ar.hibapress.com Open in urlscan Pro
151.101.130.207 Public Scan

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
an-x-request-uuid: 96d862da-514c-47fb-98c5-51b35aabdf56
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzA2OTY0NTQ4MTY1OTIxNTY5Ng%3D%3D
x-proxy-origin: 217.114.218.20; 217.114.218.20; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8CA0 0
20 B 166ms
166ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4124690250084&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8CA0 0
20 B 167ms
166ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4124690250084&version=m202309260101&ct=76&x=1&cor=3665374793390264000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 8CA0 110 KB
42 KB 69ms
69ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CV-kRiaca14U2dghpn7OVMaiEYPL4ACQa1H7QyfCW6TXaNXwyccqLdjJSCUCwxxiD1e93KidJ8mzeOVYJhKHoZDtl-P1Y4Oedt4gGSHVPkORspAaXf_rMUi4GmcMufp6s7-yMCZbLDWbzolMObhrcspKZ6NrPZGWkRzbylByzaoRfhhSY&dbm_d=AKAmf-Cc17s0KpHSE_cZmROZZxKoWLw2C-dMitUrdO68F5mh8GpOh_UpTlIk8-w3eITCmDFHn_GNVes5dqvR0NqUyF988xN8g_5FTl9-kmK4UFsCEtVgAgidYFwIJNE-VHos0o0Ov-EH33Zt-Ac28G-dF4tEnKGhROMOVFzCCIGW25wj5VxOyVvSmasSRlUBMNHeVwqj4ZISTuivMszvN9cgyC6L5W9lYA0gzP-8cNoY_2daXcZAsRGVL7huYEb_gr7uHlRH382Bj8mMKwKkDhDZ--If3e06tyHmAp7eJ0fP5p3-TdK7hBli4CSGM5AXLhiVIWQn2I9HYko6tKKnh_uJlq_utmX5WE_kO_H97dhLyGml84Omal6pfKEv--UXA3s6hVxX63_TLIaf1haAr6LUSemUV2bkzT6GHkqY5gcDYZUU93DuObV6pSxGiiPKIB78AsvlqRzCcYwBFwCmgI4-h-Nr6nfNZJ6c40DkTaMgCmeVBnFn3sINpObNSfpBQxrJ76-YEeSDoUBuVA-CZNcbL9ZXmaBgV_U4QH2YznPg143Mkz3lj9pIkW-fVHiV8-AIdiJPlBPhjZIq7_AjUNMks63m3jkco7ergzA6OCcXtWpUU2iA41ExId24fSf_PQDMylNPrUzOaJM37bfQuU5VHoEAIvkXcsZyjQ83hUHhEKGo5TDbQqjKSFDqGgw678dPQPrCAQmOs7dVquVAcsIBdCsVG_DY8C9srgF7Jvv6YufLQwfmhnB0fVCvEkVcBs8aNx2uMatWTLS1O7VvHLtaTG46-X18owUiekVfqOznzi1dG_qp_jZQgGEmMFM4W4ze03b8oYtOzFSqmjWuTaEvhavbx-u04hqKmg4cSNI82Ez2Ux8zLQ0yazOOjKDLbERAhgJs6Wm455UsnkJvhCHMnQYFNd9W8pYAVTTI5ru9e8mYJsfkp5aH1CkMoj2-ry0QIwZu1RCsPavCKCUhHG1ZSGZ0jxKRENXrCAwj22679n7auCex3LD2UfOOJIcR07xw1S-cnQ3IcGF9Ggu7datVVWYlJ8x2humY68MlFXEjh8_gAlK7iy8HeExiz_oE4ECO5N2HY3XYB3oOeVUTJIl9aUd4zuuSReDKvhpxLB2DWL1voUnyBhP1JbH9TZBTA1l03HnN4Y9-BlfkBl4ta3xHOLlbGRZeJFZU98_nYu5pHVLw_ciNxOisttu6OnrEsEw7x5kBiBTETgiS1TDFS5zGFUD94UBDw_6mmLa2Z9hrVkmBfe2IyOkcXJunyi0SXu5NSu4GXApx2tWb0bN_TU6hTVlyTus7IgOX71784ipI67w0El864GhYI7j8gY2bxlTGSm6Rqfu7YVCM5DZm4rP4vWZs6_ppl_DCvRaUiXIX6uusNO186T9Cc5X59MQYBrcRZaT5b6VHOmMaS8GAC89vOoykLKs_UWfYMkO1rWkVRglV5UO7yZD9zxSdtEWYoqN_2tT9alkTHDYgKHLa4We6P93OkFitZYPneeQ5GyfeIrcn8TiYAEhT3DhFPqYoZlPDJKQq9ysDWaxsc40hnqC--0NvZHUCNQVCLEyx2IYMGtvKf3Y_lZn6GIbQ7uavR7RGKfrRDLxg3ckOHCo8MPBK81wIzsO6jDbfYgf2s3Znkvq9efwQSm1uF13z9BFtku0Kgc8HsAYjP2A62jGgJidlzvbNJe4EKRQF2UHXZLpfm-0fmy6FrFCWKDOiZKX6Vqhm_6i7epPe8devEic5GCHezhUHuJI6Ma11G57iO0hkNNZ77TpKketj6m6t_9YLZHAc6NbyMvMYQ1lx3P5YnYrd_nWHPFL0L4l86IlDCMCPydK0fPKce760pHuupujuQrFAY-gj_Qhnqvex35zHsushVo89fpEYfoV2Zs-85wtWLMpPGSqdo8REeIISZk4iiMwPU3UcEUxx8zFcv2a9zvYHL6coeahilVoNRN_dsODRV4L0SrpwgqxdtHSef_YtjiC0OBD5Yce3rH4KPSvRXZzwSQV0TD7OzJZqYW4p1zauUFSV20Fl1viI1asEn_t-nCvCfHul3_QY622a8qMN8xRL8kBV73alL4aaccnl140NOqdmouJh_8AAOK2Oyn0sUGfccxKQS3rpuY1sp1X_2iZPBpzfB2dDOst0_crgc9N81I0-VsZSTf4aT2sBY0PWCFw08N2ZBG4Psv1nT0Vgvqd2QZ27QhWeP8JUGqp95rQ94YBCYjK2xyAhz1XL58iLkrFlHnXfAWHYebeZvKIAYyS8Qq9DOBgSaqFyWk79pnz15wAMlOoBVHYLRjKAseguneYDj4rZGz_MNxMdPKpPE82VhlDiuG59nBgfyMjjoeUhdCyYPKwsw2Hthu-L5nkL_Uxnjg3leH0eT-wep0kkg8QI4Uwgt1yKQe8eK8mnPNLdDe8AM8CjZMmGcqaTHZbK0OWFmMwx3MXqXp9RcMHPhkhrc6-kl_2c9k494vnIT_giK1KqUHJ0J-g3gpzd_BJdCAvZ-uHLyAfabkrHik71tx2_eGTB5AafIK_KtvV4Pqfpd5YFvT3jNeUC3BYifkAXGz_rw4K0NHmR2_UdvYF76-2qGQSJmawduYA6zPKFUTLrB4M-WRjG0fLfM3ZFqWqqHzpF_COa16PNmHOU8Sj3npslUJC0Hd2LhtzznAFXiwBc6dFAAx8wMSbK858yWz2TOdNSCGyHjSIRbm4Hu5AysJTS9_sAark9KcJ2m8b2YNhNf9EgnPgJ3DYl7e-zAW6rdiO9ACCOw6CAr9-T9Qwc1TldIb0XWxS_nE9Z-JoVE2Q8Qk-Osw1z1ExOZ9VACz9fBnhzmQzvK4ZP2VKpR1iqTVDJ4XkI_9SEvn-C_3hZ5UtCM64-xJaYqK0cN9VHKGr7IUQ3jJEmDveA0Qd0-sRUkH2cnRDyP4CN-8pVpigZOLrvI59zHb1d0Gr51VSlwrPxdksKFFSypfTLtsT2G7M3aQQgSgdIYS8yA0VUa4mxkZKpUPDCwG6ET5mIdER6W5fcr_Jgypaww8XK2QmL5yvTSlwwvckvxH9g11YH2KAHv5wfoJ_8smIb_WOGzTlK-JVl_RUyBrGYDGGw2FJ53if1GP3y2xRY_omwpgijbGS0shSCFJKbWnQV8rYW098DJITeaoqIEH3d-qZ-D12hcfmUQ5138ENBVuz_GQYkRI0kDEE1oYm5MS9DYMsqDvdSSKfrI5AcVm_6LLkrE25sKABz-dIG1npI34KrPi-d79fGNM7qzVKdn3DD9Whm8qK_f4yRTUAJTtZxuigL_YhaKCKjEZtANR7Qzz5MO16yXc9QbcVxv32bUyzOHgfU6WJpjXc6Jg4Gzjd1cVOEWNxSzwYJ_kwiUZdbdy3kqxkfoeoWULQuVgyXLchNVJusPBFh7pLxJvbibmCSi2N8LBzjNlrxZB_umi8UZd1DwZ0J5FOQyLZmuhmgDyy2aHmMySWijWCPgzJCq-eJKC4xSYS4QjmQKi3DSb_C15dn2jPtEfv3U2mEG0aB7QR-LSWbQLq7cKOEEqUrIuNDt3cZwqRyfQCjyJOpsgGr-iBGKv-OTkg0HWzy1gKNJe5ClclhmUB69tsEUUAD465GE6Api9buv8nl-_KIVZPmoHys3yymEa2m-G39iTRbquUW_92NGK0le-7hQlPCLI1ALiGTJm0GzLrz1X4ola94ODRAssFuolERJx8ioYhWMl9XuMEpzpvI28-PO4sjI_7z-P6AbwC8RiBye4KEt1dx5AzhisOfYqYZ5PDZb3PIfawMuQBhMeDb-z0lurrO4u7244a4eExFb4dBaX0kEhvcbAYDVwZCs_SwoY8qv6-h9KvwkUDpHSsf0Po2mL0ekijvVxSxSLHJSSDhZ5lb8a8-G6gD0oedEUozPHQgNUVF7bdAjMNaVc38g1lO26SU8yggcWda4Xz55BW2raJT3e2JVKtJaaGbiB8sNpHXK_nmRH4xXFeMC-Y0KRJfqYN270f1zmCX3IFJ5Kr5Tcv6qp_UgNJtlC86Ik7CfLXiDkL7OQUkt2_AX1CdMHmLZsb8fl5wN9yEJ0P0Nw77HSObezL0wa9zNNNLz34FkELAHCMjsCx1jpybUgcBcNn7jbAfMwV3d--P3YM_cMhOW-CjVRCn9ehqlCdmzaXMsZjPKHYO_fYIsWMm-sWZ86y-iS6leBfUxm_Nxyq2ZvrZxtZAtWSVUxdwaY4RwgTOJcuxxTlySAsG3PBsKKP_CyCG8hot0wJFWZpaqn2X6HCGIgw0_R3JpHtHlg&cid=CAQSTwAvHhf_gsJZ5dDK1ZTWtMYenmLD0c8swuPHOD0nqrCEEl1bKcxWApt4Adx0fZBEzxc-GYlTXR-NSg4m2pQjKfeNBQ8WsAt1Z-heE1HZSTEYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Far.hibapress.com%2F&ds=l&xdt=1&iif=1&cor=3665374793390264000&adk=1726166463&idt=159&cac=0&dtd=8

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38b38530e22f5c1f744bd32723bf46c35b19a316b5d1a581072395547cb74dba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42587
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1874201/77019270/ Frame 8CA0 270 KB
79 KB 155ms
51ms Script
application/javascript 63.33.146.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1874201/77019270/skeleton.js?ias_dspID=3&ias_campId=1015386370&ias_pubId=pub-1219367199329714&ias_chanId=1&ias_placementId=20855656766&bidurl=https://ar.hibapress.com/&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0hUcDkr0pCJPmYW6sfK_HOP
Requested by: Host: ar.hibapress.com
URL: https://ar.hibapress.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.33.146.168 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-33-146-168.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 1658abfbb6196d51f1e6181c06a1511cabf78fae2539ce5eee2c45fa10674f15

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 8CA0 111 KB
39 KB 82ms
23ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Origin: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 19:25:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75449
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jan 2024 19:25:42 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240122/r20110914/elements/html/ Frame 8CA0 12 KB
4 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240122/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CV-kRiaca14U2dghpn7OVMaiEYPL4ACQa1H7QyfCW6TXaNXwyccqLdjJSCUCwxxiD1e93KidJ8mzeOVYJhKHoZDtl-P1Y4Oedt4gGSHVPkORspAaXf_rMUi4GmcMufp6s7-yMCZbLDWbzolMObhrcspKZ6NrPZGWkRzbylByzaoRfhhSY&dbm_d=AKAmf-Cc17s0KpHSE_cZmROZZxKoWLw2C-dMitUrdO68F5mh8GpOh_UpTlIk8-w3eITCmDFHn_GNVes5dqvR0NqUyF988xN8g_5FTl9-kmK4UFsCEtVgAgidYFwIJNE-VHos0o0Ov-EH33Zt-Ac28G-dF4tEnKGhROMOVFzCCIGW25wj5VxOyVvSmasSRlUBMNHeVwqj4ZISTuivMszvN9cgyC6L5W9lYA0gzP-8cNoY_2daXcZAsRGVL7huYEb_gr7uHlRH382Bj8mMKwKkDhDZ--If3e06tyHmAp7eJ0fP5p3-TdK7hBli4CSGM5AXLhiVIWQn2I9HYko6tKKnh_uJlq_utmX5WE_kO_H97dhLyGml84Omal6pfKEv--UXA3s6hVxX63_TLIaf1haAr6LUSemUV2bkzT6GHkqY5gcDYZUU93DuObV6pSxGiiPKIB78AsvlqRzCcYwBFwCmgI4-h-Nr6nfNZJ6c40DkTaMgCmeVBnFn3sINpObNSfpBQxrJ76-YEeSDoUBuVA-CZNcbL9ZXmaBgV_U4QH2YznPg143Mkz3lj9pIkW-fVHiV8-AIdiJPlBPhjZIq7_AjUNMks63m3jkco7ergzA6OCcXtWpUU2iA41ExId24fSf_PQDMylNPrUzOaJM37bfQuU5VHoEAIvkXcsZyjQ83hUHhEKGo5TDbQqjKSFDqGgw678dPQPrCAQmOs7dVquVAcsIBdCsVG_DY8C9srgF7Jvv6YufLQwfmhnB0fVCvEkVcBs8aNx2uMatWTLS1O7VvHLtaTG46-X18owUiekVfqOznzi1dG_qp_jZQgGEmMFM4W4ze03b8oYtOzFSqmjWuTaEvhavbx-u04hqKmg4cSNI82Ez2Ux8zLQ0yazOOjKDLbERAhgJs6Wm455UsnkJvhCHMnQYFNd9W8pYAVTTI5ru9e8mYJsfkp5aH1CkMoj2-ry0QIwZu1RCsPavCKCUhHG1ZSGZ0jxKRENXrCAwj22679n7auCex3LD2UfOOJIcR07xw1S-cnQ3IcGF9Ggu7datVVWYlJ8x2humY68MlFXEjh8_gAlK7iy8HeExiz_oE4ECO5N2HY3XYB3oOeVUTJIl9aUd4zuuSReDKvhpxLB2DWL1voUnyBhP1JbH9TZBTA1l03HnN4Y9-BlfkBl4ta3xHOLlbGRZeJFZU98_nYu5pHVLw_ciNxOisttu6OnrEsEw7x5kBiBTETgiS1TDFS5zGFUD94UBDw_6mmLa2Z9hrVkmBfe2IyOkcXJunyi0SXu5NSu4GXApx2tWb0bN_TU6hTVlyTus7IgOX71784ipI67w0El864GhYI7j8gY2bxlTGSm6Rqfu7YVCM5DZm4rP4vWZs6_ppl_DCvRaUiXIX6uusNO186T9Cc5X59MQYBrcRZaT5b6VHOmMaS8GAC89vOoykLKs_UWfYMkO1rWkVRglV5UO7yZD9zxSdtEWYoqN_2tT9alkTHDYgKHLa4We6P93OkFitZYPneeQ5GyfeIrcn8TiYAEhT3DhFPqYoZlPDJKQq9ysDWaxsc40hnqC--0NvZHUCNQVCLEyx2IYMGtvKf3Y_lZn6GIbQ7uavR7RGKfrRDLxg3ckOHCo8MPBK81wIzsO6jDbfYgf2s3Znkvq9efwQSm1uF13z9BFtku0Kgc8HsAYjP2A62jGgJidlzvbNJe4EKRQF2UHXZLpfm-0fmy6FrFCWKDOiZKX6Vqhm_6i7epPe8devEic5GCHezhUHuJI6Ma11G57iO0hkNNZ77TpKketj6m6t_9YLZHAc6NbyMvMYQ1lx3P5YnYrd_nWHPFL0L4l86IlDCMCPydK0fPKce760pHuupujuQrFAY-gj_Qhnqvex35zHsushVo89fpEYfoV2Zs-85wtWLMpPGSqdo8REeIISZk4iiMwPU3UcEUxx8zFcv2a9zvYHL6coeahilVoNRN_dsODRV4L0SrpwgqxdtHSef_YtjiC0OBD5Yce3rH4KPSvRXZzwSQV0TD7OzJZqYW4p1zauUFSV20Fl1viI1asEn_t-nCvCfHul3_QY622a8qMN8xRL8kBV73alL4aaccnl140NOqdmouJh_8AAOK2Oyn0sUGfccxKQS3rpuY1sp1X_2iZPBpzfB2dDOst0_crgc9N81I0-VsZSTf4aT2sBY0PWCFw08N2ZBG4Psv1nT0Vgvqd2QZ27QhWeP8JUGqp95rQ94YBCYjK2xyAhz1XL58iLkrFlHnXfAWHYebeZvKIAYyS8Qq9DOBgSaqFyWk79pnz15wAMlOoBVHYLRjKAseguneYDj4rZGz_MNxMdPKpPE82VhlDiuG59nBgfyMjjoeUhdCyYPKwsw2Hthu-L5nkL_Uxnjg3leH0eT-wep0kkg8QI4Uwgt1yKQe8eK8mnPNLdDe8AM8CjZMmGcqaTHZbK0OWFmMwx3MXqXp9RcMHPhkhrc6-kl_2c9k494vnIT_giK1KqUHJ0J-g3gpzd_BJdCAvZ-uHLyAfabkrHik71tx2_eGTB5AafIK_KtvV4Pqfpd5YFvT3jNeUC3BYifkAXGz_rw4K0NHmR2_UdvYF76-2qGQSJmawduYA6zPKFUTLrB4M-WRjG0fLfM3ZFqWqqHzpF_COa16PNmHOU8Sj3npslUJC0Hd2LhtzznAFXiwBc6dFAAx8wMSbK858yWz2TOdNSCGyHjSIRbm4Hu5AysJTS9_sAark9KcJ2m8b2YNhNf9EgnPgJ3DYl7e-zAW6rdiO9ACCOw6CAr9-T9Qwc1TldIb0XWxS_nE9Z-JoVE2Q8Qk-Osw1z1ExOZ9VACz9fBnhzmQzvK4ZP2VKpR1iqTVDJ4XkI_9SEvn-C_3hZ5UtCM64-xJaYqK0cN9VHKGr7IUQ3jJEmDveA0Qd0-sRUkH2cnRDyP4CN-8pVpigZOLrvI59zHb1d0Gr51VSlwrPxdksKFFSypfTLtsT2G7M3aQQgSgdIYS8yA0VUa4mxkZKpUPDCwG6ET5mIdER6W5fcr_Jgypaww8XK2QmL5yvTSlwwvckvxH9g11YH2KAHv5wfoJ_8smIb_WOGzTlK-JVl_RUyBrGYDGGw2FJ53if1GP3y2xRY_omwpgijbGS0shSCFJKbWnQV8rYW098DJITeaoqIEH3d-qZ-D12hcfmUQ5138ENBVuz_GQYkRI0kDEE1oYm5MS9DYMsqDvdSSKfrI5AcVm_6LLkrE25sKABz-dIG1npI34KrPi-d79fGNM7qzVKdn3DD9Whm8qK_f4yRTUAJTtZxuigL_YhaKCKjEZtANR7Qzz5MO16yXc9QbcVxv32bUyzOHgfU6WJpjXc6Jg4Gzjd1cVOEWNxSzwYJ_kwiUZdbdy3kqxkfoeoWULQuVgyXLchNVJusPBFh7pLxJvbibmCSi2N8LBzjNlrxZB_umi8UZd1DwZ0J5FOQyLZmuhmgDyy2aHmMySWijWCPgzJCq-eJKC4xSYS4QjmQKi3DSb_C15dn2jPtEfv3U2mEG0aB7QR-LSWbQLq7cKOEEqUrIuNDt3cZwqRyfQCjyJOpsgGr-iBGKv-OTkg0HWzy1gKNJe5ClclhmUB69tsEUUAD465GE6Api9buv8nl-_KIVZPmoHys3yymEa2m-G39iTRbquUW_92NGK0le-7hQlPCLI1ALiGTJm0GzLrz1X4ola94ODRAssFuolERJx8ioYhWMl9XuMEpzpvI28-PO4sjI_7z-P6AbwC8RiBye4KEt1dx5AzhisOfYqYZ5PDZb3PIfawMuQBhMeDb-z0lurrO4u7244a4eExFb4dBaX0kEhvcbAYDVwZCs_SwoY8qv6-h9KvwkUDpHSsf0Po2mL0ekijvVxSxSLHJSSDhZ5lb8a8-G6gD0oedEUozPHQgNUVF7bdAjMNaVc38g1lO26SU8yggcWda4Xz55BW2raJT3e2JVKtJaaGbiB8sNpHXK_nmRH4xXFeMC-Y0KRJfqYN270f1zmCX3IFJ5Kr5Tcv6qp_UgNJtlC86Ik7CfLXiDkL7OQUkt2_AX1CdMHmLZsb8fl5wN9yEJ0P0Nw77HSObezL0wa9zNNNLz34FkELAHCMjsCx1jpybUgcBcNn7jbAfMwV3d--P3YM_cMhOW-CjVRCn9ehqlCdmzaXMsZjPKHYO_fYIsWMm-sWZ86y-iS6leBfUxm_Nxyq2ZvrZxtZAtWSVUxdwaY4RwgTOJcuxxTlySAsG3PBsKKP_CyCG8hot0wJFWZpaqn2X6HCGIgw0_R3JpHtHlg&cid=CAQSTwAvHhf_gsJZ5dDK1ZTWtMYenmLD0c8swuPHOD0nqrCEEl1bKcxWApt4Adx0fZBEzxc-GYlTXR-NSg4m2pQjKfeNBQ8WsAt1Z-heE1HZSTEYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Far.hibapress.com%2F&ds=l&xdt=1&iif=1&cor=3665374793390264000&adk=1726166463&idt=159&cac=0&dtd=8

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 03:29:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46418
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 03:29:33 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240122/r20110914/ Frame 8CA0 31 KB
12 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240122/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5fa42c1d96f1d20bb0a5c0f1468aba661ad4c3584dd51646a3bfb996e869b8dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 03:29:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46418
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11931
x-xss-protection: 0
server: cafe
etag: 11828260617052087593
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 03:29:33 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 8CA0 41 KB
14 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 11:54:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 102534
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 Jan 2025 11:54:17 GMT

GET
DATA 200
OK truncated
/ Frame 8CA0 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 721ff19ee55edd5621b744f69a93b04c3a7a6ce99745945f3282ca43a5eb124f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame B0D7 38 KB
13 KB 23ms
20ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 102534
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 25 Jan 2024 11:54:17 GMT
expires: Fri, 24 Jan 2025 11:54:17 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame B0D7 39 KB
15 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 10:22:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21614
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 10:22:57 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/18125622261736179959/ Frame D015 8 KB
3 KB 69ms
22ms Document
text/html 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18125622261736179959/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a5d833402cdfd7b07537d8db7871011939d9b3148747d688b5be85d4cb352b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 237801
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2728
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 23 Jan 2024 22:19:50 GMT
expires: Wed, 22 Jan 2025 22:19:50 GMT
last-modified: Wed, 06 Dec 2023 10:47:38 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8CA0 0
0 122ms
65ms Fetch
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuwkc6E4-dWvlxJWPYRo6II_DiV1VVDaRpNyZvbfkLAp3fT7kvb9Xgn8zyWLmA-xsksU7na-INr01jGYySBDTFtNRFNZSa5ZpXWk0xfuj0I9QKbCxJTt6-qC-_KD3HxHqplpJ8lesF_dRsz_IK42YTPTJwB4R7Pk_26lGMVIvM-HfjT8iQiUldqLUmzbsvAr9PU0R9zjVA1BcGWLoxYXFhiuQOv5QIFsmPjW_SKvt7gbV5zbeXrPtlhwXgBpoXzRvlfaOKDN9EjcUuAP31KOifem7biG-Lg1lZ5FzW_idx81GsptbNU9Wj43rAxg0ihvNMql_HV7AjfZJWmH6NV8hnRnbxFCOJbMNzjJn3dQq9XKY_lOJe3UHU_qx77aQR_Gamc7v1sPRPPpMs6--wSWGq9dHjWJlmcW_kZuKr9vzYz_KBhIo71sTgzu-pEv76I2P14RpSvt_4JcJQCQKmQbrHU2l_apMbLeEp5zprbLR3o36s8F3H3AUy2qpMd9EQi8kpI229Mu66xRD0oacXg7lFdWMzyYAwpGsPGoa8tvaijZ0DT4qQB_F9rYZmn23qqi5W5GkuRQj0YZ1r9xCEK_OpWvjxy803wkFr7b-WjGgUz7Wh-zabqGiRUeSnWmasiXw7Hcs4bjZ0dYStD84bHuuYER3xcqS4v5feuhOUhFpss7VaiZs77Db5_Jg9hfMGt9k_5em6lxR6m2S3uo59j6_Y75thrrnowzXA5oPQUwxHDmvI_1j5O8EKe6RV15uDqUfgVgpxRwponf0LqYnywyei9XQrxNezBK1u09h53TwhOB94x_iO6Uf9mjKFoewpDSUC0wpDwhGagdZ4SSOX5y7l9siergEpYIo_X4Ds5Wia12-nftZ82kDqk2Rvl3Iii2MSrPHFQVipFzn5AJdQTiEEIzy4H7DaX2DXRLmBWuXRRW177nn8tvTyanfqvDG1i1OxlwtwVOp9cP1aiAFUlbYq_iM3fDzfGbxN21gX2Pi13vz0Rr6nGRotTNrT37Em0STPBlBn6HSZTtvlJn6GyUFLCAR9KcUZtxcP8MxiGGDrTvtzEHom1NFEZvyAzfc9pnGBmxUDCCPpClZa8rDoy4RAK2Gx4svZzsCcJkMcK4wSKRK-dBeevuMFbP4wv6yBZA2hlWUH5JJOiNK2XBt-ksB3L0H_Uhatd7TP4vJKWbPiX4emH5Z4v3QuHmdMfYdx494URiooZQtaKQe7MgNCasFu72XkybdIHRwp0IEwiZpCT7Iu45MMt17JrOl11wF4ByFkqNnDG88k_EGT-1Xeo1VXmIsC7kych7PHrMX-NmkxC2dVOVa8oWZHJ7T3Y18yt73jZrvUG7UBnfiSvx-OuVoZfr4ba6syC-oM5nlP7OBLREM2y8FbaT2yHIcQbpu6jBQjQo7UMP7a2B0cRUbfzmaw9PKTKUVKHkl72kWS7mQ&sai=AMfl-YRpcO20NbiYo5r-H_7JUXDGsxWFkzD3HdVYvGiVo266hsRWcW5T7vjYcr2w6seOBDHlGOGTGpu2kEHfvsFT61oNizYF7mQszcRH8Omkr7jyWN0bR43q2Aahrw8xBoVu-r9521btGElgG0CcADcgHuSfV82QwaKJNIo8KHCRHWC0QmTu6FA37DgH-cXLf2DNghNtwk5LpvwW62iQb-JT_CDc3CtIFsbuCn92TRlQ3qPTuRHmGc0O-Z4kKJtquBGoj6ywnjEZ87j7m2d9CuD9mwDD-MgTCVr9_yCY1Hf7KA&sig=Cg0ArKJSzK1lWIbzYUSVEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=118&cbvp=1&cstd=116&cisv=r20240122.36516&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 26 Jan 2024 16:23:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B0D7 0
20 B 171ms
171ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Bumqfb9yzZdLAB6KOjuwP5Z2k0AUAAAAAOAHgBAI&bg=!hoWlhcrNAAa8BdJLnAU7ADQBe5WfOEfU6B_WrdajVO0RfR4gMF5avfL_LZldwty3y3E9W1XV9iBxAn6nAVLT7fwN3ahgAgAAADhSAAAAAmgBBwoABlN__BLS1JkDXhs32jCgTa_GMlwmdX84MO4UEyMCfd48-sSQzFlO8AvsT8bQwZvT5Htg4icfVaJRz0nVNcjr1_FsRkDf7ObI9NX_Gbnw5xQtBKqqRU5SSrZG_A2lyH6WToSFpCONKCZFrEyfnjAMcJ0Ejdl9RzQdkhj6cZy7RWLFGRAYRiRBX_HzKusfJTpB8QJX1DnVqB2hRPQmhPAaBQhM9Aha-josCyFEzRhUWRAFoUSeTbonmTy7o2TRt2HVH2S2XRvjCtW2jVT2pz6S1Z9R0eqfDowWorz36uwnNAfkZ_FHSwS9M_Q1sWAzBs8LH7SvZwi-JsY6DPowKpsVC4Ak5my_CKt6TCadqZ02TVxXOMu7E3zdUprsHaF5DgBVrOd3Ti4U5B7_8mobw_OGunWdXHBdCdPrgq0Wqq3wtYkbaBXxyBiAxSt1i7hJItBLN5Zsk9lPrIqexbjuSIQuvlU4UPmjU7-j9zWRj6fzoKtDYamc00FEHgyL3oFcwEHIzpLOzotj2rVMS_yhmO1DMH_tTGq7mj9kdmHksyiD6-whE3DHIA9VY3SZy_bewq-2h48SuRMZeaaUUzmz2LQUZ-AF7RN3fYJzZQw5bcZcu_uScMU94M42CepKeB6zONvVe2Ftf6EaU7k90Ouyrx8lJ3iuf4gCRc5CLGosBofWPAulxxdTi8Ue_GW8LKFu88kdFSTm2j8yP0qILyL5_R2WCK6yb3NhWOVXwqeOr3hfVIXKi7v4_7GpAD4rHhfIp-PI2IuMZ2UwiTHKf5mV5IrkOZHwFDfWblpnuUng7BctWeam0M3VzAKbenafEs_QDKM0-oRUxfgaQzTvFVrJfLxw7gn6bLvUto_l0lmO2A_NQ_HgfGtrDAfGqk6aIjtlLSK3o7zu4K-f73oa80HlhuilkqNImwICnvLSWnxO9pYckgqCGbTMjf9BcG6gDQ_ImywrLBxozvWp5XMmC8tUQ7VszCpH5cQ_ANUe9f1JKDsXwG8bVRnPFF6QyJZ1Kd0p528oOli8hXHSzUe_L-2m81nFLUU80eVO7Z_zlGQcU9jLjjGxbyDrBya8foC5PLZ2ZfiyWC0pXe_LfVfG4F_5NS9S9SZhXtV8sCOuke_tMisE-HwEjrc_1-fni0WiInkU5VWl06xa0mhzB7w

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 createjs.min.js Show response
code.createjs.com/1.0.0/ Frame D015 236 KB
63 KB 196ms
89ms Script
text/javascript 2a02:26f0:3500:11::215:14dc
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://code.createjs.com/1.0.0/createjs.min.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18125622261736179959/index.html?ev=01_250
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:3500:11::215:14dc Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Apache /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:11 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=900
x-n: S
accept-ranges: bytes
expires: Fri, 26 Jan 2024 16:38:11 GMT

GET
H3 200 index.js Show response
s0.2mdn.net/sadbundle/18125622261736179959/ Frame D015 201 KB
35 KB 25ms
24ms Script
application/x-javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/18125622261736179959/index.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/18125622261736179959/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a53a8043152296befd7f8ea0f4935629adceaf379d034bc8f84d7bfcbee1cb9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18125622261736179959/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 08:52:38 GMT
date: Tue, 23 Jan 2024 08:52:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 286233
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36137
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 10:47:38 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 container.html Show response
215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 4260 6 KB
3 KB 23ms
23ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ar.hibapress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 16:23:10 GMT
expires: Sat, 25 Jan 2025 16:23:10 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 1C6E 624 B
245 B 59ms
59ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiYzrmBAjAB&v=APEucNXGea_gDshJML9IZfJeoBWtiJaXgc3TTwQHn7SX_rMY-xGnP-wjliyMRusx0q0b_0CuruQI5E-mM9JGQLURqzr6MxVhwdrd1HqmqSwKWZEmOx4JgnQjFMxLcbcpD34Rw4cJ8jln8UAfseAyTwIIam54poWcceiHYgpa0rGDSwdi4oZb6Y0

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 16:23:11 GMT
expires: Fri, 26 Jan 2024 16:23:11 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 4260 172 KB
60 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Origin: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 23:49:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59647
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jan 2024 23:49:04 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240122/r20110914/elements/html/ Frame 4260 8 KB
3 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240122/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 16:24:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 86320
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3206
x-xss-protection: 0
server: cafe
etag: 12640889860211258669
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Feb 2024 16:24:31 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240122/r20110914/ Frame 4260 23 KB
9 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240122/r20110914/abg_lite_fy2021.js

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb4fec10d8f4484b291b7c7d0de59d1b4375e000029fd1a128ad10c270d8d803

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 10:23:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21563
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 16165788300067284045
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 10:23:48 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 4260 41 KB
14 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 11:54:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 102534
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 Jan 2025 11:54:17 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/ Frame 4260 3 KB
1 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/window_focus_fy2021.js

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 10:22:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21615
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 10:22:56 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/ Frame 4260 20 KB
8 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d58acf16b5e4521c9eb24fe9fd97308e5f8be1297e4b63a547e5b610611799ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 23:41:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 60074
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8492
x-xss-protection: 0
server: cafe
etag: 9878124937798820110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Feb 2024 23:41:57 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4260 42 B
63 B 167ms
167ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DXfRyjiUmP4fbDBv3y2vwLZ_HQzWKTk0mP4k4WBnIokjcoKutY8RCEO-NXkpyk6DMImUAjWHZEBBLq_0yd4qMGIUNvJXj_Lk-9u2y7efm-g0dXm6A

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4260 205 KB
65 KB 37ms
37ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fcab795411fac2ef4fe726fc3ee3ad3192ff76a846fa3b28616b3b6e61fae83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66337
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1706100845105677"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Jan 2024 16:23:11 GMT

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame 8CA0
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1874201/77019270/4.js?ias_dspID=3&ias_campId=1015386370&ias_pubId=pub-1219367199329714&ias_chanId=1&ias_placementId=20855656766&bidurl=https://ar.hibapress.com...
https://static.adsafeprotected.com/4.js?ias_xappb=&adContainerId=brand_safety_b9yzZdLAB6KOjuwP5Z2k0AU&cbFunctionName=goog_wrapCb_b9yzZdLAB6KOjuwP5Z2k0AU&true_pb=

1 KB
1 KB

30ms
26ms

Script
application/javascript

2600:9000:223f:e200:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?ias_xappb=&adContainerId=brand_safety_b9yzZdLAB6KOjuwP5Z2k0AU&cbFunctionName=goog_wrapCb_b9yzZdLAB6KOjuwP5Z2k0AU&true_pb=
Requested by: Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:223f:e200:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5431bf3cd2099a41e143f4ccab7ee74d223ea22941dfd9061c5d241ed05afade

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 20:34:33 GMT
x-amz-version-id: j.dc8NhIHD_.W9XQnY1wTLb3uCGP048v
content-encoding: gzip
via: 1.1 ab985bb6f3435d42701015dfa6015878.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 244119
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 23 Jan 2024 20:34:31 GMT
server: AmazonS3
etag: W/"eb639ea9c60fa52fae8bd853911ab0a9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: saojnf64GLMhq5P9qleJbJf9eUh1ObNffPBgg09w8AiZcdpjqyx_Mw==

Redirect headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
server: nginx
x-server-name: app14.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?ias_xappb=&adContainerId=brand_safety_b9yzZdLAB6KOjuwP5Z2k0AU&cbFunctionName=goog_wrapCb_b9yzZdLAB6KOjuwP5Z2k0AU&true_pb=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame FBDD 91 KB
23 KB 93ms
24ms Script
application/javascript 2600:9000:223f:e200:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:e200:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 00:09:11 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 ab985bb6f3435d42701015dfa6015878.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 11031241
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: 2NqOtcPpIqELr1cd4eW3ulVeAS_n09HNWQbL_8yJ2f6R5THqYrkNdQ==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 8CA0 43 B
215 B 547ms
179ms Image
image/gif 2600:1f13:800:7781:8c3e:5e6a:bcfa:1ac1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1874201&asId=5e12c3b9-b969-1377-610b-a93e407f49c3&tv=%7Bc:2qpLAc,pingTime:-3,time:34,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:15%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:34,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B30~0%5D,as:%5B30~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u2ueYfQ+11%7C12%7C13%7C14%7C15%7C161*.1874201-77019270%7C1611%7C1612%7C1613%7C171,idMap:161*,rmeas:1,rend:0,renddet:na,siq:16%7D&br=c
Requested by: Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:8c3e:5e6a:bcfa:1ac1 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
server: nginx
x-server-name: dt21.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 8CA0 43 B
216 B 542ms
178ms Image
image/gif 2600:1f13:800:7781:8c3e:5e6a:bcfa:1ac1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1874201&asId=5e12c3b9-b969-1377-610b-a93e407f49c3&tv=%7Bc:2qpLAf,pingTime:-6,time:37,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:37,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B33~0%5D,as:%5B33~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u2ueYfQ+11%7C12%7C13%7C14%7C15%7C161*.1874201-77019270%7C1611%7C1612%7C1613%7C171,idMap:161*,rmeas:1,rend:0,renddet:na,siq:16%7D&tpiLookup=ao:ar.hibapress.com*%2C215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com*&br=c
Requested by: Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:8c3e:5e6a:bcfa:1ac1 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
server: nginx
x-server-name: dt24.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 8CA0 43 B
215 B 542ms
180ms Image
image/gif 2600:1f13:800:7781:8c3e:5e6a:bcfa:1ac1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1874201&asId=5e12c3b9-b969-1377-610b-a93e407f49c3&tv=%7Bc:2qpLAj,pingTime:-2,time:41,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:554,beZ:555,mfA:557,cmA:558,inA:558,inZ:561,prA:561,prZ:566,si:570,poA:571,poZ:585,cmZ:585,mfZ:585,loA:592,loZ:593,ltA:595,ltZ:595%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.90,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:15%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:41,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B36~0%5D,as:%5B36~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u2ueYfQ+11%7C12%7C13%7C14%7C15%7C161*.1874201-77019270%7C1611%7C1612%7C1613%7C171,idMap:161*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:na,siq:16,sinceFw:25,readyFired:true%7D&br=c
Requested by: Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:8c3e:5e6a:bcfa:1ac1 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
server: nginx
x-server-name: dt23.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 6FEB 38 KB
13 KB 20ms
20ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 102534
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 25 Jan 2024 11:54:17 GMT
expires: Fri, 24 Jan 2025 11:54:17 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 160x600.html Show response
s0.2mdn.net/sadbundle/5793540040533475328/ Frame 111B 47 KB
12 KB 60ms
59ms Document
text/html 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5793540040533475328/160x600.html?e=69&leftOffset=0&topOffset=0&c=Hh90YyhcUp&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

38cd707764af5e7610feaee1542d30cfd86a74d0eee75df12aaf6b1d0ded65e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 16:23:11 GMT
expires: Sat, 25 Jan 2025 16:23:11 GMT
last-modified: Wed, 15 Feb 2023 15:29:42 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4260 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4c30fa3e6d73d2e8146466301ed6a6428c20d158a1644ba73bc9d265e1e4e1d8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 4260 0
0 130ms
65ms Fetch
image/gif 172.217.18.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjstBKcoWbRP2qW9Bm-Kb2qPE-SiyYylRvMYGljdtV2UIT8qfqU6KDBvOI_PA7d-3ExQwu97mU9335e6fQF2Iz49Gu2j1vybT5sBws6U3Mrq8Bb5wj7N-phYdbHBson_tMYU9mHf2oeoIhcFuzURg6ddko8udlO_KqsOt-Ov5KYnnt7eTnfdFO_DNNBjaq0Mi8nB7ND7Xh6TziiEf8BkWDPUVg49jqh_vUoG_de7BdoIB028piz7nFEoiacxypzhfV-LjBH9SgatD4Gv1tSUZfShs9afrFOqZuvrYPGrieF2FwJ-cIyAVhR9dk628xKp74tTgzuL-YniGvM72JPxmhRIRmqekBklj7uDh3Yv82-mbaTKq9HY8byTaY7MpcGoAq_b7d45SHIb7vXZaO4_GRE1j40_U0QA3QOuFk8naSuyubBvzqsM-K2zP5YYkiCnZmVgnlGFXmE5reelwYAmU6FFM9ytCcXBzhG-ye4apzSeP3toUnEPKkHNA8cW937n-v5HdrojS58c0JOc9ME7oS_oKpP_fjbvzZS2lsj30OKehY2GYOu2ans33uWzosjpX7HSuXpEJS4he-URy8eXj9mKB8VdGD5EJ2EUlwGRg9fTE5zufHkZQnxGMFrUtFrngjGsfpx5_hHcYxNiF1jRrzWPdTHfCZmE7QrnzXpTVHZSflZXb_q_o1Qou71RrzzGirdUSavuQgPg1fwtSJM4i8mjYh0IKGh1CZgswqrJLvMDFoqGxBcLo2Ci06XpeohzlE3HdtNsmFMBECdkDHG_ldmUmidiNw3eDNRCiuksdda-XvWcLmS3M6w2J0P0ZOQ7gSsUgodp9tZlQim9uWStlMXViExhrOXaLCP5wsn1Dcr7PpaulQQVGr8DtUzlBP5DUcmKwmH7h5gywLbgymEi5XlXVtEYTGADllAQp_ZlnGEBSm6tkXORA_lsv-OtxxEAR6k_iV3snPU8rEKPXujjDegt8PiotiQsby9zSfS5kR1nDCcwyk9AtXOnSp3Q2KVtcsrFuhdxVIjUMfr4PgkATyfuDnBnVztPgSJGJpSv9Bh1_Hpthib36st6uv_YMpPeBrZSpskq7hEqBzFzzMx8velaPaE0CxcFSw3xbQzNstfdt_bqZL3f9t5gRQoHcqniJY_IMEj9U91fTtbCiFHWXGtmDUxZAv74yhpN4TtPmMN2dH97ufrZU9dQlKDeUulhqa5qVgBmZ8QWiczmu-d3ZosIH2VuDUVGfP1Kgq7j4tt2h7NOvyL4a8jZBB8HvnO_trDWbdq-FG4FEoN5igDmAjOqbM_X6nZK1B1_sWSBAF5ReX8s8nxNyUEGHTAM8zi7lgQnn8X_VnSY8FI-rxh8z0Y2-5XMSbN89yqdxuW9EJooKGJWA6oI5lRTJsTswA8PheEXyzdfZ6HwVjyRJx6e9baojTw-92HhzwyU8pySeTrv484uKNta-awOCXpyvCJdnwVM&sai=AMfl-YTQyFj1J_J5mbWiQOE6rH7ZvpmT_lFyjJOhN2D893LWl0mbNERVSFnDyQRf2Qv-JodYN3sGEotybwqmiuXshianqJk3kpbHCvRX41-c-MLWWyweTmP_sQyn0qZ9HgOBim7E9u4MVMISWPnpXT-n9Uox8pU1XtgAu-hMulhz2B9MEcDK_4xVkUvmpPA2alcqoKm_5Ni23a-mZU4Xz6gTSNy1GvlFUDrSsX-62yO4NwhhErvY3dfZ_0vq9BkEKDm5Brxi65s9MlGnYJ-RjuVy-Ku0XkDrW_OUKilpqQCYQOClgmlaL9FpdT7EbPHnc_Ssf20pNJ390iBwOaHL_cXXtvVD-oRh0T074yBrO-gsTidFBnkIXIjvH5SLLXTCU8LpLi0mwafZZieeyYsMesEuzIY0KVkRDbHXXF9DcgLCzGX_jGU4oFt6-D3_39tV8C2O3uDwQj6dCQGH0KQsDGo9nmt6VMi2pW-CSzgC8vuwHicwsh5yY_t3vlqCi0mxEP30sRwH5g&sig=Cg0ArKJSzB8zoS27tMO_EAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9vMm9ubGluZS5kZQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=62&cbvp=1&cstd=57&cisv=r20240122.43135&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 26 Jan 2024 16:23:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 1C6E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMrD173Io_Z5n6ENU8ShmVs&google_cver=1

43 B
733 B

60ms
59ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMrD173Io_Z5n6ENU8ShmVs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiYzrmBAjAB&v=APEucNXGea_gDshJML9IZfJeoBWtiJaXgc3TTwQHn7SX_rMY-xGnP-wjliyMRusx0q0b_0CuruQI5E-mM9JGQLURqzr6MxVhwdrd1HqmqSwKWZEmOx4JgnQjFMxLcbcpD34Rw4cJ8jln8UAfseAyTwIIam54poWcceiHYgpa0rGDSwdi4oZb6Y0
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PdqZ3whk%2BQ%2Fc2mtp5UUJA0dmUSc8FLtOcKAeirczElWriOy6AsM7k5LYJE8tXFD3GJYSfT74ioAAhev5HptbqNdjtp8lEDOHOhfbKW9h0ob9EzLXaVtEr5R4Gv%2BhVl%2FOoGdF%2FFurslgKqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 84ba195969ec453a-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMrD173Io_Z5n6ENU8ShmVs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 1C6E
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZbPcbzeEP.hHqpKDbcfP3QAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMrD173Io_Z5n6ENU8ShmVs&google_cver=1&google_hm=2

43 B
734 B

54ms
54ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMrD173Io_Z5n6ENU8ShmVs&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiYzrmBAjAB&v=APEucNXGea_gDshJML9IZfJeoBWtiJaXgc3TTwQHn7SX_rMY-xGnP-wjliyMRusx0q0b_0CuruQI5E-mM9JGQLURqzr6MxVhwdrd1HqmqSwKWZEmOx4JgnQjFMxLcbcpD34Rw4cJ8jln8UAfseAyTwIIam54poWcceiHYgpa0rGDSwdi4oZb6Y0
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FEvwMqCZc8LYApe0zOCwd68aubqjzWqHJhvwYp1%2FaK3SM3ApMcZ2iXZiT13ykTtDvV33DBMUJo5Zf5X5LPqZU5YpjWlElVgygNwzLibyD7eoWyCPSAi2wVCdaQ%2BFnUqkb5A40SJGp%2BsxBw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 84ba1959dabb453a-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMrD173Io_Z5n6ENU8ShmVs&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 1C6E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEBO292HvIXt4jeTVKzGwo1s&google_cver=1

43 B
1 KB

34ms
34ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEBO292HvIXt4jeTVKzGwo1s&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiYzrmBAjAB&v=APEucNXGea_gDshJML9IZfJeoBWtiJaXgc3TTwQHn7SX_rMY-xGnP-wjliyMRusx0q0b_0CuruQI5E-mM9JGQLURqzr6MxVhwdrd1HqmqSwKWZEmOx4JgnQjFMxLcbcpD34Rw4cJ8jln8UAfseAyTwIIam54poWcceiHYgpa0rGDSwdi4oZb6Y0

Protocol

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
an-x-request-uuid: 2d59be7d-4eab-442d-8ea5-8306e73aa589
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 217.114.218.20; 217.114.218.20; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEBO292HvIXt4jeTVKzGwo1s&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1C6E
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjI2NDQyMTEwMjIxMDExMDIwNA%3D%3D

170 B
188 B

33ms
33ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjI2NDQyMTEwMjIxMDExMDIwNA%3D%3D

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
an-x-request-uuid: 380d4ef4-d031-4c51-829d-bd9dbc8b29a4
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjI2NDQyMTEwMjIxMDExMDIwNA%3D%3D
x-proxy-origin: 217.114.218.20; 217.114.218.20; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 174ms
174ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202401220101&jk=3562001547741411&bg=!KCulK2TNAAa8BdJLnAU7ADQBe5WfOJPLZyDx4NDpdyuCDU6KackQz7esS25dh9iDLfFz5v7WiCCNnrD_jyGVWTSdiQrDAgAAAEVSAAAAAWgBB5kCwtlQBg5WHYOGyzDULHZ4OJXr32Ep1tfZ_kFoaUNKtxXHMjFlMEFkfPpJrQonbkgkHwKSrkHnMR_lOXVzE3JCaTw4i0yRvoVcWsj5uJmKVBgUqVT1G4bES9ZETnm-voAw3S4neCnBqpY4G2rxZjwZAQXr5RE2niK9QDcalBUKpyN2-l3iL_p9rcvP_EJY0xifKK7Axo9x-Wj7RkWypMSXnT6ylSIPIsD1jorVlgV7r0Rx3H6goIf14Ph_4y_OL81Ybw151oDGgW9ngGL9UN8_FCyMN6xZLi3bQhAFt9VVojKmeTU2a-a6sPLDhGIs63FsLLDqHah-TOS8Xct319NGP1Rzwc7J4UhbH6n5MLUdyICwov_sfozITTlG_fInGLGhBTeajQyXu15i6oujb31VAlu11e8xIdD8B1cxv_LQWLaYq8rqFyXst76r2x-_6HWUzepZzqrSnvdhtRM9QBi2ds7AQnhLtvc6SeuMZ4aU0KBya9SdAVkJhO3QIO9hXuoshW8VJ129rlRm9gKC6bhlswzFSVaQVjvrBOo2NWznc9aMsns8Z6J9GCc1gSB88TlcIvL2MXoscO6xZf0-MRzJWVHzpzcwXyeeWS_Q6qXe_YDM8tKYNfin8GENVvgH8hGyktCV-sE_0IkmE3lV7kyvRroSs1wdm92bXun4X81lxelFR8mr5gUoNq9RerPPU-jmIL4XZ-WaRDbA2zshfu9FlQ0RyGWjX05ETODXrR9NEYSaLnIWSncW-cWf1cmNT2K3FcZ3KhrRdzv2IqX4ur4-8aHnwvpFcfUYA_HBX7w4IW_uB5-zkLAHXDHiKBjTJB4tqcKVBWUZ1jnQ3Ixvh8lumfJTdJtrXBftnsBNDajQI3QHI3M3JkefPEtwx79ZoSwQUzX95z2x8bMO7DUXTa_SyKQXIsO1Tq83yR5QVn-WhkTQJ08
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame 6FEB 39 KB
15 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 10:22:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21614
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 10:22:57 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 111B 118 KB
40 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5793540040533475328/160x600.html?e=69&leftOffset=0&topOffset=0&c=Hh90YyhcUp&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5793540040533475328/160x600.html?e=69&leftOffset=0&topOffset=0&c=Hh90YyhcUp&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 04:12:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43838
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 27 Jan 2024 04:12:33 GMT

GET
H3 200 gsap_3.9.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 111B 63 KB
25 KB 53ms
53ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.9.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5793540040533475328/160x600.html?e=69&leftOffset=0&topOffset=0&c=Hh90YyhcUp&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6dbe9c2e13cf06c6633ea3fcf6d7bd30452561202a205c75a035cd1d8b93368f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5793540040533475328/160x600.html?e=69&leftOffset=0&topOffset=0&c=Hh90YyhcUp&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25329
x-xss-protection: 0
last-modified: Wed, 29 Dec 2021 19:08:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jan 2024 16:23:11 GMT

GET
H3 200 index_atlas_NP_1.jpg
s0.2mdn.net/sadbundle/18125622261736179959/images/ Frame D015 69 KB
69 KB 22ms
22ms Image
image/jpeg 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/18125622261736179959/images/index_atlas_NP_1.jpg

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9840320d0f086649e7652cf746271d97ebe18d084ee139f7544bb8df88760209

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/18125622261736179959/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Fri, 24 Jan 2025 02:46:17 GMT
date: Thu, 25 Jan 2024 02:46:17 GMT
x-content-type-options: nosniff
age: 135414
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70469
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 10:47:38 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8CA0 0
0 58ms
57ms Fetch
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuwkc6E4-dWvlxJWPYRo6II_DiV1VVDaRpNyZvbfkLAp3fT7kvb9Xgn8zyWLmA-xsksU7na-INr01jGYySBDTFtNRFNZSa5ZpXWk0xfuj0I9QKbCxJTt6-qC-_KD3HxHqplpJ8lesF_dRsz_IK42YTPTJwB4R7Pk_26lGMVIvM-HfjT8iQiUldqLUmzbsvAr9PU0R9zjVA1BcGWLoxYXFhiuQOv5QIFsmPjW_SKvt7gbV5zbeXrPtlhwXgBpoXzRvlfaOKDN9EjcUuAP31KOifem7biG-Lg1lZ5FzW_idx81GsptbNU9Wj43rAxg0ihvNMql_HV7AjfZJWmH6NV8hnRnbxFCOJbMNzjJn3dQq9XKY_lOJe3UHU_qx77aQR_Gamc7v1sPRPPpMs6--wSWGq9dHjWJlmcW_kZuKr9vzYz_KBhIo71sTgzu-pEv76I2P14RpSvt_4JcJQCQKmQbrHU2l_apMbLeEp5zprbLR3o36s8F3H3AUy2qpMd9EQi8kpI229Mu66xRD0oacXg7lFdWMzyYAwpGsPGoa8tvaijZ0DT4qQB_F9rYZmn23qqi5W5GkuRQj0YZ1r9xCEK_OpWvjxy803wkFr7b-WjGgUz7Wh-zabqGiRUeSnWmasiXw7Hcs4bjZ0dYStD84bHuuYER3xcqS4v5feuhOUhFpss7VaiZs77Db5_Jg9hfMGt9k_5em6lxR6m2S3uo59j6_Y75thrrnowzXA5oPQUwxHDmvI_1j5O8EKe6RV15uDqUfgVgpxRwponf0LqYnywyei9XQrxNezBK1u09h53TwhOB94x_iO6Uf9mjKFoewpDSUC0wpDwhGagdZ4SSOX5y7l9siergEpYIo_X4Ds5Wia12-nftZ82kDqk2Rvl3Iii2MSrPHFQVipFzn5AJdQTiEEIzy4H7DaX2DXRLmBWuXRRW177nn8tvTyanfqvDG1i1OxlwtwVOp9cP1aiAFUlbYq_iM3fDzfGbxN21gX2Pi13vz0Rr6nGRotTNrT37Em0STPBlBn6HSZTtvlJn6GyUFLCAR9KcUZtxcP8MxiGGDrTvtzEHom1NFEZvyAzfc9pnGBmxUDCCPpClZa8rDoy4RAK2Gx4svZzsCcJkMcK4wSKRK-dBeevuMFbP4wv6yBZA2hlWUH5JJOiNK2XBt-ksB3L0H_Uhatd7TP4vJKWbPiX4emH5Z4v3QuHmdMfYdx494URiooZQtaKQe7MgNCasFu72XkybdIHRwp0IEwiZpCT7Iu45MMt17JrOl11wF4ByFkqNnDG88k_EGT-1Xeo1VXmIsC7kych7PHrMX-NmkxC2dVOVa8oWZHJ7T3Y18yt73jZrvUG7UBnfiSvx-OuVoZfr4ba6syC-oM5nlP7OBLREM2y8FbaT2yHIcQbpu6jBQjQo7UMP7a2B0cRUbfzmaw9PKTKUVKHkl72kWS7mQ&sai=AMfl-YRpcO20NbiYo5r-H_7JUXDGsxWFkzD3HdVYvGiVo266hsRWcW5T7vjYcr2w6seOBDHlGOGTGpu2kEHfvsFT61oNizYF7mQszcRH8Omkr7jyWN0bR43q2Aahrw8xBoVu-r9521btGElgG0CcADcgHuSfV82QwaKJNIo8KHCRHWC0QmTu6FA37DgH-cXLf2DNghNtwk5LpvwW62iQb-JT_CDc3CtIFsbuCn92TRlQ3qPTuRHmGc0O-Z4kKJtquBGoj6ywnjEZ87j7m2d9CuD9mwDD-MgTCVr9_yCY1Hf7KA&sig=Cg0ArKJSzK1lWIbzYUSVEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=443&vt=11&dtpt=325&dett=3&cstd=116&cisv=r20240122.36516&vwbs=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 111B 7 KB
6 KB 62ms
61ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47762a9bab2d305d1698b60c5cdc3aff123cc259dc6c4c6ab4741d39899df84d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5734
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 4260 0
0 58ms
57ms Fetch
image/gif 172.217.18.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjstBKcoWbRP2qW9Bm-Kb2qPE-SiyYylRvMYGljdtV2UIT8qfqU6KDBvOI_PA7d-3ExQwu97mU9335e6fQF2Iz49Gu2j1vybT5sBws6U3Mrq8Bb5wj7N-phYdbHBson_tMYU9mHf2oeoIhcFuzURg6ddko8udlO_KqsOt-Ov5KYnnt7eTnfdFO_DNNBjaq0Mi8nB7ND7Xh6TziiEf8BkWDPUVg49jqh_vUoG_de7BdoIB028piz7nFEoiacxypzhfV-LjBH9SgatD4Gv1tSUZfShs9afrFOqZuvrYPGrieF2FwJ-cIyAVhR9dk628xKp74tTgzuL-YniGvM72JPxmhRIRmqekBklj7uDh3Yv82-mbaTKq9HY8byTaY7MpcGoAq_b7d45SHIb7vXZaO4_GRE1j40_U0QA3QOuFk8naSuyubBvzqsM-K2zP5YYkiCnZmVgnlGFXmE5reelwYAmU6FFM9ytCcXBzhG-ye4apzSeP3toUnEPKkHNA8cW937n-v5HdrojS58c0JOc9ME7oS_oKpP_fjbvzZS2lsj30OKehY2GYOu2ans33uWzosjpX7HSuXpEJS4he-URy8eXj9mKB8VdGD5EJ2EUlwGRg9fTE5zufHkZQnxGMFrUtFrngjGsfpx5_hHcYxNiF1jRrzWPdTHfCZmE7QrnzXpTVHZSflZXb_q_o1Qou71RrzzGirdUSavuQgPg1fwtSJM4i8mjYh0IKGh1CZgswqrJLvMDFoqGxBcLo2Ci06XpeohzlE3HdtNsmFMBECdkDHG_ldmUmidiNw3eDNRCiuksdda-XvWcLmS3M6w2J0P0ZOQ7gSsUgodp9tZlQim9uWStlMXViExhrOXaLCP5wsn1Dcr7PpaulQQVGr8DtUzlBP5DUcmKwmH7h5gywLbgymEi5XlXVtEYTGADllAQp_ZlnGEBSm6tkXORA_lsv-OtxxEAR6k_iV3snPU8rEKPXujjDegt8PiotiQsby9zSfS5kR1nDCcwyk9AtXOnSp3Q2KVtcsrFuhdxVIjUMfr4PgkATyfuDnBnVztPgSJGJpSv9Bh1_Hpthib36st6uv_YMpPeBrZSpskq7hEqBzFzzMx8velaPaE0CxcFSw3xbQzNstfdt_bqZL3f9t5gRQoHcqniJY_IMEj9U91fTtbCiFHWXGtmDUxZAv74yhpN4TtPmMN2dH97ufrZU9dQlKDeUulhqa5qVgBmZ8QWiczmu-d3ZosIH2VuDUVGfP1Kgq7j4tt2h7NOvyL4a8jZBB8HvnO_trDWbdq-FG4FEoN5igDmAjOqbM_X6nZK1B1_sWSBAF5ReX8s8nxNyUEGHTAM8zi7lgQnn8X_VnSY8FI-rxh8z0Y2-5XMSbN89yqdxuW9EJooKGJWA6oI5lRTJsTswA8PheEXyzdfZ6HwVjyRJx6e9baojTw-92HhzwyU8pySeTrv484uKNta-awOCXpyvCJdnwVM&sai=AMfl-YTQyFj1J_J5mbWiQOE6rH7ZvpmT_lFyjJOhN2D893LWl0mbNERVSFnDyQRf2Qv-JodYN3sGEotybwqmiuXshianqJk3kpbHCvRX41-c-MLWWyweTmP_sQyn0qZ9HgOBim7E9u4MVMISWPnpXT-n9Uox8pU1XtgAu-hMulhz2B9MEcDK_4xVkUvmpPA2alcqoKm_5Ni23a-mZU4Xz6gTSNy1GvlFUDrSsX-62yO4NwhhErvY3dfZ_0vq9BkEKDm5Brxi65s9MlGnYJ-RjuVy-Ku0XkDrW_OUKilpqQCYQOClgmlaL9FpdT7EbPHnc_Ssf20pNJ390iBwOaHL_cXXtvVD-oRh0T074yBrO-gsTidFBnkIXIjvH5SLLXTCU8LpLi0mwafZZieeyYsMesEuzIY0KVkRDbHXXF9DcgLCzGX_jGU4oFt6-D3_39tV8C2O3uDwQj6dCQGH0KQsDGo9nmt6VMi2pW-CSzgC8vuwHicwsh5yY_t3vlqCi0mxEP30sRwH5g&sig=Cg0ArKJSzB8zoS27tMO_EAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9vMm9ubGluZS5kZQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=214&vt=11&dtpt=152&dett=3&cstd=57&cisv=r20240122.43135&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 26 Jan 2024 16:23:11 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6FEB 0
20 B 170ms
170ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B-50wbtyzZf6wNOG81PIPvOeNoAoAAAAAOAHgBAI&bg=!Y2ClYC_NAAa8BdJLnAU7ADQBe5WfOKuWo2wzDDmGWKN3P2uk4hZnaKpPi8XELnU-uIC-cryCNmx4Bm6nyuhqM3w9l8zoAgAAAEpSAAAAAWgBBwoAAoCkmQMIeu2G5vRT8zaM8Rj-YzH-b16R8BOBgvwAZe2J3nYnn8_QVMp7rJXh241Erv1O1rkXd6jx1vFJrt4UjiiDIZScXSAwiaj4sEWwq48ZMnqHkd8Jf_ZloAsm0Z9nF4Njg0-TOgnqsMPSLZz-eKwPY4QbUOCv9wS-Hy2cbZPGpfmdizfTLxQVz0XHPr1oaBN8vkS757QKAkcPVUU6rUDEWlE6FULotB1c1J6C5Mz_6gp-JYCutVku-aBAsVUXpZkjD2G4wBynXInWfJAyFP3uipV3So2CefjyAOMAEQLKYkZDbq_IlHuUwnHwqnN9ZFOu0VmpV3HAo8wf69C5X8sXu1AmNHfM9L1-VoW1vn-0EKuRRtZVZ6lDouGQNhset3WGB4djJdk9WVMXtabY29GVddBQpBZidwfW-tMxuMrYNpcYCySnkv2NTfwLq-EbdSy8Fk2NWhsD1AL82eShGvye7PEPUWc4vZVxLNumbzcUpsVUtyRbRfD4O_mwAhre6SX47DpM4KXUPuM6yDVf0JJTLPB2Vgd1Yb9lG3sPcUgm7n_tLpYnloQVOciGCIMzsC_bK2AWf2tne56d4D0c6fnAXgYhnzXrDmZDpTy22xPBNbLqZXYPaU4ufzbMC0VVTkVXvpLgykK7GDK0E9X5xBemjRu9YRrdj9EcMwlE9SKQA8W-k3vLNlkWTC1gzLP-kA_nqzkKMlaQes0rb3PXSpxz3cekIOGR3ogKX0NxTnMoft1ZYPiMdHRTU-z2ko5LHrOYfI-1Np_KKuH6eHoiFZ1zrgf_Y5Jnijh4e6BO2B69A-I0-zoa423TIZQh4tcDtWEstfrgzTvG32NT-YvmboEX3Jrz6lJJVKv3PKA8mMui_Rdt4oA-Ys9Qs8AD3iCSgs1qc-oIwnB8CrNRPk29pAoLuK52wMgwSt6FB3FPdHsLO3xp5p7vqO9PXJmW46zRqR7pQlNEaEseZGyrNLjv4aPG3kUsYj2THpBdZJP1O1OZoe02B6ZrOyUeAsmrfZjpVnPbI5gPt1fU8j5eZKo

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 111B 17 KB
6 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 26 Jan 2024 16:23:11 GMT

GET
H3 200 60005582_20231130062635025_160x600_LOOK_01.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 111B 34 KB
34 KB 29ms
28ms Image
image/png 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20231130062635025_160x600_LOOK_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e1eb4ff34ebc6610375d4784a0d9380270a3020b12a6a6b6a7561c53c2eafc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5793540040533475328/160x600.html?e=69&leftOffset=0&topOffset=0&c=Hh90YyhcUp&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 23:30:43 GMT
x-content-type-options: nosniff
age: 60748
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34675
x-xss-protection: 0
last-modified: Thu, 30 Nov 2023 14:26:35 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jan 2024 23:30:43 GMT

GET
H3 200 60005582_20231130062639026_160x600_LOOK_02.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 111B 34 KB
34 KB 33ms
33ms Image
image/png 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20231130062639026_160x600_LOOK_02.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

259d01a96002989e72822cf078f8d28e104bc6f14e5ec7240158d3f20331761f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5793540040533475328/160x600.html?e=69&leftOffset=0&topOffset=0&c=Hh90YyhcUp&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 23:22:17 GMT
x-content-type-options: nosniff
age: 61254
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35049
x-xss-protection: 0
last-modified: Thu, 30 Nov 2023 14:26:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jan 2024 23:22:17 GMT

GET
H3 200 60005582_20231130062642874_160x600_LOOK_03.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 111B 32 KB
32 KB 38ms
38ms Image
image/png 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20231130062642874_160x600_LOOK_03.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

491a558162e6ff547b47352cedf9942511757394b8b1ecddeba14355e163ce8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5793540040533475328/160x600.html?e=69&leftOffset=0&topOffset=0&c=Hh90YyhcUp&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 17:39:57 GMT
x-content-type-options: nosniff
age: 81794
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33034
x-xss-protection: 0
last-modified: Thu, 30 Nov 2023 14:26:42 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jan 2024 17:39:57 GMT

GET
H/1.1 200
OK postview.gif
portal.o2online.de/nws/img/ Frame 111B 43 B
609 B 98ms
32ms Image
image/gif 141.101.90.96
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portal.o2online.de/nws/img/postview.gif?partnerId=O2_DSP_TRA_HAV_14114_PV&mediacode=31166744_4307561_383699375_145341318_PO2502A20231201&ref=31166744_4307561_383699375_145341318_PO2502A20231201
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 141.101.90.96 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e46eb58f99814c32c849b97a268129ddb14ca88e9070964ee75a2cd987c66839

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Fri, 26 Jan 2024 16:23:11 GMT
Via: 1.1 varnish-live-1-0
CF-Cache-Status: HIT
Age: 5063079
X-Cache: MISS
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Connection: keep-alive
Content-Length: 43
Last-Modified: Thu, 09 Nov 2023 15:03:02 GMT
Server: cloudflare
Etag: "2b-609b98009f580"
Vary: Accept-Encoding
Content-Type: image/gif
X-Varnish: 323115519
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
CF-RAY: 84ba195add02085b-FRA
Expires: Sat, 25 Jan 2025 16:23:11 GMT

GET
H3 200 container.html Show response
215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7FF8 6 KB
3 KB 23ms
23ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ar.hibapress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 16:23:10 GMT
expires: Sat, 25 Jan 2025 16:23:10 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 8CA0 43 B
215 B 298ms
179ms Image
image/gif 2600:1f13:800:7781:8c3e:5e6a:bcfa:1ac1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1874201&asId=5e12c3b9-b969-1377-610b-a93e407f49c3&tv=%7Bc:2qpLEd,time:283,type:e,im:%7Bpci:%7Btdr:164%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:284,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B279~0%5D,as:%5B279~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:u2ueYfQ+11%7C12%7C13%7C14%7C15%7C161*.1874201-77019270%7C1611%7C1612%7C1613%7C171,idMap:161*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:16,sis:136%7D&br=c
Requested by: Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:8c3e:5e6a:bcfa:1ac1 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
server: nginx
x-server-name: dt22.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 1ACE 640 B
265 B 60ms
59ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGO_r5oACMAE&v=APEucNVHiPn2IFxGsBfE1o4OTqmWoAoobFNO2IcjtF7HdLDENNHPuGqqWtDrOYa6tTifFJtyHmDDzMTCoYVQeY0_kIgwpex3ckdfLDox3dWCwQCuGCyIokACUoTRiliGqpjAT-Q2kFxKRG5WPb3KTiSAmStgpfkjKNABwp7Ww7rXdKwX4vXW6no

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 16:23:11 GMT
expires: Fri, 26 Jan 2024 16:23:11 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 7FF8 89 KB
31 KB 135ms
133ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:11 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 26 Jan 2024 16:23:11 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7FF8 42 B
63 B 168ms
167ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BD8dHBP6YM1AFkUOQ99lE0SJOvI1F1a1HBQ-LxFFlbvqDf4TDT4cxv1Vp0mkW98q7wrzic2LNgMWFDxpbMzM3qCcCxzZh7dD6XRNkIkEA15kQdd1k

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

skeleton.gif
static.adsafeprotected.com/ Frame 7FF8
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/1878143/77330005/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_dspID=3&ias_campId=1015562965&ias_pubId=pub-1219367199329714&ias_chanId=1&ias_place...
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&ias_xappb=

43 B
482 B

20ms
19ms

Image
image/gif

2600:9000:223f:e200:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&ias_xappb=
Requested by: Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:223f:e200:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 17:29:44 GMT
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
via: 1.1 ab985bb6f3435d42701015dfa6015878.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 3970408
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 43
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: AmazonS3
etag: "45cf913e5d9d3c9b2058033056d3dd23"
content-type: image/gif
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: me4mZ2k6YAXQR3ZCNiTrqoKbDA2FrvPGZiKWpwfvHP1M-e5Lm7kLqA==

Redirect headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
server: nginx
x-server-name: app11.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&ias_xappb=
cache-control: no-cache
content-length: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/ Frame 7FF8 3 KB
1 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/window_focus_fy2021.js

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 10:22:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21615
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 10:22:56 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/ Frame 7FF8 20 KB
8 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d58acf16b5e4521c9eb24fe9fd97308e5f8be1297e4b63a547e5b610611799ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 23:41:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 60074
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8492
x-xss-protection: 0
server: cafe
etag: 9878124937798820110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Feb 2024 23:41:57 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7FF8 205 KB
65 KB 31ms
30ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fcab795411fac2ef4fe726fc3ee3ad3192ff76a846fa3b28616b3b6e61fae83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66337
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1706100845105677"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Jan 2024 16:23:11 GMT

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame 0FB6 39 KB
15 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 10:22:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21614
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 10:22:57 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 1ACE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFHkP6xKZmhEtVpn6T1J2wk&google_cver=1

43 B
105 B

37ms
32ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFHkP6xKZmhEtVpn6T1J2wk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGO_r5oACMAE&v=APEucNVHiPn2IFxGsBfE1o4OTqmWoAoobFNO2IcjtF7HdLDENNHPuGqqWtDrOYa6tTifFJtyHmDDzMTCoYVQeY0_kIgwpex3ckdfLDox3dWCwQCuGCyIokACUoTRiliGqpjAT-Q2kFxKRG5WPb3KTiSAmStgpfkjKNABwp7Ww7rXdKwX4vXW6no
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFHkP6xKZmhEtVpn6T1J2wk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 1ACE 43 B
295 B 81ms
31ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGO_r5oACMAE&v=APEucNVHiPn2IFxGsBfE1o4OTqmWoAoobFNO2IcjtF7HdLDENNHPuGqqWtDrOYa6tTifFJtyHmDDzMTCoYVQeY0_kIgwpex3ckdfLDox3dWCwQCuGCyIokACUoTRiliGqpjAT-Q2kFxKRG5WPb3KTiSAmStgpfkjKNABwp7Ww7rXdKwX4vXW6no
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 1ACE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESELgIfj82blzLxAW-F3MgcwQ&google_cver=1

23 B
163 B

78ms
78ms

Image
image/gif

2.19.217.101
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESELgIfj82blzLxAW-F3MgcwQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGO_r5oACMAE&v=APEucNVHiPn2IFxGsBfE1o4OTqmWoAoobFNO2IcjtF7HdLDENNHPuGqqWtDrOYa6tTifFJtyHmDDzMTCoYVQeY0_kIgwpex3ckdfLDox3dWCwQCuGCyIokACUoTRiliGqpjAT-Q2kFxKRG5WPb3KTiSAmStgpfkjKNABwp7Ww7rXdKwX4vXW6no
Protocol: H2
Server: 2.19.217.101 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-217-101.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Fri, 26 Jan 2024 16:23:11 GMT
pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESELgIfj82blzLxAW-F3MgcwQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 1ACE 23 B
163 B 119ms
94ms Image
image/gif 2.19.217.101
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGO_r5oACMAE&v=APEucNVHiPn2IFxGsBfE1o4OTqmWoAoobFNO2IcjtF7HdLDENNHPuGqqWtDrOYa6tTifFJtyHmDDzMTCoYVQeY0_kIgwpex3ckdfLDox3dWCwQCuGCyIokACUoTRiliGqpjAT-Q2kFxKRG5WPb3KTiSAmStgpfkjKNABwp7Ww7rXdKwX4vXW6no
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.217.101 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-217-101.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Fri, 26 Jan 2024 16:23:11 GMT
pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 8CA0 43 B
215 B 179ms
179ms Image
image/gif 2600:1f13:800:7781:8c3e:5e6a:bcfa:1ac1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1874201&asId=5e12c3b9-b969-1377-610b-a93e407f49c3&tv=%7Bc:2qpLGn,pingTime:-10,time:417,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtNjB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjAuMC42MDk5LjIyNCBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1706286191895%7C%7Cadeac2d1a27fea956949b178bc75ad3b%7C%7C09dd4f7e094d0daae996260c074cbdea%7C%7C2ee75f4adedc2fbaa370937a8bb55fbd%7C%7C768b31d12e63da472b3206e0f6540223%7C%7C956b576cf57e0ef6d0311446249521ae%7C%7C24bcd9cf6d40f079dea6cf7368509e9e%7C%7C1a2215fe21e8236ebd690fa5960b5063%7C%7C1663701684%7D
Requested by: Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:8c3e:5e6a:bcfa:1ac1 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
server: nginx
x-server-name: dt06.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7FF8 0
20 B 168ms
168ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1066647575667&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7FF8 0
20 B 168ms
168ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1066647575667&version=m202309260101&ct=76&x=1&cor=13786742586259315000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7FF8 101 KB
39 KB 77ms
76ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AnCH7dPWGH1rKSggNvpxGIoV4bqNEiqRMFAVB9le9vezDuZwTYSUcGd2hghrjxiFHANHkIlweT3uNr40nwx3gK6lzkQOTgo3ofUrfS8lzUMBL2YRrxfsWojwGklCJFrFtnjZlcc6mlUwn6Ho_mcwjruWa8-3y1mpPUdLUNX-8ZUzVwUIs&dbm_d=AKAmf-CSQxUy7_nLMg-7udTvjTk7bJFv3RTAK32Ro-3oDO_P4Zg6qTNaIm56YXzCn7f1OzT-W5XUHzzoXn_pjFXBmppBJ5Qp7gi4X9dUa3Z9PxVQXWhuTqWxRwfrPbDNP8vUEoGKOHfw9MeMA-QQl-oCpsD3Xd9h_tRwzWERcief5su9UBk99Ht3P7MBHzhKXPpSGwYXi1PCoZuqlqyYr5bUwc37hfacgAk11CMWvAHJoUvMzVlyQI1g0LSZ1_ORECT2AZt9xvq3ndsmfZNle_4wImTd9Jfl7njBLfvbTDmZC2YtaTuxnrgOkJ2jRa-jit4fTXP5-5u-aNl4BsMwys366in9s0R7VQOzQEelPIyfPqrqc5uHFO6q5kIkhEZfJXuWuLiQaIDLxHvHb3oss3ULxV9nfACzQLKfyM2zxkwQ1-h6oXEU3uttiMCpv3cHJrS_Ur1x69saZuKp0Fax28EYhGRscWysI5s3jhIC8mahr2pfkb7LempwZAPtT8sxe8nepJ4Mk8sRannD2TEDIoPaFTNLPai4nK_PIy40unb0N1Kxc6zkPkRBaFqWvlYuIINYQcsilxAd6I0KY2WnGTgWnJ4HP6rF0TjFdCEwvZJ-mCFVwQwDwKlgKX5MyWGmcZq5LKO83GqC5sSIlSq16P8wuXD_y7vXlUlO8dbQ96yqWf-X6uq24K3ox3fyr1cu284ERfYTeUlB5YHnGN4tozcfXxJMgKik4pjmdo70akBY0ezlBoVBIgDsoeBfLlYTMDUXA7HwP1-ds2uP5A4Jh0bmK6XrkLr6ap3ioTgVd7ZNg9QaeHAE2Fh4QzGfImvXYiP8TEgrBaYhi8EvkkTASuptQ5VPiqnqEk_bVtEH71FF0_TQnQj5P6zu1MQBTvy6NhiTcRlyYqo9ePiQztbddrLM0F8TFJwbpueGyMFBoYJvzpJmtTbqVBICbgI4qflkrnF9lF-WsOMNq809RS0IPeu7b9hCabup8deyf4R3JXkRDf4QcdM5X1v2CprVU-uCq3BYZODj1bMfKtAKIs4yFyaPNVmLXXanEOS9Og5w7dWIeYLpqi5lBH5aYNRLWxNjblrsXpdC9NTftkIKBCUEJye3rTs9rwdoy9HRsM11AaQnEk1zUB3zhPk-ZMi-t29saRkCjQblj2QnwQg8LttrPkOe1rvGMurwy1Q0ZYf0rAOHYSU-5hS-s2_CCIKL7wY2OUPho2xdoUCZoIGHR1LhL3uy2eUMLQS7ihGOXgcutbX4eAbslr4fSYEFg5yWe1lpL6eZM-8ll0pvKICMMxK2X_yOnws_ZAUKBDdHwrH7v5SRNF-GMDoEzx5cFGfErCjh3R5Eh0NXbhlcmzNMD9ekevcA-XPtqPaSV8k5sEe1tKnMR9QUqyCmy-TCU_0_JkP7ShqknRUsldewcHoZDZ1sNihZKTwlq1HpdbVu1FMhCoz6WuT8vhx88xQ5q4mcOEyIA7wBBS4zQFaSkf0O7UMtVP8w0009wxUJy7-tWXg3AdhC7h3cwi_tX9L85sU5uCHRh7qRWh-ohrhgB2WErrdU0JkNbUxAMlnODpDOIlgc5RpRW5lyFn5a0MToOxLdjER6gx44hat20kIBaeWVmnV-gV8ocavbAUi0voTxfqDDkM0JwutKKh0n6R8lpyEb2LM3ve-_k0LlbHgF1tJiJRMQuZm7xsZyJ3GiHt2mEVXsKNWKBOXV-In2HOWvYwbxfGIryW4DEEgmujqbUFPhJxszuCrCfOnEkAX9q9aPF-jpbVfy2kePbyTTdHh6lCWWAMhtpYkN8efF1jzkEY3812LstUbEONVteK9qHt8nw9-9r5HEmtnmWORKm0sij-L2W3NzEMMdOE2bqZgbW5UpzLrqtG4YpU_3Zm_CO-qOIjeCSS2U9S-d6EMhJO-VHE_17u80xbxVp_ocVdgRWZ8dEqlPgS29u89UVra7M4NOVisBUzdRYxrWd5ohmhhXkid8TPD2D7o8dX-a-JpkRIv_kp9G5m7q-axBABQpK_yuqBunvm0_8udBz8w4EQHG3mhHhfM3nvRlHcUBUIHPn9tydAFwMs10S8IpmYKuVLkZvJcaGNhYyKWixTOH4DA3Mtc0cyKA1tD4hTSfQIqUAzatYrOXr4lCprzTLkNiK3ZUCw9ITSR40AyAwvTaiGku_a2Ae8FSFnkO6zGsKUAobZXRpToealmb3qV7u3MGSZglhY934_KJpnQPgWfGIARwZLmV-swveaqRO79CUzE9Cu_gBTd58WSFTLrP_qmXF6NYtNbkoA4HFUrqNM4q3o5gNyuRZDYsyEPfKn52TTPnC2Grs88CVi2A4LIweq2bq23Ya-q0f97yWEl_pBPa7p_W0I8WrMvdBHDDVade5w6utjqwTck2KfMmJN1hcXG7i-ydBA0LoqtdDDcOqqOtVDlzuD4EaBkXRZFRUxqhE8GzD7KIxR03_YLn-kqpYcuTv6n-F3L1M2Zd4QkX-F9z4heOornPaYH7qQJjyp-Gd794E8-rth_M1L_UxEx_tCehJC-5JxdNBlC7BFvjeqgotOONSX3dP_uJEHs_XCamrfJptuOUdPp-IJpNBrgskoF0d8CMGsp8bxQ2ZOxUEj2ZYZv7JWDQ5soC1HVk_skDQOaJnXX1wqGGyUtXzigNiRhEr5ncf3BrbjQ2wI0csOXpP1FFYSJOy7gGD_i2yPctLWebnn9cVcyDJXKSiq9xcxA2ax_g6aozeum3c2ir8UHFrjvWzWZCduphscpsEJ-VgmiIgGKggsy3qUyg6jb0XNRBQFfKrbNRdPIStWu7xBQjWtul6Iwq8zAOkxf8sMDqeUkNto-DYL43NaW6Tug3pbkdGPLjQjuAmDVz-JcWRxbFy7Tpi1KR8OqrXozlq3yuBC6QZvZZYiV44Q-p4K67EGkAuOuNSzuMnHGsrMF6-pD_wybVD0KMXjj8q9fvS-D9KdEYaF4Jc-OTv60izVAwBqz1AA3EFEqPJH30Rsnqa3_uwEsWh87Zo03gwBrguse7TUXl0Xe3tEQ7nf6D0KLg8WMLYT3jcXszw_04vLwnGF9YCiJdGMsmkvAK_w6yRNEIXvbhuNY3ZZ1QTih7vRX0Tgi-ZUmnn0dbE3XGxHkjATlOOOSF1NoLOQbYL_5chknq3ErEaMJeFYHE08dp_rGxzc4bjemTaRFNzuPniLAjQjcKo_Hbl3mCYigoI755al7dzm7XNHIkjSfDqlGQj1g29rYg95nwtHnN7dSivVoesGsiz83LM5LD-kYe5KWw0jOrlGc3XbS5Pl6Otxappy9hHyEVhD5SdkAYcDfJvacqM6c2CU64MjTJlQvIBpJenIhAV5Sn3jEDJ6fJmIng3rC25a3otHEqc16TUS1OiroD7LE6UxtwaP3jDs_LG78NZYUDY4nt4E_4icpdGvXfn4JvresikFagu4rcnK_xS0vvL4XOkxshBG5VF2aT5B-aLto0lTMVIgeQzfnByeItXX0ggHxwTo44jIAc8xxPU-SCbjgPyJB1qG1gu_s5e3yYC3-AoRm3zc6AsFK4_wPRSmam9_VDFSBeYmIA5Y-E35NoX-nPl847-kPNmJcIzXTVlTGB18bj2UcAhnXyzEhXmMOcRAvGmfbWZiuVHcWH2Ei8BWMc9zaMPuLbu-vYN7zidnsEuQ17cDdZ02oKNxpksm5HaYRt-Cfs0y1WjnW7-BfHSK8RxJCbXkFm9-H4Um46CKV6BuZj1nKhY1TNmP0Fk96_XYs9UdgpLD6jm2WCo02Ps5i8y35JaA-oc2GSbhskalpHhZ1Hbhmi8sOAzf7Y8vndVa0DLOXWEEzekpc8OF9DM_Kwe2yCsV5nnnHIUh3dCOZUazgxrZpwnNuB8e_XDAmSrCCaIICTAwZVdl8vFhabRjtifwKTnyF6CVpXokpu9kq9hu6Hohfvu8QXkNSrKToHtjGaR1hV_nGsnb7OLUeBhpx-zzxOddF1RQs2tciiKjMqVKub0hk6H4C34-p3_FaxHZ7D2arOmzx9X1RuL908rnn4yHpG51xQMN41KTkX5UNHQHsqLoHe8QeOro6QhqTtAtP3E6_gFPiSNdOelsD2gf4MLvNOmCfJ8ZcjTULsbuPfBkb6QOyP0sCPdxrJNYYxTpc64BUc0h3W2IqxxnIZesxtgiZ-k6F7oVAC56I5ZOlOm5nz1PXhcIKl7zDUkIhpHMJy4OfpzTdL4clf8_v48Lc-Z4C5uzK0ICVUt6FiC9-5XpKgD6zzCVttlxy4l3mKHP97pNyw7bxVYQjJqwPOvoRCbps&cid=CAQSTwAvHhf_Z3iTFAF-GAvhTEn9qvZcIyJlefhGsSn3zQR8544diILodDQ5h2ydECyPZIKZTXqTCa-7dnSQo03bOfema3w7GOTL4h3h9VltjhcYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Far.hibapress.com%2F&ds=l&xdt=1&iif=1&cor=13786742586259315000&adk=3047537734&idt=142&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

83d48ad46ebd6828ef007eb47c01441a65dea28287cef60a2ebc52f38f2d3008

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40138
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 7FF8 172 KB
60 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Origin: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 23:49:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59648
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jan 2024 23:49:04 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240122/r20110914/elements/html/ Frame 7FF8 12 KB
4 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240122/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AnCH7dPWGH1rKSggNvpxGIoV4bqNEiqRMFAVB9le9vezDuZwTYSUcGd2hghrjxiFHANHkIlweT3uNr40nwx3gK6lzkQOTgo3ofUrfS8lzUMBL2YRrxfsWojwGklCJFrFtnjZlcc6mlUwn6Ho_mcwjruWa8-3y1mpPUdLUNX-8ZUzVwUIs&dbm_d=AKAmf-CSQxUy7_nLMg-7udTvjTk7bJFv3RTAK32Ro-3oDO_P4Zg6qTNaIm56YXzCn7f1OzT-W5XUHzzoXn_pjFXBmppBJ5Qp7gi4X9dUa3Z9PxVQXWhuTqWxRwfrPbDNP8vUEoGKOHfw9MeMA-QQl-oCpsD3Xd9h_tRwzWERcief5su9UBk99Ht3P7MBHzhKXPpSGwYXi1PCoZuqlqyYr5bUwc37hfacgAk11CMWvAHJoUvMzVlyQI1g0LSZ1_ORECT2AZt9xvq3ndsmfZNle_4wImTd9Jfl7njBLfvbTDmZC2YtaTuxnrgOkJ2jRa-jit4fTXP5-5u-aNl4BsMwys366in9s0R7VQOzQEelPIyfPqrqc5uHFO6q5kIkhEZfJXuWuLiQaIDLxHvHb3oss3ULxV9nfACzQLKfyM2zxkwQ1-h6oXEU3uttiMCpv3cHJrS_Ur1x69saZuKp0Fax28EYhGRscWysI5s3jhIC8mahr2pfkb7LempwZAPtT8sxe8nepJ4Mk8sRannD2TEDIoPaFTNLPai4nK_PIy40unb0N1Kxc6zkPkRBaFqWvlYuIINYQcsilxAd6I0KY2WnGTgWnJ4HP6rF0TjFdCEwvZJ-mCFVwQwDwKlgKX5MyWGmcZq5LKO83GqC5sSIlSq16P8wuXD_y7vXlUlO8dbQ96yqWf-X6uq24K3ox3fyr1cu284ERfYTeUlB5YHnGN4tozcfXxJMgKik4pjmdo70akBY0ezlBoVBIgDsoeBfLlYTMDUXA7HwP1-ds2uP5A4Jh0bmK6XrkLr6ap3ioTgVd7ZNg9QaeHAE2Fh4QzGfImvXYiP8TEgrBaYhi8EvkkTASuptQ5VPiqnqEk_bVtEH71FF0_TQnQj5P6zu1MQBTvy6NhiTcRlyYqo9ePiQztbddrLM0F8TFJwbpueGyMFBoYJvzpJmtTbqVBICbgI4qflkrnF9lF-WsOMNq809RS0IPeu7b9hCabup8deyf4R3JXkRDf4QcdM5X1v2CprVU-uCq3BYZODj1bMfKtAKIs4yFyaPNVmLXXanEOS9Og5w7dWIeYLpqi5lBH5aYNRLWxNjblrsXpdC9NTftkIKBCUEJye3rTs9rwdoy9HRsM11AaQnEk1zUB3zhPk-ZMi-t29saRkCjQblj2QnwQg8LttrPkOe1rvGMurwy1Q0ZYf0rAOHYSU-5hS-s2_CCIKL7wY2OUPho2xdoUCZoIGHR1LhL3uy2eUMLQS7ihGOXgcutbX4eAbslr4fSYEFg5yWe1lpL6eZM-8ll0pvKICMMxK2X_yOnws_ZAUKBDdHwrH7v5SRNF-GMDoEzx5cFGfErCjh3R5Eh0NXbhlcmzNMD9ekevcA-XPtqPaSV8k5sEe1tKnMR9QUqyCmy-TCU_0_JkP7ShqknRUsldewcHoZDZ1sNihZKTwlq1HpdbVu1FMhCoz6WuT8vhx88xQ5q4mcOEyIA7wBBS4zQFaSkf0O7UMtVP8w0009wxUJy7-tWXg3AdhC7h3cwi_tX9L85sU5uCHRh7qRWh-ohrhgB2WErrdU0JkNbUxAMlnODpDOIlgc5RpRW5lyFn5a0MToOxLdjER6gx44hat20kIBaeWVmnV-gV8ocavbAUi0voTxfqDDkM0JwutKKh0n6R8lpyEb2LM3ve-_k0LlbHgF1tJiJRMQuZm7xsZyJ3GiHt2mEVXsKNWKBOXV-In2HOWvYwbxfGIryW4DEEgmujqbUFPhJxszuCrCfOnEkAX9q9aPF-jpbVfy2kePbyTTdHh6lCWWAMhtpYkN8efF1jzkEY3812LstUbEONVteK9qHt8nw9-9r5HEmtnmWORKm0sij-L2W3NzEMMdOE2bqZgbW5UpzLrqtG4YpU_3Zm_CO-qOIjeCSS2U9S-d6EMhJO-VHE_17u80xbxVp_ocVdgRWZ8dEqlPgS29u89UVra7M4NOVisBUzdRYxrWd5ohmhhXkid8TPD2D7o8dX-a-JpkRIv_kp9G5m7q-axBABQpK_yuqBunvm0_8udBz8w4EQHG3mhHhfM3nvRlHcUBUIHPn9tydAFwMs10S8IpmYKuVLkZvJcaGNhYyKWixTOH4DA3Mtc0cyKA1tD4hTSfQIqUAzatYrOXr4lCprzTLkNiK3ZUCw9ITSR40AyAwvTaiGku_a2Ae8FSFnkO6zGsKUAobZXRpToealmb3qV7u3MGSZglhY934_KJpnQPgWfGIARwZLmV-swveaqRO79CUzE9Cu_gBTd58WSFTLrP_qmXF6NYtNbkoA4HFUrqNM4q3o5gNyuRZDYsyEPfKn52TTPnC2Grs88CVi2A4LIweq2bq23Ya-q0f97yWEl_pBPa7p_W0I8WrMvdBHDDVade5w6utjqwTck2KfMmJN1hcXG7i-ydBA0LoqtdDDcOqqOtVDlzuD4EaBkXRZFRUxqhE8GzD7KIxR03_YLn-kqpYcuTv6n-F3L1M2Zd4QkX-F9z4heOornPaYH7qQJjyp-Gd794E8-rth_M1L_UxEx_tCehJC-5JxdNBlC7BFvjeqgotOONSX3dP_uJEHs_XCamrfJptuOUdPp-IJpNBrgskoF0d8CMGsp8bxQ2ZOxUEj2ZYZv7JWDQ5soC1HVk_skDQOaJnXX1wqGGyUtXzigNiRhEr5ncf3BrbjQ2wI0csOXpP1FFYSJOy7gGD_i2yPctLWebnn9cVcyDJXKSiq9xcxA2ax_g6aozeum3c2ir8UHFrjvWzWZCduphscpsEJ-VgmiIgGKggsy3qUyg6jb0XNRBQFfKrbNRdPIStWu7xBQjWtul6Iwq8zAOkxf8sMDqeUkNto-DYL43NaW6Tug3pbkdGPLjQjuAmDVz-JcWRxbFy7Tpi1KR8OqrXozlq3yuBC6QZvZZYiV44Q-p4K67EGkAuOuNSzuMnHGsrMF6-pD_wybVD0KMXjj8q9fvS-D9KdEYaF4Jc-OTv60izVAwBqz1AA3EFEqPJH30Rsnqa3_uwEsWh87Zo03gwBrguse7TUXl0Xe3tEQ7nf6D0KLg8WMLYT3jcXszw_04vLwnGF9YCiJdGMsmkvAK_w6yRNEIXvbhuNY3ZZ1QTih7vRX0Tgi-ZUmnn0dbE3XGxHkjATlOOOSF1NoLOQbYL_5chknq3ErEaMJeFYHE08dp_rGxzc4bjemTaRFNzuPniLAjQjcKo_Hbl3mCYigoI755al7dzm7XNHIkjSfDqlGQj1g29rYg95nwtHnN7dSivVoesGsiz83LM5LD-kYe5KWw0jOrlGc3XbS5Pl6Otxappy9hHyEVhD5SdkAYcDfJvacqM6c2CU64MjTJlQvIBpJenIhAV5Sn3jEDJ6fJmIng3rC25a3otHEqc16TUS1OiroD7LE6UxtwaP3jDs_LG78NZYUDY4nt4E_4icpdGvXfn4JvresikFagu4rcnK_xS0vvL4XOkxshBG5VF2aT5B-aLto0lTMVIgeQzfnByeItXX0ggHxwTo44jIAc8xxPU-SCbjgPyJB1qG1gu_s5e3yYC3-AoRm3zc6AsFK4_wPRSmam9_VDFSBeYmIA5Y-E35NoX-nPl847-kPNmJcIzXTVlTGB18bj2UcAhnXyzEhXmMOcRAvGmfbWZiuVHcWH2Ei8BWMc9zaMPuLbu-vYN7zidnsEuQ17cDdZ02oKNxpksm5HaYRt-Cfs0y1WjnW7-BfHSK8RxJCbXkFm9-H4Um46CKV6BuZj1nKhY1TNmP0Fk96_XYs9UdgpLD6jm2WCo02Ps5i8y35JaA-oc2GSbhskalpHhZ1Hbhmi8sOAzf7Y8vndVa0DLOXWEEzekpc8OF9DM_Kwe2yCsV5nnnHIUh3dCOZUazgxrZpwnNuB8e_XDAmSrCCaIICTAwZVdl8vFhabRjtifwKTnyF6CVpXokpu9kq9hu6Hohfvu8QXkNSrKToHtjGaR1hV_nGsnb7OLUeBhpx-zzxOddF1RQs2tciiKjMqVKub0hk6H4C34-p3_FaxHZ7D2arOmzx9X1RuL908rnn4yHpG51xQMN41KTkX5UNHQHsqLoHe8QeOro6QhqTtAtP3E6_gFPiSNdOelsD2gf4MLvNOmCfJ8ZcjTULsbuPfBkb6QOyP0sCPdxrJNYYxTpc64BUc0h3W2IqxxnIZesxtgiZ-k6F7oVAC56I5ZOlOm5nz1PXhcIKl7zDUkIhpHMJy4OfpzTdL4clf8_v48Lc-Z4C5uzK0ICVUt6FiC9-5XpKgD6zzCVttlxy4l3mKHP97pNyw7bxVYQjJqwPOvoRCbps&cid=CAQSTwAvHhf_Z3iTFAF-GAvhTEn9qvZcIyJlefhGsSn3zQR8544diILodDQ5h2ydECyPZIKZTXqTCa-7dnSQo03bOfema3w7GOTL4h3h9VltjhcYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Far.hibapress.com%2F&ds=l&xdt=1&iif=1&cor=13786742586259315000&adk=3047537734&idt=142&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 03:29:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46419
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 03:29:33 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240122/r20110914/ Frame 7FF8 31 KB
12 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240122/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5fa42c1d96f1d20bb0a5c0f1468aba661ad4c3584dd51646a3bfb996e869b8dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 03:29:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46419
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11931
x-xss-protection: 0
server: cafe
etag: 11828260617052087593
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 03:29:33 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 7FF8 41 KB
14 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 11:54:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 102535
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 Jan 2025 11:54:17 GMT

GET
DATA 200
OK truncated
/ Frame 7FF8 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c8bb59284c823396a3a25ba48a294046aa15d27d9e9e48fef481d88c970a26b5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 9C60 38 KB
13 KB 20ms
19ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 102535
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 25 Jan 2024 11:54:17 GMT
expires: Fri, 24 Jan 2025 11:54:17 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/187560977508666974/ Frame F953 30 KB
5 KB 54ms
54ms Document
text/html 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/187560977508666974/index.html?e=69&leftOffset=0&topOffset=0&c=2LUwu8upUY&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90adf63ecea9c3a4f995a0b5a95f69f73e42dcf1bc9d3509874f9df34891cd83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 16:23:12 GMT
expires: Sat, 25 Jan 2025 16:23:12 GMT
last-modified: Wed, 27 Sep 2023 08:53:45 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7FF8 0
0 63ms
62ms Fetch
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvLcTOLY5kG2Mo4nuGXpCAy252VE6ii7G-2M-z8GKew_RjyYJ7LIXxs_oWYWOIVxNOpNIc28xn0MmnRwTbucnXoh1JZOCpC7aYkXhdbnUJSyp4SrNSboA0s6H4z2eTgTBdHBdRVblbCQdi5G0GyEIt3pFgu57jHpZd6lgWJo9p97ot6qalClC8NVwVPfaVCPy032f_W8OK1PnRSEoOSHwjSVFo3g-w3W7RQM8ytj7hc5XCWuWZaMrb6wcKCg3ndRbGbuGv-GPL3ydJF--cNQz64k6S_HicQZY8SDbaNiWUBfYxLjpVN7EmAigOAvxdJpI7xJeC2xUGGQcHh0YHVrMnLpj9tAY2Zl_3lFOyLgbSaZ2ZQVzUPo4QUNWN3O236OMsaKW6X5iTpdy2olTnFnHu4x9nwku7v1YJSY0OWugfW9kueFtVbjh6NqSWCz9l4VdxOszuiDkKLApT7a-MXXyv5hP6JLfZtngNKn8ad1I7xESxS-cGH6T43Qhdy--ghpBzosXjshRT7fGCXNCBjA4trPSdVWDYpl5dJBLI58NGARL1Qa97_ROb90nSBXua_NrNS6ytDa1JIz-Trs-7bkx1jSar-ID-0rAJPUhFkjW4JvkiE332xrXUwQ5Oxkpkoa91m2K-rfM3og_kwpZYv1e5HHR1K1lNnVAup9iv4ZaYLtK-3En2Xk2GMUKpjylqsGrPnHgU_aNMIRnpFxmf9TaW3SIaosxaqEUBGYAlZXUvCZRg7UxVx7Sdi0JQVeOxAxup1PSi-hl94p0tBBAJr75LWEGVe4EUjzBbBru0STa6MoVhk0HeVtfvdee6oP3shTNXo0V0O8LZUuG1hFE2RJa4LSu184DznuaIYVP4HORyAi8hpoYYIZUvMaBgWOx4k7qohxhgBC91QUlChxQbzQZWn6TUIH-iG5gU2Y-3XhQhV5xhWAPLBsBYW0MWPJDrw2JiPLFgSh-9cShvsKo6x8-gMl-giqHdQUstaiZF5dIPis3K_xBRlKrHo_YguLUxSFunJ0SUix7pq7F4tQ1H5sgPQeuQUbVG6Zl1da8V7UrHUmy4D7FZTNMQCapDgpV4xbNBot-1B4Dwx6BK7MQ8W9py4V2QtmT2NiqSwbYtaPbRBTsRZPeLrDMW9TSIaHYPt_6CPdQ096nc3aK4FtqU3IIAuk9bpocQGJ-1SUHJyvas5owc3DfGP2e-iIwmYS3CRSqWyFAncxwZsnQIhFvi_ZnIjZ3GG5dL4O4HrcFHKnpJ01hm5lcSSVTlFlNpWJsHjJcioqYlm6-363DrCg_ZpDTTj2scCu61ngCRwMQ6pLzhpMRO2fz4SghkQbCSBY6qILqeyTVweSzD0Mvc-6NuXz9-zY7EDxaV6RSoElvo45npxrSEIC3TbhETZZLBJ2dE7NP1rspTm7nUJEmg&sai=AMfl-YT_DfdHBrGzf23QFVLK3czjf2o5uW2ObxfAs5Vnv_egCpr9_Ms1xFXV-Kf1m9g-QlR24FT-JH6kJVflHVMu2Fx9_z_XJSs289Xun0fSpeFJ30T9PjDwnGf_bFYpyHpKaEmaLOVbbi8sl7ZCp8HblF6AirrQpG-uurscvJOUxrJVWwJDlrvjPGUdRyRxtaEZAi0LFVNbOKFfSdCgCDplegQ-sb5wYjV6JoJWH64tjxWVLyTYdAY-El_HYk1ceA_ihJpiU-IuAttlNLIYB28CDr_-KUISCIxDx2S5tvSmmg&sig=Cg0ArKJSzJBW3XAxutA8EAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=51&cbvp=1&cstd=47&cisv=r20240122.25894&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-54-76-134-49.eu-west-1.compute.amazonaws.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 26 Jan 2024 16:23:12 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2

200

firstevent
skydeutschland.demdex.net/ Frame 7FF8
Redirect Chain

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=184604978&d_placement=383383107&d_campaign=31191216&d_bust=3174041577&gdpr=&gdpr_con...
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=184604978&d_placement=383383107&d_campaign=31191216&d_bust=3174041577&gdpr=&gdp...

42 B
734 B

52ms
52ms

Image
image/gif

54.76.134.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=184604978&d_placement=383383107&d_campaign=31191216&d_bust=3174041577&gdpr=&gdpr_consent=

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

54.76.134.49 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

dcs: dcs-prod-irl1-2-v054-0d743c645.edge-irl1.demdex.com 5 ms
pragma: no-cache
date: Fri, 26 Jan 2024 16:23:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: 6K+d9wl6TD4=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-irl1-1-v054-0d3e12a4c.edge-irl1.demdex.com 0 ms
pragma: no-cache
date: Fri, 26 Jan 2024 16:23:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: O8rNLyhTRqI=
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=184604978&d_placement=383383107&d_campaign=31191216&d_bust=3174041577&gdpr=&gdpr_consent=
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame 9C60 39 KB
15 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 10:22:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21615
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 10:22:57 GMT

GET
H3 200 style.css
s0.2mdn.net/sadbundle/187560977508666974/ Frame F953 5 KB
2 KB 25ms
25ms Stylesheet
text/css 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/187560977508666974/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/187560977508666974/index.html?e=69&leftOffset=0&topOffset=0&c=2LUwu8upUY&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f377965ecd9c8d0159a7949e977cfa96c6ad41edc3a27b8b786e65f20309b59e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/187560977508666974/index.html?e=69&leftOffset=0&topOffset=0&c=2LUwu8upUY&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 08:58:00 GMT
date: Tue, 23 Jan 2024 08:58:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 285912
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1718
x-xss-protection: 0
last-modified: Wed, 27 Sep 2023 08:53:45 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame F953 120 KB
41 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/187560977508666974/index.html?e=69&leftOffset=0&topOffset=0&c=2LUwu8upUY&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/187560977508666974/index.html?e=69&leftOffset=0&topOffset=0&c=2LUwu8upUY&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 11:17:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18348
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 27 Jan 2024 11:17:24 GMT

GET
H3 200 gsap_3.11.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame F953 69 KB
27 KB 57ms
56ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.11.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/187560977508666974/index.html?e=69&leftOffset=0&topOffset=0&c=2LUwu8upUY&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fbae080321632ad4ce06e9207ef9a534abd1d6488a96a0a4334fa768d1f93717

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/187560977508666974/index.html?e=69&leftOffset=0&topOffset=0&c=2LUwu8upUY&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27635
x-xss-protection: 0
last-modified: Fri, 12 May 2023 16:03:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jan 2024 16:23:12 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9C60 0
20 B 173ms
172ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BURa2b9yzZazFOaiRjuwPjcGc2AoAAAAAOAHgBAI&bg=!iYqlisXNAAa8BdJLnAU7ADQBe5WfOGos4qL1MekE_-e6gmtWbpCBR2wSmUdQWnwNnC56WXgdH76387H0ZgyUsMX07LsZAgAAADNSAAAAAWgBB5kDF3jW62BeLOFH0x88-iB3zPB9oqzvvheUqX0GkBPeBrzjIA6DIN9WZmE38h4UUYdR1Az_Ci8STTnjZyV5sSYhc6ZX764eEtk4imzFRQAIlBhUDcjMwqiTsV5ePVixlmPWkoVBGeT-CNrpfz9ipBHFoFyquQfLNsZGSogLzA29YoVCy03EJ71GVqyl6IWUJchDs4LkmTULg80jd6DxFVfB1gK1RkU2Ewv2bx9oqA9vdC8tIz-5l7ueUNdSTwlP4VJtOPCcZakITBEadlIPIqsyPmMJETTsQae5webH1qn3XM04cDOaBo_YDTYJ6tSqA27bvHbSYnPGZnDfXuhuz2KeXCncVSc-n0HjA1X25jTM774sK0kBOB6c-zxBXJI-Pz15WBqTO4UFNxnSUwEkzynvrUgGjOnAKJiPApaZnMNTdZPxrS4aJFefbkag_UMTgXmAb6hoIkdnmZGn9CDrZ4B-2bf1Kal8ZcWYEj4sgn3T2jV3UCNO5EJ1vG21kFETqdQDe6Q5glVGfVlZhvb0OhNWcnFDi6ogp7mtLchSOaBuCytzBt3fx74ERA-4SSqtQafMqcDg0yE1jd0_QsFFrZNs9BW68aXDCfshJywp8w4Krcfyz_VZ4l0S-wm9RrsMyWyatnQ8x8q6LZFlsRcYH26J0KfajRAmeKspMCcF8hwaHvBB8tjJP28zREUyfDk4oBYDCCHBYkcyBw0l93gLokcsE5lGaFft3AmwYZPJs_cKQHiactG8zlEmCun4sDtAXSOT-AhA9GD4yZwHWww-JAUk0WYPvEpUnKD3SGPuxA9zYDtkf7-A3wO44psXux8FOYecBpS1VbZrh2eZlxWPPvuil4a-ZyLltPkQ_ACLmU4_oMV1iDQnE_It8I9x-kfBBv2XyZdVLIHAuLjDFivPZoisACZKgnZ0ADiYI43xeAjkZnq21O69P5madPgl8dNGY4Al8jdnjN3IG81yYZEHzhbbzC3FB-Jw9oGu99FF4Q_6pw6N-dx387U56ZHnovdPx2cvRQSPB0YCLj0w5Pee9wp-nkuMuoMbJea6

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame F953 8 KB
6 KB 112ms
111ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

39c18a1fe884e7c02e5d594ac28c2b0f8d48c54ee6f1fe449df5f293a717c3f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5950
x-xss-protection: 0

GET
H3 200 CTA_FX.png
s0.2mdn.net/creatives/assets/4736540/ Frame F953 519 B
550 B 22ms
22ms Image
image/png 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/creatives/assets/4736540/CTA_FX.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/187560977508666974/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e8e59c22f784ae124e2e4ea700d0361f147c5e67417abb1f845f49082190111

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/187560977508666974/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:20:37 GMT
x-content-type-options: nosniff
age: 155
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 519
x-xss-protection: 0
last-modified: Wed, 21 Dec 2022 12:50:41 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jan 2024 16:35:37 GMT

GET
H3 200 sky_bold.woff
s0.2mdn.net/creatives/assets/3668815/ Frame F953 28 KB
28 KB 24ms
24ms Font
font/woff 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3668815/sky_bold.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/187560977508666974/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dcda08a8d45d378df4fdeafd2529f3c7521d3e9c3a4b12daf2fe2c919940e57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/187560977508666974/style.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:21:15 GMT
x-content-type-options: nosniff
age: 117
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28672
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 12:38:17 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jan 2024 16:36:15 GMT

GET
H3 200 sky_regular.woff
s0.2mdn.net/creatives/assets/3668815/ Frame F953 33 KB
33 KB 90ms
90ms Font
font/woff 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3668815/sky_regular.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/187560977508666974/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f738547bbcdbef189de47347ad84fc0bb0c15164980f51a0214706fa5c94a73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/187560977508666974/style.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:20:51 GMT
x-content-type-options: nosniff
age: 141
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33980
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 12:38:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jan 2024 16:35:51 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8CA0 42 B
64 B 203ms
203ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuNW4r7OaQWALQfm1_bIgHgPe9e_ZPUSzm8ZCnOoFaxCjodPAr1-35ZhojXHEecIJO93U0PkqgOAYXRDINZoZSyWycRH5-SwY6mvSTbyIJI-G85U-yNPCiMJEQJS9c4hBN2tj7aZZWzI2nzWdiiNUe42VRk&sai=AMfl-YQjrjV3F8ZuR4v8Wf9aSwoJ0LuKyfzen6C4qzwkAs17yOcZoSAgPP-eHXoOmUYh-ZsGayYoUakmtJIgK42C28q8nsRAcrYZ1mmTwqiHzRd0HAIMmfoJxaKvnf7fsMXZxCmJIl6EHfdFoDPNp3pNUw&sig=Cg0ArKJSzK_Galdt76niEAE&cid=CAQSTwAvHhf_gsJZ5dDK1ZTWtMYenmLD0c8swuPHOD0nqrCEEl1bKcxWApt4Adx0fZBEzxc-GYlTXR-NSg4m2pQjKfeNBQ8WsAt1Z-heE1HZSTEYAQ&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20240124&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2927977637&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=170628619100&rst=1706286190924&rpt=309&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 DCO_Residential_True_Detective_S4_160x600.jpg_1702392396651_DCO_Residential_True_Detective_S4_160x600.jpg
s0.2mdn.net/dynamic/2/11041269/s0.2mdn.net/creatives/assets/4736540/ Frame F953 53 KB
53 KB 24ms
23ms Image
image/jpeg 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11041269/s0.2mdn.net/creatives/assets/4736540/DCO_Residential_True_Detective_S4_160x600.jpg_1702392396651_DCO_Residential_True_Detective_S4_160x600.jpg

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

060e28e8ee82098448ec47a6c4fb6247e72ba784ae0bb4656750a220c52d720a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/187560977508666974/index.html?e=69&leftOffset=0&topOffset=0&c=2LUwu8upUY&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 23:02:45 GMT
x-content-type-options: nosniff
age: 235227
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54690
x-xss-protection: 0
last-modified: Tue, 12 Dec 2023 14:47:04 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 22 Jan 2025 23:02:45 GMT

GET
H3 200 blank.png_1672924800548_blank.png
s0.2mdn.net/dynamic/2/11041269/s0.2mdn.net/creatives/assets/4736540/ Frame F953 95 B
124 B 27ms
27ms Image
image/png 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11041269/s0.2mdn.net/creatives/assets/4736540/blank.png_1672924800548_blank.png

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9df9512d0f2332b34e43e220b6bdc675dc6b663e72406edde64fd96dc9128e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/187560977508666974/index.html?e=69&leftOffset=0&topOffset=0&c=2LUwu8upUY&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 16:03:51 GMT
x-content-type-options: nosniff
age: 260361
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95
x-xss-protection: 0
last-modified: Thu, 05 Jan 2023 13:20:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 22 Jan 2025 16:03:51 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7FF8 0
0 57ms
56ms Fetch
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvLcTOLY5kG2Mo4nuGXpCAy252VE6ii7G-2M-z8GKew_RjyYJ7LIXxs_oWYWOIVxNOpNIc28xn0MmnRwTbucnXoh1JZOCpC7aYkXhdbnUJSyp4SrNSboA0s6H4z2eTgTBdHBdRVblbCQdi5G0GyEIt3pFgu57jHpZd6lgWJo9p97ot6qalClC8NVwVPfaVCPy032f_W8OK1PnRSEoOSHwjSVFo3g-w3W7RQM8ytj7hc5XCWuWZaMrb6wcKCg3ndRbGbuGv-GPL3ydJF--cNQz64k6S_HicQZY8SDbaNiWUBfYxLjpVN7EmAigOAvxdJpI7xJeC2xUGGQcHh0YHVrMnLpj9tAY2Zl_3lFOyLgbSaZ2ZQVzUPo4QUNWN3O236OMsaKW6X5iTpdy2olTnFnHu4x9nwku7v1YJSY0OWugfW9kueFtVbjh6NqSWCz9l4VdxOszuiDkKLApT7a-MXXyv5hP6JLfZtngNKn8ad1I7xESxS-cGH6T43Qhdy--ghpBzosXjshRT7fGCXNCBjA4trPSdVWDYpl5dJBLI58NGARL1Qa97_ROb90nSBXua_NrNS6ytDa1JIz-Trs-7bkx1jSar-ID-0rAJPUhFkjW4JvkiE332xrXUwQ5Oxkpkoa91m2K-rfM3og_kwpZYv1e5HHR1K1lNnVAup9iv4ZaYLtK-3En2Xk2GMUKpjylqsGrPnHgU_aNMIRnpFxmf9TaW3SIaosxaqEUBGYAlZXUvCZRg7UxVx7Sdi0JQVeOxAxup1PSi-hl94p0tBBAJr75LWEGVe4EUjzBbBru0STa6MoVhk0HeVtfvdee6oP3shTNXo0V0O8LZUuG1hFE2RJa4LSu184DznuaIYVP4HORyAi8hpoYYIZUvMaBgWOx4k7qohxhgBC91QUlChxQbzQZWn6TUIH-iG5gU2Y-3XhQhV5xhWAPLBsBYW0MWPJDrw2JiPLFgSh-9cShvsKo6x8-gMl-giqHdQUstaiZF5dIPis3K_xBRlKrHo_YguLUxSFunJ0SUix7pq7F4tQ1H5sgPQeuQUbVG6Zl1da8V7UrHUmy4D7FZTNMQCapDgpV4xbNBot-1B4Dwx6BK7MQ8W9py4V2QtmT2NiqSwbYtaPbRBTsRZPeLrDMW9TSIaHYPt_6CPdQ096nc3aK4FtqU3IIAuk9bpocQGJ-1SUHJyvas5owc3DfGP2e-iIwmYS3CRSqWyFAncxwZsnQIhFvi_ZnIjZ3GG5dL4O4HrcFHKnpJ01hm5lcSSVTlFlNpWJsHjJcioqYlm6-363DrCg_ZpDTTj2scCu61ngCRwMQ6pLzhpMRO2fz4SghkQbCSBY6qILqeyTVweSzD0Mvc-6NuXz9-zY7EDxaV6RSoElvo45npxrSEIC3TbhETZZLBJ2dE7NP1rspTm7nUJEmg&sai=AMfl-YT_DfdHBrGzf23QFVLK3czjf2o5uW2ObxfAs5Vnv_egCpr9_Ms1xFXV-Kf1m9g-QlR24FT-JH6kJVflHVMu2Fx9_z_XJSs289Xun0fSpeFJ30T9PjDwnGf_bFYpyHpKaEmaLOVbbi8sl7ZCp8HblF6AirrQpG-uurscvJOUxrJVWwJDlrvjPGUdRyRxtaEZAi0LFVNbOKFfSdCgCDplegQ-sb5wYjV6JoJWH64tjxWVLyTYdAY-El_HYk1ceA_ihJpiU-IuAttlNLIYB28CDr_-KUISCIxDx2S5tvSmmg&sig=Cg0ArKJSzJBW3XAxutA8EAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=268&vt=11&dtpt=217&dett=3&cstd=47&cisv=r20240122.25894&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:12 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 sky_medium.woff
s0.2mdn.net/creatives/assets/3668815/ Frame F953 27 KB
27 KB 24ms
24ms Font
font/woff 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3668815/sky_medium.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/187560977508666974/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4373878b9f750698b6a199ebc0eb0e550df208c5a1f9f778a346e271a2b4d733

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/187560977508666974/style.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:14:11 GMT
x-content-type-options: nosniff
age: 541
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27952
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 12:38:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jan 2024 16:29:11 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame F953 17 KB
6 KB 49ms
48ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 26 Jan 2024 16:23:12 GMT

GET
H3 200 container.html Show response
215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 4006 6 KB
3 KB 21ms
21ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ar.hibapress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 16:23:10 GMT
expires: Sat, 25 Jan 2025 16:23:10 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ Frame 4006 14 KB
1 KB 31ms
31ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 26 Jan 2024 16:23:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 26 Jan 2024 15:39:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 26 Jan 2024 16:23:12 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/ Frame 4006 2 KB
822 B 20ms
20ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 11:54:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16135
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 11:54:17 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240122/r20110914/ Frame 4006 23 KB
9 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240122/r20110914/abg_lite_fy2021.js

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb4fec10d8f4484b291b7c7d0de59d1b4375e000029fd1a128ad10c270d8d803

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 11:54:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16135
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 16165788300067284045
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 11:54:17 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/ Frame 4006 3 KB
1 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/window_focus_fy2021.js

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 10:22:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21616
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 10:22:56 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/ Frame 4006 20 KB
8 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d58acf16b5e4521c9eb24fe9fd97308e5f8be1297e4b63a547e5b610611799ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 23:41:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 60075
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8492
x-xss-protection: 0
server: cafe
etag: 9878124937798820110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Feb 2024 23:41:57 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4006 205 KB
65 KB 33ms
33ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fcab795411fac2ef4fe726fc3ee3ad3192ff76a846fa3b28616b3b6e61fae83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66337
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1706100845105677"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Jan 2024 16:23:12 GMT

GET
H2 200 5ff8bb2821e31fbf08fa14f5007a6efe.js Show response
www.gstatic.com/mysidia/ Frame 4006 37 KB
16 KB 69ms
21ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/5ff8bb2821e31fbf08fa14f5007a6efe.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54db8dca7039b548a0aa4e5e22fcea2a4e536b8aaec0b13a750dbc61ca3f3538

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 13:15:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11266
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15476
x-xss-protection: 0
last-modified: Tue, 23 Jan 2024 00:40:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 25 Apr 2024 13:15:26 GMT

GET
H3 200 2400663585862923800
tpc.googlesyndication.com/simgad/ Frame 4006 2 KB
2 KB 22ms
22ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2400663585862923800?w=100&h=100&tw=1&q=75

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e166c2cd6b66973e2bc76605093b1cad14904c27664f00020b1f86bce2be10e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:47:06 GMT
date: Tue, 23 Jan 2024 23:47:06 GMT
x-content-type-options: nosniff
age: 232566
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1671
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 15:14:31 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame 85DC 39 KB
15 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 10:22:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21615
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 10:22:57 GMT

GET
DATA 200
OK truncated
/ Frame 4006 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63d1210585ae459473e0bfade148e4df8fd2af3a526d973175ac8bca8eebcd8c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 4006 33 KB
33 KB 21ms
20ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 04:01:15 GMT
x-content-type-options: nosniff
age: 303717
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Jan 2025 04:01:15 GMT

OPTIONS
H3 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 98ms
53ms Preflight
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=CSzJYb9yzZbSQK6X1x_AP6p-8sAPIyLnEdb66x7qfEmQQASDjz_JCYJWCgICYB6ABiZaj4gPIAQmpAuejGO2JL7I-4AIAqAMByAPLBKoEqAJP0KETjeGEChTetiykYoCyDdePTGPCwi7VXdS5c7DcqLFoHHDHi7alqGTfWgW7Z8Xmd0G3FM7G-dOnfZgnby0ZL7oyx3TmfdCe75-CTtefYyLSO9SQbzT5d_Ej-Su4H7SiykweoJPnEWgfyXp1fn8hgea_UJzkvl5x-p0EAbSqwlgvRV4PjjkQggPTx1i6yJlMJo4h5Ghj919wljANJQzB7H-UUclweycDliuT-vQsl6_FfsR289DTC-Id2k9XwWSQTH1eoXt9fEs279yl02V_JaBfV9tMrNcVYz20aWi_ksmeBVbzB591qodBDv8LLPxFAw2tiGlkesspAFa0aHhl14aajyW3wUehinB3PWM3qj6AsW1SskZrSvpx9Y3xe9tnKvuyl630r8AE3Puw_s4E4AQBiAWmm6iETpIFBAgEGAGSBQQIBRgEoAYugAff6dwdqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwDyBwQQ5bQF0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOli-5ouyu_uDA5oJJmh0dHBzOi8vd3d3Lm5pY29yZXR0ZS5kZT9nY2xzcmM9YXcuZHMmgAoByAsBmAy23oKq2gTiDRMIppGMsrv7gwMVpfoRCB3qDw82uBODBNgTDtAVAZgWAYAXAbIXHgocCAASFHB1Yi0xMjE5MzY3MTk5MzI5NzE0GKu-Hg&sigh=FfSuvYgyCWw&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTgAvHhf_R__urZcAsK-CUdarAn9qsx-QCkm4GmqazhazRnSry45Vkm6Ql0x4X_WXMWblTCba6IETthayrlP7hjrg0KDhXGV1uhvqRcqR5BgB&template_id=515&cbvp=2&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 26 Jan 2024 16:23:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 4006
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=CSzJYb9yzZbSQK6X1x_AP6p-8sAPIyLnEdb66x7qfEmQQASDjz_JCYJWCgICYB6ABiZaj4gPIAQmpAuejGO2JL7I-4AIAqAMByAPLBKoEqAJP0KETjeGEChTetiykYoCyDdePTGPCwi7V...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229969086712651055682%22,%22debug_reporting%22:true,%22destination%22:%22https://nicorette.de%22,%22event_report_window%22:%...

0
0

92ms
51ms

Fetch
text/css

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229969086712651055682%22,%22debug_reporting%22:true,%22destination%22:%22https://nicorette.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%221011403529%22],%2222%22:[%22true%22],%224%22:[%2201-26%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%221448810443640932929%22}&andc=true

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:12 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"9969086712651055682","debug_reporting":true,"destination":"https://nicorette.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["1011403529"],"22":["true"],"4":["01-26"],"6":["true"]},"priority":"500","source_event_id":"1448810443640932929"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: null
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 26 Jan 2024 16:23:12 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 26 Jan 2024 16:23:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"9969086712651055682","debug_reporting":true,"destination":"https://nicorette.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["1011403529"],"22":["true"],"4":["01-26"],"6":["true"]},"priority":"500","source_event_id":"1448810443640932929"}&andc=true
access-control-allow-origin: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 P1hqgBmkkNDwT9zug75Po3J06KDKU0QoOZK6hiZMV2E.js Show response
pagead2.googlesyndication.com/bg/ Frame D969 51 KB
19 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/P1hqgBmkkNDwT9zug75Po3J06KDKU0QoOZK6hiZMV2E.js

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3f586a8019a490d0f04fdcee83be4fa37274e8a0ca5344283992ba86264c5761

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 09:52:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23442
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19859
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 09:52:30 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4260 42 B
64 B 173ms
173ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvAgDPIN9uKBR5JvJw3FjD8uAgtON9Ww7C3w_IJdmxKBA_5rM8fXQPmM0YysuslIQ5BRVWr7Ze-2RksgoZEbxJC7yOx_A82kHuBGb7WVEX48d4I0d7WuQAfBnRfK78_qx1qHPbJO3MjH9M5jiHNJssRLKsS&sai=AMfl-YTEq0_q3URvzt27roVIpem8bAkXx7Xq-RKuCs-4QBjNM-VLMZwqh3dFVx7SSAZp00n5ekTUMzogBTpPhlnds5VxAg8NU6Eygf8BVaXyd48MiFI48pqY4oTxYRpNRAC5x4ACnWNVqncAHXTERc5-&sig=Cg0ArKJSzJj9t8XUIAAHEAE&cid=CAQSTgAvHhf_8h3ufbxgrtE4CzGN-AwR4mJe65wTyP02GANb3OHpWCLG2lTzVNSZkFRwjIVWagghqgoZ4uYJ4LWiwK619Zy34MQvr2c1iuJ4thgB&id=lidar2&mcvt=1000&p=0,1290,600,1450&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20240124&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1389964298&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=170628619100&rst=1706286191430&rpt=122&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 107ms
51ms Preflight
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 26 Jan 2024 16:23:12 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012401091919000/ Frame 513A 196 KB
56 KB 95ms
20ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012401091919000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e874111442f36d488f5e4a7f742391a8c02b70c60b333454fe4f85a3b26e3d5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 23 Jan 2024 23:24:46 GMT
age: 233906
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56104
x-xss-protection: 0
server: sffe
etag: "cf7caf439f3410f8"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 22 Jan 2025 23:24:46 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012401091919000/v0/ Frame 513A 15 KB
5 KB 137ms
62ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012401091919000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d79a688e4e23466eeee3ab0d7d3a99a0588b1aa1c7ae0f4fedfbd498c9022eb4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 23 Jan 2024 23:43:46 GMT
age: 232766
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5212
x-xss-protection: 0
server: sffe
etag: "d5f0e0ea1e5219b8"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 22 Jan 2025 23:43:46 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012401091919000/v0/ Frame 513A 95 KB
29 KB 138ms
63ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012401091919000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36726fd194e9e08908bb49a382c3fe0b70ee41d480b09869b5aa70c81fcabe7f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 23 Jan 2024 23:31:19 GMT
age: 233513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29119
x-xss-protection: 0
server: sffe
etag: "7ed328db9ca95286"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 22 Jan 2025 23:31:19 GMT

GET
H2 200 amp-carousel-0.1.mjs Show response
cdn.ampproject.org/rtv/012401091919000/v0/ Frame 513A 32 KB
10 KB 143ms
69ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012401091919000/v0/amp-carousel-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c345e24d86a242dc27149a0789797535705a97cde668399f6b10469dddcd3709

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 23 Jan 2024 23:27:48 GMT
age: 233724
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10071
x-xss-protection: 0
server: sffe
etag: "e2ff55a63087267b"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 22 Jan 2025 23:27:48 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012401091919000/v0/ Frame 513A 5 KB
2 KB 135ms
61ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012401091919000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

643fe707091c6e32630daf29adabf146aea6096d30af0367bcddbe54c19bcad0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 23 Jan 2024 23:36:16 GMT
age: 233216
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1910
x-xss-protection: 0
server: sffe
etag: "b1b3f9c71858a21a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 22 Jan 2025 23:36:16 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012401091919000/v0/ Frame 513A 40 KB
13 KB 130ms
56ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012401091919000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

062e7c29b1c3e36f8684e7e298346efe23cd760daf282103361b0645d843c686

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 23 Jan 2024 23:27:47 GMT
age: 233725
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12971
x-xss-protection: 0
server: sffe
etag: "0e9793e292f94cd9"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 22 Jan 2025 23:27:47 GMT

GET
H2 200 amp-gwd-animation-0.1.mjs Show response
cdn.ampproject.org/rtv/012401091919000/v0/ Frame 513A 6 KB
2 KB 50ms
50ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012401091919000/v0/amp-gwd-animation-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

328621d7eb22f4344032ec841b0eadc2b5aa0e67fb9d3fb4dce821c1937b69e8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 23 Jan 2024 23:43:47 GMT
age: 232766
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2435
x-xss-protection: 0
server: sffe
etag: "11e7c79ea5a0f838"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 22 Jan 2025 23:43:47 GMT

GET
DATA 200
OK truncated
/ Frame 513A 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 86788db4eb271c118ec42c22efd8b5a74e546739124f217056e9c5face2be86f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 ar.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 513A 3 KB
3 KB 32ms
31ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/ar.png

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dfa586fa8b70c056272ef189e613dc9f6bcb8f9b659259219fa776f639dd3374

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 23:49:27 GMT
x-content-type-options: nosniff
server: cafe
age: 59625
etag: 9421415325968714010
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2737
x-xss-protection: 0
expires: Fri, 26 Jan 2024 23:49:27 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 513A 344 B
372 B 30ms
29ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 19:01:23 GMT
x-content-type-options: nosniff
server: cafe
age: 76909
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 344
x-xss-protection: 0
expires: Fri, 26 Jan 2024 19:01:23 GMT

GET
H3 200 img01-04-06.jpg
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 94 KB
94 KB 38ms
37ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/img01-04-06.jpg

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2e05b0dda917d727683c323f06a7201606df9e8525bca96d47c09c5d180f36ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Fri, 24 Jan 2025 03:13:31 GMT
date: Thu, 25 Jan 2024 03:13:31 GMT
x-content-type-options: nosniff
age: 133781
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 96241
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 text01.png
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 3 KB
3 KB 44ms
42ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/text01.png

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

329be7527d6923c33118a5e491dd8e6cbb3016148f27b6198613dd297cf21a55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:52:13 GMT
date: Tue, 23 Jan 2024 23:52:13 GMT
x-content-type-options: nosniff
age: 232259
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3215
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 img02.jpg
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 71 KB
71 KB 52ms
51ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/img02.jpg

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65696461c47b2e882acff02a5b940bd479ac212a9d37bcc64a2e0596ecd73787

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:43:05 GMT
date: Tue, 23 Jan 2024 23:43:05 GMT
x-content-type-options: nosniff
age: 232807
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72689
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 text02.png
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 5 KB
5 KB 27ms
27ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/text02.png

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

71bd22d2c450ca9daaffce6e5237bd5f5dcb097a886866198ea193499a7f6835

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:52:13 GMT
date: Tue, 23 Jan 2024 23:52:13 GMT
x-content-type-options: nosniff
age: 232259
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5317
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 img03.jpg
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 75 KB
75 KB 33ms
32ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/img03.jpg

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eef1f5f880d5d226245fa0eab92f38818004a10fcf9802b2b18bd36cb19064c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:52:13 GMT
date: Tue, 23 Jan 2024 23:52:13 GMT
x-content-type-options: nosniff
age: 232259
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 76981
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 text03.png
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 6 KB
6 KB 64ms
63ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/text03.png

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2ebeae661088f655507a04adefa5e21a8c5aab1d61023f84970c87bfbbdd7b29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:41:45 GMT
date: Tue, 23 Jan 2024 23:41:45 GMT
x-content-type-options: nosniff
age: 232887
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5771
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 text04.png
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 6 KB
6 KB 46ms
46ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/text04.png

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8c9aab730728bd23ec38f101d970da3ad7e9f0e0ff4587125843b874bbb8faf2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:37:41 GMT
date: Tue, 23 Jan 2024 23:37:41 GMT
x-content-type-options: nosniff
age: 233131
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5886
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 text06.png
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 8 KB
8 KB 58ms
57ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/text06.png

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e69ccc7dcb1e4ebd97d1bf575bac0ebfc99b4d780bfc52fbb622d156dd8b165a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:37:41 GMT
date: Tue, 23 Jan 2024 23:37:41 GMT
x-content-type-options: nosniff
age: 233131
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8125
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 logo.png
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 16 KB
16 KB 60ms
59ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/logo.png

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff7667c052da8841db61b604923b9ed08ac1e088d7d8d4d81403d76a9c32196b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:37:41 GMT
date: Tue, 23 Jan 2024 23:37:41 GMT
x-content-type-options: nosniff
age: 233131
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16356
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Mazda_Garantie.png
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 4 KB
4 KB 49ms
49ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/Mazda_Garantie.png

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

caf5b4387bb00996c8f095e2bdcda0dde203a9c15094c5c31473c3817308ac2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:37:41 GMT
date: Tue, 23 Jan 2024 23:37:41 GMT
x-content-type-options: nosniff
age: 233131
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4149
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 cta.jpg
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 6 KB
6 KB 45ms
44ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/cta.jpg

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

415f2c374b50d4402c7e59a630f97a8f5de749979fa53d3ec7ed64a338aaa98d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:44:56 GMT
date: Tue, 23 Jan 2024 23:44:56 GMT
x-content-type-options: nosniff
age: 232696
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6518
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 ar.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 513A 3 KB
3 KB 20ms
20ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/ar.png

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dfa586fa8b70c056272ef189e613dc9f6bcb8f9b659259219fa776f639dd3374

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 23:49:27 GMT
x-content-type-options: nosniff
server: cafe
age: 59626
etag: 9421415325968714010
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2737
x-xss-protection: 0
expires: Fri, 26 Jan 2024 23:49:27 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 513A 344 B
374 B 21ms
21ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 19:01:23 GMT
x-content-type-options: nosniff
server: cafe
age: 76910
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 344
x-xss-protection: 0
expires: Fri, 26 Jan 2024 19:01:23 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7FF8 42 B
64 B 173ms
173ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstOlvSc-yWcnqdixRhVWX3SeRMya9sQeDJSCSTAJExk59pL-hFsfGSF5-kOJYLBAT9G1mNujbn8a51KR84bAoh4CYUENao-ytmsIcfRDkxyp0A4RayHvAqIsc-PoM5aYfH00SzZc-LEl6fV99gh5XQ7BcGj&sai=AMfl-YQs1L9TqzLkbhBak4y8QgX13hCD8WL1EDd-M1M_ahUpp-RApLOpZoXuNam0Lq7XI4NFFLqV8oo8seoO5RPjbudRDA6F4ubDOaq6en6VSo3y8RXyL1_9KTf7F4Ni-oAOCcSkG4Conbs0k5znD9Y4LQ&sig=Cg0ArKJSzP7KJsszp3E1EAE&cid=CAQSTwAvHhf_Z3iTFAF-GAvhTEn9qvZcIyJlefhGsSn3zQR8544diILodDQ5h2ydECyPZIKZTXqTCa-7dnSQo03bOfema3w7GOTL4h3h9VltjhcYAQ&id=lidar2&mcvt=1009&p=0,269,40,310&mtos=1009,1009,1009,1009,1050&tos=1009,0,0,0,41&v=20240124&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=304137664&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=170628619200&rst=1706286191745&rpt=293&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 img01-04-06.jpg
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 94 KB
94 KB 21ms
20ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/img01-04-06.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2e05b0dda917d727683c323f06a7201606df9e8525bca96d47c09c5d180f36ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Fri, 24 Jan 2025 03:13:31 GMT
date: Thu, 25 Jan 2024 03:13:31 GMT
x-content-type-options: nosniff
age: 133782
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 96241
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 text01.png
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 3 KB
3 KB 25ms
24ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/text01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

329be7527d6923c33118a5e491dd8e6cbb3016148f27b6198613dd297cf21a55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:52:13 GMT
date: Tue, 23 Jan 2024 23:52:13 GMT
x-content-type-options: nosniff
age: 232260
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3215
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 img02.jpg
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 71 KB
71 KB 26ms
25ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/img02.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65696461c47b2e882acff02a5b940bd479ac212a9d37bcc64a2e0596ecd73787

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:43:05 GMT
date: Tue, 23 Jan 2024 23:43:05 GMT
x-content-type-options: nosniff
age: 232808
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72689
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 text02.png
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 5 KB
5 KB 27ms
25ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/text02.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

71bd22d2c450ca9daaffce6e5237bd5f5dcb097a886866198ea193499a7f6835

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:52:13 GMT
date: Tue, 23 Jan 2024 23:52:13 GMT
x-content-type-options: nosniff
age: 232260
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5317
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 img03.jpg
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 75 KB
75 KB 28ms
26ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/img03.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eef1f5f880d5d226245fa0eab92f38818004a10fcf9802b2b18bd36cb19064c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:52:13 GMT
date: Tue, 23 Jan 2024 23:52:13 GMT
x-content-type-options: nosniff
age: 232260
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 76981
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 text03.png
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 6 KB
6 KB 29ms
28ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/text03.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2ebeae661088f655507a04adefa5e21a8c5aab1d61023f84970c87bfbbdd7b29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:41:45 GMT
date: Tue, 23 Jan 2024 23:41:45 GMT
x-content-type-options: nosniff
age: 232888
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5771
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 text04.png
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 6 KB
6 KB 30ms
29ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/text04.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8c9aab730728bd23ec38f101d970da3ad7e9f0e0ff4587125843b874bbb8faf2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:37:41 GMT
date: Tue, 23 Jan 2024 23:37:41 GMT
x-content-type-options: nosniff
age: 233132
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5886
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 text06.png
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 8 KB
8 KB 31ms
30ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/text06.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e69ccc7dcb1e4ebd97d1bf575bac0ebfc99b4d780bfc52fbb622d156dd8b165a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:37:41 GMT
date: Tue, 23 Jan 2024 23:37:41 GMT
x-content-type-options: nosniff
age: 233132
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8125
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 logo.png
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 16 KB
16 KB 31ms
31ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/logo.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff7667c052da8841db61b604923b9ed08ac1e088d7d8d4d81403d76a9c32196b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:37:41 GMT
date: Tue, 23 Jan 2024 23:37:41 GMT
x-content-type-options: nosniff
age: 233132
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16356
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Mazda_Garantie.png
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 4 KB
4 KB 33ms
33ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/Mazda_Garantie.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

caf5b4387bb00996c8f095e2bdcda0dde203a9c15094c5c31473c3817308ac2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:37:41 GMT
date: Tue, 23 Jan 2024 23:37:41 GMT
x-content-type-options: nosniff
age: 233132
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4149
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 cta.jpg
tpc.googlesyndication.com/sadbundle/15401731810828696689/ Frame 513A 6 KB
6 KB 34ms
33ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/15401731810828696689/cta.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

415f2c374b50d4402c7e59a630f97a8f5de749979fa53d3ec7ed64a338aaa98d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Wed, 22 Jan 2025 23:44:56 GMT
date: Tue, 23 Jan 2024 23:44:56 GMT
x-content-type-options: nosniff
age: 232697
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6518
x-xss-protection: 0
last-modified: Tue, 16 Jan 2024 12:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 container.html Show response
215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 1124 6 KB
3 KB 22ms
21ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ar.hibapress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 16:23:10 GMT
expires: Sat, 25 Jan 2025 16:23:10 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 513A 0
0 63ms
63ms Image
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C6gl6cNyzZbTbDdf_x_APhNOEoAeo8Pi8dfri4PjFEofRor3AARABIOPP8kJglYKAgJgHoAHH8OONA8gBCakC56MY7Ykvsj7gAgCoAwHIAwiqBK8CT9C-aaglqTUwUEOurCfDbrlik2qxgC8DZarGm5t9hQR6GxL-UORRaHxGdi1WDP9ZnsGsIUwJdrgllaMZCBV-HruVxzEvYxlHOzbhMnwiQYhPel3nd-1TqivRWmxbunLPYP9SMytL7Rbxp9RCFYP4aUT2QAX-V-MYuvW8lRS-ALgFgWUb5yhQ9UYnj440Y82w2owKezVnYkBy5wlUx3niFazXY32CmZ1rwIcjGG55yQLCqmywsaWllhSonpGPwunUeoEHWF5AiBGuxIUDB-cd-9OhtiJdSGOZRb7DlHntIXXoZFE-09Nb4l9wU749nGpVelgNJ5espfGMMWbPzeIG17YhlSk8BjfErhQ-1sDq4sSuXorLcFb_38o781HBYhpvWxYrabPpBDiwCSgD5o30wASq2vafuQTgBAGIBY677fhNkgUECAQYAZIFBAgFGASgBi6AB4T9onKoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAPIHBBD-_wfSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WLLRi7K7-4MDmglwaHR0cHM6Ly93d3cubWF6ZGEtYXV0b2hhdXMtc2NoaW5kbGJlY2stcmVnZW5zYnVyZy5kZS9iZXJhdHVuZy11bmQta2F1Zi9hbmdlYm90ZS9ha3R1ZWxsZS1ha3Rpb25lbi9sZWFzaW5nd29jaGVuL4AKAcgLAeINEwi4_Iuyu_uDAxXX_xEIHYQpAXTYEw2IFALQFQGAFwGyFx4KHAgAEhRwdWItMTIxOTM2NzE5OTMyOTcxNBirvh4&sigh=asYOH4ByKOM&uach_m=%5B%5D&ase=2&nis=5&cid=CAQSTwAvHhf_VIWRW8eWp1e-5EdXzOceiHDlqE5Jb0VsNH1c0S172SVq79cnULLHu663uFbF49MShO4fvvOybZZKGKLS3rNJXcXo2k1stSXwzFYYAQ&template_id=419&cbvp=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame BF0D 466 B
238 B 59ms
59ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkYlJifhgIwAQ&v=APEucNUQ4Oskeb6Ws2HIxfclxefWl3kAkOv2fHKS8RWYBT_iJijXxfVDhPdcm7lmfYm6W8ZeOMtOzW6EgPVkS5mIWQWKb-sLRUtz2zOtpbIlT58-RDXe1UqSb3gviLj-mVrTN46TRQtlOESvJd4XHz3K2HC31yNXfSXggIDsxC-tCVxACo2vqbg

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37ab5c060ae53ccda75b8bd212d874a17650f7954b11c4e31f568990ab40196b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 16:23:13 GMT
expires: Fri, 26 Jan 2024 16:23:13 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 1124 111 KB
39 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Origin: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 19:25:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75451
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jan 2024 19:25:42 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240122/r20110914/elements/html/ Frame 1124 8 KB
3 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240122/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef34301455784e8a56ecc7a80985d6fd317ddd8328b6232dc0bc3223d79c91c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 16:24:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 86322
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3206
x-xss-protection: 0
server: cafe
etag: 12640889860211258669
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Feb 2024 16:24:31 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240122/r20110914/ Frame 1124 23 KB
9 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240122/r20110914/abg_lite_fy2021.js

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb4fec10d8f4484b291b7c7d0de59d1b4375e000029fd1a128ad10c270d8d803

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 10:23:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21565
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9319
x-xss-protection: 0
server: cafe
etag: 16165788300067284045
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 10:23:48 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 1124 41 KB
14 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 11:54:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 102536
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 Jan 2025 11:54:17 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/ Frame 1124 3 KB
1 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/window_focus_fy2021.js

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 10:22:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21617
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 10:22:56 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/ Frame 1124 20 KB
8 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d58acf16b5e4521c9eb24fe9fd97308e5f8be1297e4b63a547e5b610611799ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 23:41:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 60076
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8492
x-xss-protection: 0
server: cafe
etag: 9878124937798820110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Feb 2024 23:41:57 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1124 42 B
63 B 166ms
166ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Ac4YAwaeVUF3fqxffEp6G1AMu099iw_kJSYH9d_sqecsdd-TNGVw34MCKNrXAIlHjCzuSvaoIA59ZY6ozRYQWoxTvt_Kg4wZBn-gQEdbq8pRoDpwA

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1124 205 KB
65 KB 43ms
43ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fcab795411fac2ef4fe726fc3ee3ad3192ff76a846fa3b28616b3b6e61fae83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66337
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1706100845105677"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Jan 2024 16:23:13 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame B080 38 KB
13 KB 20ms
20ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 102536
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 25 Jan 2024 11:54:17 GMT
expires: Fri, 24 Jan 2025 11:54:17 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/12002841043897381916/ Frame D86B 100 KB
21 KB 25ms
25ms Document
text/html 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12002841043897381916/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13d387d4a767f2115191546ae5d46c3b9912181cd263218def2f48b164a46a19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 9119
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 21934
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 13:51:14 GMT
expires: Sat, 25 Jan 2025 13:51:14 GMT
last-modified: Tue, 23 Jan 2024 12:05:23 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 1124 0
0 66ms
66ms Fetch
image/gif 172.217.18.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuS8zWaQNJGcQp0U_US0HIJ7d_9f1AuLm9B87BdsWo12NcqYUP8c4JHWNRevRXJLHk9wtQ9vQEE2kOcplSG4cSVBm1cWbKqbbpw3leRXzzlQBY96A8nAO1S7OS-ifTw2N5jsUQvXRaZkLlpd4-yxgpDiMRQsnQ96p9KPgjihU8ZdoWZMnvPITuo2ZSh56asFc-RP0Ec4mOQcoFz2m5SEJJ-46xAal_hOwuB755YWsvF71zs5rLd11zVMvAhHS2BqxienlQNRBROX7f8Br_sNX-68t3vqx9JKBQpz-9yajVWjkcPVbEKDxKq-uu7RYndK0MlxImQaEEC8CuRPWdYn8nO4SHDQrGvmXV_8EK23gf2g7rl5jyRF6yPzVue036g5EMAwt1u_xK1wTJRLCMx3z7hZs9xjtFaldX_BPKNFCDMnmn1USssO1rA8--3l7n2BbOVeCgDk7K-ea1jzKye-9z5wcCMxkkTt2yXb9-L9MWIl_rh3B3GWZhb5sbMXiaGdlsVskmzu5SVpAqOoXFxH82cSO4YQOlq_a0XHih2xsRtg2bq2qQLSmjbuUqDLw9HjPYHKCeplngi0mQlPICJYLYjPPAh-6wyIKHNId5faeUn2RgXT1upf04MgI3dj_Uh26VA7Kl_yCAJM6oVQLMn05d9Ny0jXv3DMJf5K_fYD3CB3z8SM0Lz0shbDmi14NFgKrax91sIWv6CLVaTvDEGPNbXlOV9kzTZUZefPJ-OXZYDeXXfBeo1nO2zEbKvDaHbwVYSQPB--KdChzVw99IZeBmo-oqKnGwKsKQEY2k0tfg-Ne5Y1JwHNOx96mIcMOBTqiscSDgu8s8K6PyJ1qsRCK5rWCB9k4T6ZgXKkUQlnM-giKAfBiKK4INP183S-sRS3F9gFAjemSyFz7HyVBi4EOfXxg6lB6B5YjX7UNJefPkPpvKoQz7CblNNUNZtqkveJhqsMpJ7sT5zVRzoTDkObirA-vLIS9sBRysnIwQij02DDjBymIIbExh9Qf3PRCfnv4Tiz_yrACMnLB1skfQk0S6JQCy0kgxyZD9Whdc1zPdMFlUvGCQ1AfOBJvxShwSqyTS-8xHVPB0pUSSubx6piHtWwyH4-yTSabnZoLIrGI7jZga3P_h3dN1U2dUNdYQZIIJk_NBDaNZe5CVXF76b3yuDM_V93VQPiTwOcZN_YGi98pQ-QOC8I4mSjGUXsvxewSD7UMFI-60MI8G3vgLd1NqgS3FXG2VkJXJ_1qGqThbfnmyHGa2lQZQUHazCS4kskojhMmduGsA6wWFxxoq6fbSHu7RnP0j9UsRsVqTx2tsb7Spn-aDucbsnp7GDP6FvlGrDvVh0Fh1Qfbc5gK6NTHGL5EuFypXFDHYaU5QCqrWB4D4DcUeVVu4QvPNcZ-Lxf4Remw8qo5dOCdINHnzmZaHSYG-dvY__zf8RNSbRF0MHGnNeSk-nNB-TQRbTA8_05K9YXRtQD4QaPH8EbFFaTn_HmNmGqA&sai=AMfl-YSPYmSZo8UUFzFc63ndf2sAKqj57Bz04pWtViVnlnaawNNSfgqdhkG1z12RvXsu5XySgslxxuuckxBwi7FX2tPksyMr0vmdJ-tMTa7dy-X8j2y59GF60q-GwX2l-gTI7z9pj3GvHtEwiUZl5FZL7ugEXyLDtw-HNj57iAdhR5bexU4pyYXM6Bdkjb-lushhbsUjFoiVoa_7yhq2-uLyWztE2nz4LShbVcUCPNDbVuixvFxPHHaY8Lu3GieLPEl9jA7_pf6vlalzynnFvA8j612gI6L4XdYDTQRqL2ySXCSlieaJ3JXBIiM0Uzc9C-PufcOKclIdgd7n6NLi0UcX-6EukxXpzNi6fqcPLqMAo4MoK6hOCb6_6lBw7x1xeO1NmdABKLP1fXQNhUORyHL_4It3dWb6LBlzi9-EmxGIZwU_SToy2pPfUYam--wNWFM83DqZmdA7MiOCq5XjbOr_rT5ta9adYOyd4JrV2GmStZ1YpjsDbwFqN2uEN_ZcItAucrGXgmgKt0s&sig=Cg0ArKJSzIVE1gFU59Q-EAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly90dWkuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=33&cbvp=1&cstd=32&cisv=r20240122.32776&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 26 Jan 2024 16:23:13 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 1124 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5eb02e7ad42a2bf319ad4fef8359bb31f08d1c3b9796313be722d9e094f63581

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET

partner
sync.search.spotxchange.com/ Frame BF0D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEAuTeHpwZnzwjUrFSzY-R_Q&google_cver=1

0
0

GET partner
sync.search.spotxchange.com/ Frame BF0D 0
0

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58269/ Frame BF0D 0
125 B 97ms
23ms Image
text/plain 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNKOMxDkyTkYlJifhgIwAQ&v=APEucNUQ4Oskeb6Ws2HIxfclxefWl3kAkOv2fHKS8RWYBT_iJijXxfVDhPdcm7lmfYm6W8ZeOMtOzW6EgPVkS5mIWQWKb-sLRUtz2zOtpbIlT58-RDXe1UqSb3gviLj-mVrTN46TRQtlOESvJd4XHz3K2HC31yNXfSXggIDsxC-tCVxACo2vqbg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/9.1.10.94 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:13 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8CA0 0
20 B 167ms
167ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=4124690250084&version=m202309260101&ct=76&x=1&cor=3665374793390264000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 DcmEnabler_01_250.js Show response
s0.2mdn.net/879366/ Frame D86B 32 KB
11 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12002841043897381916/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12002841043897381916/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 23:49:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59643
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11558
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jan 2024 23:49:10 GMT

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame B080 39 KB
15 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 10:22:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21616
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 10:22:57 GMT

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 1124 0
0 57ms
57ms Fetch
image/gif 172.217.18.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuS8zWaQNJGcQp0U_US0HIJ7d_9f1AuLm9B87BdsWo12NcqYUP8c4JHWNRevRXJLHk9wtQ9vQEE2kOcplSG4cSVBm1cWbKqbbpw3leRXzzlQBY96A8nAO1S7OS-ifTw2N5jsUQvXRaZkLlpd4-yxgpDiMRQsnQ96p9KPgjihU8ZdoWZMnvPITuo2ZSh56asFc-RP0Ec4mOQcoFz2m5SEJJ-46xAal_hOwuB755YWsvF71zs5rLd11zVMvAhHS2BqxienlQNRBROX7f8Br_sNX-68t3vqx9JKBQpz-9yajVWjkcPVbEKDxKq-uu7RYndK0MlxImQaEEC8CuRPWdYn8nO4SHDQrGvmXV_8EK23gf2g7rl5jyRF6yPzVue036g5EMAwt1u_xK1wTJRLCMx3z7hZs9xjtFaldX_BPKNFCDMnmn1USssO1rA8--3l7n2BbOVeCgDk7K-ea1jzKye-9z5wcCMxkkTt2yXb9-L9MWIl_rh3B3GWZhb5sbMXiaGdlsVskmzu5SVpAqOoXFxH82cSO4YQOlq_a0XHih2xsRtg2bq2qQLSmjbuUqDLw9HjPYHKCeplngi0mQlPICJYLYjPPAh-6wyIKHNId5faeUn2RgXT1upf04MgI3dj_Uh26VA7Kl_yCAJM6oVQLMn05d9Ny0jXv3DMJf5K_fYD3CB3z8SM0Lz0shbDmi14NFgKrax91sIWv6CLVaTvDEGPNbXlOV9kzTZUZefPJ-OXZYDeXXfBeo1nO2zEbKvDaHbwVYSQPB--KdChzVw99IZeBmo-oqKnGwKsKQEY2k0tfg-Ne5Y1JwHNOx96mIcMOBTqiscSDgu8s8K6PyJ1qsRCK5rWCB9k4T6ZgXKkUQlnM-giKAfBiKK4INP183S-sRS3F9gFAjemSyFz7HyVBi4EOfXxg6lB6B5YjX7UNJefPkPpvKoQz7CblNNUNZtqkveJhqsMpJ7sT5zVRzoTDkObirA-vLIS9sBRysnIwQij02DDjBymIIbExh9Qf3PRCfnv4Tiz_yrACMnLB1skfQk0S6JQCy0kgxyZD9Whdc1zPdMFlUvGCQ1AfOBJvxShwSqyTS-8xHVPB0pUSSubx6piHtWwyH4-yTSabnZoLIrGI7jZga3P_h3dN1U2dUNdYQZIIJk_NBDaNZe5CVXF76b3yuDM_V93VQPiTwOcZN_YGi98pQ-QOC8I4mSjGUXsvxewSD7UMFI-60MI8G3vgLd1NqgS3FXG2VkJXJ_1qGqThbfnmyHGa2lQZQUHazCS4kskojhMmduGsA6wWFxxoq6fbSHu7RnP0j9UsRsVqTx2tsb7Spn-aDucbsnp7GDP6FvlGrDvVh0Fh1Qfbc5gK6NTHGL5EuFypXFDHYaU5QCqrWB4D4DcUeVVu4QvPNcZ-Lxf4Remw8qo5dOCdINHnzmZaHSYG-dvY__zf8RNSbRF0MHGnNeSk-nNB-TQRbTA8_05K9YXRtQD4QaPH8EbFFaTn_HmNmGqA&sai=AMfl-YSPYmSZo8UUFzFc63ndf2sAKqj57Bz04pWtViVnlnaawNNSfgqdhkG1z12RvXsu5XySgslxxuuckxBwi7FX2tPksyMr0vmdJ-tMTa7dy-X8j2y59GF60q-GwX2l-gTI7z9pj3GvHtEwiUZl5FZL7ugEXyLDtw-HNj57iAdhR5bexU4pyYXM6Bdkjb-lushhbsUjFoiVoa_7yhq2-uLyWztE2nz4LShbVcUCPNDbVuixvFxPHHaY8Lu3GieLPEl9jA7_pf6vlalzynnFvA8j612gI6L4XdYDTQRqL2ySXCSlieaJ3JXBIiM0Uzc9C-PufcOKclIdgd7n6NLi0UcX-6EukxXpzNi6fqcPLqMAo4MoK6hOCb6_6lBw7x1xeO1NmdABKLP1fXQNhUORyHL_4It3dWb6LBlzi9-EmxGIZwU_SToy2pPfUYam--wNWFM83DqZmdA7MiOCq5XjbOr_rT5ta9adYOyd4JrV2GmStZ1YpjsDbwFqN2uEN_ZcItAucrGXgmgKt0s&sig=Cg0ArKJSzIVE1gFU59Q-EAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly90dWkuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=128&vt=11&dtpt=95&dett=3&cstd=32&cisv=r20240122.32776&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: ar.hibapress.com
URL: https://ar.hibapress.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:13 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7FF8 0
20 B 166ms
166ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1066647575667&version=m202309260101&ct=76&x=1&cor=13786742586259315000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame CAE6 6 KB
3 KB 21ms
21ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ar.hibapress.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 16:23:10 GMT
expires: Sat, 25 Jan 2025 16:23:10 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B080 0
20 B 175ms
175ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B7w9RcNyzZcSUNITQ1PIPpoKSoAgAAAAAOAHgBAI&bg=!h4SlhMvNAAa8BdJLnAU7ADQBe5WfOMrQXA5Wzru2d7o8tdNcPzJsXfp7b3xNFfGyjTZQeSUvYnczbzVRYSMMEwXk1LzJAgAAAEFSAAAAAmgBB5kDAaAeCTbOeoiZsCK8DtzwK3QUJTSKPzHM12IpnjIFnxIDg3dxo_acSrIIf-TMxT6zgVrFcbApO_JXkPSVecpUGOrOPf6kKoVUuRpxxiR3avomLreAJpOKCqCmWG2bHbhWFiz9p2uNQVf8C8tNPECLeAlfmtKRua5hkNo0_wOYv0yYh0BwCDLrQoxrWHmN2Vjn6lipVS4byFvASsihQ2vuvoat9ZE0x_pFCwB8Vo9mCGJe5ICMKCSe4wOHyKJKteul8V3uut0wxdoISjgC_J9AzR2t0CRL6VQoP66AtX1hH7pqOtdYNx1nUi5V43sk24t1lHCq9Skk-U3imlSV6L-hXdb84Xdb8JoeQce4lWSbL6rgwb5DbNtJ_yJrM4Cc4n69I_109Ll0kc8OHyGPlCHUG3Bca_gNCESrBvhQsDlalNkBSUsWVCv18zJv2AsZHpWRGZj1nv9spwYdP3q5wU6TpyyBy5yf7OB7SyLGdEKX8Jy45era1R6zR1L139QnyHwJuxmd4g-YEflTfhb3CrDmH0OnB1LxNatexKTQQeU6oYprQpHUZ8sWGeb5QRXbBMI06bNUqleRhqX3xnB6VxX50ZV9mq_1qEAbSUJidbkb9HdP0PTIyQKiUzY5MQsckVkEBcer6Y6BEroBeamufwO6pAVfTojUeXYYSocWb532hJwP8QJrvotAF9kwJTEsY24JRW5a39XVoFhsW5p2jlxWeyfAELNTyzojhG5WJfsGCWt7f6XwxVUwihIqWPbUZVoLAqJiG0GD5VdeJWvSvs6PvOvgU2NQ8uDajA14jF5bjKcaBmekel1vwyvGNfFjPc_qmgRIaiDSgMZViAUPRyMBYjsaX8YP6QqQIrOJsuFCuWoYyZDNsvWWuSwV4oD0SpLc1mZKtZheyuKhJQ2y71hmZqgrYjHVEpi7xQms5dBX8GvWpPLT9bzzEYfiHFS8TTzgCMjlUWGEGf9kbvqff4HEwHEJDNR2rJO6fYQBMeyfh0AXs0853jMTAAmP7QB3Z8URwGQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6EDF 398 B
225 B 60ms
60ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNWl39KXxqZisYx6TrkUwvoMiMnkSG5t7CZW3mN6PvpbQqP4EUQcUU-82xIRBAqOQbHWnQGanN-0FMdxwg3JqGsZtymBR38egROXI9wEuM30lVBbmKLp_i07Rc4wV1AL2zE4OimQulj8lXg4GKawBAoVsIRJcdn3St0-IrjKOxTk90ze7XY

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dc00d2dc19a9dd32d5f89ec3d68bfed90dd775a5fa638855b7fe00d6415f379b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 202
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 16:23:13 GMT
expires: Fri, 26 Jan 2024 16:23:13 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame CAE6 89 KB
31 KB 139ms
139ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:13 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 26 Jan 2024 16:23:13 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame CAE6 42 B
63 B 169ms
168ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AmNIBV_sz8qt6hGYeNqQi1Kc9H_KAGnwhYrVXmvBGJwolCHgZbRHLgw2214xJJ1fQjZ2aF7_gGt6TstV33KPtoXsbbDpe3xl4XceWTpaTyZ94KO7M

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/ Frame CAE6 3 KB
1 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/window_focus_fy2021.js

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 10:22:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21617
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 09 Feb 2024 10:22:56 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/ Frame CAE6 20 KB
8 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240122/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d58acf16b5e4521c9eb24fe9fd97308e5f8be1297e4b63a547e5b610611799ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 23:41:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 60076
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8492
x-xss-protection: 0
server: cafe
etag: 9878124937798820110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 08 Feb 2024 23:41:57 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame CAE6 205 KB
65 KB 32ms
32ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fcab795411fac2ef4fe726fc3ee3ad3192ff76a846fa3b28616b3b6e61fae83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66337
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1706100845105677"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 26 Jan 2024 16:23:13 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4006 42 B
64 B 174ms
174ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstU4H5MvwQ-4vdCSvkYzpgv2X8mTL2O62a5vLxC0acfhM5iIImokz3Wn3hfuGHnhIczEhFCoKA3G0UrqpAvRwcq9buAlGVcW0gm3rg4Ik5r6lgw8pH0h6W2eeGlwTZO3UlAYmutcnSouMZuDeVR8udXDJPSEcJalgsW8J6EmHhOT8T6yBrb4IhOU4Z7hLkkKFPWCAWfzpRFe6OnRT7qHG1wkW1GKq_t2p9SAUs16R8dGJcbMm1rGncLqG_KXuCLCnLcdx-pN34UhWBDfsw_JSxz1X9IbN1I5cRNfDUlbegmUngV33_C4Qz6IwM77TQ04Uky7sVs0b4foK5UyF9yz-jKwcT8OBHhhtiujRvQS5QuW7p_pQ5ujP9gH6yAUIzxeZNEqa0NgaZVvD0Mh9VmPHOpcZiZCynKYlgcwnC4GAm0KACslEAB7PG31_5Zv3Xju80LWI5d2V6fjozIrIOJtDMJET1YJ4du3pXWcXTNziOpHPUJ-hi_GyldN4j_cA_uKEm-3_bY5Bmc15RUxM40q57GXFjTDZNfsRZmUy2AgxuoGcIhUvKJHeb1g_7STE7_WWFbslzB-78q3PmxaMCxDxblYRZAyBc688vrA0WIdS2cK9_0orWYkttUkjQ7c-H3E-VBE43Wn4ogaXyLAZY1CDEeW7fGG6nZfKnPAmnlr1r8hXrOk0jsgwcGePvoW7afWF2YCbzEtchsaAYx5qIHeRNx1hC5nOdZyNPlgWixPb4-fAEJSWKG3txMxIZbxJA97JVt_6aHaZTs1pqLVj-h5E7VVtaLGbt6lw8sBrioC_mT266dr3iNg9qMYlgH-F_xv_iAIvrepoofy4UXs8iukKcODGJVkleX2Hxep-qa1xAaVsFC6j-L5SlPvupHfkbU2TzhuORWAaGqaxzLsK6CjdgYI8giNDM0biZ1z9G8luXPkORwSqDe2bwYQOmqZQnJ0vZGp46hmTSapFF9PuMY7hWzm9one0kvScLtD7z8-PZ9_ByEMMN4kNq68H36nEQoBG-PrsBr7-7At1AgdJvyxdoRDgxLoS8SghzGyE8rMqG7nBf9hWLnklpap0hX4plYwNl6uY_9o_5I5XTG330pe9ONHdQcYKgGH26mvIL4OZdAmGLG_ScDnygqdKgR10vJtElqZ13orcnPoqd3Bamd0kBm-8u8dFSkbrTqi9S_U4IM9WgeRUacIAulN943GE_foUy-CDCmJnhai3mujyxkkzKzKMU8WwlySIqWWsmx2RTUcVllU2MPXx8-fOHfxQnXvk2Fnxoi5C4uB6CkHm580iSVIwSNlwbZfxZUqJB1cvkFvjodIREpOSRG3nEeIGplPCsiiR2dEYhp0Xiqm7Bq7Bwx7NfKIZkr60DoHYs&sai=AMfl-YSTb4r-rvvuNOxlKL5KegY3mpJpHsawWmbyJMlM5L6OUtKvYr-QMYUOIrgcHQPzaNICkSLFVZ2PzbrbDhtq1qzeFF_pyYJp4dge2qY7sbrVybuidRd77V26H9-tqtmpqYoF8MCrc1MNh0XvUTy9d7rYdJPGnv4OxUYnsw&sig=Cg0ArKJSzDvu_nu84nHXEAE&cid=CAQSTgAvHhf_R__urZcAsK-CUdarAn9qsx-QCkm4GmqazhazRnSry45Vkm6Ql0x4X_WXMWblTCba6IETthayrlP7hjrg0KDhXGV1uhvqRcqR5BgB&id=lidar2&mcvt=1000&p=1110,436,1200,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20240124&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1152212579&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=170628619200&rst=1706286192311&rpt=160&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 6EDF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEOQNizy9JWEoZSk_36IrQU8&google_cver=1

43 B
163 B

82ms
28ms

Image
image/gif

91.134.110.137
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEOQNizy9JWEoZSk_36IrQU8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNWl39KXxqZisYx6TrkUwvoMiMnkSG5t7CZW3mN6PvpbQqP4EUQcUU-82xIRBAqOQbHWnQGanN-0FMdxwg3JqGsZtymBR38egROXI9wEuM30lVBbmKLp_i07Rc4wV1AL2zE4OimQulj8lXg4GKawBAoVsIRJcdn3St0-IrjKOxTk90ze7XY
Protocol: HTTP/1.1
Server: 91.134.110.137 , France, ASN16276 (OVH, FR),
Reverse DNS: ip137.ip-91-134-110.eu
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:12 GMT
transfer-encoding: chunked
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:13 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEOQNizy9JWEoZSk_36IrQU8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 316
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK /
rtb-csync.smartadserver.com/redir/ Frame 6EDF 43 B
163 B 92ms
28ms Image
image/gif 91.134.110.137
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=GOOGLE_HOSTED_PI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_hm%3DSMART_USER_ID_B64
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNWl39KXxqZisYx6TrkUwvoMiMnkSG5t7CZW3mN6PvpbQqP4EUQcUU-82xIRBAqOQbHWnQGanN-0FMdxwg3JqGsZtymBR38egROXI9wEuM30lVBbmKLp_i07Rc4wV1AL2zE4OimQulj8lXg4GKawBAoVsIRJcdn3St0-IrjKOxTk90ze7XY
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 91.134.110.137 , France, ASN16276 (OVH, FR),
Reverse DNS: ip137.ip-91-134-110.eu
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:13 GMT
transfer-encoding: chunked
content-type: image/gif

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 8CA0 43 B
215 B 178ms
178ms Image
image/gif 2600:1f13:800:7781:8c3e:5e6a:bcfa:1ac1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1874201&asId=5e12c3b9-b969-1377-610b-a93e407f49c3&tv=%7Bc:2qpM6U,pingTime:1,time:2062,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:15%7D,%7Bpiv:100,vs:i,r:,t:1062%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1000,o:1062,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1057~0,0~100%5D,as:%5B1057~728.90%5D%7D%7D,%7Bsl:i,t:1062,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1000~100%5D,as:%5B1000~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:392,fm:u2ueYfQ+11%7C12%7C13%7C14%7C15%7C161*.1874201-77019270%7C1611%7C1612%7C1613%7C171,idMap:161*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:16,sis:136%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:8c3e:5e6a:bcfa:1ac1 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:13 GMT
server: nginx
x-server-name: dt08.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 8CA0 43 B
215 B 179ms
179ms Image
image/gif 2600:1f13:800:7781:8c3e:5e6a:bcfa:1ac1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1874201&asId=5e12c3b9-b969-1377-610b-a93e407f49c3&tv=%7Bc:2qpM6V,pingTime:1,time:2063,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:15%7D,%7Bpiv:100,vs:i,r:,t:1062%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1001,o:1062,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1057~0,0~100%5D,as:%5B1057~728.90%5D%7D%7D,%7Bsl:i,t:1062,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:392,fm:u2ueYfQ+11%7C12%7C13%7C14%7C15%7C161*.1874201-77019270%7C1611%7C1612%7C1613%7C171,idMap:161*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:16,sis:136%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:8c3e:5e6a:bcfa:1ac1 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:13 GMT
server: nginx
x-server-name: dt04.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CAE6 0
20 B 168ms
167ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4811244828054&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CAE6 0
20 B 167ms
167ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4811244828054&version=m202309260101&ct=77&x=1&cor=16540528523994520000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame CAE6 20 KB
13 KB 62ms
62ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CXi6tnE8GanFOpH0zQCKp-TGkdex5m3eJ_rV0OifWv7UgYMRb1riDBrUkxXcy7Q1tvMaSpRzJi71FCYlXRlljZTVZU8bUYa9QZT4VZOLLEUctAjHyQ2czd9Hzbe3bjPX8MEvTwz2tvQMrgv6wI8w1TBSh848rILb_xLFSAMPaHclhT14Q&cry=1&dbm_d=AKAmf-ApX9N-Kty1fYFC2pGjG4gzjNRjIgiezvfcoZugdPL-4RmS00nzKRdFAlzHDRglejt-VJ8b5fZQ-GrIxrZoUrjp8-bRwdm4sqC53zK_fjGmFkeCTeGgQMa-04k6G3VuVFv7IMKfQw5wJgeXcFqjrZTdzGVnlo0rr8FJ2s022723DOi7CjwsNlG9smAGwQDPxf-LCLi2CLVFhjdMlW97ViyzxfqsHeLngTzvIPdxg-_MapytONDdJUMHY-hpfoey1ZSEIiXA1PAxdQCW_9rnmZWZQ4GocCYpq69mKeK0npL9m91wHa6q2cEmkCZnsunBn4T35Ls_cK8YPteVxqDnaRnfU0anAGfNTZCbx0AArEa363m3xW5SuLMBTryQ6iKk__K0HesAbfN2gglegF-TOnxPsW9jLXxcKsErV8kHUb84tLEzuSUu_ZRvSccgkvLuJjaSYiWaqEiVLov3d3KlmII3JPWYPflZoIwkxAFjvENjp0jY4JfRKcUJEqo9DH24kF99D1w0CdJHece7VS9xdUgo7ijtBGR9gL_iegGn8uLFCrWMSmxtHrSaWEuvmvtpMpTQVX7wLCchPk3aE2qDO493hyjzca8vekz2aO-V4tXy3srIN1PuSe_7JfK6bRpL7ZFqhAOux-yPNcepu2ByFcUZ-vXZcTlMVEyePbpsBfMxtF_LZeKbdBqq-gAMhtPYufcDQxcDeST69adXEgkRGSPq3KhlEWnoGx22BF8zf7uoBLHaUIwAHZ8ZALW-vN_mwFdmZvnID5igOQiVZuM6cEKalcd_zL6Pxd4i_AzpJZmXbwKKKuSTXZG3Igo7FM208hWq4MdYTDjkGi_C2LRxWqSoyDtjdeRXrX3V8KtRiTFttmhtSzeZvFIpjDRr_WiF-SxLCDlAOe8MzE5XIXwA2EpXw1dzTc3FrKzmkOAj0BseEmFT4Wh1Gt_w3URb1gGV3FgvF3QCfbxF2rEqszVHJi1zYDvRz9aVfcNg0Vx3rInC5LxdcclbJ5F6iXcyyV0sFnfQe4QI6Ka24D7rIe0RwxKYZhLLtG0xe0gbsgi10lUeQxivx1bMCAVMd7H8QcnE-G7nlzQ52U5_w6-9ye86lFPP2irfBHKHskgbotO6fULFWRNrgzGhVvPbP6udsaPSpc9hDyq9JfZrKmKmL7h4aEmH47pfzvVMqLXwOWvlJGXARaeECix3IWGIaRDBsBHgeYKnQF4Dp2t6K_LBfv12txRhEq7e9iM92tQsJEGcW6F5gwOriZ16U4q4M5uD0jos4W0YTvwDwwfM4grveKBsxIr-lwLtzB8gvqUTb5KggDODILP5v8_gFS_4019xjZi-KaZkqU2onc03bDtzak4FevAOwYF5oxhWuD082xD1sSuywRuaFycoEGtPcLcSEbPxot3_7XCPoW-yznHhNF_E__pHcYc8ohJ04VEcFHhZ4kPrGARJSACFe9Ba_8EaaPleVXZkM5hEezd7SjpE5NC2dIQDyIraaqgmEOP15lWu0Bjs1WfzY3f6os82-owSny24dUsJ3Gn5opVF__y2AeGwKXG3WV9WWLtf0kmDydF9gLSG8PLcJk7QAUsBcyTeogg-Kp0fibynw1RELVwOhJp9gsKVFImtOd21D1JzPBBefwiBcv7dcu3Q9xuQ8eFLll_s6TEkK8uCiFEyYxGDRwbuAHON-moaZUmEEdIrVki3rRO8miwI8fXosDrE8uIMazchXLsMENx9DPOqYXZgffUjcdSPwhSzAwMh2nj2xU5b-qGd3zJxboFyMznU47mO119SJDRls3OCLS68z1hUMMoiI1SH-twAVIdyF2Pe2UyqUxMj-Io7xEpOPnDnGCLxxrlgw2ASy1je1o2WmPJGVqPPkqCj4w1ejCoUaV529eHeZQ2U-yR1a9StrSCR31oRETnPoF4oxT-n4nTSPA5oEpXihBAkj_91Lxjw8HeuMTlPsjE2gnaTSlv0galFtDiczxW45lzSppxasuMSj1bRNILW0hA61OTYE-BzCW8_qKhldTBmSXZfoZoiyN0-kzm77ybUx9b08O_HjbIbQ1dn8s4LIojpsXJF6yEIB8-Nj8UAFd0vTuOSCUQUGS6RATFbTxMyGp0t2N3HS4LYDJ3ibOl-fZbyYGucWVTFtzn2DivST_YqrntwOpbn18v7FLbMBkw-MMiEQrvJVdUVbaLjjMDBIMQA0nsZyxqZk9BSeSG3AfjSh7zUJuRFdYgKM1niFb4RWxLH6JETcGIT7CEQW3TmVveJirYEhRFAoNGB2Mo2krrF9J5NXi7SQIgixrlT_PLwvnL5vgDEr66yR9vw4O-nNqFejWj8rsNAy6aRyjFfDBAfRCmLPY1bzSvA9MYUVjVaLVg-Fy0Bex_Wai_oy7C5aq6bCwbjshZPilhASrhERfn0sx95jqr2er4CYfg08_54Ue9bPiYFvEEG8x6N8sDOYClKYP0SVlJGQp6EOj1k4OFgFoTemQ-prwJd6phgRbh9nGmc-heulDLdsnw2c8XjIRLkFLV5hGlEnYQFT0WGwTFQ2tLWGyYGno8iRfZZi1H2mFDnymiLLP5bG_d2JUBDHpi8G5cDhxpkPYpO9KLUh-jJlbI_jEorDQC2xAZdi1JTCafgdI0Sf8F8s9RknNczODooa6q6-ayzCRlEKOdW31ro3NPWn8VolGfXtgiJEtMTIAGWHKLGiFji4BhcEh_g4Qj0XLF0ua3jPJDvb_uaghVQLIPmkfF2wvadkPE0xvEdrW1IV3PZLUlvS6L-XsTylm4MNDE0tVKad6xlQ8xsbn-6jgC5eMjhtjOq7WX_Xm8DcVxRBq0uS1l-Z1cAPbt8NsCw13sr6pn0cymuUT3Qma_H4OB59YR9X8AOM7Zx1R8Rmyq_t7LslL6bPlF97Su30tGFfrMqlVjJz2GfAq9UqsbbD7wGF1vr_mkP2rPa3aMsc86ahC7Q2lS0JML_j5_9wMxuk05iggUN1eAr6op-s_cUQGQBB_EBZq5eN8jtKWtpEMpAT4BXKA0prEsk-AeOc6A3e84hdUNPqUiPKvmbdLigNJL-Jz_awqU6h4P5XUaaGkKW6s7PmpvLAR_nKo4CfSWa94QyVqpLp5akEc7Iu3QSviPYB8WyjhMniR7ZNaClkzTSgMmV5di8--_jd1zIS9n-Rwe0okMlCGfd66A1m6iVsafEHjxnJ-0tnxc3esDboYAcP90c_0J0y1E9wZb7NbDKY1oHOEh5q8xx-KBZgjtZfoerrBxlqGSeTzKyZ_oWQxO-dJ2dKHsJuc7zXjo_aYghhU1DCquXjyOUyWa227Dw0yFQpj3SxtW6VkhwEvYOvSY0FgqajSGgPrBb5EB7B8qEylETSqgqe65EjfS2Q5cLo-HqlqYLH8elGqwOuCvMpG4Gk0Dog_9CV7vyWvj5A1RrKezrPIB6aDK7ETRXzOsGhBjG1WLhXF4bAmqV3UFsBxE5GCmq5ULqxsYZFLuLD75HdukmtP9_DrvdwC6aLKZEivTLCP1QBw1E1xiBBJJ5f6OGfGBPF16OytAXQqElidqkFPMzyegCjhiQihu6xLOnj7tEdxt6MJZnk8RG9byzSimz4wj0xs6l4llRlATAa7A4WfQ6Jhx5zMk8bTxpOy-WDmm6WwFTpe6cy5PQvQE8dna-TeNUvFzCEvn8-6waJL0RTEzIemgHnXCCm5OXAOswHX3b8cqR_K6In1a2c6VGhl2xL5JXpsThCwKX0qpeHNXfvzbYRvJ3YgPjj6r9KVgWiT0Jp1TNJVI5SnlOVMpwOyygTV0SkAVeQnpwQBERnH3KCaB94P9b2NIx3Ssw0ay6pKtTAax6lSeuxGtFDdHOkzYzpO432LdPH2q7M7PRvVon9YuwWgJtLKuOSn8ZJRo-26QUeQt3PL-rJVqHq08mSgzrliFx-0NyXRtYhXR2o66BODt1VatH72yyBH2HEgWEPwEBZwqGl-xdMZ2vP86EI1DjWy7Vz92vjaqoUVoHRzehDaEpe0GR4_k8mGce78CRbTb6u-nPWNbQgWfG9qXWyH9B6gEpOeimkrO4EctUAkr3E2pYWh3FOBeiO1eWYWHLif4QAr7bPRDusddnjQXhEDg46YZ4PG_Zf9bx0KdAaAkPZT1f-TH-ojBFSFfLWHLu8OwGOuRr0nWxE_6HdwRLB0UjygHFnx2Gn2MyekyTfsyeLlWlUeESwvWRfpyuKEeXZg-jX_Cn9ieDGM91S6iVbSdRu8gzv-PyQBnQJlg5OPjPKt475t8iyZxrkMjpkHXtH6xvAqw&cid=CAQSTwAvHhf_L31aFU49H7489iUAyHsZfanCqzlHqAKUpVEkQztx2bJQkjSI9gF1ohUFtJyhzF_rIue_17TQrif_pZpFsmRX1hXSJ_hslMuJUuYYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Far.hibapress.com%2F&ds=l&xdt=1&iif=1&cor=16540528523994520000&adk=943508964&idt=169&cac=0&dtd=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eeb18237a7bbfc7208dc6afdb0c8b4ac212b7ce3fe8339430bbf6a446ad3fe1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:13 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13646
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame CAE6 41 KB
14 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CXi6tnE8GanFOpH0zQCKp-TGkdex5m3eJ_rV0OifWv7UgYMRb1riDBrUkxXcy7Q1tvMaSpRzJi71FCYlXRlljZTVZU8bUYa9QZT4VZOLLEUctAjHyQ2czd9Hzbe3bjPX8MEvTwz2tvQMrgv6wI8w1TBSh848rILb_xLFSAMPaHclhT14Q&cry=1&dbm_d=AKAmf-ApX9N-Kty1fYFC2pGjG4gzjNRjIgiezvfcoZugdPL-4RmS00nzKRdFAlzHDRglejt-VJ8b5fZQ-GrIxrZoUrjp8-bRwdm4sqC53zK_fjGmFkeCTeGgQMa-04k6G3VuVFv7IMKfQw5wJgeXcFqjrZTdzGVnlo0rr8FJ2s022723DOi7CjwsNlG9smAGwQDPxf-LCLi2CLVFhjdMlW97ViyzxfqsHeLngTzvIPdxg-_MapytONDdJUMHY-hpfoey1ZSEIiXA1PAxdQCW_9rnmZWZQ4GocCYpq69mKeK0npL9m91wHa6q2cEmkCZnsunBn4T35Ls_cK8YPteVxqDnaRnfU0anAGfNTZCbx0AArEa363m3xW5SuLMBTryQ6iKk__K0HesAbfN2gglegF-TOnxPsW9jLXxcKsErV8kHUb84tLEzuSUu_ZRvSccgkvLuJjaSYiWaqEiVLov3d3KlmII3JPWYPflZoIwkxAFjvENjp0jY4JfRKcUJEqo9DH24kF99D1w0CdJHece7VS9xdUgo7ijtBGR9gL_iegGn8uLFCrWMSmxtHrSaWEuvmvtpMpTQVX7wLCchPk3aE2qDO493hyjzca8vekz2aO-V4tXy3srIN1PuSe_7JfK6bRpL7ZFqhAOux-yPNcepu2ByFcUZ-vXZcTlMVEyePbpsBfMxtF_LZeKbdBqq-gAMhtPYufcDQxcDeST69adXEgkRGSPq3KhlEWnoGx22BF8zf7uoBLHaUIwAHZ8ZALW-vN_mwFdmZvnID5igOQiVZuM6cEKalcd_zL6Pxd4i_AzpJZmXbwKKKuSTXZG3Igo7FM208hWq4MdYTDjkGi_C2LRxWqSoyDtjdeRXrX3V8KtRiTFttmhtSzeZvFIpjDRr_WiF-SxLCDlAOe8MzE5XIXwA2EpXw1dzTc3FrKzmkOAj0BseEmFT4Wh1Gt_w3URb1gGV3FgvF3QCfbxF2rEqszVHJi1zYDvRz9aVfcNg0Vx3rInC5LxdcclbJ5F6iXcyyV0sFnfQe4QI6Ka24D7rIe0RwxKYZhLLtG0xe0gbsgi10lUeQxivx1bMCAVMd7H8QcnE-G7nlzQ52U5_w6-9ye86lFPP2irfBHKHskgbotO6fULFWRNrgzGhVvPbP6udsaPSpc9hDyq9JfZrKmKmL7h4aEmH47pfzvVMqLXwOWvlJGXARaeECix3IWGIaRDBsBHgeYKnQF4Dp2t6K_LBfv12txRhEq7e9iM92tQsJEGcW6F5gwOriZ16U4q4M5uD0jos4W0YTvwDwwfM4grveKBsxIr-lwLtzB8gvqUTb5KggDODILP5v8_gFS_4019xjZi-KaZkqU2onc03bDtzak4FevAOwYF5oxhWuD082xD1sSuywRuaFycoEGtPcLcSEbPxot3_7XCPoW-yznHhNF_E__pHcYc8ohJ04VEcFHhZ4kPrGARJSACFe9Ba_8EaaPleVXZkM5hEezd7SjpE5NC2dIQDyIraaqgmEOP15lWu0Bjs1WfzY3f6os82-owSny24dUsJ3Gn5opVF__y2AeGwKXG3WV9WWLtf0kmDydF9gLSG8PLcJk7QAUsBcyTeogg-Kp0fibynw1RELVwOhJp9gsKVFImtOd21D1JzPBBefwiBcv7dcu3Q9xuQ8eFLll_s6TEkK8uCiFEyYxGDRwbuAHON-moaZUmEEdIrVki3rRO8miwI8fXosDrE8uIMazchXLsMENx9DPOqYXZgffUjcdSPwhSzAwMh2nj2xU5b-qGd3zJxboFyMznU47mO119SJDRls3OCLS68z1hUMMoiI1SH-twAVIdyF2Pe2UyqUxMj-Io7xEpOPnDnGCLxxrlgw2ASy1je1o2WmPJGVqPPkqCj4w1ejCoUaV529eHeZQ2U-yR1a9StrSCR31oRETnPoF4oxT-n4nTSPA5oEpXihBAkj_91Lxjw8HeuMTlPsjE2gnaTSlv0galFtDiczxW45lzSppxasuMSj1bRNILW0hA61OTYE-BzCW8_qKhldTBmSXZfoZoiyN0-kzm77ybUx9b08O_HjbIbQ1dn8s4LIojpsXJF6yEIB8-Nj8UAFd0vTuOSCUQUGS6RATFbTxMyGp0t2N3HS4LYDJ3ibOl-fZbyYGucWVTFtzn2DivST_YqrntwOpbn18v7FLbMBkw-MMiEQrvJVdUVbaLjjMDBIMQA0nsZyxqZk9BSeSG3AfjSh7zUJuRFdYgKM1niFb4RWxLH6JETcGIT7CEQW3TmVveJirYEhRFAoNGB2Mo2krrF9J5NXi7SQIgixrlT_PLwvnL5vgDEr66yR9vw4O-nNqFejWj8rsNAy6aRyjFfDBAfRCmLPY1bzSvA9MYUVjVaLVg-Fy0Bex_Wai_oy7C5aq6bCwbjshZPilhASrhERfn0sx95jqr2er4CYfg08_54Ue9bPiYFvEEG8x6N8sDOYClKYP0SVlJGQp6EOj1k4OFgFoTemQ-prwJd6phgRbh9nGmc-heulDLdsnw2c8XjIRLkFLV5hGlEnYQFT0WGwTFQ2tLWGyYGno8iRfZZi1H2mFDnymiLLP5bG_d2JUBDHpi8G5cDhxpkPYpO9KLUh-jJlbI_jEorDQC2xAZdi1JTCafgdI0Sf8F8s9RknNczODooa6q6-ayzCRlEKOdW31ro3NPWn8VolGfXtgiJEtMTIAGWHKLGiFji4BhcEh_g4Qj0XLF0ua3jPJDvb_uaghVQLIPmkfF2wvadkPE0xvEdrW1IV3PZLUlvS6L-XsTylm4MNDE0tVKad6xlQ8xsbn-6jgC5eMjhtjOq7WX_Xm8DcVxRBq0uS1l-Z1cAPbt8NsCw13sr6pn0cymuUT3Qma_H4OB59YR9X8AOM7Zx1R8Rmyq_t7LslL6bPlF97Su30tGFfrMqlVjJz2GfAq9UqsbbD7wGF1vr_mkP2rPa3aMsc86ahC7Q2lS0JML_j5_9wMxuk05iggUN1eAr6op-s_cUQGQBB_EBZq5eN8jtKWtpEMpAT4BXKA0prEsk-AeOc6A3e84hdUNPqUiPKvmbdLigNJL-Jz_awqU6h4P5XUaaGkKW6s7PmpvLAR_nKo4CfSWa94QyVqpLp5akEc7Iu3QSviPYB8WyjhMniR7ZNaClkzTSgMmV5di8--_jd1zIS9n-Rwe0okMlCGfd66A1m6iVsafEHjxnJ-0tnxc3esDboYAcP90c_0J0y1E9wZb7NbDKY1oHOEh5q8xx-KBZgjtZfoerrBxlqGSeTzKyZ_oWQxO-dJ2dKHsJuc7zXjo_aYghhU1DCquXjyOUyWa227Dw0yFQpj3SxtW6VkhwEvYOvSY0FgqajSGgPrBb5EB7B8qEylETSqgqe65EjfS2Q5cLo-HqlqYLH8elGqwOuCvMpG4Gk0Dog_9CV7vyWvj5A1RrKezrPIB6aDK7ETRXzOsGhBjG1WLhXF4bAmqV3UFsBxE5GCmq5ULqxsYZFLuLD75HdukmtP9_DrvdwC6aLKZEivTLCP1QBw1E1xiBBJJ5f6OGfGBPF16OytAXQqElidqkFPMzyegCjhiQihu6xLOnj7tEdxt6MJZnk8RG9byzSimz4wj0xs6l4llRlATAa7A4WfQ6Jhx5zMk8bTxpOy-WDmm6WwFTpe6cy5PQvQE8dna-TeNUvFzCEvn8-6waJL0RTEzIemgHnXCCm5OXAOswHX3b8cqR_K6In1a2c6VGhl2xL5JXpsThCwKX0qpeHNXfvzbYRvJ3YgPjj6r9KVgWiT0Jp1TNJVI5SnlOVMpwOyygTV0SkAVeQnpwQBERnH3KCaB94P9b2NIx3Ssw0ay6pKtTAax6lSeuxGtFDdHOkzYzpO432LdPH2q7M7PRvVon9YuwWgJtLKuOSn8ZJRo-26QUeQt3PL-rJVqHq08mSgzrliFx-0NyXRtYhXR2o66BODt1VatH72yyBH2HEgWEPwEBZwqGl-xdMZ2vP86EI1DjWy7Vz92vjaqoUVoHRzehDaEpe0GR4_k8mGce78CRbTb6u-nPWNbQgWfG9qXWyH9B6gEpOeimkrO4EctUAkr3E2pYWh3FOBeiO1eWYWHLif4QAr7bPRDusddnjQXhEDg46YZ4PG_Zf9bx0KdAaAkPZT1f-TH-ojBFSFfLWHLu8OwGOuRr0nWxE_6HdwRLB0UjygHFnx2Gn2MyekyTfsyeLlWlUeESwvWRfpyuKEeXZg-jX_Cn9ieDGM91S6iVbSdRu8gzv-PyQBnQJlg5OPjPKt475t8iyZxrkMjpkHXtH6xvAqw&cid=CAQSTwAvHhf_L31aFU49H7489iUAyHsZfanCqzlHqAKUpVEkQztx2bJQkjSI9gF1ohUFtJyhzF_rIue_17TQrif_pZpFsmRX1hXSJ_hslMuJUuYYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Far.hibapress.com%2F&ds=l&xdt=1&iif=1&cor=16540528523994520000&adk=943508964&idt=169&cac=0&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 11:54:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 102536
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 Jan 2025 11:54:17 GMT

GET
H3 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwNjI4NjE5MzY2ODQyOQogIHNlcnZlcl9pcDogMTI2MDY3OTgwCiAgcHJvY2Vzc19pZDogMTI1ODQzNTAwMQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame CAE6 0
22 B 186ms
186ms Image
image/png 172.217.18.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwNjI4NjE5MzY2ODQyOQogIHNlcnZlcl9pcDogMTI2MDY3OTgwCiAgcHJvY2Vzc19pZDogMTI1ODQzNTAwMQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAyMjQwNzQ3NDUzNjcxMjE1NTc5CmRlYnVnX2tleTogMTQ0MzQxNDIwOTk1MDQwODY3NDMKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDI0LTAxLTI2IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIxNzU4OTkKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIwNzA2NwogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vZGVidWdjb252ZXJzaW9uZG9tYWluMS5jb20iCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9kZWJ1Z2NvbnZlcnNpb25kb21haW4yLmNvbSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNAo

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a92-123-148-9.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:13 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x7e99a08e958de9be0000000000000000","13":"0x5b6e9c656ff8c58d0000000000000000","14":"0xa58c436a2c2ecfc00000000000000000","15":"0x4010d700e62410640000000000000000"},"debug_key":"14434142099504086743","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"2240747453671215579"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK iju9wczm8trb Show response
hal9000.redintelligence.net/zone/ Frame CAE6 12 KB
4 KB 88ms
25ms Script
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1706286193134366&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC5Z9_cdyzZd6ZCIHEx_APi_Ok4Aqm5b2gaa2VnKfJD_AuEAEg48_yQmCVgoCAmAfIAQmpAkTLtHHvO7I-qAMByAObBKoEmgJP0CRYw2ZHn0z8gyTvSD0iPftrTT1pxiK8qpxyaKraRIRZrkNEiwyYbYQ_K3dgY4heBoM0e3tlZLLoanoOMlQXKNrL2GqC_DhVY5DcIkwl8ajFc8pTCNZudjJ-q-82NoQR45xerO5MHqoYseT3ETrQKLsq1oGZj2OGWdsPk_HZkNMhDxM0rJNqMuwt-OHJlUnK5-Ng2vw5lissSG5P477CPifKvlnN9cqq9uGYALynLrRBq00Jrr_TuPspg_SbaYoUc-opETJo8H1MEw3bikJBYFrqcigwfxO3U8Uoo3X8DGp-lAABJ5B1aoq3xLQ6nKn83f9bvQabuQfluUiNGltvKBPCw0rxAcLh7PxrpR2-BHQ8L0BWo1ldIezABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHTICqgI6AoBASL39wTpYxuGLsrv7gwOACgGYCwHICwGADAGqDQJEReINEwjchoyyu_uDAxUB4hEIHYs5CaywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyGAUYTSIBAA%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_L31aFU49H7489iUAyHsZfanCqzlHqAKUpVEkQztx2bJQkjSI9gF1ohUFtJyhzF_rIue_17TQrif_pZpFsmRX1hXSJ_hslMuJUuYYAQ%26sig%3DAOD64_22t3MdiGwom--NKSu3zrt2mw75NA%26client%3Dca-pub-1219367199329714%26dbm_c%3DAKAmf-AMPZtcgyAQqQayYNVT0z5TU2ySxpHTSacusz67lHNY4aCW5Xo4Xwd6Gj83m9v_upaZnXtJgyRCEftBXKEI7ymLdzRHxrnK3_s7Ms1CV3M2QE613-gw31qFVgJ_SQltnbsWnubhLbuc_EgrRA9-SxkGhsCz6yqpijNDFfk77Iht3mvR9Y4%26cry%3D1%26dbm_d%3DAKAmf-D8iFzq-v7nlX3lDOVt2LA-VjJ6PWlLgPmPpbOO_7dnY2Md9gHS_6k6GZahc7IP97TZm3J-DwXP-7De6AaNv8o4jdv4V32syFUjiwYSzSMvvvgTPkHCRF0IlJxI6Nh50IBk21sZrzXx-KA7cnSpCB_Uvx0PDXckdI4jhg6LeCB0bOxmkZ1MpitGMf78TumI3COTui8dyd2NWFNCmdDJakDlkS7fCtt62pNl_Hq-Uxipm_arhBhCjVjQ389FINDO_iYgJpSgPTQc6KER0OmvFJV62rC_hA6HrGxYrmaPSJE9JKO5-yu2wrvK65iw0L8tlzLNXyXkP26NcdZFEw7iHYDwpxrkTVCCdJXpcOmarIsSjJRyQVe-DQ0iwMpDintld8MwxD97I4avVzt7Nw8U05Ose5Z6aI4h20BZcVgC9MnmI1UiMEs-6fbpj5xKMF7Te_HMVBlIyGYXC9HKXFOZThI8NgLugQcCaZwGNFGr9ImMl620xg2b_cVwufBPMT4E1oRDCqutHkPyMHjYSqLER9TFl9_-TCpQ1tBVAVeVeHxp8CNjoRnQ0u7VB5NeaVPGAv48ZvYL%26adurl%3D
Requested by: Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 1062f4af4e3703813313697ad62961c56e8f7e8e7c5579e903e36bd07e91d299

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Fri, 26 Jan 2024 16:23:13 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4257
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame C5F9 38 KB
13 KB 20ms
20ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 102536
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 25 Jan 2024 11:54:17 GMT
expires: Fri, 24 Jan 2025 11:54:17 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame C5F9 39 KB
15 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 10:22:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21616
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 25 Jan 2025 10:22:57 GMT

GET
H/1.1

200
OK

request.php Show response
hal900016.redintelligence.net/ Frame CAE6
Redirect Chain

https://hal900016.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=ba16c46d37&subid=&uid=d7e0375af003a166&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900016.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=ba16c46d37&subid=&uid=d7e0375af003a166&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

146ms
96ms

Script
application/x-javascript

138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900016.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=ba16c46d37&subid=&uid=d7e0375af003a166&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC5Z9_cdyzZd6ZCIHEx_APi_Ok4Aqm5b2gaa2VnKfJD_AuEAEg48_yQmCVgoCAmAfIAQmpAkTLtHHvO7I-qAMByAObBKoEmgJP0CRYw2ZHn0z8gyTvSD0iPftrTT1pxiK8qpxyaKraRIRZrkNEiwyYbYQ_K3dgY4heBoM0e3tlZLLoanoOMlQXKNrL2GqC_DhVY5DcIkwl8ajFc8pTCNZudjJ-q-82NoQR45xerO5MHqoYseT3ETrQKLsq1oGZj2OGWdsPk_HZkNMhDxM0rJNqMuwt-OHJlUnK5-Ng2vw5lissSG5P477CPifKvlnN9cqq9uGYALynLrRBq00Jrr_TuPspg_SbaYoUc-opETJo8H1MEw3bikJBYFrqcigwfxO3U8Uoo3X8DGp-lAABJ5B1aoq3xLQ6nKn83f9bvQabuQfluUiNGltvKBPCw0rxAcLh7PxrpR2-BHQ8L0BWo1ldIezABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHTICqgI6AoBASL39wTpYxuGLsrv7gwOACgGYCwHICwGADAGqDQJEReINEwjchoyyu_uDAxUB4hEIHYs5CaywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyGAUYTSIBAA%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_L31aFU49H7489iUAyHsZfanCqzlHqAKUpVEkQztx2bJQkjSI9gF1ohUFtJyhzF_rIue_17TQrif_pZpFsmRX1hXSJ_hslMuJUuYYAQ%26sig%3DAOD64_22t3MdiGwom--NKSu3zrt2mw75NA%26client%3Dca-pub-1219367199329714%26dbm_c%3DAKAmf-AMPZtcgyAQqQayYNVT0z5TU2ySxpHTSacusz67lHNY4aCW5Xo4Xwd6Gj83m9v_upaZnXtJgyRCEftBXKEI7ymLdzRHxrnK3_s7Ms1CV3M2QE613-gw31qFVgJ_SQltnbsWnubhLbuc_EgrRA9-SxkGhsCz6yqpijNDFfk77Iht3mvR9Y4%26cry%3D1%26dbm_d%3DAKAmf-D8iFzq-v7nlX3lDOVt2LA-VjJ6PWlLgPmPpbOO_7dnY2Md9gHS_6k6GZahc7IP97TZm3J-DwXP-7De6AaNv8o4jdv4V32syFUjiwYSzSMvvvgTPkHCRF0IlJxI6Nh50IBk21sZrzXx-KA7cnSpCB_Uvx0PDXckdI4jhg6LeCB0bOxmkZ1MpitGMf78TumI3COTui8dyd2NWFNCmdDJakDlkS7fCtt62pNl_Hq-Uxipm_arhBhCjVjQ389FINDO_iYgJpSgPTQc6KER0OmvFJV62rC_hA6HrGxYrmaPSJE9JKO5-yu2wrvK65iw0L8tlzLNXyXkP26NcdZFEw7iHYDwpxrkTVCCdJXpcOmarIsSjJRyQVe-DQ0iwMpDintld8MwxD97I4avVzt7Nw8U05Ose5Z6aI4h20BZcVgC9MnmI1UiMEs-6fbpj5xKMF7Te_HMVBlIyGYXC9HKXFOZThI8NgLugQcCaZwGNFGr9ImMl620xg2b_cVwufBPMT4E1oRDCqutHkPyMHjYSqLER9TFl9_-TCpQ1tBVAVeVeHxp8CNjoRnQ0u7VB5NeaVPGAv48ZvYL%26adurl%3D&documentReferer=https%3A%2F%2Far.hibapress.com%2F&ancestorOrigins=https%3A%2F%2Far.hibapress.com&random=9726065364685&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1
Requested by: Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: f84b4d65a3ede310f479d75e91cc4a9b040df0f4aa62e112e8f0ce1f6c74c766

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 26 Jan 2024 16:23:13 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 72861300133122704444554012581016
Connection: close
Content-Length: 1355
Expires: Fri, 26 Jan 2024 16:23:13 +0100

Redirect headers

Pragma: no-cache
Date: Fri, 26 Jan 2024 16:23:13 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=ba16c46d37&subid=&uid=d7e0375af003a166&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC5Z9_cdyzZd6ZCIHEx_APi_Ok4Aqm5b2gaa2VnKfJD_AuEAEg48_yQmCVgoCAmAfIAQmpAkTLtHHvO7I-qAMByAObBKoEmgJP0CRYw2ZHn0z8gyTvSD0iPftrTT1pxiK8qpxyaKraRIRZrkNEiwyYbYQ_K3dgY4heBoM0e3tlZLLoanoOMlQXKNrL2GqC_DhVY5DcIkwl8ajFc8pTCNZudjJ-q-82NoQR45xerO5MHqoYseT3ETrQKLsq1oGZj2OGWdsPk_HZkNMhDxM0rJNqMuwt-OHJlUnK5-Ng2vw5lissSG5P477CPifKvlnN9cqq9uGYALynLrRBq00Jrr_TuPspg_SbaYoUc-opETJo8H1MEw3bikJBYFrqcigwfxO3U8Uoo3X8DGp-lAABJ5B1aoq3xLQ6nKn83f9bvQabuQfluUiNGltvKBPCw0rxAcLh7PxrpR2-BHQ8L0BWo1ldIezABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHTICqgI6AoBASL39wTpYxuGLsrv7gwOACgGYCwHICwGADAGqDQJEReINEwjchoyyu_uDAxUB4hEIHYs5CaywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyGAUYTSIBAA%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_L31aFU49H7489iUAyHsZfanCqzlHqAKUpVEkQztx2bJQkjSI9gF1ohUFtJyhzF_rIue_17TQrif_pZpFsmRX1hXSJ_hslMuJUuYYAQ%26sig%3DAOD64_22t3MdiGwom--NKSu3zrt2mw75NA%26client%3Dca-pub-1219367199329714%26dbm_c%3DAKAmf-AMPZtcgyAQqQayYNVT0z5TU2ySxpHTSacusz67lHNY4aCW5Xo4Xwd6Gj83m9v_upaZnXtJgyRCEftBXKEI7ymLdzRHxrnK3_s7Ms1CV3M2QE613-gw31qFVgJ_SQltnbsWnubhLbuc_EgrRA9-SxkGhsCz6yqpijNDFfk77Iht3mvR9Y4%26cry%3D1%26dbm_d%3DAKAmf-D8iFzq-v7nlX3lDOVt2LA-VjJ6PWlLgPmPpbOO_7dnY2Md9gHS_6k6GZahc7IP97TZm3J-DwXP-7De6AaNv8o4jdv4V32syFUjiwYSzSMvvvgTPkHCRF0IlJxI6Nh50IBk21sZrzXx-KA7cnSpCB_Uvx0PDXckdI4jhg6LeCB0bOxmkZ1MpitGMf78TumI3COTui8dyd2NWFNCmdDJakDlkS7fCtt62pNl_Hq-Uxipm_arhBhCjVjQ389FINDO_iYgJpSgPTQc6KER0OmvFJV62rC_hA6HrGxYrmaPSJE9JKO5-yu2wrvK65iw0L8tlzLNXyXkP26NcdZFEw7iHYDwpxrkTVCCdJXpcOmarIsSjJRyQVe-DQ0iwMpDintld8MwxD97I4avVzt7Nw8U05Ose5Z6aI4h20BZcVgC9MnmI1UiMEs-6fbpj5xKMF7Te_HMVBlIyGYXC9HKXFOZThI8NgLugQcCaZwGNFGr9ImMl620xg2b_cVwufBPMT4E1oRDCqutHkPyMHjYSqLER9TFl9_-TCpQ1tBVAVeVeHxp8CNjoRnQ0u7VB5NeaVPGAv48ZvYL%26adurl%3D&documentReferer=https%3A%2F%2Far.hibapress.com%2F&ancestorOrigins=https%3A%2F%2Far.hibapress.com&random=9726065364685&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Fri, 26 Jan 2024 16:23:13 +0100

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C5F9 0
20 B 172ms
172ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BBFp2cdyzZY3mKIzKjuwPueOI2AQAAAAAOAHgBAI&bg=!5-Sl5KvNAAa8BdJLnAU7ADQBe5WfOEBbmFF99mv9I3KRt1lBXAj_G60QpUcfiZAyuE5WMZbIRuY4_FJzswvlCFnmKaRrAgAAADRSAAAAAWgBB5kDAyLVVcpFdSXk9Hsg1dOXQAl3cms6bdLP6BcLvexy411jy34zjEDwhIPtKcuGY-wGjBRgRVEYr5Q_Dh-37eOy6z1JS3dvASsVww8SUj5YVMXflxvHlRJPkgE-hzPIKgXG8XgKHuFJUG2iSnG9YKW0ZZ6qMB7gn6dbjTnTZguXDcUNMoHuu8H1Q1aouvtSfvcpTX_Y3DcWHBNtm57gVWHv9jHAfV48owENzTkBAtq_SoOKEWfms-yd4CpHY8OkVrY9hs_Cy_abXWkMum8dA8HQ3aqpYeDNyiZg09sF0ru0apNol5EIh2tFdnXDCnGA6QOrk3_tx1lNMIlv2IrkAsWMX2e3RPITcbupf7769sccn55xQH37gdQuCmIU3BDW7a6dxY7Cra-Rku3GFsX-Kmfl2sMgrhvyagwzzTaWz1Ig7RrUiUjm6GNFQFUwkyQ3Pk5HapHboYlP1DeEv8vCWt-GP2GqHvXvPeqJaVc5jo7Jh35t7Z-6zBYIxDgiUL7bvmIDP11qN6GBbP-DzDSrM9JjOvPP8jZJG38gd7S0mzuFRbt5d35ORvQT45wDHu8AVD46oPawX0oO3MmNN9cWv5HwvwSYYSg9rj9TFSlukSbZdnKvrmj25OWKPBE43j-eavshec1I1m_mIbgLwFwcgAchynX6T5_z670ev3YuObP5OZzUNZZfGc93Zdexf1Kpge9LJXCLVNshaTnCesAwVGu4qeNLh5Rlr7n1TsqvUPiFkHIbKbUjNbThYXxo-tOB8RelpXskG2SGanwsEVWsT7fNQH3WfngVJ-ZSdSdTVZJlhnE1gc6Wn8-JyVOSsK27hFO8QOAUM7_JghmErm5hYTXeTLi-SeBq6xboc07hDqmzG3yTkMQiJCW3ul4XUX2FzivN06aPpHJuSu8avDN27bo7C6N6fR9ek9wFYVWAQwCZGuIhUwnyrFOieBdBdCW1cP9mTZKjH9KKnX0Ai1WygSrwF8gjGE1g-d3oM-qqH0GaJLKmMst1idWS1GO1sub3oo_OOxVSxA

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
adv.office-partner.de/ Frame 1A23 930 B
923 B 229ms
20ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=ba16c46d37&subid=&uid=d7e0375af003a166&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC5Z9_cdyzZd6ZCIHEx_APi_Ok4Aqm5b2gaa2VnKfJD_AuEAEg48_yQmCVgoCAmAfIAQmpAkTLtHHvO7I-qAMByAObBKoEmgJP0CRYw2ZHn0z8gyTvSD0iPftrTT1pxiK8qpxyaKraRIRZrkNEiwyYbYQ_K3dgY4heBoM0e3tlZLLoanoOMlQXKNrL2GqC_DhVY5DcIkwl8ajFc8pTCNZudjJ-q-82NoQR45xerO5MHqoYseT3ETrQKLsq1oGZj2OGWdsPk_HZkNMhDxM0rJNqMuwt-OHJlUnK5-Ng2vw5lissSG5P477CPifKvlnN9cqq9uGYALynLrRBq00Jrr_TuPspg_SbaYoUc-opETJo8H1MEw3bikJBYFrqcigwfxO3U8Uoo3X8DGp-lAABJ5B1aoq3xLQ6nKn83f9bvQabuQfluUiNGltvKBPCw0rxAcLh7PxrpR2-BHQ8L0BWo1ldIezABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHTICqgI6AoBASL39wTpYxuGLsrv7gwOACgGYCwHICwGADAGqDQJEReINEwjchoyyu_uDAxUB4hEIHYs5CaywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyGAUYTSIBAA%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_L31aFU49H7489iUAyHsZfanCqzlHqAKUpVEkQztx2bJQkjSI9gF1ohUFtJyhzF_rIue_17TQrif_pZpFsmRX1hXSJ_hslMuJUuYYAQ%26sig%3DAOD64_22t3MdiGwom--NKSu3zrt2mw75NA%26client%3Dca-pub-1219367199329714%26dbm_c%3DAKAmf-AMPZtcgyAQqQayYNVT0z5TU2ySxpHTSacusz67lHNY4aCW5Xo4Xwd6Gj83m9v_upaZnXtJgyRCEftBXKEI7ymLdzRHxrnK3_s7Ms1CV3M2QE613-gw31qFVgJ_SQltnbsWnubhLbuc_EgrRA9-SxkGhsCz6yqpijNDFfk77Iht3mvR9Y4%26cry%3D1%26dbm_d%3DAKAmf-D8iFzq-v7nlX3lDOVt2LA-VjJ6PWlLgPmPpbOO_7dnY2Md9gHS_6k6GZahc7IP97TZm3J-DwXP-7De6AaNv8o4jdv4V32syFUjiwYSzSMvvvgTPkHCRF0IlJxI6Nh50IBk21sZrzXx-KA7cnSpCB_Uvx0PDXckdI4jhg6LeCB0bOxmkZ1MpitGMf78TumI3COTui8dyd2NWFNCmdDJakDlkS7fCtt62pNl_Hq-Uxipm_arhBhCjVjQ389FINDO_iYgJpSgPTQc6KER0OmvFJV62rC_hA6HrGxYrmaPSJE9JKO5-yu2wrvK65iw0L8tlzLNXyXkP26NcdZFEw7iHYDwpxrkTVCCdJXpcOmarIsSjJRyQVe-DQ0iwMpDintld8MwxD97I4avVzt7Nw8U05Ose5Z6aI4h20BZcVgC9MnmI1UiMEs-6fbpj5xKMF7Te_HMVBlIyGYXC9HKXFOZThI8NgLugQcCaZwGNFGr9ImMl620xg2b_cVwufBPMT4E1oRDCqutHkPyMHjYSqLER9TFl9_-TCpQ1tBVAVeVeHxp8CNjoRnQ0u7VB5NeaVPGAv48ZvYL%26adurl%3D&documentReferer=https%3A%2F%2Far.hibapress.com%2F&ancestorOrigins=https%3A%2F%2Far.hibapress.com&random=9726065364685&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Fri, 26 Jan 2024 16:23:14 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Fri, 02 Feb 2024 16:23:14 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame 9019 0
327 B 92ms
29ms Document
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=72861300133122704444554012581016&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=ba16c46d37&subid=&uid=d7e0375af003a166&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC5Z9_cdyzZd6ZCIHEx_APi_Ok4Aqm5b2gaa2VnKfJD_AuEAEg48_yQmCVgoCAmAfIAQmpAkTLtHHvO7I-qAMByAObBKoEmgJP0CRYw2ZHn0z8gyTvSD0iPftrTT1pxiK8qpxyaKraRIRZrkNEiwyYbYQ_K3dgY4heBoM0e3tlZLLoanoOMlQXKNrL2GqC_DhVY5DcIkwl8ajFc8pTCNZudjJ-q-82NoQR45xerO5MHqoYseT3ETrQKLsq1oGZj2OGWdsPk_HZkNMhDxM0rJNqMuwt-OHJlUnK5-Ng2vw5lissSG5P477CPifKvlnN9cqq9uGYALynLrRBq00Jrr_TuPspg_SbaYoUc-opETJo8H1MEw3bikJBYFrqcigwfxO3U8Uoo3X8DGp-lAABJ5B1aoq3xLQ6nKn83f9bvQabuQfluUiNGltvKBPCw0rxAcLh7PxrpR2-BHQ8L0BWo1ldIezABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHTICqgI6AoBASL39wTpYxuGLsrv7gwOACgGYCwHICwGADAGqDQJEReINEwjchoyyu_uDAxUB4hEIHYs5CaywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyGAUYTSIBAA%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_L31aFU49H7489iUAyHsZfanCqzlHqAKUpVEkQztx2bJQkjSI9gF1ohUFtJyhzF_rIue_17TQrif_pZpFsmRX1hXSJ_hslMuJUuYYAQ%26sig%3DAOD64_22t3MdiGwom--NKSu3zrt2mw75NA%26client%3Dca-pub-1219367199329714%26dbm_c%3DAKAmf-AMPZtcgyAQqQayYNVT0z5TU2ySxpHTSacusz67lHNY4aCW5Xo4Xwd6Gj83m9v_upaZnXtJgyRCEftBXKEI7ymLdzRHxrnK3_s7Ms1CV3M2QE613-gw31qFVgJ_SQltnbsWnubhLbuc_EgrRA9-SxkGhsCz6yqpijNDFfk77Iht3mvR9Y4%26cry%3D1%26dbm_d%3DAKAmf-D8iFzq-v7nlX3lDOVt2LA-VjJ6PWlLgPmPpbOO_7dnY2Md9gHS_6k6GZahc7IP97TZm3J-DwXP-7De6AaNv8o4jdv4V32syFUjiwYSzSMvvvgTPkHCRF0IlJxI6Nh50IBk21sZrzXx-KA7cnSpCB_Uvx0PDXckdI4jhg6LeCB0bOxmkZ1MpitGMf78TumI3COTui8dyd2NWFNCmdDJakDlkS7fCtt62pNl_Hq-Uxipm_arhBhCjVjQ389FINDO_iYgJpSgPTQc6KER0OmvFJV62rC_hA6HrGxYrmaPSJE9JKO5-yu2wrvK65iw0L8tlzLNXyXkP26NcdZFEw7iHYDwpxrkTVCCdJXpcOmarIsSjJRyQVe-DQ0iwMpDintld8MwxD97I4avVzt7Nw8U05Ose5Z6aI4h20BZcVgC9MnmI1UiMEs-6fbpj5xKMF7Te_HMVBlIyGYXC9HKXFOZThI8NgLugQcCaZwGNFGr9ImMl620xg2b_cVwufBPMT4E1oRDCqutHkPyMHjYSqLER9TFl9_-TCpQ1tBVAVeVeHxp8CNjoRnQ0u7VB5NeaVPGAv48ZvYL%26adurl%3D&documentReferer=https%3A%2F%2Far.hibapress.com%2F&ancestorOrigins=https%3A%2F%2Far.hibapress.com&random=9726065364685&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript; charset=utf-8
date: Fri, 26 Jan 2024 16:23:14 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
vary: Origin

GET
H2 200 link.html Show response
track.webgains.com/ Frame CAE6 2 KB
2 KB 295ms
87ms Script
text/html 13.42.201.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=72861300133122704444554012581016&nw=1
Requested by: Host: ar.hibapress.com
URL: https://ar.hibapress.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.42.201.144 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-42-201-144.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 494673c60c6b29d183c67e084cfc3a1aa23d4d7fdc0b3b94abe1a179cd26b7e9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:14 GMT
last-modified: Fri, 26 Jan 2024 16:23:14 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Fri, 26 Jan 2024 16:24:14 GMT

GET
H2 200 e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame CAE6 0
326 B 93ms
30ms Script
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=72861300133122704444554012581016&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=ba16c46d37&subid=&uid=d7e0375af003a166&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC5Z9_cdyzZd6ZCIHEx_APi_Ok4Aqm5b2gaa2VnKfJD_AuEAEg48_yQmCVgoCAmAfIAQmpAkTLtHHvO7I-qAMByAObBKoEmgJP0CRYw2ZHn0z8gyTvSD0iPftrTT1pxiK8qpxyaKraRIRZrkNEiwyYbYQ_K3dgY4heBoM0e3tlZLLoanoOMlQXKNrL2GqC_DhVY5DcIkwl8ajFc8pTCNZudjJ-q-82NoQR45xerO5MHqoYseT3ETrQKLsq1oGZj2OGWdsPk_HZkNMhDxM0rJNqMuwt-OHJlUnK5-Ng2vw5lissSG5P477CPifKvlnN9cqq9uGYALynLrRBq00Jrr_TuPspg_SbaYoUc-opETJo8H1MEw3bikJBYFrqcigwfxO3U8Uoo3X8DGp-lAABJ5B1aoq3xLQ6nKn83f9bvQabuQfluUiNGltvKBPCw0rxAcLh7PxrpR2-BHQ8L0BWo1ldIezABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHTICqgI6AoBASL39wTpYxuGLsrv7gwOACgGYCwHICwGADAGqDQJEReINEwjchoyyu_uDAxUB4hEIHYs5CaywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyGAUYTSIBAA%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_L31aFU49H7489iUAyHsZfanCqzlHqAKUpVEkQztx2bJQkjSI9gF1ohUFtJyhzF_rIue_17TQrif_pZpFsmRX1hXSJ_hslMuJUuYYAQ%26sig%3DAOD64_22t3MdiGwom--NKSu3zrt2mw75NA%26client%3Dca-pub-1219367199329714%26dbm_c%3DAKAmf-AMPZtcgyAQqQayYNVT0z5TU2ySxpHTSacusz67lHNY4aCW5Xo4Xwd6Gj83m9v_upaZnXtJgyRCEftBXKEI7ymLdzRHxrnK3_s7Ms1CV3M2QE613-gw31qFVgJ_SQltnbsWnubhLbuc_EgrRA9-SxkGhsCz6yqpijNDFfk77Iht3mvR9Y4%26cry%3D1%26dbm_d%3DAKAmf-D8iFzq-v7nlX3lDOVt2LA-VjJ6PWlLgPmPpbOO_7dnY2Md9gHS_6k6GZahc7IP97TZm3J-DwXP-7De6AaNv8o4jdv4V32syFUjiwYSzSMvvvgTPkHCRF0IlJxI6Nh50IBk21sZrzXx-KA7cnSpCB_Uvx0PDXckdI4jhg6LeCB0bOxmkZ1MpitGMf78TumI3COTui8dyd2NWFNCmdDJakDlkS7fCtt62pNl_Hq-Uxipm_arhBhCjVjQ389FINDO_iYgJpSgPTQc6KER0OmvFJV62rC_hA6HrGxYrmaPSJE9JKO5-yu2wrvK65iw0L8tlzLNXyXkP26NcdZFEw7iHYDwpxrkTVCCdJXpcOmarIsSjJRyQVe-DQ0iwMpDintld8MwxD97I4avVzt7Nw8U05Ose5Z6aI4h20BZcVgC9MnmI1UiMEs-6fbpj5xKMF7Te_HMVBlIyGYXC9HKXFOZThI8NgLugQcCaZwGNFGr9ImMl620xg2b_cVwufBPMT4E1oRDCqutHkPyMHjYSqLER9TFl9_-TCpQ1tBVAVeVeHxp8CNjoRnQ0u7VB5NeaVPGAv48ZvYL%26adurl%3D&documentReferer=https%3A%2F%2Far.hibapress.com%2F&ancestorOrigins=https%3A%2F%2Far.hibapress.com&random=9726065364685&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:14 GMT
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx
host: pv.medialead.de
vary: Origin
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 0
proxy-host: pv.medialead.de

GET
H2 200 e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame CAE6 43 B
360 B 94ms
30ms Image
image/gif 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=72861300133122704444554012581016&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=ba16c46d37&subid=&uid=d7e0375af003a166&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC5Z9_cdyzZd6ZCIHEx_APi_Ok4Aqm5b2gaa2VnKfJD_AuEAEg48_yQmCVgoCAmAfIAQmpAkTLtHHvO7I-qAMByAObBKoEmgJP0CRYw2ZHn0z8gyTvSD0iPftrTT1pxiK8qpxyaKraRIRZrkNEiwyYbYQ_K3dgY4heBoM0e3tlZLLoanoOMlQXKNrL2GqC_DhVY5DcIkwl8ajFc8pTCNZudjJ-q-82NoQR45xerO5MHqoYseT3ETrQKLsq1oGZj2OGWdsPk_HZkNMhDxM0rJNqMuwt-OHJlUnK5-Ng2vw5lissSG5P477CPifKvlnN9cqq9uGYALynLrRBq00Jrr_TuPspg_SbaYoUc-opETJo8H1MEw3bikJBYFrqcigwfxO3U8Uoo3X8DGp-lAABJ5B1aoq3xLQ6nKn83f9bvQabuQfluUiNGltvKBPCw0rxAcLh7PxrpR2-BHQ8L0BWo1ldIezABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHTICqgI6AoBASL39wTpYxuGLsrv7gwOACgGYCwHICwGADAGqDQJEReINEwjchoyyu_uDAxUB4hEIHYs5CaywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyGAUYTSIBAA%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_L31aFU49H7489iUAyHsZfanCqzlHqAKUpVEkQztx2bJQkjSI9gF1ohUFtJyhzF_rIue_17TQrif_pZpFsmRX1hXSJ_hslMuJUuYYAQ%26sig%3DAOD64_22t3MdiGwom--NKSu3zrt2mw75NA%26client%3Dca-pub-1219367199329714%26dbm_c%3DAKAmf-AMPZtcgyAQqQayYNVT0z5TU2ySxpHTSacusz67lHNY4aCW5Xo4Xwd6Gj83m9v_upaZnXtJgyRCEftBXKEI7ymLdzRHxrnK3_s7Ms1CV3M2QE613-gw31qFVgJ_SQltnbsWnubhLbuc_EgrRA9-SxkGhsCz6yqpijNDFfk77Iht3mvR9Y4%26cry%3D1%26dbm_d%3DAKAmf-D8iFzq-v7nlX3lDOVt2LA-VjJ6PWlLgPmPpbOO_7dnY2Md9gHS_6k6GZahc7IP97TZm3J-DwXP-7De6AaNv8o4jdv4V32syFUjiwYSzSMvvvgTPkHCRF0IlJxI6Nh50IBk21sZrzXx-KA7cnSpCB_Uvx0PDXckdI4jhg6LeCB0bOxmkZ1MpitGMf78TumI3COTui8dyd2NWFNCmdDJakDlkS7fCtt62pNl_Hq-Uxipm_arhBhCjVjQ389FINDO_iYgJpSgPTQc6KER0OmvFJV62rC_hA6HrGxYrmaPSJE9JKO5-yu2wrvK65iw0L8tlzLNXyXkP26NcdZFEw7iHYDwpxrkTVCCdJXpcOmarIsSjJRyQVe-DQ0iwMpDintld8MwxD97I4avVzt7Nw8U05Ose5Z6aI4h20BZcVgC9MnmI1UiMEs-6fbpj5xKMF7Te_HMVBlIyGYXC9HKXFOZThI8NgLugQcCaZwGNFGr9ImMl620xg2b_cVwufBPMT4E1oRDCqutHkPyMHjYSqLER9TFl9_-TCpQ1tBVAVeVeHxp8CNjoRnQ0u7VB5NeaVPGAv48ZvYL%26adurl%3D&documentReferer=https%3A%2F%2Far.hibapress.com%2F&ancestorOrigins=https%3A%2F%2Far.hibapress.com&random=9726065364685&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:14 GMT
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx
host: pv.medialead.de
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 43
proxy-host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame CAE6 43 B
702 B 260ms
182ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2519595&v=14098&q=379097&r=296283&pref1=72861300133122704444554012581016&pv=1

Requested by

Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=ba16c46d37&subid=&uid=d7e0375af003a166&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC5Z9_cdyzZd6ZCIHEx_APi_Ok4Aqm5b2gaa2VnKfJD_AuEAEg48_yQmCVgoCAmAfIAQmpAkTLtHHvO7I-qAMByAObBKoEmgJP0CRYw2ZHn0z8gyTvSD0iPftrTT1pxiK8qpxyaKraRIRZrkNEiwyYbYQ_K3dgY4heBoM0e3tlZLLoanoOMlQXKNrL2GqC_DhVY5DcIkwl8ajFc8pTCNZudjJ-q-82NoQR45xerO5MHqoYseT3ETrQKLsq1oGZj2OGWdsPk_HZkNMhDxM0rJNqMuwt-OHJlUnK5-Ng2vw5lissSG5P477CPifKvlnN9cqq9uGYALynLrRBq00Jrr_TuPspg_SbaYoUc-opETJo8H1MEw3bikJBYFrqcigwfxO3U8Uoo3X8DGp-lAABJ5B1aoq3xLQ6nKn83f9bvQabuQfluUiNGltvKBPCw0rxAcLh7PxrpR2-BHQ8L0BWo1ldIezABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHTICqgI6AoBASL39wTpYxuGLsrv7gwOACgGYCwHICwGADAGqDQJEReINEwjchoyyu_uDAxUB4hEIHYs5CaywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwGyGAUYTSIBAA%26ae%3D1%26num%3D1%26cid%3DCAQSTwAvHhf_L31aFU49H7489iUAyHsZfanCqzlHqAKUpVEkQztx2bJQkjSI9gF1ohUFtJyhzF_rIue_17TQrif_pZpFsmRX1hXSJ_hslMuJUuYYAQ%26sig%3DAOD64_22t3MdiGwom--NKSu3zrt2mw75NA%26client%3Dca-pub-1219367199329714%26dbm_c%3DAKAmf-AMPZtcgyAQqQayYNVT0z5TU2ySxpHTSacusz67lHNY4aCW5Xo4Xwd6Gj83m9v_upaZnXtJgyRCEftBXKEI7ymLdzRHxrnK3_s7Ms1CV3M2QE613-gw31qFVgJ_SQltnbsWnubhLbuc_EgrRA9-SxkGhsCz6yqpijNDFfk77Iht3mvR9Y4%26cry%3D1%26dbm_d%3DAKAmf-D8iFzq-v7nlX3lDOVt2LA-VjJ6PWlLgPmPpbOO_7dnY2Md9gHS_6k6GZahc7IP97TZm3J-DwXP-7De6AaNv8o4jdv4V32syFUjiwYSzSMvvvgTPkHCRF0IlJxI6Nh50IBk21sZrzXx-KA7cnSpCB_Uvx0PDXckdI4jhg6LeCB0bOxmkZ1MpitGMf78TumI3COTui8dyd2NWFNCmdDJakDlkS7fCtt62pNl_Hq-Uxipm_arhBhCjVjQ389FINDO_iYgJpSgPTQc6KER0OmvFJV62rC_hA6HrGxYrmaPSJE9JKO5-yu2wrvK65iw0L8tlzLNXyXkP26NcdZFEw7iHYDwpxrkTVCCdJXpcOmarIsSjJRyQVe-DQ0iwMpDintld8MwxD97I4avVzt7Nw8U05Ose5Z6aI4h20BZcVgC9MnmI1UiMEs-6fbpj5xKMF7Te_HMVBlIyGYXC9HKXFOZThI8NgLugQcCaZwGNFGr9ImMl620xg2b_cVwufBPMT4E1oRDCqutHkPyMHjYSqLER9TFl9_-TCpQ1tBVAVeVeHxp8CNjoRnQ0u7VB5NeaVPGAv48ZvYL%26adurl%3D&documentReferer=https%3A%2F%2Far.hibapress.com%2F&ancestorOrigins=https%3A%2F%2Far.hibapress.com&random=9726065364685&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 26 Jan 2024 16:23:14 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H2

200

activityi;dc_pre=CL-M_rO7-4MDFQPD9gIdzxEH8w;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3565171663596.316 Show response
8019191.fls.doubleclick.net/ Frame 2C6F
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3565171663596.316?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CL-M_rO7-4MDFQPD9gIdzxEH8w;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3565171663596.316?

2 KB
1013 B

553ms
552ms

Document
text/html

142.250.74.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CL-M_rO7-4MDFQPD9gIdzxEH8w;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3565171663596.316?

Requested by

Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f6.1e100.net

Software

cafe /

Resource Hash

1fc3c5fcc0fe8e47ed0d9281a5294aa81759b050cfc2af7cc2d116a83f0b46b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 903
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 16:23:14 GMT
expires: Fri, 26 Jan 2024 16:23:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 26 Jan 2024 16:23:14 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CL-M_rO7-4MDFQPD9gIdzxEH8w;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3565171663596.316?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900016.redintelligence.net/ Frame 4E82 7 KB
2 KB 75ms
25ms Document
text/html 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900016.redintelligence.net/request_content.php?s=72861300133122704444554012581016&a=064afb6d
Requested by: Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 9b8819ebbdc5e023ad2b25476f7ce78b3e9b12bf2690ab53437818fb6e84f92d

Request headers

Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2065
Content-Type: text/html; charset=utf-8
Date: Fri, 26 Jan 2024 16:23:14 GMT
Expires: Fri, 26 Jan 2024 16:23:14 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 513A 42 B
64 B 175ms
175ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvdDmZMEkx_MFhVY3Izz38G0MIM9Q8gPoWvbkTRaPBAQIRPVNe4s0Ll9it4WFPoWNifQpGmC3_1kxa-m0IKkZUtWUG9zEDOR31rWQkh7aYelR8mfbIPDEQKIAB7cKO2ZhRE-szkTMOYH4Q6sWHDhOoDLMtq&sai=AMfl-YRNG-tgyBqB6aaJOyAVTipktApb9OuRQWAuDRmDCItR8tyb8DCXc1H0f6Bkd-cQL5mPyjyGKQC-H5xoQ4sgXa9jSJ4Wh4RxD8yxWfQy2q3xYFlRuh_IFAvJG1ru__t5o7NsvdB7Br7_iFdKcFoKtA&sig=Cg0ArKJSzDBEbLXuWYLMEAE&cid=CAQSTwAvHhf_VIWRW8eWp1e-5EdXzOceiHDlqE5Jb0VsNH1c0S172SVq79cnULLHu663uFbF49MShO4fvvOybZZKGKLS3rNJXcXo2k1stSXwzFYYAQ&id=ampim&o=335,911&d=290,250&ss=1600,1200&bs=1600,1200&mcvt=1006&mtos=0,0,1006,1006,1006&tos=0,0,1006,0,0&tfs=293&tls=1299&g=100&h=100&tt=1299&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ar.hibapress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 4E82 5 KB
682 B 31ms
30ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=72861300133122704444554012581016&a=064afb6d

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900016.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 26 Jan 2024 16:23:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 26 Jan 2024 15:43:30 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 26 Jan 2024 16:23:14 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4E82 16 KB
16 KB 78ms
26ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=72861300133122704444554012581016&a=064afb6d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: eb45020144561527744cde260ea9e87e119a36920c87bfddf3bb4d899945e830

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900016.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Fri, 26 Jan 2024 16:23:14 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16516
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4E82 17 KB
17 KB 79ms
28ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=72861300133122704444554012581016&a=064afb6d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 6a7edaa4f003a25d3eaada8ca016c2589037fb50f4d0c572a3996244399f0773

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900016.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Fri, 26 Jan 2024 16:23:14 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16984
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4E82 17 KB
17 KB 78ms
27ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/3839/creativesup/father_daughter_1200x627.jpg
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=72861300133122704444554012581016&a=064afb6d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: f355c02958fe5f7deedfc656f223d22f26bbf4a96975db3562de094f00e9f314

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900016.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Fri, 26 Jan 2024 16:23:14 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16841
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame 1A23 180 KB
64 KB 80ms
31ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d56dd939456d84dd35f8408f5eebee960c46cbb06204fc99d81be65d46e7e1b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:14 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65493
x-xss-protection: 0
last-modified: Fri, 26 Jan 2024 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 26 Jan 2024 16:23:14 GMT

GET
H/1.1 200
OK viewability Show response
hal900016.redintelligence.net/ Frame 4E82 0
150 B 80ms
30ms Script
text/html 138.201.220.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900016.redintelligence.net/viewability?s=72861300133122704444554012581016&a=45114b39&vb=m
Requested by: Host: hal900016.redintelligence.net
URL: https://hal900016.redintelligence.net/request_content.php?s=72861300133122704444554012581016&a=064afb6d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.220.30 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.30.220.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900016.redintelligence.net/request_content.php?s=72861300133122704444554012581016&a=064afb6d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Fri, 26 Jan 2024 16:23:14 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame CAE6 55 KB
19 KB 108ms
25ms Script
application/javascript 18.66.147.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=72861300133122704444554012581016&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-120.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f757c1aa85f17bfbbbc91f88fecc3d5d7ec1ef4c12a2c48e548bcbfe62e8a731

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 12:29:34 GMT
content-encoding: gzip
via: 1.1 6b25d4ce9efa3f2699980e1915129606.cloudfront.net (CloudFront)
last-modified: Wed, 24 Jan 2024 12:21:17 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 14021
x-amz-server-side-encryption: AES256
etag: W/"d03a4b6e4f5237491989961fe4aef528"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: aUzgjivoiAQljnr5KYb3yiQcLuRf6YtmgZREMfujQD1j8LbHtf1yIA==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame CAE6 85 B
435 B 80ms
23ms Image
image/gif 99.86.4.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1706286494&Signature=ot2gPUHhVRAtRhSgU3hoAF8CtViyTAiSwCl~jTBj6sgv9ljUK4kfQKy86CdfwpAJ5zoP38s6X8fLKmf4fIW1Airy6gCJWs5KRZ0jA4DIKm71ILkhzkevAMVKRlZfWh2hWmYgQmZJcPjNmoGUHXJqC3Er7aS8jbmnmghyGoDz6Nra8qpHW9gEKU-ecmRFWwhqVVie20hd7REVuahX~shzqzLk4DLFs4NboxU1WNpd8S5Y8rWn2XkGQEEhWwjLKAetRj2LfB4Q~frOE6CXfXxqj8VMOA3nM~GvKNze~fcYjlJ3WcMp6d50YnIcvIan6oFRevhgxACCdBjnC3vdajaXSw__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com
URL: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-53.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://215db8578edf3842825cde9a757ff2cc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-amz-version-id: null
date: Fri, 26 Jan 2024 09:25:44 GMT
via: 1.1 1277de71b2472d19ca0bfc510db9ec54.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 33839
etag: "70af33d70b6810475aae19743c8c435b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 85
x-amz-cf-id: 3WPs-f7jlJv7JfSNDJX4fkcMajP7N3-dqat_gDiuc0iIcZG1A3s20Q==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame 1A23 277 KB
92 KB 30ms
30ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d0f97d85715707c2bb4a1210086e905fc038bfc5b9964cc91eac46bc7d122f4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 16:23:14 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93715
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 26 Jan 2024 16:23:14 GMT

GET
H2 200 dc_pre=CL-M_rO7-4MDFQPD9gIdzxEH8w;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3565171663596.316
adservice.google.com/ddm/fls/z/ Frame 2C6F 42 B
401 B 108ms
57ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CL-M_rO7-4MDFQPD9gIdzxEH8w;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3565171663596.316

Requested by

Host: 8019191.fls.doubleclick.net
URL: https://8019191.fls.doubleclick.net/activityi;dc_pre=CL-M_rO7-4MDFQPD9gIdzxEH8w;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3565171663596.316?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://8019191.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 26 Jan 2024 16:23:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 attribution_src_register;crd=Zmxvb2RsaWdodF9jb25maWdfaWQ6IDgwMTkxOTEKYWR2ZXJ0aXNlcl9kb21haW46ICJodHRwczovL2dvb2dsZXN5bmRpY2F0aW9uLmNvbSIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IENPTlZFUlNJT04K...
ad.doubleclick.net/ddm/activity/ Frame 2C6F 0
22 B 175ms
175ms Image
image/png 172.217.18.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=Zmxvb2RsaWdodF9jb25maWdfaWQ6IDgwMTkxOTEKYWR2ZXJ0aXNlcl9kb21haW46ICJodHRwczovL2dvb2dsZXN5bmRpY2F0aW9uLmNvbSIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IENPTlZFUlNJT04KZGVidWdfa2V5OiAxMDUxODk4ODU2MTk0MDE5MzAyNApjdGNfY29udmVyc2lvbl9idWNrZXQ6IDEKYXJjaGV0eXBlX2lkOiAxCmFyY2hldHlwZV9pZDogMwphcmNoZXR5cGVfaWQ6IDQKYXJjaGV0eXBlX2lkOiA1CmFyY2hldHlwZV9pZDogNgphcmNoZXR5cGVfaWQ6IDcKYXJjaGV0eXBlX2lkOiA4CmFyY2hldHlwZV9pZDogOQphcmNoZXR5cGVfaWQ6IDEwCmFyY2hldHlwZV9pZDogMTEKYXJjaGV0eXBlX2lkOiAxMgphcmNoZXR5cGVfaWQ6IDEzCmFyY2hldHlwZV9pZDogMTQKYXJjaGV0eXBlX2lkOiAxNQphcmNoZXR5cGVfaWQ6IDE2CmFyY2hldHlwZV9pZDogMTcKYXJjaGV0eXBlX2lkOiAxOAphcmNoZXR5cGVfaWQ6IDE5CmFyY2hldHlwZV9pZDogMjAKYXJjaGV0eXBlX2lkOiAyMQpjb252ZXJzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBDT05WRVJTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0FDVElWSVRZX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA2MDM5MDAxCiAgfQp9CmNvbnZlcnNpb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IENPTlZFUlNJT05fRElNRU5TSU9OX0NPTlZFUlNJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDI0LTAxLTI2IgogIH0KfQpicm93c2VyX2F0dHJpYnV0aW9uX2FwaV9yZXF1ZXN0X3Byb2Nlc3NpbmdfYml0czogNTcwNDI1MzQ0CmdjbGlkOiAiIgp0cmlnZ2VyX2RlZHVwbGljYXRpb25fa2V5OiA0NTIzNjMxNDk1ODY3NTY3NTEwCg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS