5jKIckBeF4-YQa2zBs8RliRkpQn0gLK6wMDs79w8WMD21xO0Zcaz09cekRr7I9NOuvu3HeyK32LePItVxUaY1xqAx6E1UtPWV531YMaNf-05_UhpDVgE8xix6QrHOLJfNivZ1dLsg6KZUyg3hBRXGcDELUz6pkQerTMyCxrhKqiwQ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.216.3 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
via: 1.1 google
server: OXGW/16.216.3
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHLE9ii3u3ItMfH21QLBiRI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 98CF
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NzA3ODgzZWItNWM2Zi0yMmQ0LWVlZjEtNWFjMmNiZjZlYmU2

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NzA3ODgzZWItNWM2Zi0yMmQ0LWVlZjEtNWFjMmNiZjZlYmU2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGJLYjLMBMAE&v=APEucNV8Q_5jKIckBeF4-YQa2zBs8RliRkpQn0gLK6wMDs79w8WMD21xO0Zcaz09cekRr7I9NOuvu3HeyK32LePItVxUaY1xqAx6E1UtPWV531YMaNf-05_UhpDVgE8xix6QrHOLJfNivZ1dLsg6KZUyg3hBRXGcDELUz6pkQerTMyCxrhKqiwQ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: gzip
server: OXGW/16.216.3
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NzA3ODgzZWItNWM2Zi0yMmQ0LWVlZjEtNWFjMmNiZjZlYmU2
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame 98CF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEKWG9AQ14B92QdJotoOmiEE&google_cver=1

23 B
172 B

34ms
32ms

Image
image/gif

95.100.64.146
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEKWG9AQ14B92QdJotoOmiEE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGJLYjLMBMAE&v=APEucNV8Q_5jKIckBeF4-YQa2zBs8RliRkpQn0gLK6wMDs79w8WMD21xO0Zcaz09cekRr7I9NOuvu3HeyK32LePItVxUaY1xqAx6E1UtPWV531YMaNf-05_UhpDVgE8xix6QrHOLJfNivZ1dLsg6KZUyg3hBRXGcDELUz6pkQerTMyCxrhKqiwQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.64.146 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-64-146.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.6 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 27 Sep 2021 05:44:56 GMT
server: akka-http/10.2.6
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEKWG9AQ14B92QdJotoOmiEE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 98CF 23 B
172 B 121ms
33ms Image
image/gif 95.100.64.146
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGJLYjLMBMAE&v=APEucNV8Q_5jKIckBeF4-YQa2zBs8RliRkpQn0gLK6wMDs79w8WMD21xO0Zcaz09cekRr7I9NOuvu3HeyK32LePItVxUaY1xqAx6E1UtPWV531YMaNf-05_UhpDVgE8xix6QrHOLJfNivZ1dLsg6KZUyg3hBRXGcDELUz6pkQerTMyCxrhKqiwQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.64.146 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-64-146.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.6 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 27 Sep 2021 05:44:56 GMT
server: akka-http/10.2.6
content-length: 23
content-type: image/gif

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 50E1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

43 B
894 B

15ms
14ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYsqK9lQEwAQ&v=APEucNU895Q_3K811gHeBCkwSr3Uo4Fc5xJypK84sZBJC1F5HQAjytr4Li0cqhhnY76InfdlFkZFae4rj5_vPUCaDv2SksMj1Iuh99z1zhnR5gPsVOc4_9f2Z3JAWvbTGCO0cQq4-NXacH6DNdGAQoUfIQz-Ew070eG1hK0ly8dMdK_rF9i8fwo
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:56 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 05:44:56 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 50E1
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVFaV1lVfZkywdes9eLIRwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1

43 B
894 B

13ms
13ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYsqK9lQEwAQ&v=APEucNU895Q_3K811gHeBCkwSr3Uo4Fc5xJypK84sZBJC1F5HQAjytr4Li0cqhhnY76InfdlFkZFae4rj5_vPUCaDv2SksMj1Iuh99z1zhnR5gPsVOc4_9f2Z3JAWvbTGCO0cQq4-NXacH6DNdGAQoUfIQz-Ew070eG1hK0ly8dMdK_rF9i8fwo
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:56 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 05:44:56 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEkNmu_M8z7XJIBJe7uGb24&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 50E1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

43 B
1004 B

14ms
13ms

Image
image/gif

185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYsqK9lQEwAQ&v=APEucNU895Q_3K811gHeBCkwSr3Uo4Fc5xJypK84sZBJC1F5HQAjytr4Li0cqhhnY76InfdlFkZFae4rj5_vPUCaDv2SksMj1Iuh99z1zhnR5gPsVOc4_9f2Z3JAWvbTGCO0cQq4-NXacH6DNdGAQoUfIQz-Ew070eG1hK0ly8dMdK_rF9i8fwo

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:56 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 890cbe40-f0f2-457e-aa73-7bd040ec5e8d
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFRjZXzU05fVAsZFnQpae1U&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 50E1
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:56 GMT
X-Proxy-Origin: 91.199.118.72; 91.199.118.72; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: a9cc97d8-1b1a-4087-abef-d904cbd899a8
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTE5NjMxNTk2NTM5OTYyNzM1OQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 Enabler_01_246.js Show response
s0.2mdn.net/879366/ Frame DCA0 116 KB
39 KB 19ms
16ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_246.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886628/20210825081638199/728x90.html?e=69&leftOffset=0&topOffset=0&c=aaYn2UjXrS&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b64291fc91dc77833930ffcead244193c5cfd9e882af312ecc89b580160c22a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886628/20210825081638199/728x90.html?e=69&leftOffset=0&topOffset=0&c=aaYn2UjXrS&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 15:57:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49633
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40237
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 15:57:43 GMT

GET
H2 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame DCA0 60 KB
24 KB 21ms
19ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886628/20210825081638199/728x90.html?e=69&leftOffset=0&topOffset=0&c=aaYn2UjXrS&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886628/20210825081638199/728x90.html?e=69&leftOffset=0&topOffset=0&c=aaYn2UjXrS&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 05:44:56 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/ Frame 326E 36 KB
6 KB 30ms
17ms Document
text/html 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=kSlaqDT6dk&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6441798447ba251e1090a35dcee01ee8b3e9446325a4c058fabda6090a90a16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=kSlaqDT6dk&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 5616
date: Mon, 27 Sep 2021 05:44:56 GMT
expires: Tue, 28 Sep 2021 05:44:56 GMT
cache-control: public, max-age=86400
last-modified: Fri, 11 Sep 2020 18:40:52 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 18D0 0
24 B 35ms
33ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvEvKtnb-sDus0vgaYct1JdruHK35XyJblazK-plU_K3j-bsedTIdso-S-x_4ag9Z87o5BySC1A4r9ZoDl5bl3nHS_ylW0w-LRl7agB9ugVV92FD18ckvfO_Q-8rMvGvGppYDEgIQo05-K0n303QRdHZzJfBOzsIMBMI5TARkiNIX2Q4Othe8aL6JvZ00E2O0Gxsbl6V_PsFF0pPoMl4f6tBUkqlH36aScKFPUqjEA8-jq56B4NNc4g5oLmqiVRz7EUm6MpXVKWJZYa4OLj-0J64gbvwcrwnh41lw7yGXw6rYC8VgqczAV-X6VgUrwYrUv7GOJaEB0zRCLXWoT1LLEK8yxldwAH0DuDjrkQuQLWbViy1cEdd4JvhCYYBrbaz9mu_cALCU1ADy0zobn6L8uQMdLTdEZ7RytNyvmXOuG-9gmC5-jJyrHwDee5DiPWRuTIbSk8nYVEzZtvqXE6LKhEIUA_47FuSu0czszj3JtWcq9HKBuBkw3NiSuXNa4utIGpl3SjICPvL6LitnYoJr1Brnje89UU0X6ei4kYXLGx2NCWZppkZkQwGdrjmPmGh7Af4kxHMGh-f8U9d59YsaLTjZSXNHQ3Y7gzippZrcfHtugh0_jdDjHzVvQTX5VA1WlfGvPD9znuxXZDG8-dX__xFZdxNE7nozgio6trDLvLo3Rs9Cg9Ff5ThCx_yRC_28P24kdqdcoXvm12Xn2BpOQDPGT95W07qkIM62u7OaJRDqu8zPsPEDkv2cPTcJHbIwj6hdi0pCLnJ7QAl9QXJCGVuALMxH6eA-KUs_A5ijxRH2OmW7wXvhD0iK47nOXjrFdy2Hsei0DZ8xweFfxZXcRzimypTLW8RW9-YSwEcm6uUv7DbZREDpAK01w0X78zRfnOozj556mKBG-Qm1qBjLumbvb2Li6ab5ewcBxpnsq6FZ5FTowMfnvksYARKscpHaet4M0Tg9XW861JZ_WSG2X3TU5RbHy7O4I5lJx56cXOObhlQ6CZ6PfESOCrQPcyC5OpVjwxyyHsU7wQYKEnOXKVaR13bvlHEq4sWaOwHLIsVU-q7h178HCnw2xLttBQy-W9qfNcmHEWYRXJUE9BJ0lL1nyfD3XRWW9Ef0D83PObLnXhtAmAg0fahroPm-2lxNhDpgq86X4MCyQT82g-YTtmGvweMTBvUPQ&sai=AMfl-YTqlUz6GdZuG7LrAb8CMeOaQMPhtv-6yimxu0Rb6RO6FcmRqGg3hNAX3PwmAu5mf2EkXBxyEz741p0GCCxCSBcRBQoD87p43lqlTdjVQ7iDTiEyEwlBoI9B7cuqmf3SeALs_R26oHhYhXePFkreOaPSjIoXjeSNj34Pz_Y&sig=Cg0ArKJSzLU_5wbZoequEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=492&cbvp=1&cstd=488&cisv=r20210922.15247&adurl=

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 27 Sep 2021 05:44:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

firstevent
skydeutschland.demdex.net/ Frame 18D0
Redirect Chain

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306717467&d_campaign=26006000&d_bust=3494960417&gdpr=&gdpr_con...
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306717467&d_campaign=26006000&d_bust=3494960417&gdpr=&gdp...

42 B
967 B

37ms
37ms

Image
image/gif

54.247.138.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306717467&d_campaign=26006000&d_bust=3494960417&gdpr=&gdpr_consent=

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.247.138.82 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v018-08e636f2c.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: T7jbEe2FTQY=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v018-0ea7417ce.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: zbtA6KAiRMI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306717467&d_campaign=26006000&d_bust=3494960417&gdpr=&gdpr_consent=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 18D0 43 B
1 KB 82ms
19ms Image
image/gif 213.202.235.10
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvApi=sky-dv360&extProvId=300&extPu=sky-dv360&extLi=21213705&extPm=364525147&extCr=53131072&gdpr=&gdpr_consent=&rnd=3494960417

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

213.202.235.10 Düsseldorf, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Microsoft-IIS/8.5 / ASP.NET

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
Pragma: no-cache
X-ET-Code: 0
Last-Modified: Mo, 27 Sep 2021 05:44:56 GMT
Server: Microsoft-IIS/8.5
Date: Mon, 27 Sep 2021 05:44:55 GMT
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 923
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/ Frame 862F 36 KB
6 KB 22ms
16ms Document
text/html 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=XOo7GbFz4c&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6441798447ba251e1090a35dcee01ee8b3e9446325a4c058fabda6090a90a16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=XOo7GbFz4c&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 5616
date: Mon, 27 Sep 2021 05:44:56 GMT
expires: Tue, 28 Sep 2021 05:44:56 GMT
cache-control: public, max-age=86400
last-modified: Fri, 11 Sep 2020 18:40:52 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame DCD7 0
24 B 29ms
28ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsssI6aSxl1lJJkTdu-376pq9XbUo4I8vw753I2TcrDw8XeyaFyptyeeh9UwADfDAbTuG6auUfWmWdiJCdb2ss42LhWX4uQ8sCy_2yi_xTKwtAMatGWmKG6TytYzsqlj2xbWi-kzorMGAbXZUx0mHSv07iBvyKLiLC9DWNX8im-rAcB6IdOLyOQLFtqRaNzV7DlMhnsMQL_q7x2Zvpa4M36VxwUnq7Iumo1lqG3Vzc2Y2Za4j4R7tDsMJY1aZFPVmSYcBCxKD-TAHBvFhGgv0S41sOXx1sIwGXcMbC4a4XW6RRqFcC4lanWgpHGTfgoeMoLHBSTirdLrjM1_M6WTuMHi4-dv1-TOobMQ7_6ni00N_uJ0CtsmDPq2DTckjv6anhMAfE0BdIftirJFQK-LTFcAJ8CH6Q-yBagNijZI8MWJSrkfG1Wb0nX8sP1fmvu4pxrVQJxbsA2uB8n5T6_xsGDrTwSgskFEv-WXzlPHtc4nSGbNzB-Dokhvw5L4gdqIr9Dph_G46gi_jPXfdreyt-ya6SPJ-Pf0oqJZ_ZPpChvhbqtOggf8z73oqB_9f7WQ7JuBNSqVQnHW1N-WeCHn1IrnEO_YfwmsJrWDHvLp8w3Ba2YDazEcmFlin8R87DUn_RzsoB4H8UjrWPwa6NTDUE18Ic0Dj2cGzEDYCA0FGfUihGxxy2IbELuP0RPkVAW_mInMTvlfubxiQw6fgawK-Di0_lTk80RsbHOHC1mR6L22sh1pxVTL3wJ6iv2ujMS7CZzJGXgIhhLw7q1nSGbTI3VqFqkXBd9vml7Fv25dBwmIAV7ttH1x_L3xo_-xcB2Gyf-yN2tB1h60C6ppNVllaK880AIkW02ED02ifbZcwCRSV05lw5W50qzgqaFp8oTr-fiDYJlcaVO1S17B9FDXOMLPiJH7nOLPqi673wLTwl8RcW4Ag0bRwjcVjJOtOH_ow84Uv-BX3PQfzdS16rSq7-H0ttYpOFXdrSlQPPQUwDu4lh42f-oIkJiLufDa1cIT2IqNHNShCfj6Nwk4Uvg1uvfT1d2Rx5_oQOB-YR7DCC-2JI3SxRx36COBFqazBv8EIfpzx_KI-A7FNNptrRCnxhgzSoNjzpNOcy4vlm_Or_KE4Uai-NJOsO5Xgn-wQHHn_gxbdoM61JWfiJPf2I-q1oOefmkyrxdHfg&sai=AMfl-YS1SdeNkrd7GM0qNrmwOFhM6JWgIY8-cJziG6urcH-phVWLynYnudkqTGtYcEs4o75qLgpPh5tlCvlWvTlVVu_pOQkANyN-55kKwRDCa9zeT4N12kzWzcZuzemtCR_oQ1qUHbztSfY_DKJ8B0_1V_hCJMv_cifFOmm7YXI&sig=Cg0ArKJSzO0F_-dYXlaqEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=517&cbvp=1&cstd=513&cisv=r20210922.57588&adurl=

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 27 Sep 2021 05:44:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

firstevent
skydeutschland.demdex.net/ Frame DCD7
Redirect Chain

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306796677&d_campaign=26005997&d_bust=1999892317&gdpr=&gdpr_con...
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306796677&d_campaign=26005997&d_bust=1999892317&gdpr=&gdp...

42 B
967 B

43ms
43ms

Image
image/gif

54.247.138.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306796677&d_campaign=26005997&d_bust=1999892317&gdpr=&gdpr_consent=

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.247.138.82 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v018-0c31a9294.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 0ePRVsnAQxw=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v018-0dce05a19.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: QIY+2p5hSgs=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306796677&d_campaign=26005997&d_bust=1999892317&gdpr=&gdpr_consent=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame DCD7 43 B
1 KB 79ms
21ms Image
image/gif 213.202.235.10
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvApi=sky-dv360&extProvId=300&extPu=sky-dv360&extLi=21213704&extPm=364525325&extCr=53131065&gdpr=&gdpr_consent=&rnd=1999892317

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

213.202.235.10 Düsseldorf, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Microsoft-IIS/8.5 / ASP.NET

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
Pragma: no-cache
X-ET-Code: 0
Last-Modified: Mo, 27 Sep 2021 05:44:56 GMT
Server: Microsoft-IIS/8.5
Date: Mon, 27 Sep 2021 05:44:55 GMT
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 923
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/ Frame D44C 36 KB
6 KB 17ms
16ms Document
text/html 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=jZDqOVZ7ly&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e2718b4b437edd86140d80891cf912e88267f780c14656e84f27a38b10f48b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=jZDqOVZ7ly&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 5641
date: Mon, 27 Sep 2021 05:44:56 GMT
expires: Tue, 28 Sep 2021 05:44:56 GMT
cache-control: public, max-age=86400
last-modified: Fri, 11 Sep 2020 17:03:37 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FC4C 0
24 B 29ms
28ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvBlbHpYnL-I7Sd2DMkXAaTV6NeHeM-5ViR1_gAXB7PST22px5Zbylme0h2FDsv6F5YDNLt4jvZ0iV0SWofz3SWeN3jGM-fpmhPh4ztfdFUYbCOnrCjd6DNjuyl3rL3_NE2nqbgyZ8u7uMAfZVd_JJ6Ipi1DiWn1U_M7Menp6qkiXQJSDZBT7tIj4paPl6-UFpaT0v8Mc5Wpw--EvtUs4ZgfXWOs3adJQEpVk_WgGJtoDgklk1IAIIki17h1O1nHTA1fy94iCYlDyinjnt2rcFgqJxqIZbSHZ1I8Tg6-6pbJD8TiqC42Af1LWt2KW66zw2NwuH5Nq0K-NGA6kQZafLnWcEwcJ0DvdcS7cNP4CyOTwsToDnw5A2fNGMDOgo8r1BjAehZcGPt86T7w_Ze3vY3HF2ei-2TJZod8llqi5L3WjLSM3qQq2OGN0kVN2BTVuSpak3JOZT2WeVZjyrRTzxPb5B21Ewn5QVoHQGQ56sn0SBTvCLhwb9WL2YCLXmit3VslluvX5hg6vH96w5uGeh4hmBXpgsuiu4iQvFuQ_vBRSWsvb4kU6H3otkjY4kXoNW0i2mH0bSFUIipPG1_pxQudi8esLMzol2LqWNXwgvp2fxYhkg6Iq3AvNDg28IzjZ-kpBzltnfyGRUr8tE8UjNYKyjPToc4HtfPI1VIZJb_xRMST2_X-i8zStmY3pgXuEweHl2qahfcd8bdsq5KealjbTg27RJLa2CS5wPtQO-AaO3BSuWhUR4blQ1MqeYI6-emb_mbE4Up7nUsqMWnjmy_9F-7y_HwHdZKk2sncbPL40zFPcy4Fgchp5FFTM5YOoWuZxGXGnjPyn4DiOHjJLDtZV1xZfpoVJVeSR5eYg7CGTIN2UBzmwUIPPsfs9BP8plWQkSFJwUG8AqRCAEwjnW5283xK0cm_DhnYQqToL2fwFB_8ku8jcaQ6WFyao7-_lititDtKO-Bg1qiUqiJBI_ZG9c0xPjy1oqkmnGB7r9Sb1Hvd8KQXyvPQYz4rKP8R2KJo5XzhF6X-5KCiq4fczy1Y-23IOn_m9pOt_RnSkqDEizKqwP9Fg0pkDK0uRuazmaW5_gBB_VfJxXYDPy8VN_ELOAzKgv2DCJuAQ7fT1VBdFENqF5S6e6Uz-_FIROtU9eH6o84B2E7XFW2kvJVfrQNnDLwgEBlqNVu&sai=AMfl-YTaqNui1tUUxFufj8mE0xy9g9GtmwUBQ9dv5s8SOV-llwpZfYD9geQfzLSXuCumhQ8MLN4rBFtDN9RaywHpPwAzqGev4c7jCSYhTli-_RPEnI6nwp2Ccn3B2vzT7UDWvrxG8_VTQmtW1ot5G6EUw0ApyHImCZfydjrTdC0&sig=Cg0ArKJSzM-UOsO4X8_ZEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=541&cbvp=1&cstd=538&cisv=r20210922.91877&adurl=

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 27 Sep 2021 05:44:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame FC4C 43 B
1 KB 82ms
27ms Image
image/gif 213.202.235.10
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvApi=sky-dv360&extProvId=300&extPu=sky-dv360&extLi=21213705&extPm=364525329&extCr=53131072&gdpr=&gdpr_consent=&rnd=3276752196

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

213.202.235.10 Düsseldorf, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Microsoft-IIS/8.5 / ASP.NET

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
Pragma: no-cache
X-ET-Code: 0
Last-Modified: Mo, 27 Sep 2021 05:44:56 GMT
Server: Microsoft-IIS/8.5
Date: Mon, 27 Sep 2021 05:44:55 GMT
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 923
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

firstevent
skydeutschland.demdex.net/ Frame FC4C
Redirect Chain

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=131961474&d_placement=306717470&d_campaign=26006000&d_bust=3276752196&gdpr=&gdpr_con...
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=131961474&d_placement=306717470&d_campaign=26006000&d_bust=3276752196&gdpr=&gdp...

42 B
967 B

37ms
36ms

Image
image/gif

54.247.138.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=131961474&d_placement=306717470&d_campaign=26006000&d_bust=3276752196&gdpr=&gdpr_consent=

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.247.138.82 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v018-0d2a84df6.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: O5BJ+QDGSv0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v018-0d91241d3.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: 7p/g2llJTig=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=131961474&d_placement=306717470&d_campaign=26006000&d_bust=3276752196&gdpr=&gdpr_consent=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame 2973 110 KB
38 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61693042/20210610071319456/300x250.html?e=69&leftOffset=0&topOffset=0&c=FkncJFXFQ2&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61693042/20210610071319456/300x250.html?e=69&leftOffset=0&topOffset=0&c=FkncJFXFQ2&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 17:25:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 44396
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 17:25:00 GMT

GET
H2 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 2973 60 KB
24 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61693042/20210610071319456/300x250.html?e=69&leftOffset=0&topOffset=0&c=FkncJFXFQ2&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61693042/20210610071319456/300x250.html?e=69&leftOffset=0&topOffset=0&c=FkncJFXFQ2&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 05:44:56 GMT

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3E68 22 KB
8 KB 8ms
7ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 24 Sep 2021 11:21:20 GMT
expires: Sat, 24 Sep 2022 11:21:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 239016
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 78E2 22 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 24 Sep 2021 11:21:20 GMT
expires: Sat, 24 Sep 2022 11:21:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 239016
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame 4E8D 23 KB
9 KB 9ms
7ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/H0ZEmIz7.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8727
date: Wed, 22 Sep 2021 09:07:14 GMT
expires: Thu, 22 Sep 2022 09:07:14 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 419862
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame 2B58 23 KB
9 KB 9ms
7ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/H0ZEmIz7.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8727
date: Wed, 22 Sep 2021 09:07:14 GMT
expires: Thu, 22 Sep 2022 09:07:14 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 419862
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame 6573 23 KB
9 KB 7ms
7ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/H0ZEmIz7.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8727
date: Wed, 22 Sep 2021 09:07:14 GMT
expires: Thu, 22 Sep 2022 09:07:14 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 419862
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 07E0 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 13:20:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 145459
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 25 Sep 2022 13:20:37 GMT

GET
DATA 200
OK truncated
/ Frame 07E0 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5195960955ad6e0e20fac741149a9f79dce0b01f41ffbe56bf2d4387459d57e5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame D09F 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 13:20:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 145459
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 25 Sep 2022 13:20:37 GMT

GET
DATA 200
OK truncated
/ Frame D09F 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3ac05d8e5fe0a9bc750d13d557452ba5b8caa5373bdbccb17f3a08a8dbbaccfe

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame DCD7 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 13:20:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 145459
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 25 Sep 2022 13:20:37 GMT

GET
DATA 200
OK truncated
/ Frame DCD7 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 02ef8d6344525fdb503f8ae76e95a4d9351e2cb34dfd02b325b34eaa5e941366

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 18D0 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 13:20:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 145459
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 25 Sep 2022 13:20:37 GMT

GET
DATA 200
OK truncated
/ Frame 18D0 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 77f27349a18440f39e3b1113fe0c0b7c3fd676f54d2dd74a7f79c3eae596a741

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FC4C 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 13:20:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 145459
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 25 Sep 2022 13:20:37 GMT

GET
DATA 200
OK truncated
/ Frame FC4C 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2e11baa606cc78d219a4621f357c918e6e161b6f3b813fe51b74b6ce265efd4b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/ Frame 37FB 36 KB
6 KB 15ms
14ms Document
text/html 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=5en7iClDNd&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6441798447ba251e1090a35dcee01ee8b3e9446325a4c058fabda6090a90a16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=5en7iClDNd&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 5616
date: Mon, 27 Sep 2021 05:44:56 GMT
expires: Tue, 28 Sep 2021 05:44:56 GMT
cache-control: public, max-age=86400
last-modified: Fri, 11 Sep 2020 18:40:52 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0B19 0
24 B 29ms
29ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuwUyozj1GzfPgduRA-CiaDKwD6jDg8fJ3pBIBdkfhlPFeyS4JxRUW5T5ZoqsKtDjI1h7-NEVGUl5OEXsDPb1tuycDEGeo1JyfSKBXJn0TXMg96nQSADbSNZdO1SpJCZTHlWPnElafwtG5xJqCTwcgbZtqqN9_l788hfnldD2ilYt66swNgEZzPR7kYsFo3dNRRmn3IWe0Qgbs0qoz3MyyeBAWjIsiYj6rhA8tU1ntw9KWS21HNYBnwBVhZ5RPSG864EZ4X4_EkMCpuMbfulNE99t_my2NjuejHv6Mu2gZN4y1ABDKxk9CTx5yHd-7wU5UNClw0Mdz1Yg9qJiMmFcOeZ6wjD7ZlQdDXK-fc5aOOAGyXCY1pKP2EWhs7zhdMix0cFY18qX2QQUEgN-QIT6Cbd-DoDjg9yCVwpzCPyRW1Pno5mUQflF0UnkffFTv9_vYLckFKHzI_2NCUUrzULTeeuTMpiKTeg3nObLZoCq8ILU7RFvKP6ES94N9lraWtUkbmb0r7nuMs_l0AywXPYIvbGJ0VZwHgaeo_MyZ-b3Wsxa3pp9fHQvbUh2YtfJ_QpSc7HrtIelOaZ3Px7IerNk76ouICZCtqIaFV80bRkYuuP2o2pVP90D140FHEl0j4bx6up-udW7ZtCitlJECLjalzyX_RBy-9Cz5qN2PD9aE9JNW_9-JNkm6oAdN1ZM_g6Mdn_CHEMWLVw2wsjuoIvZyiFk9PWmXrAWUhlAz7VqqeD3vqc67cvlewZX20LJzDRqkZgIQfrYLc5kwOaku_qtffiFnUvJmKFTZ7ORqZGyMcu7JdyMShoqWSNKQkMwMO4etq2cHM5U0HVCgewxvX_R04eyF0oCtgAA7A8MPUjaWPZBrTQ3AtQ8rpRcCW1V118wBElsfh3vdvJDdze5bip9i1yZa3SXbxYilq-OOdq2_VmLfJhXwzmqF1x5TRhdSjBjHOP-XVI4gnLLWTKrhRJLtEVaOqd3ZyCISmqqh-IPeLr7L7UjN3Ge0Gkz1IjtSbOKui9IiK7fy2uEahZ7U2aIyko3iAaFmm9YV853QdPZizxzWhYFc6rrIV9VDbAxBIAn46UEcI7p8YbeqalDH6EF--kU7XXGLNI7BwzllTOh5mOT87xx2BUZnnQwV2uNEfBQfNZ7mhxlsfhkb0NthV8d8Xz-Sphi8OJfk&sai=AMfl-YTw-nxZ2p6NQ3RTI7yGKH11mKiGsjaqbneCjCaYz2Z3UXHhiuGmiu7kc_Qdc3yGxu-iIouaZMC3tYr1gYnZl7v9iAHPfeFZHihL1q2mhSEbJxIKiX42PsMCB1ocfqzC3N2IUtctp4YiyWvv3XEES3OprnCKXGvA2hGwG9I&sig=Cg0ArKJSzIHCUpUEHAC9EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=237&cbvp=1&cstd=234&cisv=r20210922.77819&adurl=

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 27 Sep 2021 05:44:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 0B19 43 B
946 B 76ms
42ms Image
image/gif 213.202.235.10
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvApi=sky-dv360&extProvId=300&extPu=sky-dv360&extLi=21213705&extPm=364525147&extCr=14744098213&gdpr=&gdpr_consent=&rnd=2352617156

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

213.202.235.10 Düsseldorf, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Microsoft-IIS/8.5 / ASP.NET

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
Pragma: no-cache
X-ET-Code: 0
Last-Modified: Mo, 27 Sep 2021 05:44:56 GMT
Server: Microsoft-IIS/8.5
Date: Mon, 27 Sep 2021 05:44:55 GMT
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 923
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

firstevent
skydeutschland.demdex.net/ Frame 0B19
Redirect Chain

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306717467&d_campaign=26006000&d_bust=2352617156&gdpr=&gdpr_con...
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306717467&d_campaign=26006000&d_bust=2352617156&gdpr=&gdp...

42 B
967 B

40ms
39ms

Image
image/gif

54.247.138.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.247.138.82 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v018-0b2a1d0a1.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 1dh44HaiQSs=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v018-0231ac4a8.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: 7jX3nuipRyg=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=306717467&d_campaign=26006000&d_bust=2352617156&gdpr=&gdpr_consent=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 300x250.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61886595/20210825081323865/ Frame BFB4 26 KB
9 KB 20ms
19ms Document
text/html 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61886595/20210825081323865/300x250.html?e=69&leftOffset=0&topOffset=0&c=Mmo8apYL6P&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ceda431c98f0680ee13307f3aeca312fd4e0658fe7d75a15db7612bac5122630

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61886595/20210825081323865/300x250.html?e=69&leftOffset=0&topOffset=0&c=Mmo8apYL6P&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 8703
date: Mon, 27 Sep 2021 05:44:56 GMT
expires: Tue, 28 Sep 2021 05:44:56 GMT
cache-control: public, max-age=86400
last-modified: Wed, 25 Aug 2021 15:13:23 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame E451 0
24 B 22ms
22ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss_SB-ztwGUbZF4hT_dvCqJqjwyygwg3nKX2iJH2k4toi2Jki15cO3uPLlIbCgrfkGV3t8SA0R9xrakbt4WOjtuR0q5GdXN8KJGR7reVe1MeKN83Pbpzl0q5J74NjxZglg4F-p0gE7tjqnYQuDQs2n4kIRNx2FVqO7gsnWgriFbF25xKQ82RBTApH73Vs96TmlLTDsomsSzp8L_XRzfbyzMDITQZW4sxdO7L9Yg24py7zhWgCu27YNfoDAUA8GtGLkeQn5vLNSiNcweHK1jGmjoYi1wI89GN3ZaYE3XNuHxiQbtMYxidM1u8n9tLUzZJktRdIMae61NUcNcfBox1nXMD4gK7E63iSXuoK_VgKUYAy2NPBKqz8o62Pl3MAFfqPit5etru6sNirIECKm--jw3FrGBCVfFPEuLiXUGnkARQgZgc_HHxYiddsHHnT0eVwRRYOxOeRhvINd5rbwJmcGg0nZjboz8DV3rlDieN5nmGNrLWAFtayrSVFvl1HZnWAw-EsTZ9jd_8T2S4ORHYujwLrjJoA2O_DLWDwMMEktAFugzHrNGnwlJcQC07GCSKs7jp79bYR5ggl-gEpw4ONmLA95zstrPPClka4LIXIrvJ0zNLPOqwuw-dkBB94oI3WjF8bstWNSSOCRYn1P3A7hRbQ2nkKxurr9qt5Kgg_mb3Y0tBgvGPWY2D_Tr1mr3A0Xe_cpYMVTLITfzfY9UlxSN1qg4Fmh3ebt-AsCHg0UWQhGCsIUUGVlfjr1GZBIY_K3i1HVKXWKDpsnlfSTDIFIi-Zvlr7GYIopVscP0lVdYsz7BSuduwL0MWq5i6H79Kiy_udCj_fD0CEMql8l-w_-2zfesD2MiKRKw2uO5ObhE0A2pMdF5oTUQ3Tv2rsNPjr8udzmMPDqDOapJjLRtnI2-5vXfMIDjImwnsHJrsXjFhQxp1cB72Uj_wZqthFd-ze8kMuBzO2ULVOI6T_tittA4zYCVS-dzKLnQLzXmN7Nk2J2zohIWJVlXWqcwFAAuPxPV1yBtsRHC348akx5xSX23FOyZ977qngYtRI9D9DGNYFwyAE-BDJ66ItCjXkIbPuyTPJq_4qlX4H-pZWm9FDJLS9WWzUCQpp3YB97YKOj_2NHXGLCzEG-7LZOxToB7Ua2Yb4b8Yw_CDu781nWwY2McpP-teGg&sai=AMfl-YRKI6XKJubXtKKabo7GS477KT8aTKCmsU2R5mtCqbDOVr6E53YW8cUUv2hguWDLBquMnicWBAPKbXGwZ83p1skfm60ELu79Z3e7HTJbPrkMPg0W2hKOK8igBN5eFijUl9bPciox_pf833cqG8gu5UR09OdqKhC9XeurWZs&sig=Cg0ArKJSzA_hjMQDkgpZEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=238&cbvp=1&cstd=235&cisv=r20210922.63623&adurl=

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 27 Sep 2021 05:44:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 Standard Show response
s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.209/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/ImageTag:types/ Frame 15D1 85 KB
36 KB 19ms
16ms Script
text/javascript 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.209/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/ImageTag:types/Standard
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: ae8a9ee03c283c1394c0996cc74bf700a20e086bc816154f0f2a88c5bf7127d3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: gzip
last-modified: Mon, 30 Aug 2021 07:04:15 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Tue, 28 Sep 2021 08:54:39 GMT

GET
DATA 200
OK truncated
/ Frame BB3C 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: de0b54d3abbe11efdb1ed2d1e0801149707cbaddb709dab03e8d37bf5520aae2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK mz3e4ljusno6 Show response
hal9000.redintelligence.net/zone/ Frame 3612 11 KB
4 KB 59ms
12ms Script
text/html 138.201.63.117
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/mz3e4ljusno6?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsoVLVlpRYf7tGc_ngQeyvJjoD4_g-IZT3bWLpMoM99KivcABEAEggdWcJGCVgoCAsAfIAQmpAqia_ovzqbM-qAMBqgTXAU_QaK_xHQe489oyccVTgGOa5yroVSWEYNmq9XAN5LlQQFNE_ZTOz5HXACeps5iHRP6llApqKy-cfSHcwQoF7j-IZhbRodpDp2BWv4CBQGwJ5l0ajFHBuGPblechlkqcprgfE2YAqh4eszr6FWMiBDOfEMG5PWIiclOlbiCD6G0LV9KS-Z6r644m91NvTS04RblSjR3aGyiCEdzPWwk2UD8EOUiwURQDVXFpE_qNaAqjCjGFqRomeMvqdUyAhMouxR5OM_RYYzmuCUUPf82npcJHB8f2FNewwAS78ajAzwHgBAOQBgGgBk2AB-vn6F6oB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoLqUYfwHBZ1q4hhlS4MjKyHRLjA%26sig%3DAOD64_3nVg9Z3CQCbtK2bmCb71DEuGSRoQ%26client%3Dca-pub-9252416192348979%26dbm_c%3DAKAmf-Cjh-rPkja75vtBqNY-lLTgSno66ImKtYcMXByxwINNJT9ygTkZFEVvuKqnIJZkzxtSbKeAFknGLTExxEb8UsAzwNNev5H9UdgfEJG03sQ881BmU3_uD8VXYeK20sL0VaapBj4Bazx4uQFZW0YPnOJX4O-ztA%26cry%3D1%26dbm_d%3DAKAmf-Aq_UGeMyQ-KU3XhJxwKkYC_0DrTiW2PDh-NK7bEdx2EkNgOC1uwoP-graVvysNg0MXUITe-Upq0ticT6NurZWvd8OtLciMypH1HgJ5QFVpqcc5_vNr4UwGkHWj6mN4Hak5--U5DBu2-Vt8mKCpz7yWEuCiOx2Y_rBw6RWDrSzALmLuYp94-F0tIPikvlmCQvPasXohFhqUNxsDfhXeLA9Ssrek5QHCNTvwAa6FuwHUV6AlS_gX7mqc4ZDKTvhk0qFAm-SZASX2AijgpR_-zSpmDlI8IfA0VqTJOwDXf0FoRdlUCsmjsMrP2Y94-mkkT0cixPxUmFZlkt0mLcaZut7B3L8d-HrJGl8xIhN7pV90t-tmyFpUIWSwHZy8_ZgQlVoo7ZAYFjRZUqsjvDWLy-294id7g9XRjS-Y4x1646z3IoOAznec18rxT3cRRDMLOxiPr80Z%26adurl%3D
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.117 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.117.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a741d03d8a731bb214b3a7676d87d94b4b80e566886d97b64341b74f7a7190e1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Mon, 27 Sep 2021 05:44:56 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3883
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 206
Partial Content file.mp4
r3---sn-4g5ednd7.c.2mdn.net/videoplayback/id/674ae099102b2807/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3773920563/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame C3D5 878 KB
879 KB 322ms
7ms Media
video/mp4 2a00:1450:4001:16::8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:16::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

da4961bbff4814e3705a57e129bc2c0c2b567e462f758efc59fa04f4b6811976

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Range: bytes=0-

Response headers

Date: Mon, 27 Sep 2021 05:44:56 GMT
X-Content-Type-Options: nosniff
Content-Range: bytes 0-898943/898944
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 898944
Last-Modified: Fri, 20 Aug 2021 15:14:18 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Expires: Mon, 27 Sep 2021 05:44:56 GMT

GET
DATA 200
OK truncated
/ Frame 15D1 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a007050c7014c1bb5c5b3f8129e06bdc81de35ef8a34a7c598cc4fdebffadc3d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame E91C 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 24 Sep 2021 11:21:20 GMT
expires: Sat, 24 Sep 2022 11:21:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 239016
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 /
track.adform.net/csimpr/ Frame BB3C 35 B
503 B 21ms
20ms Ping
image/gif 37.157.4.41
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/csimpr/?bn=46470475&csi=JIKT37QGlXFNhiP4oxX0FnMUK3cpWsTiccQxSXeI7XDrygPkIxxfk4fao0CuKR6idcAwv4GerurIv5HB7suEMWQBbo50IEXs0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.41 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 200 45502510.png
s1.adform.net/Banners/45502510/ Frame BB3C 82 KB
82 KB 17ms
17ms Image
image/png 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/45502510/45502510.png?bv=2

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

5589d0b5a24e6a73d4e551ec9b9d932dde45d3c1399417a85e4c94e0aa71ac60

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:56 GMT
last-modified: Thu, 27 May 2021 10:40:42 GMT
server: nginx
etag: "60af772a-146c4"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 83652

GET
H2 200 main.css
s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/css/ Frame C854 4 KB
2 KB 8ms
7ms Stylesheet
text/css 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/css/main.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/js/pre.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a2170bee8a433cb663085e6d7829282ac4049d6be902e1d53260290de3f6ca9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:42:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 165
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1479
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:43:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 27 Sep 2022 05:42:11 GMT

GET
H2 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame C854 60 KB
24 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/js/pre.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 05:44:56 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C63C 0
23 B 17ms
17ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 05:44:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7A50 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 24 Sep 2021 11:21:20 GMT
expires: Sat, 24 Sep 2022 11:21:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 239016
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 206
Partial Content file.mp4
r5---sn-4g5ednsy.c.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 6985 869 KB
870 KB 324ms
8ms Media
video/mp4 2a00:1450:4001::a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001::a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

8222c0abfdeba53481fa3b2d61887bd1bfee871ba0deb41482d48f78bfe1cdea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Range: bytes=0-

Response headers

Date: Mon, 27 Sep 2021 05:44:56 GMT
X-Content-Type-Options: nosniff
Content-Range: bytes 0-890171/890172
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 890172
Last-Modified: Fri, 20 Aug 2021 15:16:32 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Expires: Mon, 27 Sep 2021 05:44:56 GMT

GET
H/1.1 206
Partial Content file.mp4
r5---sn-4g5ednsy.c.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 301D 869 KB
870 KB 322ms
7ms Media
video/mp4 2a00:1450:4001::a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r5---sn-4g5ednsy.c.2mdn.net/videoplayback/id/59fb236b121f21b7/itag/343/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1664257495/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/658F8C14CCB805ABD0DC57366E41A95A91569AE9.2C8DDF81699AC10C38DE2B43855DEC8EC73D5E8E/key/cms1/cms_redirect/yes/mh/ZC/mip/2a0f:9441:5:0:e4::1/mm/42/mn/sn-4g5ednsy/ms/onc/mt/1632720891/mv/u/mvi/1/pl/48/ir/1/rr/12/file/file.mp4

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001::a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

8222c0abfdeba53481fa3b2d61887bd1bfee871ba0deb41482d48f78bfe1cdea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Range: bytes=0-

Response headers

Date: Mon, 27 Sep 2021 05:44:56 GMT
X-Content-Type-Options: nosniff
Content-Range: bytes 0-890171/890172
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 890172
Last-Modified: Fri, 20 Aug 2021 15:16:32 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
Expires: Mon, 27 Sep 2021 05:44:56 GMT

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 712F 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 24 Sep 2021 11:21:20 GMT
expires: Sat, 24 Sep 2022 11:21:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 239016
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame D8A8 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 24 Sep 2021 11:21:20 GMT
expires: Sat, 24 Sep 2022 11:21:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 239016
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 673D 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 24 Sep 2021 11:21:20 GMT
expires: Sat, 24 Sep 2022 11:21:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 239016
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame CFA1 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 24 Sep 2021 11:21:20 GMT
expires: Sat, 24 Sep 2022 11:21:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 239016
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 0B19 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 13:20:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 145459
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 25 Sep 2022 13:20:37 GMT

GET
DATA 200
OK truncated
/ Frame 0B19 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c319bdb131d1dbb8db8da078f5b3aa209e4b8a33cb2cf0a50320075a96a64341

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E451 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 25 Sep 2021 13:20:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 145459
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 25 Sep 2022 13:20:37 GMT

GET
DATA 200
OK truncated
/ Frame E451 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 900b981b53a61f537232e8b7b0aa9810d261a187259f02a5b63b8d8a95d7aa22

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame D09F 0
23 B 17ms
17ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 05:44:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 07E0 0
23 B 17ms
17ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 05:44:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 main.css
s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/css/ Frame 5822 4 KB
2 KB 7ms
7ms Stylesheet
text/css 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/css/main.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/js/pre.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

abbe6ef7758de9bb497995416167a14b08fb4dbc9f178176824abf4bc3e9201a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 13:16:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 404891
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1491
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:45:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 22 Sep 2022 13:16:45 GMT

GET
H2 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 5822 60 KB
24 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/js/pre.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 05:44:56 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame BE53 0
23 B 18ms
18ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 05:44:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 burst_sprite.png
s0.2mdn.net/creatives/assets/4265994/ Frame BFB4 611 KB
612 KB 7ms
6ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/creatives/assets/4265994/burst_sprite.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886595/20210825081323865/300x250.html?e=69&leftOffset=0&topOffset=0&c=Mmo8apYL6P&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d61fc26a3bd592f513df1a0a3a890c1815a1c443e04367c507118b6444d67c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886595/20210825081323865/300x250.html?e=69&leftOffset=0&topOffset=0&c=Mmo8apYL6P&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:39:33 GMT
x-content-type-options: nosniff
age: 323
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 626083
x-xss-protection: 0
last-modified: Wed, 25 Aug 2021 09:11:05 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 05:54:33 GMT

GET
H2 200 burst_bg.png
s0.2mdn.net/creatives/assets/4265994/ Frame BFB4 16 KB
16 KB 9ms
9ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/creatives/assets/4265994/burst_bg.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886595/20210825081323865/300x250.html?e=69&leftOffset=0&topOffset=0&c=Mmo8apYL6P&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

611a43a6eacca4472e3255af142a12dee9632e30b1da8d7d773f4a9dfe758ebf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886595/20210825081323865/300x250.html?e=69&leftOffset=0&topOffset=0&c=Mmo8apYL6P&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:36:12 GMT
x-content-type-options: nosniff
last-modified: Wed, 18 Aug 2021 08:17:43 GMT
server: sffe
age: 524
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16503
x-xss-protection: 0
expires: Mon, 27 Sep 2021 05:51:12 GMT

GET
H2 200 burst_hl_01.png
s0.2mdn.net/creatives/assets/4265994/ Frame BFB4 4 KB
4 KB 7ms
6ms Image
image/png 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/creatives/assets/4265994/burst_hl_01.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886595/20210825081323865/300x250.html?e=69&leftOffset=0&topOffset=0&c=Mmo8apYL6P&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

49fd28980e7b8f554dae61f682b50648abad4e767a0c0037d3b158115011f032

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886595/20210825081323865/300x250.html?e=69&leftOffset=0&topOffset=0&c=Mmo8apYL6P&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:36:12 GMT
x-content-type-options: nosniff
last-modified: Wed, 18 Aug 2021 08:17:46 GMT
server: sffe
age: 524
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3723
x-xss-protection: 0
expires: Mon, 27 Sep 2021 05:51:12 GMT

GET
H2 200 style.css
s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/ Frame D44C 6 KB
2 KB 16ms
15ms Stylesheet
text/css 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=jZDqOVZ7ly&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97f6f81b224c70cf2431f07287d287446129697370b4419a9b82838be0ea0174

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=jZDqOVZ7ly&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 08:20:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 77037
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1656
x-xss-protection: 0
last-modified: Fri, 11 Sep 2020 17:03:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 08:20:59 GMT

GET
H2 200 Enabler_01_244.js Show response
s0.2mdn.net/879366/ Frame D44C 109 KB
37 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_244.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=jZDqOVZ7ly&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7052ee7e4fa3d19fa953957b23d6cd29b2311739ec0932d6e570577d19f2503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=jZDqOVZ7ly&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 16:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48084
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38072
x-xss-protection: 0
last-modified: Tue, 07 Jul 2020 18:35:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 16:23:32 GMT

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.4.2/ Frame D44C 59 KB
21 KB 249ms
27ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.4.2/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61460724/20200911100337694/index.html?e=69&leftOffset=0&topOffset=0&c=jZDqOVZ7ly&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3c5ff7e114ffe32212ee07123f9dc6aa19c09072e44fe64649c9cc747040cab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 213792
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 21678
timing-allow-origin: *
last-modified: Tue, 21 Jul 2020 23:12:03 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f177643-eca3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GMeLcdYBrdlNg30VA8rIAj0O%2FVFGJ8MGO9oYWhYZGkFHV8yOPklYiYlxNnqLku5%2FcarsOi6WaXFruDtuWphBgr3Ou3pPi5YKDkpcuZhC57GhRKEkjNKLVjz%2FMRx%2BNkusD2vvK6%2ByhOabmSrmDDCZs4kV"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69526c4ab896699f-FRA
expires: Sat, 17 Sep 2022 05:44:56 GMT

GET
H2 200 style.css
s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/ Frame 326E 6 KB
2 KB 15ms
14ms Stylesheet
text/css 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=kSlaqDT6dk&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2392bb69de9eb1e9efad1da54204d43b70c52e5b6004b053d1e645fac906ac3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=kSlaqDT6dk&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 07:15:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80965
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1741
x-xss-protection: 0
last-modified: Fri, 11 Sep 2020 18:40:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 07:15:31 GMT

GET
H2 200 Enabler_01_244.js Show response
s0.2mdn.net/879366/ Frame 326E 109 KB
37 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_244.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=kSlaqDT6dk&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7052ee7e4fa3d19fa953957b23d6cd29b2311739ec0932d6e570577d19f2503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=kSlaqDT6dk&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 16:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48084
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38072
x-xss-protection: 0
last-modified: Tue, 07 Jul 2020 18:35:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 16:23:32 GMT

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.4.2/ Frame 326E 59 KB
22 KB 235ms
14ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.4.2/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=kSlaqDT6dk&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3c5ff7e114ffe32212ee07123f9dc6aa19c09072e44fe64649c9cc747040cab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 213792
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 21678
timing-allow-origin: *
last-modified: Tue, 21 Jul 2020 23:12:03 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f177643-eca3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nhEcK%2FQ%2ByxblPOOXC5rIitiBgDyh3tXOaQfp0ftgreQ%2FiFNTzJAWMoHRXFjkANlr6mNkJ4GFRY35mgX8ikA2hNaXKRix%2FPsVTPrnl62CN%2FCQTriCqw%2B5W9SE43yb9Q9HCv2GfpSMt1bU5c5bPLwiaCOy"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69526c4ab89a699f-FRA
expires: Sat, 17 Sep 2022 05:44:56 GMT

POST
H2 200 /
track.adform.net/csimpr/ Frame 15D1 35 B
494 B 19ms
19ms Ping
image/gif 37.157.4.41
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/csimpr/?bn=45192706&csi=C1jS-NBs7pWRqgZLShL-yVlhqMBBvKig6_P6oKPUI4wJDwKV3Zer3Ifao0CuKR6i-50O82UI2-oT_Q2V0dt082QBbo50IEXs0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.41 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 05:44:56 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 200 44372182.png
s1.adform.net/Banners/44372182/ Frame 15D1 23 KB
23 KB 17ms
17ms Image
image/png 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/44372182/44372182.png?bv=2

Requested by

Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

9b0638f676337b2a5ec4452d165731e46e37c4bfba07285803c25dff5325ba54

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:56 GMT
last-modified: Wed, 07 Apr 2021 07:09:22 GMT
server: nginx
etag: "606d5aa2-5be9"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 23529

GET
H/1.1

200
OK

request.php Show response
hal90001.redintelligence.net/ Frame 3612
Redirect Chain

https://hal90001.redintelligence.net/request.php?zone=mz3e4ljusno6&nw=20&renderingType=javascript&namespace=9b2ef5839a&subid=&uid=e6e8f55901ab4720&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90001.redintelligence.net/request.php?zone=mz3e4ljusno6&nw=20&renderingType=javascript&namespace=9b2ef5839a&subid=&uid=e6e8f55901ab4720&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

2 KB
1 KB

110ms
82ms

Script
application/x-javascript

46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90001.redintelligence.net/request.php?zone=mz3e4ljusno6&nw=20&renderingType=javascript&namespace=9b2ef5839a&subid=&uid=e6e8f55901ab4720&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsoVLVlpRYf7tGc_ngQeyvJjoD4_g-IZT3bWLpMoM99KivcABEAEggdWcJGCVgoCAsAfIAQmpAqia_ovzqbM-qAMBqgTXAU_QaK_xHQe489oyccVTgGOa5yroVSWEYNmq9XAN5LlQQFNE_ZTOz5HXACeps5iHRP6llApqKy-cfSHcwQoF7j-IZhbRodpDp2BWv4CBQGwJ5l0ajFHBuGPblechlkqcprgfE2YAqh4eszr6FWMiBDOfEMG5PWIiclOlbiCD6G0LV9KS-Z6r644m91NvTS04RblSjR3aGyiCEdzPWwk2UD8EOUiwURQDVXFpE_qNaAqjCjGFqRomeMvqdUyAhMouxR5OM_RYYzmuCUUPf82npcJHB8f2FNewwAS78ajAzwHgBAOQBgGgBk2AB-vn6F6oB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoLqUYfwHBZ1q4hhlS4MjKyHRLjA%26sig%3DAOD64_3nVg9Z3CQCbtK2bmCb71DEuGSRoQ%26client%3Dca-pub-9252416192348979%26dbm_c%3DAKAmf-Cjh-rPkja75vtBqNY-lLTgSno66ImKtYcMXByxwINNJT9ygTkZFEVvuKqnIJZkzxtSbKeAFknGLTExxEb8UsAzwNNev5H9UdgfEJG03sQ881BmU3_uD8VXYeK20sL0VaapBj4Bazx4uQFZW0YPnOJX4O-ztA%26cry%3D1%26dbm_d%3DAKAmf-Aq_UGeMyQ-KU3XhJxwKkYC_0DrTiW2PDh-NK7bEdx2EkNgOC1uwoP-graVvysNg0MXUITe-Upq0ticT6NurZWvd8OtLciMypH1HgJ5QFVpqcc5_vNr4UwGkHWj6mN4Hak5--U5DBu2-Vt8mKCpz7yWEuCiOx2Y_rBw6RWDrSzALmLuYp94-F0tIPikvlmCQvPasXohFhqUNxsDfhXeLA9Ssrek5QHCNTvwAa6FuwHUV6AlS_gX7mqc4ZDKTvhk0qFAm-SZASX2AijgpR_-zSpmDlI8IfA0VqTJOwDXf0FoRdlUCsmjsMrP2Y94-mkkT0cixPxUmFZlkt0mLcaZut7B3L8d-HrJGl8xIhN7pV90t-tmyFpUIWSwHZy8_ZgQlVoo7ZAYFjRZUqsjvDWLy-294id7g9XRjS-Y4x1646z3IoOAznec18rxT3cRRDMLOxiPr80Z%26adurl%3D&documentReferer=https%3A%2F%2Ftravel.blogmura.com%2F&ancestorOrigins=https%3A%2F%2Ftravel.blogmura.com&random=3589232508605&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com
URL: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 5213bcbdf609bf4b0cde8f27012633416493ab95edba8e3094c02a277e9a65b0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:56 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 13907100037705501084668011730001
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 893
Expires: Mon, 27 Sep 2021 06:44:56 +0200

Redirect headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 05:44:56 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=mz3e4ljusno6&nw=20&renderingType=javascript&namespace=9b2ef5839a&subid=&uid=e6e8f55901ab4720&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsoVLVlpRYf7tGc_ngQeyvJjoD4_g-IZT3bWLpMoM99KivcABEAEggdWcJGCVgoCAsAfIAQmpAqia_ovzqbM-qAMBqgTXAU_QaK_xHQe489oyccVTgGOa5yroVSWEYNmq9XAN5LlQQFNE_ZTOz5HXACeps5iHRP6llApqKy-cfSHcwQoF7j-IZhbRodpDp2BWv4CBQGwJ5l0ajFHBuGPblechlkqcprgfE2YAqh4eszr6FWMiBDOfEMG5PWIiclOlbiCD6G0LV9KS-Z6r644m91NvTS04RblSjR3aGyiCEdzPWwk2UD8EOUiwURQDVXFpE_qNaAqjCjGFqRomeMvqdUyAhMouxR5OM_RYYzmuCUUPf82npcJHB8f2FNewwAS78ajAzwHgBAOQBgGgBk2AB-vn6F6oB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoLqUYfwHBZ1q4hhlS4MjKyHRLjA%26sig%3DAOD64_3nVg9Z3CQCbtK2bmCb71DEuGSRoQ%26client%3Dca-pub-9252416192348979%26dbm_c%3DAKAmf-Cjh-rPkja75vtBqNY-lLTgSno66ImKtYcMXByxwINNJT9ygTkZFEVvuKqnIJZkzxtSbKeAFknGLTExxEb8UsAzwNNev5H9UdgfEJG03sQ881BmU3_uD8VXYeK20sL0VaapBj4Bazx4uQFZW0YPnOJX4O-ztA%26cry%3D1%26dbm_d%3DAKAmf-Aq_UGeMyQ-KU3XhJxwKkYC_0DrTiW2PDh-NK7bEdx2EkNgOC1uwoP-graVvysNg0MXUITe-Upq0ticT6NurZWvd8OtLciMypH1HgJ5QFVpqcc5_vNr4UwGkHWj6mN4Hak5--U5DBu2-Vt8mKCpz7yWEuCiOx2Y_rBw6RWDrSzALmLuYp94-F0tIPikvlmCQvPasXohFhqUNxsDfhXeLA9Ssrek5QHCNTvwAa6FuwHUV6AlS_gX7mqc4ZDKTvhk0qFAm-SZASX2AijgpR_-zSpmDlI8IfA0VqTJOwDXf0FoRdlUCsmjsMrP2Y94-mkkT0cixPxUmFZlkt0mLcaZut7B3L8d-HrJGl8xIhN7pV90t-tmyFpUIWSwHZy8_ZgQlVoo7ZAYFjRZUqsjvDWLy-294id7g9XRjS-Y4x1646z3IoOAznec18rxT3cRRDMLOxiPr80Z%26adurl%3D&documentReferer=https%3A%2F%2Ftravel.blogmura.com%2F&ancestorOrigins=https%3A%2F%2Ftravel.blogmura.com&random=3589232508605&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Mon, 27 Sep 2021 06:44:56 +0200

GET
H2 200 style.css
s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/ Frame 862F 6 KB
2 KB 13ms
11ms Stylesheet
text/css 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=XOo7GbFz4c&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2392bb69de9eb1e9efad1da54204d43b70c52e5b6004b053d1e645fac906ac3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=XOo7GbFz4c&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 07:15:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80965
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1741
x-xss-protection: 0
last-modified: Fri, 11 Sep 2020 18:40:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 07:15:31 GMT

GET
H2 200 Enabler_01_244.js Show response
s0.2mdn.net/879366/ Frame 862F 109 KB
37 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_244.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=XOo7GbFz4c&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7052ee7e4fa3d19fa953957b23d6cd29b2311739ec0932d6e570577d19f2503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=XOo7GbFz4c&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 16:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48084
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38072
x-xss-protection: 0
last-modified: Tue, 07 Jul 2020 18:35:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 16:23:32 GMT

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.4.2/ Frame 862F 59 KB
21 KB 241ms
25ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.4.2/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=XOo7GbFz4c&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3c5ff7e114ffe32212ee07123f9dc6aa19c09072e44fe64649c9cc747040cab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 213792
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 21678
timing-allow-origin: *
last-modified: Tue, 21 Jul 2020 23:12:03 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f177643-eca3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=10ChfLPA4IeL5VjDOaOnq1GgRGNumD5NsUV5Yg1BmyrcW2JlvAalpjfvdnjARG4OdvTXHDvd0%2FpvtBq510wHJnKan2o%2FRdK1CDFWzdnAoLzAwdigNMa4%2B6lOFX77XBkqxHoQWgLV%2FjTPzPbAOoL4CtAB"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69526c4ab89c699f-FRA
expires: Sat, 17 Sep 2022 05:44:56 GMT

GET
H2 200 style.css
s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/ Frame 37FB 6 KB
2 KB 7ms
6ms Stylesheet
text/css 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=5en7iClDNd&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2392bb69de9eb1e9efad1da54204d43b70c52e5b6004b053d1e645fac906ac3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=5en7iClDNd&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 07:15:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80965
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1741
x-xss-protection: 0
last-modified: Fri, 11 Sep 2020 18:40:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 07:15:31 GMT

GET
H2 200 Enabler_01_244.js Show response
s0.2mdn.net/879366/ Frame 37FB 109 KB
37 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_244.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=5en7iClDNd&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7052ee7e4fa3d19fa953957b23d6cd29b2311739ec0932d6e570577d19f2503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=5en7iClDNd&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 16:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48084
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38072
x-xss-protection: 0
last-modified: Tue, 07 Jul 2020 18:35:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 16:23:32 GMT

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.4.2/ Frame 37FB 59 KB
21 KB 177ms
20ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.4.2/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61453748/20200911114052183/index.html?e=69&leftOffset=0&topOffset=0&c=5en7iClDNd&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3c5ff7e114ffe32212ee07123f9dc6aa19c09072e44fe64649c9cc747040cab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 213792
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 21678
timing-allow-origin: *
last-modified: Tue, 21 Jul 2020 23:12:03 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f177643-eca3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B08tE%2Bcq4E9Q57I%2B85yXI3Xd%2BvRYcWJmMEbYHOEEVwNqWiK7iBressCXLYYv%2Fx%2BisswVepTGL63YxooahIn8t06vhGSyMImbMOdLLLolw7DG3pp2TUfbV1PFDqWfU2U2cziXT552GFXsMDTOLHNYIxaJ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69526c4ab89f699f-FRA
expires: Sat, 17 Sep 2022 05:44:56 GMT

GET
H2 200 Enabler_01_246.js Show response
s0.2mdn.net/879366/ Frame BFB4 116 KB
39 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_246.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886595/20210825081323865/300x250.html?e=69&leftOffset=0&topOffset=0&c=Mmo8apYL6P&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b64291fc91dc77833930ffcead244193c5cfd9e882af312ecc89b580160c22a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886595/20210825081323865/300x250.html?e=69&leftOffset=0&topOffset=0&c=Mmo8apYL6P&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 15:57:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49633
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40237
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 15:57:43 GMT

GET
H2 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame BFB4 60 KB
24 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886595/20210825081323865/300x250.html?e=69&leftOffset=0&topOffset=0&c=Mmo8apYL6P&t=1&renderingType=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61886595/20210825081323865/300x250.html?e=69&leftOffset=0&topOffset=0&c=Mmo8apYL6P&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 05:44:56 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame DCA0 6 KB
4 KB 38ms
18ms XHR
application/json 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_246&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_246.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

058ca5f943b6fc000908482c7ea40cf5ee42844973b22a4d55374dd22d7eaab3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4447
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 2973 6 KB
5 KB 35ms
17ms XHR
application/json 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e663a7094ec2802e0564c51d2f4ebfdc7948561cc1eb0ea81ea93505e35f63f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4524
x-xss-protection: 0

GET
H2 200 main.js Show response
s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/js/ Frame C854 5 KB
2 KB 7ms
7ms Script
application/x-javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/js/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/assets/js/pre.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1c350f5b2a4eb5b0eefd6850c988a2b20d6ca108464bbd3027e13f7dcfb6f487

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6957642102685471180/01_Think_Phase_HAPA_Banner_Zuhause/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 24 Sep 2021 13:46:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 230284
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1740
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:43:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 24 Sep 2022 13:46:52 GMT

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C452 22 KB
8 KB 7ms
5ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 24 Sep 2021 11:21:20 GMT
expires: Sat, 24 Sep 2022 11:21:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 239016
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7DBA 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 24 Sep 2021 11:21:20 GMT
expires: Sat, 24 Sep 2022 11:21:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 239016
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 -1aq-589pTXQhIX0O0sr0by93NOseZw7_D6wdr9M3ZU.js Show response
pagead2.googlesyndication.com/bg/ Frame 3E68 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/-1aq-589pTXQhIX0O0sr0by93NOseZw7_D6wdr9M3ZU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fb56aafb9f3da535d08485f43b4b2bd1bcbddcd3ac799c3bfc3eb076bf4cdd95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:23:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1296
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13400
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 23:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 27 Sep 2022 05:23:20 GMT

GET
H2 200 -1aq-589pTXQhIX0O0sr0by93NOseZw7_D6wdr9M3ZU.js Show response
pagead2.googlesyndication.com/bg/ Frame 78E2 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/-1aq-589pTXQhIX0O0sr0by93NOseZw7_D6wdr9M3ZU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fb56aafb9f3da535d08485f43b4b2bd1bcbddcd3ac799c3bfc3eb076bf4cdd95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:23:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1296
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13400
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 23:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 27 Sep 2022 05:23:20 GMT

GET
H2 200 -1aq-589pTXQhIX0O0sr0by93NOseZw7_D6wdr9M3ZU.js Show response
pagead2.googlesyndication.com/bg/ Frame 4E8D 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/-1aq-589pTXQhIX0O0sr0by93NOseZw7_D6wdr9M3ZU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fb56aafb9f3da535d08485f43b4b2bd1bcbddcd3ac799c3bfc3eb076bf4cdd95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:23:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1296
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13400
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 23:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 27 Sep 2022 05:23:20 GMT

GET
H2 200 -1aq-589pTXQhIX0O0sr0by93NOseZw7_D6wdr9M3ZU.js Show response
pagead2.googlesyndication.com/bg/ Frame 2B58 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/-1aq-589pTXQhIX0O0sr0by93NOseZw7_D6wdr9M3ZU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fb56aafb9f3da535d08485f43b4b2bd1bcbddcd3ac799c3bfc3eb076bf4cdd95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:23:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1296
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13400
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 23:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 27 Sep 2022 05:23:20 GMT

GET
H2 200 -1aq-589pTXQhIX0O0sr0by93NOseZw7_D6wdr9M3ZU.js Show response
pagead2.googlesyndication.com/bg/ Frame 6573 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/-1aq-589pTXQhIX0O0sr0by93NOseZw7_D6wdr9M3ZU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fb56aafb9f3da535d08485f43b4b2bd1bcbddcd3ac799c3bfc3eb076bf4cdd95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:23:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1296
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13400
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 23:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 27 Sep 2022 05:23:20 GMT

GET
H2 200 main.js Show response
s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/js/ Frame 5822 5 KB
2 KB 8ms
7ms Script
application/x-javascript 2a00:1450:4001:82f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/js/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/assets/js/pre.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

897eaf2610e2e1ee4091aaf5906f50315216a7492a6b1a0730dbac9d43b56812

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5116723813012973680/02_Think_Phase_HAPA_Banner_Schneller/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 24 Sep 2021 12:19:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 235545
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1761
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 18:45:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 24 Sep 2022 12:19:11 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame DCA0 17 KB
6 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_246.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 27 Sep 2021 05:44:56 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 2973 17 KB
6 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:44:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 27 Sep 2021 05:44:56 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame E451 0
23 B 17ms
17ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 05:44:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 18D0 0
23 B 17ms
17ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 05:44:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0B19 0
23 B 17ms
17ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 05:44:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FC4C 0
23 B 18ms
17ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1e5a0967e430800823f5604cc6f74cf.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 05:44:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame DCD7 0
23 B 18ms
17ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: travel.blogmura.com
URL: https://travel.blogmura.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS