www.thegimp.fr Open in urlscan Pro
213.186.33.2 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.thegimp.fr/
Submission: On October 10 via manual (October 10th 2021, 5:49:36 pm UTC) from FR — Scanned from DE

Summary HTTP 123 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 18 IPs in 5 countries across 15 domains to perform 123 HTTP transactions. The main IP is 213.186.33.2, located in France and belongs to OVH, FR. The main domain is www.thegimp.fr.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on January 12th 2021. Valid for: a year.

This is the only time www.thegimp.fr was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
28	213.186.33.2 213.186.33.2	16276 (OVH) (OVH)
2	142.250.186.110 142.250.186.110	15169 (GOOGLE) (GOOGLE)
2	104.16.18.94 104.16.18.94	13335 (CLOUDFLAR...) (CLOUDFLARENET)
19	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
3	142.250.185.168 142.250.185.168	15169 (GOOGLE) (GOOGLE)
18	142.250.185.226 142.250.185.226	15169 (GOOGLE) (GOOGLE)
1	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
6 10	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
6	142.250.185.195 142.250.185.195	15169 (GOOGLE) (GOOGLE)
3	142.250.185.234 142.250.185.234	15169 (GOOGLE) (GOOGLE)
20	172.217.18.97 172.217.18.97	15169 (GOOGLE) (GOOGLE)
2	142.250.185.70 142.250.185.70	15169 (GOOGLE) (GOOGLE)
4	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
2	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
2 3	142.250.185.164 142.250.185.164	15169 (GOOGLE) (GOOGLE)
4 8	2.21.17.14 2.21.17.14	16625 (AKAMAI-AS) (AKAMAI-AS)
4 6	185.33.221.90 185.33.221.90	29990 (ASN-APPNEX) (ASN-APPNEX)
123	18

28 213.186.33.2 (France)

ASN16276 (OVH, FR)
PTR: cluster002.ovh.net

www.thegimp.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.easycommander.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.110 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f14.1e100.net

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.16.18.94 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 142.250.185.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.168 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f8.1e100.net

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 142.250.185.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 142.250.185.66 (United States) 6 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.185.195 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.234 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 172.217.18.97 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.70 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f6.1e100.net

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.164 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2.21.17.14 (Brussels, Belgium) 4 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-21-17-14.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 185.33.221.90 (Amsterdam, Netherlands) 4 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
39	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	381 KB
27	thegimp.fr www.thegimp.fr	142 KB
26	doubleclick.net 6 redirects googleads.g.doubleclick.net googleads4.g.doubleclick.net cm.g.doubleclick.net	124 KB
8	casalemedia.com 4 redirects dsum-sec.casalemedia.com	7 KB
8	gstatic.com www.gstatic.com fonts.gstatic.com	73 KB
7	google.com 2 redirects apis.google.com adservice.google.com www.google.com	73 KB
6	adnxs.com 4 redirects ib.adnxs.com	6 KB
4	googletagservices.com www.googletagservices.com	149 KB
3	googleapis.com fonts.googleapis.com	2 KB
3	google-analytics.com ssl.google-analytics.com	17 KB
2	2mdn.net s0.2mdn.net	43 KB
2	cloudflare.com cdnjs.cloudflare.com	8 KB
1	googleadservices.com partner.googleadservices.com	657 B
1	easycommander.com www.easycommander.com	472 B
0	addthis.com Failed s7.addthis.com Failed
123	15

	Domain	Requested by
27	www.thegimp.fr	www.thegimp.fr
20	tpc.googlesyndication.com	googleads.g.doubleclick.net www.thegimp.fr tpc.googlesyndication.com pagead2.googlesyndication.com
19	pagead2.googlesyndication.com	www.thegimp.fr pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
14	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net www.thegimp.fr
8	dsum-sec.casalemedia.com	4 redirects googleads.g.doubleclick.net
8	cm.g.doubleclick.net	6 redirects googleads.g.doubleclick.net
6	ib.adnxs.com	4 redirects googleads.g.doubleclick.net
6	www.gstatic.com	googleads.g.doubleclick.net
4	googleads4.g.doubleclick.net	www.thegimp.fr googleads.g.doubleclick.net
4	www.googletagservices.com	googleads.g.doubleclick.net
3	www.google.com	2 redirects tpc.googlesyndication.com
3	fonts.googleapis.com	googleads.g.doubleclick.net
3	ssl.google-analytics.com	www.thegimp.fr
2	fonts.gstatic.com	fonts.googleapis.com
2	s0.2mdn.net	www.thegimp.fr googleads.g.doubleclick.net
2	adservice.google.com	pagead2.googlesyndication.com
2	cdnjs.cloudflare.com	www.thegimp.fr
2	apis.google.com	www.thegimp.fr apis.google.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	www.easycommander.com	www.thegimp.fr
0	s7.addthis.com Failed	www.thegimp.fr
123	21

This site contains links to these domains. Also see Links.

Domain
www.cnil.fr
translate.google.com
www.addthis.com
www.easycommander.com
www.gimp.org

Subject Issuer	Validity	Valid
cluster002.hosting.ovh.net Sectigo RSA Domain Validation Secure Server CA	`2021-01-12` - `2022-01-12`	a year	crt.sh
*.apis.google.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-21` - `2022-09-20`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.google.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh

This page contains 18 frames:

Primary Page: https://www.thegimp.fr/
Frame ID: AA32DBF4EED0C6A9AD851490D1D47E27
Requests: 46 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20190131/zrt_lookup.html
Frame ID: C3F391C3E3574E37D0E69FE8C500539D
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=60&slotname=1976579711&adk=2993391561&adf=195915709&pi=t.ma~as.1976579711&w=468&lmt=1633888171&psa=0&format=468x60&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171435&bpp=3&bdt=181&idt=90&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&correlator=5344943662906&frm=20&pv=2&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=414&ady=662&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=tl0T9xNPFg&p=https%3A//www.thegimp.fr&dtd=104
Frame ID: 21397FA03809F78CD647837B350F5D09
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=60&slotname=9945988513&adk=2908073654&adf=3671569792&pi=t.ma~as.9945988513&w=468&lmt=1633888171&psa=0&format=468x60&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171439&bpp=1&bdt=185&idt=104&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=411&ady=1489&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=MVWThirkeM&p=https%3A//www.thegimp.fr&dtd=105
Frame ID: CE5666BCA4D665F11C330E9E6C5952F1
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=250&slotname=5376188112&adk=2291775438&adf=3447725916&pi=t.ma~as.5376188112&w=300&lmt=1633888171&psa=0&format=300x250&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171440&bpp=1&bdt=187&idt=105&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60%2C468x60&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=941&ady=184&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=IseXZ5Fi6A&p=https%3A//www.thegimp.fr&dtd=107
Frame ID: 3A38276D16602E88E21D17F04F4452CE
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&adk=1812271804&adf=3025194257&lmt=1633888171&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.thegimp.fr%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171473&bpp=1&bdt=220&idt=75&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60%2C468x60%2C300x250&nras=1&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=78
Frame ID: 0DAC22325D7F2293CDD07A64C5F0BBCA
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 006ABCD40E8A3EB2C8EBA2A1481F3090
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJLmnb8CENeEhsECGJ-y_LYBMAE&v=APEucNUF7jMmXZ0R0epT94GMF2dQWHRFius19JULURP0inlEZUg9j3HuzXUO5HBppd_JN3KrLvYW565K7Wf1rKCb7sdbz8Qk-Q
Frame ID: B82D39C915F845A45D106F436931983A
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20211006/r20110914/abg_lite_fy2019.js
Frame ID: 581ACC125224B3E9E771A324196A6830
Requests: 12 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 05D0B34E3404B55619574A4580096E49
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1
Frame ID: 2EB31BC56E5330FDD75082DCAB67A1EC
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI-FFBDqij8YloC6tQEwAQ&v=APEucNUvA7CcnR1rAeJHdInhsZBr3bS_vZErYjgFnjavfk4xT1S2M1rUvKLdvNpyle1mURUsmT-LLcDWmrwu2LChTdi5ntsaIg
Frame ID: 600A5646F7385C71BC9A8714C1E9E109
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C9Kzm-B93e5bXCixWNAnP8Nru_MOMCjBImh65bcMmNS7LQeGdRkwhU1cdoP-JB3FOn1lQT_2tfp9LCJ-iV-Ik2bdvSbCM5M8HK4FrEruu3zAev0pukkgoDIuFvDSA_AOiO7PmieMeCToc_0eK2IzDL7RY6lA&dbm_d=AKAmf-D942kW1-rVzarTiq4tJD4la4tPefG4vbsYVc9VHk7cja3P7uFhBuATpI-BjJCy1VG_zLmr9fprWRknKdcU68_YWAYHLyJaf3UpuTgeQhcEBK3aDub5Jif2jl0qLWeBWTUOMO9OTVUbljGE9YxAt2vgoNSOxcmPJCvYJVzK9yaXKmWexQBIB2XFWD3JeKaRgHGxIJPJVS7IT98DyJ3k2zq8WOrVHO1934ADM8h853Jg0og2aJFlFkKQJ7iyHpu_QiNw00EMbCilDky9BmWjDGdGqKeeKn3ak9FhLwgKw7E1bayMyJmR0eKcIwUSkLcTBFFT5yhDpdR3PbBeQzrp5tCYXhbuly1CFz4XrLJNfhb2Qh9aOTNX2_3OXTnQYp19t2_-7Bz-JCypfdGIanv5OZNx8QljhmjHXKKNafeotP-WfNPr08J3HzF3HVvtvtYrIo6KeHp_gS6q8XBZ3uyZHX8MpJqD1POXVrbp7MnTRJo1mMK_A_NeaIVkdwq6LYCtDoyT5HLm8mLy7mYz6pWa5LcjPuieCHpQ87g3tQ55gISTJvyD41x8n8rwtsxkGGcs8QWPUGDOkLu1wI7xJPFiPJU93EfdhCmDV9oAy8bcQF27Vd4hnQeVPGTEygW_GlVkXfB7KOi49P5yyDgd0ekz6Vn5RXAIy2ocMGPnlR2CPDYvRbNFs5vKL4YbHqfn59UyUJduOkZjZHTDAszv4053x6DeNXUxrA4wLnS5Skb0WaeetgZUIkgR9nEktTQbZpIiHdn7vSv0jcMFpx0jiyS7PVWw-2oHNR1bGOEmi59T_gVvTgf-b3lXGWeV5oRdwSQBsOdcztr1qfsuuEefzZVM6EjufQF9kMee9LVCMrraHCcii2wLRUAfJR7Tjt4QIgF3JT_8kVZImYAJrNOlXAtFwitgAELCC91OHGGEkQcMgyoEcdeeNPcOutrEoQOAU4Yo9HQaZsU8evl7wvHtFsRfmiGe47CKwFEBOf9PkRace8SMd3K_2QeNIZ4IN3-bDyYV7NR2qYZTAs6fSUgl2fwapyyXCaRYnsJqI0imBewIPypA8yPNfZubamQb_H-AvxnBpWHiBvAa65y9qLqTTHxYEJwhvldDrBlzC0I947_tURhMPJvNcH3ALHONOe-ybWIs-AmhT4Nkma7qaTwr5Y4LJ9bTVums6izqT1wy0mU0HEj88ZsavrPHcwgEyUog973B2VJ2j-AbU1-5mdaeZwTlOz7XU5zfFfdWjy4IycECy2x4MA0s49F1H36J40QIbyZEuFs9tx6X2MoSU6n2ZuFex1ZHkSs7Fn9hQIgBxVLMGRqPiZeVXGRL5dCLMndAQ1KgtGkY8ziNULzTTpAbkv6Fko8ZW92A4QjKeYN990_GApsvxCmlvUin_sgcUDytA2mBadi7E-JyL2IqZbSN4hUAuH5MF9dfLlYesl0l8K_aat0qUr5YMRkjHtVkZTDgA610i0Rrn_DgcRJ2LcwguIDqNNmbi8hwKpqMidiFa8ypwrwJNdrkRynPG0bjyKX6-nLYFBn6CZewtBEudmWF_bR2N8FnPoMq5ltwFdoEqzXauK83hjohZALLHFEQ2Oxq_BA3p3YYAZ6KmM6wytVMjR_6QSE0MEV2G0WYPgHEaLsXquurAYtwSF12Wr6o-8YXJs2C7lq3SfpY3k-pOjHanWjETfQeTCRsGVDdtMezBNL1YF3EKg_aXquhj3RusD55C3eXAsmcrcBPpOK_TxUURlz68lARjsoUggASqtOzWkbuT50Hdh7YQhGq5elgRZUObrOuQd-G3a9lsR2GQXtSTC5kGhJ3FZzIlFMej76-H2MC5bCKO81KFaKTZivEgMVVnS3z5Zie9upARq5FwPJZaBZeRN4yHuFFjfCptKCcHGa8e0r2hNifjke8V-V9ugXqTxVI1YAAT-FdneJuo-6JVbIE2xGgAmJTNr7tvK1V34V8Xt3iFUin-THXCPwJBHZBVebtzIY-btxyYQZ34jyIPxANarX2quQdAWwsZtTctZIsdBOdbJzAbB8DewuJWxMdlXQZTrOvU4VcDD06R35KJaYY34g039UYwahJHMrpFg_D4z-hcuonRCnOYGP_RB6_PAY5TTBjYtB-V6xl3sD1CQwOpGLVwM6tK8IcmzfpWpCBGBRtY0pMdLansNww3Ri2D19swEFsuDEW6s-qZ4JOVIEjMdV9VGesti6keprY7DfE-K0nWZmbR_INUv7qhQw_wMi4LKipnhv4CCIKuQK_wegN7H6Pmj9qsksiLpsUgvqUcc9aRrJMv440SweNS7iOxIgNcsZ8Fkixe8hhYCt4wCz5ExAknTSM9V33pyhlszAe1w48-ILd1cu5npIwE0-OEWCD__Z7PRK2UtihDiIOjRwnAvo4dhO6Tqo4alfdpVeS2LEXqFj3S_k-6lIVHfJqimKQ-q-L6esNBfoYoFhgqhkbuKDXR31ApvigzL7bvfCudCo2VY6aXluiKp0Lkd7odjb0RRRaq5il8dTnuxXrv0u2yxGwC4qQkiJaAyqENzX3FrpxAJFdj4qHlxAzaM8dMV47QneBiBezBRoQjuMJoyT-C56GivhXo0pximIEJdtMyarXvgLScaRXTb9KFD1XW9gXpvIXvgvFTFXR3KEOWhG7wydXbTZ7RZyL5MKr2CEgQUS2Mx8rnsDul2uBA1Dm0QNPkGxiKkMyYNkXICjP4a-y0336P_CzXsCFuXa5g2RpWLlMAx8UJrAUWMs80-SCintJ6ghedPeF&cid=CAASBORoeGU&rfl=2%2Chttps%253A%252F%252Fwww.thegimp.fr%252F%240
Frame ID: 0D5E0622761113A58E98F05E105DA245
Requests: 12 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 1A417029CC4A0696CA464A1D96C37C7E
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: CE7B7A229009FB27544E567797833FD1
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: D8CDD5E8983FC7EAE9F4BE8B0B641F4A
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 22A6A051523D6775505D3EA0C890EDA4
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: E68D276D8FAA1706ED5AA50D7F299C8A
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

The Gimp.fr

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

Osano (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cookieconsent\.min\.js

Page Statistics

123
Requests

76 %
HTTPS

0 %
IPv6

15
Domains

21
Subdomains

18
IPs

5
Countries

1017 kB
Transfer

2437 kB
Size

17
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cnil.fr/fr/cookies-les-outils-pour-les-maitriser/
Title: En savoir plus

Search URL Search Domain Scan URL

URL: http://translate.google.com/translate?u=https://www.thegimp.fr:443/&hl=fr&sl=fr&tl=en

Search URL Search Domain Scan URL

URL: http://www.addthis.com/bookmark.php?v=20

Search URL Search Domain Scan URL

URL: http://www.easycommander.com/logiciel/libre
Title: Libre

Search URL Search Domain Scan URL

URL: http://www.easycommander.com/logiciel/graphisme-imagerie
Title: Graphisme et Imagerie

Search URL Search Domain Scan URL

URL: http://www.easycommander.com/logiciel/retouche-d-images
Title: Retouche d'images

Search URL Search Domain Scan URL

URL: http://www.gimp.org/
Title: http://www.gimp.org/

Search URL Search Domain Scan URL

URL: http://www.easycommander.com/logiciel/windows
Title: Windows

Search URL Search Domain Scan URL

URL: http://www.easycommander.com/logiciel/mac
Title: Mac

Search URL Search Domain Scan URL

URL: http://www.easycommander.com/logiciel/linux
Title: Linux

Search URL Search Domain Scan URL

URL: http://www.easycommander.com/

Search URL Search Domain Scan URL

URL: http://www.easycommander.com/telecharger/7-zip
Title: 7zip

Search URL Search Domain Scan URL

URL: http://www.easycommander.com/telecharger/photoscape
Title: Photoscape

Search URL Search Domain Scan URL

URL: http://www.easycommander.com/telecharger/xnview
Title: XNView

Search URL Search Domain Scan URL

URL: http://www.easycommander.com/telecharger/photoshop
Title: Photoshop

Search URL Search Domain Scan URL

URL: http://www.easycommander.com/telecharger/picasa
Title: Picasa

Search URL Search Domain Scan URL

URL: http://www.easycommander.com/telecharger/photofiltre
Title: PhotoFiltre

Search URL Search Domain Scan URL

URL: http://www.easycommander.com/telecharger/paint-net
Title: Paint.NET

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 70

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 73

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1&C=1

Request Chain 74

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YWMnrEh03OwPOCjyMukaNQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1

Request Chain 75

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESECzCqdxRzcrz7Ee7jRKxfT4&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECzCqdxRzcrz7Ee7jRKxfT4%26google_cver%3D1

Request Chain 76

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkwMjU0MzA3NzA1NDEwMDYwNA%3D%3D

Request Chain 100

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1

Request Chain 101

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YWMnrEh03OwPOCjyMukaNQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1

Request Chain 102

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESECzCqdxRzcrz7Ee7jRKxfT4&google_cver=1

Request Chain 103

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE2NDM5OTE3MDQ0ODQ5NjU2Ng%3D%3D

Request Chain 112

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

123 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.thegimp.fr/ 18 KB
5 KB 107ms
51ms Document
text/html 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache / PHP/5.2.17
Resource Hash: 82a08ec3d30b6463635243a96801b3d6c194b2a7e247fdf5e5bcb0cd41c0665b

Request headers

:method: GET
:authority: www.thegimp.fr
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
content-type: text/html
content-length: 5233
server: Apache
x-powered-by: PHP/5.2.17
vary: Accept-Encoding
content-encoding: gzip

GET
H2 200 style.css
www.thegimp.fr/ 5 KB
2 KB 18ms
18ms Stylesheet
text/css 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.thegimp.fr/style.css?2.4
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 4ee750477e19621c8e85783d47c22bac97e1866ea1969a5f06d5c301ef2b160a

Request headers

:path: /style.css?2.4
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
content-encoding: gzip
last-modified: Wed, 10 Apr 2019 08:05:57 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=900
accept-ranges: bytes
content-length: 1352
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 style_fiche.css
www.thegimp.fr/ 6 KB
2 KB 19ms
18ms Stylesheet
text/css 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.thegimp.fr/style_fiche.css?1.4
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: c41b97f23e59bb8ee559591c311c5014e2b839614176280030ad77c9d7358839

Request headers

:path: /style_fiche.css?1.4
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
content-encoding: gzip
last-modified: Wed, 10 Apr 2019 08:04:08 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=900
accept-ranges: bytes
content-length: 1553
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 plusone.js Show response
apis.google.com/js/ 52 KB
21 KB 55ms
32ms Script
application/javascript 142.250.186.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js

Requested by

Host: www.thegimp.fr
URL: https://www.thegimp.fr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f14.1e100.net

Software

ESF /

Resource Hash

cf4aa82a277dcc9151be7cad6bec03563daf4ac182b606f652b6265fdd010157

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MNWTx21ET2kTeITBGzHOYA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
etag: "c34d224d0ee061f3752d1f91e397a052"
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraZH88pL4jQdjcWpuaSZEaZk6SzMEy_nItKJ7e9QFtt","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraZH88pL4jQdjcWpuaSZEaZk6SzMEy_nItKJ7e9QFtt"}]}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-MNWTx21ET2kTeITBGzHOYA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraZH88pL4jQdjcWpuaSZEaZk6SzMEy_nItKJ7e9QFtt"
expires: Sun, 10 Oct 2021 17:49:31 GMT

GET
H2 200 cookieconsent.min.css
cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/ 4 KB
2 KB 36ms
20ms Stylesheet
text/css 104.16.18.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.css

Requested by

Host: www.thegimp.fr
URL: https://www.thegimp.fr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.18.94 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

456ab1a71507ed91abae14c9d08faffb373a7bc711a66e44341b7b8b7bb72ab4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 266086
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 948
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:09:17 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e2d-f62"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AIj96MzOZloDJoSSybZFQw5V3Kx5hSPvbsjX8Clj69BSl83WHlDz9Hi4J9q%2Byj461z7ntOrQKvvsNSt2%2F5Skskcbc%2F0x7%2F2gZrOjwtRZfDcW3CSQVvmjA4isLNnmvapIOf11%2FhG7"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69c1af8e99e22b65-FRA
expires: Fri, 30 Sep 2022 17:49:31 GMT

GET
H2 200 cookieconsent.min.js Show response
cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/ 19 KB
6 KB 38ms
21ms Script
application/javascript 104.16.18.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.js

Requested by

Host: www.thegimp.fr
URL: https://www.thegimp.fr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.18.94 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af4c6683814aa527caf53bde3d021e6aafe00833b45f2dead043c87ed7864674

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 945323
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 5676
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:09:17 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e2d-4d5a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O7xGlfT3L8Cm%2BPrSB2X2C4EBN%2FVbulRUerT185sM0lkeLs9PQXWhZ2SoL6y5ZuyzuVzsTum8x%2Fo1%2Fwz7aCSBA%2BiaHYxY2n6IGFj8lPg%2BTt7ai58eIhuo0Z1RsPI2cTCGSPWZGgFR"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69c1af8e99e62b65-FRA
expires: Fri, 30 Sep 2022 17:49:31 GMT

GET
H2 200 icone-the-gimp-679.gif
www.thegimp.fr/ 785 B
964 B 18ms
18ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/icone-the-gimp-679.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 8427cab0fd9efbeaed1fa2377dadc2e2a89aaf60aa6a888e3b1db382c6453839

Request headers

:path: /icone-the-gimp-679.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Wed, 25 Feb 2009 16:18:28 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 785
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 drapeau_anglais.gif
www.thegimp.fr/img/ 455 B
634 B 18ms
18ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/drapeau_anglais.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: a4be1b49356308cc3808653f386bfa67264efd252362c690a6b0de75538a6dc3

Request headers

:path: /img/drapeau_anglais.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Wed, 01 Apr 2009 11:15:43 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 455
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 bookmark.gif
www.thegimp.fr/img/ 492 B
671 B 17ms
17ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/bookmark.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 193ddff54438442c762c9720df54f159c9d40a46fee7c0969d30cde685d06d13

Request headers

:path: /img/bookmark.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Fri, 03 Apr 2009 16:08:44 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 492
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 back.gif
www.thegimp.fr/img/ 169 B
348 B 19ms
17ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/back.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 07071c90dd3c06ab4617213c0a7c21df43689ab7a64e03864af1dccc4f81a04f

Request headers

:path: /img/back.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Sat, 07 Mar 2009 00:55:18 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 169
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 miniature-the-gimp-679.jpg
www.thegimp.fr/ 7 KB
7 KB 70ms
68ms Image
image/jpeg 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/miniature-the-gimp-679.jpg
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache / PHP/5.2.17
Resource Hash: 6f379d66d0fac0f93548871ae54d5273ac2637f44fb1c4a9c3edf4a8fba08e5b

Request headers

:path: /miniature-the-gimp-679.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
cache-control: max-age=900
server: Apache
content-type: image/jpeg
x-powered-by: PHP/5.2.17
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 favicon.gif
www.easycommander.com/img/ 292 B
472 B 74ms
18ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.easycommander.com/img/favicon.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 8db4fb2f786d9fe30223f0ef15d76bc88f6da6a13aa2fd446022c430696e2e2e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Wed, 14 Jan 2009 10:14:17 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 292
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 picto_windows.gif
www.thegimp.fr/img/ 413 B
592 B 19ms
17ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/picto_windows.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: a9feb2844d245e7bd95681cf923345ab84b39157593a0fd9cfddf92e99fae8f9

Request headers

:path: /img/picto_windows.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Mon, 02 Mar 2009 23:10:16 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 413
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 drapp_fra.gif
www.thegimp.fr/img/ 1 KB
1 KB 51ms
49ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/drapp_fra.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 462d8dd38077886b5369748ca71069dba9865eb2fa6bc22c608daed91384506b

Request headers

:path: /img/drapp_fra.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Thu, 17 Jul 2008 13:13:27 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 1119
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 drapp_us.gif
www.thegimp.fr/img/ 1 KB
1 KB 37ms
35ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/drapp_us.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 24fa0ccbcb12952cd6d03deaedd6f968e61968a9d93765901c1fd8fd49e0b157

Request headers

:path: /img/drapp_us.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Thu, 17 Jul 2008 13:17:11 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 1097
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 picto_mac.gif
www.thegimp.fr/img/ 1 KB
1 KB 45ms
43ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/picto_mac.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 2a010828e3fbdef5966918ac3fbe3e634e618c827e619e9e64c350a823fe602a

Request headers

:path: /img/picto_mac.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Mon, 02 Mar 2009 23:10:17 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 1061
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 picto_linux.gif
www.thegimp.fr/img/ 639 B
818 B 51ms
50ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/picto_linux.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: d4d56abcb8521ee277e7ed0a204ef9ce8ead2c42f33f1db089146fb96164c735

Request headers

:path: /img/picto_linux.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Mon, 02 Mar 2009 23:10:16 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 639
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 144 KB
51 KB 58ms
35ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.thegimp.fr
URL: https://www.thegimp.fr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

2fec39b2741a618c1ee273eb5109850ddee3c6dcd3c7f830c173c3cd12edf05a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51245
x-xss-protection: 0
server: cafe
etag: 8044536160632942091
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 10 Oct 2021 17:49:31 GMT

GET
H2 200 screenshot-2-the-gimp-679.jpg
www.thegimp.fr/ 40 KB
40 KB 19ms
17ms Image
image/jpeg 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/screenshot-2-the-gimp-679.jpg
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 835028b83e76f77bfd87a4baebdfc603c9c6ee55516af930d3fe75f463a4ff3d

Request headers

:path: /screenshot-2-the-gimp-679.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Wed, 06 Oct 2010 16:41:24 GMT
server: Apache
content-type: image/jpeg
cache-control: max-age=900
accept-ranges: bytes
content-length: 40969
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 screenshot-1-the-gimp-679.jpg
www.thegimp.fr/ 64 KB
64 KB 52ms
50ms Image
image/jpeg 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/screenshot-1-the-gimp-679.jpg
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 1e58ae72fdc6ace4f2f82a0b627902a2f1b86db0c97180ed2dd449932bdefe75

Request headers

:path: /screenshot-1-the-gimp-679.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Wed, 06 Oct 2010 16:41:23 GMT
server: Apache
content-type: image/jpeg
cache-control: max-age=900
accept-ranges: bytes
content-length: 65729
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.yUoUa-d8e1E.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMxrycmnC1khz2ORddaX90UOzgNPA/ 147 KB
51 KB 9ms
8ms Script
text/javascript 142.250.186.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.yUoUa-d8e1E.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMxrycmnC1khz2ORddaX90UOzgNPA/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f14.1e100.net

Software

sffe /

Resource Hash

2ecc45ef1d382035c1367ab078ad6f52bae305feaa6dc5ac2c17908d8f7e2a55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 05 Oct 2021 20:09:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 423625
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51514
x-xss-protection: 0
last-modified: Fri, 10 Sep 2021 23:24:10 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="social-frontend-mpm-access"
expires: Wed, 05 Oct 2022 20:09:06 GMT

GET show_ads.js
pagead2.googlesyndication.com/pagead/ 0
0

GET addthis_widget.js
s7.addthis.com/js/200/ 0
0

GET
H2 200 top_domaine.gif
www.thegimp.fr/img/ 706 B
885 B 50ms
49ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/top_domaine.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/style_fiche.css?1.4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 677cdfd3f90bb4ed80611c63d0517e15725b9f87fb28338bc075870a900c8fa2

Request headers

:path: /img/top_domaine.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/style_fiche.css?1.4
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/style_fiche.css?1.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Mon, 23 Feb 2009 23:47:47 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 706
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 bg_page.gif
www.thegimp.fr/img/ 140 B
319 B 65ms
65ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/bg_page.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/style.css?2.4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 4dbcdf350709e1d65c3e10470d7fb528866688b64c36cad124bed85a537b13bc

Request headers

:path: /img/bg_page.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/style.css?2.4
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/style.css?2.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Wed, 18 Feb 2009 16:22:54 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 140
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 top_bg_domaine.gif
www.thegimp.fr/img/ 692 B
871 B 58ms
58ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/top_bg_domaine.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/style_fiche.css?1.4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: a046ab3920b517dd0276090ef75b7c18de4301538fe1562c5144e50c4552f844

Request headers

:path: /img/top_bg_domaine.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/style_fiche.css?1.4
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/style_fiche.css?1.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Tue, 24 Feb 2009 11:50:47 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 692
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 puce_info.gif
www.thegimp.fr/img/ 863 B
1 KB 49ms
49ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/puce_info.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/style_fiche.css?1.4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 09e713d454197ae2595b33c1c348a87377f62ec048e4089aa19fce9c6df98771

Request headers

:path: /img/puce_info.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/style_fiche.css?1.4
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/style_fiche.css?1.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Sat, 24 May 2008 12:41:23 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 863
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 bg_download.gif
www.thegimp.fr/img/ 3 KB
3 KB 64ms
64ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/bg_download.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/style_fiche.css?1.4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 128e00f73e558e2af3acde1cc54c719f71803f51aa4fc5f9086bea6997b01edd

Request headers

:path: /img/bg_download.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/style_fiche.css?1.4
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/style_fiche.css?1.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Wed, 18 Feb 2009 15:54:49 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 2745
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 bg_download_bottom.gif
www.thegimp.fr/img/ 783 B
962 B 51ms
51ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/bg_download_bottom.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/style_fiche.css?1.4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: b553178e7570cddd887449ce86817e1b977881c46048d04b3abc32def4adc2e7

Request headers

:path: /img/bg_download_bottom.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/style_fiche.css?1.4
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/style_fiche.css?1.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Wed, 18 Feb 2009 16:07:10 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 783
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 colDroite-1-dyna-top.gif
www.thegimp.fr/img/ 482 B
661 B 51ms
49ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/colDroite-1-dyna-top.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/style_fiche.css?1.4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: cd8d0ffcf6236ed535ea7d6a086b468477ac11433bb2376212bac55ef0ac20f2

Request headers

:path: /img/colDroite-1-dyna-top.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/style_fiche.css?1.4
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/style_fiche.css?1.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Wed, 10 Sep 2008 15:02:50 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 482
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 colDroite-1-dyna-middle.gif
www.thegimp.fr/img/ 91 B
269 B 51ms
49ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/colDroite-1-dyna-middle.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/style_fiche.css?1.4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 13e183edb5256c2eedeae5900baf0415fbc5e02e0f3ede809931d60666057fe4

Request headers

:path: /img/colDroite-1-dyna-middle.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/style_fiche.css?1.4
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/style_fiche.css?1.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Wed, 10 Sep 2008 15:02:45 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 91
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 colDroite-1-dyna-titre.gif
www.thegimp.fr/img/ 4 KB
4 KB 51ms
48ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/colDroite-1-dyna-titre.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/style_fiche.css?1.4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: a92ed2c37ede90cdc2e756dcb4f255999f3d0ce688b767c0ab12bbd46c65c921

Request headers

:path: /img/colDroite-1-dyna-titre.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/style_fiche.css?1.4
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/style_fiche.css?1.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Wed, 10 Sep 2008 15:51:30 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 3794
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 ico.gif
www.thegimp.fr/img/ 114 B
293 B 50ms
48ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/ico.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: c90ed31c95e1a425d9cb4ef1ddf86cb026aff41efe14b9620a464601fb192324

Request headers

:path: /img/ico.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Sun, 27 Apr 2008 23:54:50 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 114
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 colDroite-1-dyna-bottom.gif
www.thegimp.fr/img/ 477 B
656 B 49ms
48ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/colDroite-1-dyna-bottom.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/style_fiche.css?1.4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 2c4293997c3d3617d95a0a7c1b50ade28d236ba0786d66e3d33a4afadd784182

Request headers

:path: /img/colDroite-1-dyna-bottom.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/style_fiche.css?1.4
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/style_fiche.css?1.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Wed, 10 Sep 2008 15:02:47 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 477
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 bottom.gif
www.thegimp.fr/img/ 1 KB
1 KB 49ms
48ms Image
image/gif 213.186.33.2
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.thegimp.fr/img/bottom.gif
Requested by: Host: www.thegimp.fr
URL: https://www.thegimp.fr/style.css?2.4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.186.33.2 , France, ASN16276 (OVH, FR),
Reverse DNS: cluster002.ovh.net
Software: Apache /
Resource Hash: 8df3faf208906f6cac37199c28b330d7672ac51aec03298822b9dac4c116bad0

Request headers

:path: /img/bottom.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.thegimp.fr
referer: https://www.thegimp.fr/style.css?2.4
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/style.css?2.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
last-modified: Thu, 19 Feb 2009 14:53:39 GMT
server: Apache
content-type: image/gif
cache-control: max-age=900
accept-ranges: bytes
content-length: 1071
expires: Sun, 10 Oct 2021 18:04:31 GMT

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 45ms
6ms Script
text/javascript 142.250.185.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: www.thegimp.fr
URL: https://www.thegimp.fr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f8.1e100.net

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.thegimp.fr/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 3124
date: Sun, 10 Oct 2021 16:57:27 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Sun, 10 Oct 2021 18:57:27 GMT

GET
H3 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110040101/ 257 KB
95 KB 67ms
52ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110040101/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

19f362b8270f24033bb3822bc08eeee3f431c8e2ad0c2e33cbf83bfbc8f70dc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 97103
x-xss-protection: 0
server: cafe
etag: 1209692965872863621
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Oct 2021 17:49:31 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211006/r20190131/ Frame C3F3 10 KB
5 KB 31ms
6ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211006/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

e59f39fd9be6b3737942676248d273b23f94ab60f7b7e608230d6a107dccb7ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20211006/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thegimp.fr/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 10 Oct 2021 17:14:18 GMT
expires: Sun, 24 Oct 2021 17:14:18 GMT
content-type: text/html; charset=UTF-8
etag: 10398570473303663775
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4601
x-xss-protection: 0
age: 2113
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
54 B 29ms
14ms Image
image/gif 142.250.185.168
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1544893434&utmhn=www.thegimp.fr&utmcs=windows-1252&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=The%20Gimp.fr&utmhid=1114397195&utmr=-&utmp=%2F&utmht=1633888171467&utmac=UA-3892863-7&utmcc=__utma%3D226517848.2125498307.1633888171.1633888171.1633888171.1%3B%2B__utmz%3D226517848.1633888171.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1665515684&utmredir=1&utmu=HAAAAAAAAAAAAAAAAAAAAAAE~

Requested by

Host: www.thegimp.fr
URL: https://www.thegimp.fr/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f8.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Oct 2021 17:49:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
54 B 32ms
22ms Image
image/gif 142.250.185.168
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=2&utmn=246014772&utmhn=www.thegimp.fr&utmcs=windows-1252&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=The%20Gimp.fr&utmhid=1114397195&utmr=-&utmp=%2F&utmht=1633888171472&utmac=UA-3892863-2&utmcc=__utma%3D226517848.2125498307.1633888171.1633888171.1633888171.1%3B%2B__utmz%3D226517848.1633888171.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=342757778&utmredir=1&utmmt=1&utmu=HAAAAAAAAAAAAAAAAAAAAAAE~

Requested by

Host: www.thegimp.fr
URL: https://www.thegimp.fr/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f8.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Oct 2021 17:49:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 200 B
657 B 56ms
22ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.thegimp.fr&callback=_gfp_s_&client=pub-1376455721539420

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110040101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

cb50543ea98a767ec78df733a059f1cc6999d813694d21d22a6e35c28bbc931a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 192
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 44ms
16ms Script
application/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.thegimp.fr

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110040101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 10 Oct 2021 17:49:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2139 61 KB
26 KB 670ms
647ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=60&slotname=1976579711&adk=2993391561&adf=195915709&pi=t.ma~as.1976579711&w=468&lmt=1633888171&psa=0&format=468x60&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171435&bpp=3&bdt=181&idt=90&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&correlator=5344943662906&frm=20&pv=2&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=414&ady=662&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=tl0T9xNPFg&p=https%3A//www.thegimp.fr&dtd=104

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110040101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

ed34118646072361d7456861a2a67dc23a9666e1df865b936d60a3637941dafa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8726451593740147&output=html&h=60&slotname=1976579711&adk=2993391561&adf=195915709&pi=t.ma~as.1976579711&w=468&lmt=1633888171&psa=0&format=468x60&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171435&bpp=3&bdt=181&idt=90&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&correlator=5344943662906&frm=20&pv=2&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=414&ady=662&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=tl0T9xNPFg&p=https%3A//www.thegimp.fr&dtd=104
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thegimp.fr/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 10 Oct 2021 17:49:32 GMT
server: cafe
content-length: 26852
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 10-Oct-2021 18:04:31 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 10 Oct 2021 17:49:32 GMT
cache-control: private

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame CE56 14 KB
7 KB 930ms
907ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=60&slotname=9945988513&adk=2908073654&adf=3671569792&pi=t.ma~as.9945988513&w=468&lmt=1633888171&psa=0&format=468x60&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171439&bpp=1&bdt=185&idt=104&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=411&ady=1489&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=MVWThirkeM&p=https%3A//www.thegimp.fr&dtd=105

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110040101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

1ea4436f58dfee0b4498e04dc5b5fdd9edc379f49092ef4eff7a6ff8970122f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8726451593740147&output=html&h=60&slotname=9945988513&adk=2908073654&adf=3671569792&pi=t.ma~as.9945988513&w=468&lmt=1633888171&psa=0&format=468x60&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171439&bpp=1&bdt=185&idt=104&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=411&ady=1489&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=MVWThirkeM&p=https%3A//www.thegimp.fr&dtd=105
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thegimp.fr/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 10 Oct 2021 17:49:32 GMT
server: cafe
content-length: 7277
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 10-Oct-2021 18:04:31 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 10 Oct 2021 17:49:32 GMT
cache-control: private

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3A38 75 KB
21 KB 591ms
569ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=250&slotname=5376188112&adk=2291775438&adf=3447725916&pi=t.ma~as.5376188112&w=300&lmt=1633888171&psa=0&format=300x250&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171440&bpp=1&bdt=187&idt=105&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60%2C468x60&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=941&ady=184&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=IseXZ5Fi6A&p=https%3A//www.thegimp.fr&dtd=107

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110040101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

c05d6f17aa147a79f4ee09f7cb8fe2b037a90b2cd13619d194da9cc642498616

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8726451593740147&output=html&h=250&slotname=5376188112&adk=2291775438&adf=3447725916&pi=t.ma~as.5376188112&w=300&lmt=1633888171&psa=0&format=300x250&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171440&bpp=1&bdt=187&idt=105&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60%2C468x60&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=941&ady=184&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=IseXZ5Fi6A&p=https%3A//www.thegimp.fr&dtd=107
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thegimp.fr/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 10 Oct 2021 17:49:32 GMT
server: cafe
content-length: 21242
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 10-Oct-2021 18:04:31 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 10 Oct 2021 17:49:32 GMT
cache-control: private

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0DAC 134 KB
32 KB 773ms
752ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&adk=1812271804&adf=3025194257&lmt=1633888171&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.thegimp.fr%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171473&bpp=1&bdt=220&idt=75&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60%2C468x60%2C300x250&nras=1&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=78

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110040101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

2cc69f1fd4bbd358cad9152802d616d0d8886fe4875c6c738c0c14b694cf72ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8726451593740147&output=html&adk=1812271804&adf=3025194257&lmt=1633888171&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.thegimp.fr%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171473&bpp=1&bdt=220&idt=75&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60%2C468x60%2C300x250&nras=1&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=78
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thegimp.fr/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 10 Oct 2021 17:49:32 GMT
server: cafe
content-length: 32525
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 10-Oct-2021 18:04:31 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 10 Oct 2021 17:49:32 GMT
cache-control: private

GET
H2 200 f14dc7a62bcf992c762f7db4d8023af3.js Show response
www.gstatic.com/mysidia/ Frame 3A38 7 KB
4 KB 30ms
7ms Script
text/javascript 142.250.185.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f14dc7a62bcf992c762f7db4d8023af3.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=250&slotname=5376188112&adk=2291775438&adf=3447725916&pi=t.ma~as.5376188112&w=300&lmt=1633888171&psa=0&format=300x250&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171440&bpp=1&bdt=187&idt=105&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60%2C468x60&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=941&ady=184&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=IseXZ5Fi6A&p=https%3A//www.thegimp.fr&dtd=107

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f3.1e100.net

Software

sffe /

Resource Hash

becadbd507adae917ccd1498c88f26a85a348c349c45471af0cf23529b424c70

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 07:19:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 37787
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3144
x-xss-protection: 0
last-modified: Mon, 04 Oct 2021 18:12:44 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Sat, 08 Jan 2022 07:19:45 GMT

GET
H2 200 51960db45470192acc393a412d64dac5.js Show response
www.gstatic.com/mysidia/ Frame 3A38 8 KB
3 KB 30ms
8ms Script
text/javascript 142.250.185.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/51960db45470192acc393a412d64dac5.js?tag=text/vanilla_highlight

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f3.1e100.net

Software

sffe /

Resource Hash

ab79f20c51a2afc5bfd43cc8f688ac4708fa6a4495c30405e75b11e8246f6aba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 06 Oct 2021 09:28:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 375685
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3401
x-xss-protection: 0
last-modified: Mon, 04 Oct 2021 18:12:44 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Tue, 04 Jan 2022 09:28:07 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 3A38 3 KB
1 KB 41ms
17ms Stylesheet
text/css 142.250.185.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f10.1e100.net

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 10 Oct 2021 16:51:04 GMT
server: ESF
date: Sun, 10 Oct 2021 17:49:32 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires: Sun, 10 Oct 2021 17:49:32 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/ Frame 3A38 1 KB
864 B 23ms
7ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

cafe /

Resource Hash

6500bd4cd278cdd0e00b473891ec40860e4dde8e5a7f02ab1d2ad6e30dfb0ce4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:43:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 384
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 837
x-xss-protection: 0
server: cafe
etag: 7640065535275194769
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 17:43:08 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211006/r20110914/ Frame 3A38 18 KB
8 KB 29ms
6ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211006/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

cafe /

Resource Hash

2df1e67459f1d7eda2c4c5af7e07c73f911f6c898f3d061d8f3e9a32ad63fe31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7605
x-xss-protection: 0
server: cafe
etag: 4152153861754824712
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 17:49:24 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/ Frame 3A38 3 KB
1 KB 23ms
8ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

cafe /

Resource Hash

5120f35e394e169ac0839405dbd6e680163a4e02f060f5a6a833ebfacf35d966

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:48:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1344
x-xss-protection: 0
server: cafe
etag: 10107448882299530629
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 17:48:43 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3A38 123 KB
37 KB 18ms
18ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

sffe /

Resource Hash

e96cb07afdac92a8c77fbd5b9bb721e548070f4657f4f1e71329d2fd9032be47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37898
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1633547226118934"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 10 Oct 2021 17:49:32 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/ Frame 3A38 14 KB
6 KB 29ms
8ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

cafe /

Resource Hash

51896cb4e932803b983cf59d85b20c705f42a891fa0c9c408e3cb267b5bb949c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:44:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 318
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6219
x-xss-protection: 0
server: cafe
etag: 4041254270185007295
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 17:44:14 GMT

GET
H3 200 8400539943eb1c96fa551c508d61e34e.js Show response
www.gstatic.com/mysidia/ Frame 3A38 26 KB
11 KB 35ms
14ms Script
text/javascript 142.250.185.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8400539943eb1c96fa551c508d61e34e.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f3.1e100.net

Software

sffe /

Resource Hash

cd1aa1b17ad107887c38eedf2e24ab209a184dfd3abdae3484d36e10d74cbbb2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 07:19:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 37787
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11136
x-xss-protection: 0
last-modified: Mon, 04 Oct 2021 18:12:44 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Sat, 08 Jan 2022 07:19:45 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/5962255563661156191/ Frame 3A38 3 KB
3 KB 23ms
9ms Image
image/png 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5962255563661156191/downsize_200k_v1?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

sffe /

Resource Hash

d375b958c605f2c7d6fdc81e3be171709da862eedcd0bb078336446a411e7a48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 08 Oct 2021 12:20:36 GMT
x-content-type-options: nosniff
age: 192536
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3046
x-xss-protection: 0
last-modified: Thu, 02 Jan 2020 19:24:59 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/content-ads-owners
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 08 Oct 2022 12:20:36 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 3A38 0
0 108ms
86ms Fetch
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CwdGxqydjYbjBJMyO7_UP6O6V0A7oyaDyZJfdmr6AC-2Zr9j8FBABILLZlyJgyQagAf_bisgDyAEBqAMBqgTGAU_Q6HL-tVnYgLQdWqdXBkz29ix0shcwJ-D6jfq-55RmQxjKTkvAhHGGShJIuyrW3Woc73ZPlyBrIIU1Qptahl79TLSHsmKpbogTAmCp9SUDb0mHAh40MIUG6d7hOnLM9TiTSOaSYq57b74ROsJwcQ5CfF6g2EJ8fAFRJwKXrIpQH6poTXAkySAXg1C8WpKxk_EExNHprcfZp0nJmqxRBYmFXTFMhQHiVnAJMV3EVvNC8UyWAAh5kQnXhwaSPEc-_NUuB14Wk8AE1LDF7IQDkgUECAQYAZIFBAgFGASAB97SgEGoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4b2AcB8gcEEOeAB9IIBwiAYRABGF-ACgHICwHYEwyIFATQFQGAFwGyFxwKGggAEhRwdWItODcyNjQ1MTU5Mzc0MDE0NxgA&sigh=EdPIdeTDaEA&template_id=5001

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=250&slotname=5376188112&adk=2291775438&adf=3447725916&pi=t.ma~as.5376188112&w=300&lmt=1633888171&psa=0&format=300x250&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171440&bpp=1&bdt=187&idt=105&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60%2C468x60&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=941&ady=184&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=IseXZ5Fi6A&p=https%3A//www.thegimp.fr&dtd=107
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 10 Oct 2021 17:49:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 10 Oct 2021 17:49:32 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 006A 143 B
163 B 28ms
13ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=250&slotname=5376188112&adk=2291775438&adf=3447725916&pi=t.ma~as.5376188112&w=300&lmt=1633888171&psa=0&format=300x250&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171440&bpp=1&bdt=187&idt=105&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60%2C468x60&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=941&ady=184&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=IseXZ5Fi6A&p=https%3A//www.thegimp.fr&dtd=107
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=250&slotname=5376188112&adk=2291775438&adf=3447725916&pi=t.ma~as.5376188112&w=300&lmt=1633888171&psa=0&format=300x250&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171440&bpp=1&bdt=187&idt=105&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60%2C468x60&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=941&ady=184&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=IseXZ5Fi6A&p=https%3A//www.thegimp.fr&dtd=107

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 10 Oct 2021 17:35:57 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 815
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 3A38 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ac5cb763f5965a515ebce985064a978d70d5ec46b1faaae408e3a61e40d18eae

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame B82D 624 B
300 B 40ms
40ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJLmnb8CENeEhsECGJ-y_LYBMAE&v=APEucNUF7jMmXZ0R0epT94GMF2dQWHRFius19JULURP0inlEZUg9j3HuzXUO5HBppd_JN3KrLvYW565K7Wf1rKCb7sdbz8Qk-Q

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=60&slotname=1976579711&adk=2993391561&adf=195915709&pi=t.ma~as.1976579711&w=468&lmt=1633888171&psa=0&format=468x60&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171435&bpp=3&bdt=181&idt=90&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&correlator=5344943662906&frm=20&pv=2&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=414&ady=662&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=tl0T9xNPFg&p=https%3A//www.thegimp.fr&dtd=104

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJLmnb8CENeEhsECGJ-y_LYBMAE&v=APEucNUF7jMmXZ0R0epT94GMF2dQWHRFius19JULURP0inlEZUg9j3HuzXUO5HBppd_JN3KrLvYW565K7Wf1rKCb7sdbz8Qk-Q
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=60&slotname=1976579711&adk=2993391561&adf=195915709&pi=t.ma~as.1976579711&w=468&lmt=1633888171&psa=0&format=468x60&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171435&bpp=3&bdt=181&idt=90&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&correlator=5344943662906&frm=20&pv=2&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=414&ady=662&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=tl0T9xNPFg&p=https%3A//www.thegimp.fr&dtd=104
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=60&slotname=1976579711&adk=2993391561&adf=195915709&pi=t.ma~as.1976579711&w=468&lmt=1633888171&psa=0&format=468x60&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171435&bpp=3&bdt=181&idt=90&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&correlator=5344943662906&frm=20&pv=2&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=414&ady=662&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=tl0T9xNPFg&p=https%3A//www.thegimp.fr&dtd=104

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 10 Oct 2021 17:49:32 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUn3Ru6Mp6fUJ6nOpsMjp8Vh-oZqxAsluC_xlY9DXZos9U9QwRnuFpk1sMXQ; expires=Tue, 10-Oct-2023 17:49:32 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 10 Oct 2021 17:49:32 GMT

GET
H3 200 abg_lite_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20211006/r20110914/ Frame 581A 18 KB
7 KB 8ms
7ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211006/r20110914/abg_lite_fy2019.js

Requested by

Host: www.thegimp.fr
URL: https://www.thegimp.fr/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

2df1e67459f1d7eda2c4c5af7e07c73f911f6c898f3d061d8f3e9a32ad63fe31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:36:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 773
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7605
x-xss-protection: 0
server: cafe
etag: 4152153861754824712
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 17:36:39 GMT

GET
H2 200 18419332705303272681
s0.2mdn.net/simgad/ Frame 581A 28 KB
29 KB 30ms
8ms Image
image/png 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/18419332705303272681

Requested by

Host: www.thegimp.fr
URL: https://www.thegimp.fr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

sffe /

Resource Hash

cf927a27d0dc6c1badc04f8d25e436d76213d91267a068613229493e58c65cc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 09 Oct 2021 02:22:48 GMT
x-content-type-options: nosniff
age: 142004
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28719
x-xss-protection: 0
last-modified: Fri, 08 Oct 2021 22:56:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 09 Oct 2022 02:22:48 GMT

GET
H3 200 omrhp_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20211006/r20110914/elements/html/ Frame 581A 6 KB
3 KB 8ms
8ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211006/r20110914/elements/html/omrhp_fy2019.js

Requested by

Host: www.thegimp.fr
URL: https://www.thegimp.fr/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

fb9268e99659f17a183de7aa0d4e27453f96c159a7ba99d6482522f8f72d1009

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:44:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 286
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2631
x-xss-protection: 0
server: cafe
etag: 10983085961369067521
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 17:44:46 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 581A 0
592 B 55ms
33ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstUOf6BA3s4E4CayeEB6YX9gQ57nN4QqJTWqlgHa1fkQEfx--rxBefFdLx-FNX7iMfVUsB9FfwukQwLaXWtiXOKEFyhg19fBeyxSMEtTt3XgSwV3NSaAKiNHjiEf9C3kL5ouSwwqBOpHSpmpTDjgYbzov4cOKYLTTU-_DZXJsT7GobpcJkjPrSEj4VDnMbsDYZm5Kq9A9Z4gJtQgk8N6oZ30lK8YdnXJu2Q1Lt6id8rZ93vaw8ciVneS9Q5iqxGgEG9a7V_mLBaCa0axnyQf3rIhhuSaxA2TQQwBuFCul5SxG7GzKy_Zn-k8c3fIw_Tmdkoo_fm0pVPb7ejMRoq_vi1yP5RzZZvjqdEj71ssENJr2qhVBi-b0CSCDIcAeTYuWzR-l8AAmJowC3LpCI7pYO28frpXntxGiPrFicM4l7d6g9vSBhEXinr7LhuvUUfZ3ffbkQlIDU8mvtYR5nor7NvSH6Z9h83pNL109CGW_6AhUyuydsZ3NBcx8x1SFH_TB8pQOmwFEEejR47grKpS6hzeucUvcvxF_nRlffOcZJ73E_N8roDfRd12HNJBFe12enSKIkEp3BDepecTrn_--Dv3BSIwGdUsns3tht1jz7awyml_RXN--A3WQYHV-nRIkmlADUJYUhM7MHWXWAzJF4aYw21786zKaQkWt9q-Qi2_xuy0bLeYmKHduMUDCCDK9epPiPeU5UQ1NkncBP9bOvpYk55ZhyFXIwFQLAUVXHLbpIUsJswy432nCoiqvvrW7ExP6pJoDJVsjMlwK2bltaGmozL-448gDvhPiPhij2cOS1JMn0fsNhx9YopESViqddAAofNonB7xYvChqZFfBJBVe0zmr5p1mT9pKL84wvinW4uAERiU18h2PcpkaytuFSO0TWnarikQn72fasTX7Ej4mNZuwXwXa7SAHcIXpK2OaouSjLNt0yvi-zUdZv8dIGpX3mSKSktzsC7WXaBynj3tSGnWk5_Xhbnr_UI7Lta7HFhcAUxAdGtC2rATfHD2vG69nAllWb3qcAnzaqICScLUkreDpq5RIgxHXEbrkCs3ek0vv0m4nc&sai=AMfl-YQJN1ZT5gM3DyV460Ic_F0eHvS9yzGWTNPT95wbJT4C6z_vKKvdZhpGK3olqHuGMLCi-iLgF3sB7yoxV3o-q2xekHsOHe_vmd-6CMX8MdBJdOdRxGDzn468SmNbPwwuVeqdIKawnEXrUimNLRwQPIyfX3y9gfcDEEzI5qbQsg&sig=Cg0ArKJSzMHFjfm9RZb0EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211006.14735&adurl=

Requested by

Host: www.thegimp.fr
URL: https://www.thegimp.fr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sun, 10 Oct 2021 17:49:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 581A 41 KB
15 KB 7ms
7ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.thegimp.fr
URL: https://www.thegimp.fr/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 14:33:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 270975
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Fri, 07 Oct 2022 14:33:17 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/ Frame 581A 3 KB
1 KB 8ms
8ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

cafe /

Resource Hash

5120f35e394e169ac0839405dbd6e680163a4e02f060f5a6a833ebfacf35d966

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:48:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1344
x-xss-protection: 0
server: cafe
etag: 10107448882299530629
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 17:48:43 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 581A 123 KB
37 KB 60ms
59ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

sffe /

Resource Hash

e96cb07afdac92a8c77fbd5b9bb721e548070f4657f4f1e71329d2fd9032be47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37898
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1633547226118934"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 10 Oct 2021 17:49:32 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/ Frame 581A 14 KB
6 KB 8ms
7ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

cafe /

Resource Hash

51896cb4e932803b983cf59d85b20c705f42a891fa0c9c408e3cb267b5bb949c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6219
x-xss-protection: 0
server: cafe
etag: 4041254270185007295
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 17:49:04 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 581A 42 B
63 B 40ms
40ms Image
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BgLH1wmFeCB8LeZUUXq0o3PLtM9MENokehOWvbxLMW3oc_S0FGje8ea5zObPDoaRDhtRKd1p-WaRyRoyqhgoYvdaGpS9O7R05IRhrAuOxJofvNab4

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Oct 2021 17:49:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame 3A38 21 KB
22 KB 33ms
8ms Font
font/woff2 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 19:46:29 GMT
x-content-type-options: nosniff
age: 511383
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21660
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:07:18 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 04 Oct 2022 19:46:29 GMT

GET
H2 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame 3A38 21 KB
21 KB 37ms
14ms Font
font/woff2 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 18:21:26 GMT
x-content-type-options: nosniff
age: 516486
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21424
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:08:24 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 04 Oct 2022 18:21:26 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 006A
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

47ms
47ms

Document
text/html

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si?st=NO_DATA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUlLRjQ-GVSGnt2RgQe_k5FaZtEux-8j-hN6Z1LwBuXqDHl6IUrwf-njSBmkTcg; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 10 Oct 2021 17:49:32 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sun, 10-Oct-2021 18:49:32 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 10 Oct 2021 17:49:32 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 10 Oct 2021 17:49:32 GMT
server: safe
content-length: 257
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 05D0 22 KB
8 KB 7ms
7ms Document
text/html 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Thu, 07 Oct 2021 14:33:17 GMT
expires: Fri, 07 Oct 2022 14:33:17 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 270975
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 581A 0
60 B 45ms
44ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.thegimp.fr
URL: https://www.thegimp.fr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sun, 10 Oct 2021 17:49:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame B82D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1&C=1

43 B
1014 B

39ms
39ms

Image
image/gif

2.21.17.14
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJLmnb8CENeEhsECGJ-y_LYBMAE&v=APEucNUF7jMmXZ0R0epT94GMF2dQWHRFius19JULURP0inlEZUg9j3HuzXUO5HBppd_JN3KrLvYW565K7Wf1rKCb7sdbz8Qk-Q
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.17.14 Brussels, Belgium, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-17-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 10 Oct 2021 17:49:32 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 10 Oct 2021 17:49:32 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 10 Oct 2021 17:49:32 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Sun, 10 Oct 2021 17:49:32 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame B82D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YWMnrEh03OwPOCjyMukaNQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1

43 B
894 B

38ms
38ms

Image
image/gif

2.21.17.14
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJLmnb8CENeEhsECGJ-y_LYBMAE&v=APEucNUF7jMmXZ0R0epT94GMF2dQWHRFius19JULURP0inlEZUg9j3HuzXUO5HBppd_JN3KrLvYW565K7Wf1rKCb7sdbz8Qk-Q
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.17.14 Brussels, Belgium, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-17-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 10 Oct 2021 17:49:32 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 10 Oct 2021 17:49:32 GMT

Redirect headers

pragma: no-cache
date: Sun, 10 Oct 2021 17:49:32 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame B82D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESECzCqdxRzcrz7Ee7jRKxfT4&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECzCqdxRzcrz7Ee7jRKxfT4%26google_cver%3D1

43 B
1 KB

15ms
15ms

Image
image/gif

185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECzCqdxRzcrz7Ee7jRKxfT4%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJLmnb8CENeEhsECGJ-y_LYBMAE&v=APEucNUF7jMmXZ0R0epT94GMF2dQWHRFius19JULURP0inlEZUg9j3HuzXUO5HBppd_JN3KrLvYW565K7Wf1rKCb7sdbz8Qk-Q

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 10 Oct 2021 17:49:32 GMT
X-Proxy-Origin: 216.131.114.162; 216.131.114.162; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 5834ca82-b601-4464-b37e-ed3e2c1b4dcb
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 10 Oct 2021 17:49:32 GMT
X-Proxy-Origin: 216.131.114.162; 216.131.114.162; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: a9cdf933-2cad-4d56-9faa-5089cf971ade
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESECzCqdxRzcrz7Ee7jRKxfT4%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B82D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkwMjU0MzA3NzA1NDEwMDYwNA%3D%3D

170 B
188 B

32ms
18ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkwMjU0MzA3NzA1NDEwMDYwNA%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Oct 2021 17:49:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 10 Oct 2021 17:49:32 GMT
X-Proxy-Origin: 216.131.114.162; 216.131.114.162; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 12752e50-8f17-4ac2-90e5-c1fea56ccb70
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzkwMjU0MzA3NzA1NDEwMDYwNA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 581A 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 174ba958ca59b0797146859b55bd2d3df7b9a1fe3c3fcb510a4b24dae3d46a1c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Op0h1o4bLATv4Gekw87wLIhuIhk3mUgQ1PXLVSVUXpk.js Show response
pagead2.googlesyndication.com/bg/ Frame 05D0 35 KB
13 KB 8ms
8ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Op0h1o4bLATv4Gekw87wLIhuIhk3mUgQ1PXLVSVUXpk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

sffe /

Resource Hash

3a9d21d68e1b2c04efe067a4c3cef02c886e221937994810d4f5cb5525545e99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 09 Oct 2021 16:17:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 91908
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13306
x-xss-protection: 0
last-modified: Tue, 05 Oct 2021 11:38:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sun, 09 Oct 2022 16:17:44 GMT

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110040101/ 142 KB
51 KB 30ms
30ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110040101/reactive_library_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110040101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

0f0ce648ea1b5faec971bbdac56ea40e5250f6ca85a0002a8a07f8a272deb64c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52346
x-xss-protection: 0
server: cafe
etag: 16693080848976965784
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Oct 2021 17:49:32 GMT

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 52ms
24ms Script
application/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.thegimp.fr

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110040101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 10 Oct 2021 17:49:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/ Frame 2EB3 10 KB
5 KB 14ms
13ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110040101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

e59f39fd9be6b3737942676248d273b23f94ab60f7b7e608230d6a107dccb7ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thegimp.fr/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUlLRjQ-GVSGnt2RgQe_k5FaZtEux-8j-hN6Z1LwBuXqDHl6IUrwf-njSBmkTcg; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 10 Oct 2021 17:29:23 GMT
expires: Sun, 24 Oct 2021 17:29:23 GMT
content-type: text/html; charset=UTF-8
etag: 10398570473303663775
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4601
x-xss-protection: 0
age: 1209
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 css2
fonts.googleapis.com/ Frame 2EB3 4 KB
635 B 32ms
16ms Stylesheet
text/css 142.250.185.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f10.1e100.net

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 10 Oct 2021 16:56:23 GMT
server: ESF
date: Sun, 10 Oct 2021 17:49:32 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires: Sun, 10 Oct 2021 17:49:32 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 2EB3 205 B
229 B 15ms
14ms Image
image/png 142.250.185.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f3.1e100.net

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 06 Oct 2021 08:19:39 GMT
x-content-type-options: nosniff
age: 379793
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 06 Oct 2022 08:19:39 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 2EB3 604 B
628 B 16ms
15ms Image
image/png 142.250.185.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f3.1e100.net

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 00:41:57 GMT
x-content-type-options: nosniff
age: 61655
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 10 Oct 2022 00:41:57 GMT

GET
H3 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211006/r20110914/elements/html/ Frame 2EB3 17 KB
7 KB 9ms
8ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211006/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

cafe /

Resource Hash

9d4b879e7fb9539f59e30a0c8b0fe2fa020c99e58caa9a7e616d459a5e017e03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 16:47:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7627
x-xss-protection: 0
server: cafe
etag: 14532344818667626787
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 16:47:24 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 600A 624 B
299 B 24ms
24ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CI-FFBDqij8YloC6tQEwAQ&v=APEucNUvA7CcnR1rAeJHdInhsZBr3bS_vZErYjgFnjavfk4xT1S2M1rUvKLdvNpyle1mURUsmT-LLcDWmrwu2LChTdi5ntsaIg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=60&slotname=9945988513&adk=2908073654&adf=3671569792&pi=t.ma~as.9945988513&w=468&lmt=1633888171&psa=0&format=468x60&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171439&bpp=1&bdt=185&idt=104&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=411&ady=1489&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=MVWThirkeM&p=https%3A//www.thegimp.fr&dtd=105

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CI-FFBDqij8YloC6tQEwAQ&v=APEucNUvA7CcnR1rAeJHdInhsZBr3bS_vZErYjgFnjavfk4xT1S2M1rUvKLdvNpyle1mURUsmT-LLcDWmrwu2LChTdi5ntsaIg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=60&slotname=9945988513&adk=2908073654&adf=3671569792&pi=t.ma~as.9945988513&w=468&lmt=1633888171&psa=0&format=468x60&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171439&bpp=1&bdt=185&idt=104&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=411&ady=1489&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=MVWThirkeM&p=https%3A//www.thegimp.fr&dtd=105
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUlLRjQ-GVSGnt2RgQe_k5FaZtEux-8j-hN6Z1LwBuXqDHl6IUrwf-njSBmkTcg; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=60&slotname=9945988513&adk=2908073654&adf=3671569792&pi=t.ma~as.9945988513&w=468&lmt=1633888171&psa=0&format=468x60&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171439&bpp=1&bdt=185&idt=104&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=411&ady=1489&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=MVWThirkeM&p=https%3A//www.thegimp.fr&dtd=105

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 10 Oct 2021 17:49:32 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 10 Oct 2021 17:49:32 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0D5E 53 KB
25 KB 60ms
58ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C9Kzm-B93e5bXCixWNAnP8Nru_MOMCjBImh65bcMmNS7LQeGdRkwhU1cdoP-JB3FOn1lQT_2tfp9LCJ-iV-Ik2bdvSbCM5M8HK4FrEruu3zAev0pukkgoDIuFvDSA_AOiO7PmieMeCToc_0eK2IzDL7RY6lA&dbm_d=AKAmf-D942kW1-rVzarTiq4tJD4la4tPefG4vbsYVc9VHk7cja3P7uFhBuATpI-BjJCy1VG_zLmr9fprWRknKdcU68_YWAYHLyJaf3UpuTgeQhcEBK3aDub5Jif2jl0qLWeBWTUOMO9OTVUbljGE9YxAt2vgoNSOxcmPJCvYJVzK9yaXKmWexQBIB2XFWD3JeKaRgHGxIJPJVS7IT98DyJ3k2zq8WOrVHO1934ADM8h853Jg0og2aJFlFkKQJ7iyHpu_QiNw00EMbCilDky9BmWjDGdGqKeeKn3ak9FhLwgKw7E1bayMyJmR0eKcIwUSkLcTBFFT5yhDpdR3PbBeQzrp5tCYXhbuly1CFz4XrLJNfhb2Qh9aOTNX2_3OXTnQYp19t2_-7Bz-JCypfdGIanv5OZNx8QljhmjHXKKNafeotP-WfNPr08J3HzF3HVvtvtYrIo6KeHp_gS6q8XBZ3uyZHX8MpJqD1POXVrbp7MnTRJo1mMK_A_NeaIVkdwq6LYCtDoyT5HLm8mLy7mYz6pWa5LcjPuieCHpQ87g3tQ55gISTJvyD41x8n8rwtsxkGGcs8QWPUGDOkLu1wI7xJPFiPJU93EfdhCmDV9oAy8bcQF27Vd4hnQeVPGTEygW_GlVkXfB7KOi49P5yyDgd0ekz6Vn5RXAIy2ocMGPnlR2CPDYvRbNFs5vKL4YbHqfn59UyUJduOkZjZHTDAszv4053x6DeNXUxrA4wLnS5Skb0WaeetgZUIkgR9nEktTQbZpIiHdn7vSv0jcMFpx0jiyS7PVWw-2oHNR1bGOEmi59T_gVvTgf-b3lXGWeV5oRdwSQBsOdcztr1qfsuuEefzZVM6EjufQF9kMee9LVCMrraHCcii2wLRUAfJR7Tjt4QIgF3JT_8kVZImYAJrNOlXAtFwitgAELCC91OHGGEkQcMgyoEcdeeNPcOutrEoQOAU4Yo9HQaZsU8evl7wvHtFsRfmiGe47CKwFEBOf9PkRace8SMd3K_2QeNIZ4IN3-bDyYV7NR2qYZTAs6fSUgl2fwapyyXCaRYnsJqI0imBewIPypA8yPNfZubamQb_H-AvxnBpWHiBvAa65y9qLqTTHxYEJwhvldDrBlzC0I947_tURhMPJvNcH3ALHONOe-ybWIs-AmhT4Nkma7qaTwr5Y4LJ9bTVums6izqT1wy0mU0HEj88ZsavrPHcwgEyUog973B2VJ2j-AbU1-5mdaeZwTlOz7XU5zfFfdWjy4IycECy2x4MA0s49F1H36J40QIbyZEuFs9tx6X2MoSU6n2ZuFex1ZHkSs7Fn9hQIgBxVLMGRqPiZeVXGRL5dCLMndAQ1KgtGkY8ziNULzTTpAbkv6Fko8ZW92A4QjKeYN990_GApsvxCmlvUin_sgcUDytA2mBadi7E-JyL2IqZbSN4hUAuH5MF9dfLlYesl0l8K_aat0qUr5YMRkjHtVkZTDgA610i0Rrn_DgcRJ2LcwguIDqNNmbi8hwKpqMidiFa8ypwrwJNdrkRynPG0bjyKX6-nLYFBn6CZewtBEudmWF_bR2N8FnPoMq5ltwFdoEqzXauK83hjohZALLHFEQ2Oxq_BA3p3YYAZ6KmM6wytVMjR_6QSE0MEV2G0WYPgHEaLsXquurAYtwSF12Wr6o-8YXJs2C7lq3SfpY3k-pOjHanWjETfQeTCRsGVDdtMezBNL1YF3EKg_aXquhj3RusD55C3eXAsmcrcBPpOK_TxUURlz68lARjsoUggASqtOzWkbuT50Hdh7YQhGq5elgRZUObrOuQd-G3a9lsR2GQXtSTC5kGhJ3FZzIlFMej76-H2MC5bCKO81KFaKTZivEgMVVnS3z5Zie9upARq5FwPJZaBZeRN4yHuFFjfCptKCcHGa8e0r2hNifjke8V-V9ugXqTxVI1YAAT-FdneJuo-6JVbIE2xGgAmJTNr7tvK1V34V8Xt3iFUin-THXCPwJBHZBVebtzIY-btxyYQZ34jyIPxANarX2quQdAWwsZtTctZIsdBOdbJzAbB8DewuJWxMdlXQZTrOvU4VcDD06R35KJaYY34g039UYwahJHMrpFg_D4z-hcuonRCnOYGP_RB6_PAY5TTBjYtB-V6xl3sD1CQwOpGLVwM6tK8IcmzfpWpCBGBRtY0pMdLansNww3Ri2D19swEFsuDEW6s-qZ4JOVIEjMdV9VGesti6keprY7DfE-K0nWZmbR_INUv7qhQw_wMi4LKipnhv4CCIKuQK_wegN7H6Pmj9qsksiLpsUgvqUcc9aRrJMv440SweNS7iOxIgNcsZ8Fkixe8hhYCt4wCz5ExAknTSM9V33pyhlszAe1w48-ILd1cu5npIwE0-OEWCD__Z7PRK2UtihDiIOjRwnAvo4dhO6Tqo4alfdpVeS2LEXqFj3S_k-6lIVHfJqimKQ-q-L6esNBfoYoFhgqhkbuKDXR31ApvigzL7bvfCudCo2VY6aXluiKp0Lkd7odjb0RRRaq5il8dTnuxXrv0u2yxGwC4qQkiJaAyqENzX3FrpxAJFdj4qHlxAzaM8dMV47QneBiBezBRoQjuMJoyT-C56GivhXo0pximIEJdtMyarXvgLScaRXTb9KFD1XW9gXpvIXvgvFTFXR3KEOWhG7wydXbTZ7RZyL5MKr2CEgQUS2Mx8rnsDul2uBA1Dm0QNPkGxiKkMyYNkXICjP4a-y0336P_CzXsCFuXa5g2RpWLlMAx8UJrAUWMs80-SCintJ6ghedPeF&cid=CAASBORoeGU&rfl=2%2Chttps%253A%252F%252Fwww.thegimp.fr%252F%240

Requested by

Host: www.thegimp.fr
URL: https://www.thegimp.fr/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

329cc81eab63122ade7bcc69e9d2fb09068f804dd8084f4ca241a4715463242b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8726451593740147&output=html&h=60&slotname=9945988513&adk=2908073654&adf=3671569792&pi=t.ma~as.9945988513&w=468&lmt=1633888171&psa=0&format=468x60&url=https%3A%2F%2Fwww.thegimp.fr%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633888171439&bpp=1&bdt=185&idt=104&shv=r20211006&mjsv=m202110040101&ptt=9&saldr=aa&abxe=1&prev_fmts=468x60&correlator=5344943662906&frm=20&pv=1&ga_vid=2125498307.1633888171&ga_sid=1633888171&ga_hid=1114397195&ga_fc=1&ga_wpids=UA-3892863-7&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=411&ady=1489&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C31063104&oid=2&pvsid=37472944995510&pem=87&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=MVWThirkeM&p=https%3A//www.thegimp.fr&dtd=105
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Oct 2021 17:49:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25490
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/ Frame 0D5E 3 KB
1 KB 8ms
7ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

cafe /

Resource Hash

5120f35e394e169ac0839405dbd6e680163a4e02f060f5a6a833ebfacf35d966

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:48:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1344
x-xss-protection: 0
server: cafe
etag: 10107448882299530629
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 17:48:43 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0D5E 123 KB
37 KB 29ms
28ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

sffe /

Resource Hash

e96cb07afdac92a8c77fbd5b9bb721e548070f4657f4f1e71329d2fd9032be47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37898
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1633547226118934"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 10 Oct 2021 17:49:32 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/ Frame 0D5E 14 KB
6 KB 8ms
7ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

cafe /

Resource Hash

51896cb4e932803b983cf59d85b20c705f42a891fa0c9c408e3cb267b5bb949c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6219
x-xss-protection: 0
server: cafe
etag: 4041254270185007295
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 17:49:04 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0D5E 42 B
63 B 41ms
40ms Image
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D-veE4gA0dVaog5DzVqVeEdknOTBMLLKJuWT2Uv113PXFdwyoWhhfWN4UAwWDPRJa4hdhPBWQvRTWfzOfqRArCPpaVqj2l6luSJ5FnM9TUuIXioL8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Oct 2021 17:49:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 1A41 3 KB
580 B 17ms
17ms Stylesheet
text/css 142.250.185.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f10.1e100.net

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 10 Oct 2021 17:04:07 GMT
server: ESF
date: Sun, 10 Oct 2021 17:49:32 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires: Sun, 10 Oct 2021 17:49:32 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/ Frame 1A41 1 KB
864 B 7ms
7ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

cafe /

Resource Hash

6500bd4cd278cdd0e00b473891ec40860e4dde8e5a7f02ab1d2ad6e30dfb0ce4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:43:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 384
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 837
x-xss-protection: 0
server: cafe
etag: 7640065535275194769
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 17:43:08 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211006/r20110914/ Frame 1A41 18 KB
7 KB 7ms
7ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211006/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

cafe /

Resource Hash

2df1e67459f1d7eda2c4c5af7e07c73f911f6c898f3d061d8f3e9a32ad63fe31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 224
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7605
x-xss-protection: 0
server: cafe
etag: 4152153861754824712
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 17:45:48 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/ Frame 1A41 3 KB
1 KB 8ms
8ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

cafe /

Resource Hash

5120f35e394e169ac0839405dbd6e680163a4e02f060f5a6a833ebfacf35d966

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:48:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1344
x-xss-protection: 0
server: cafe
etag: 10107448882299530629
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 17:48:43 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1A41 123 KB
37 KB 26ms
25ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

sffe /

Resource Hash

e96cb07afdac92a8c77fbd5b9bb721e548070f4657f4f1e71329d2fd9032be47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37898
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1633547226118934"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 10 Oct 2021 17:49:32 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/ Frame 1A41 14 KB
6 KB 8ms
8ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211006/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

cafe /

Resource Hash

51896cb4e932803b983cf59d85b20c705f42a891fa0c9c408e3cb267b5bb949c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6219
x-xss-protection: 0
server: cafe
etag: 4041254270185007295
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 17:49:04 GMT

GET
H3 200 94b9e9edb15b7c220f12fa63d878a5af.js Show response
www.gstatic.com/mysidia/ Frame 1A41 27 KB
11 KB 14ms
14ms Script
text/javascript 142.250.185.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/94b9e9edb15b7c220f12fa63d878a5af.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f3.1e100.net

Software

sffe /

Resource Hash

3d1246d2fe982f57c0a911530b2fa93a679e42c0d897151f39cffa4762c55f5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:23:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300372
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11213
x-xss-protection: 0
last-modified: Thu, 07 Oct 2021 05:48:38 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Wed, 05 Jan 2022 06:23:20 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame CE7B 143 B
163 B 13ms
13ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUlLRjQ-GVSGnt2RgQe_k5FaZtEux-8j-hN6Z1LwBuXqDHl6IUrwf-njSBmkTcg; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 10 Oct 2021 17:35:57 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 815
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 600A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1

43 B
894 B

59ms
38ms

Image
image/gif

2.21.17.14
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI-FFBDqij8YloC6tQEwAQ&v=APEucNUvA7CcnR1rAeJHdInhsZBr3bS_vZErYjgFnjavfk4xT1S2M1rUvKLdvNpyle1mURUsmT-LLcDWmrwu2LChTdi5ntsaIg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.17.14 Brussels, Belgium, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-17-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 10 Oct 2021 17:49:32 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 10 Oct 2021 17:49:32 GMT

Redirect headers

pragma: no-cache
date: Sun, 10 Oct 2021 17:49:32 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 600A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YWMnrEh03OwPOCjyMukaNQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1

43 B
894 B

39ms
39ms

Image
image/gif

2.21.17.14
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI-FFBDqij8YloC6tQEwAQ&v=APEucNUvA7CcnR1rAeJHdInhsZBr3bS_vZErYjgFnjavfk4xT1S2M1rUvKLdvNpyle1mURUsmT-LLcDWmrwu2LChTdi5ntsaIg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.17.14 Brussels, Belgium, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-17-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 10 Oct 2021 17:49:32 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 10 Oct 2021 17:49:32 GMT

Redirect headers

pragma: no-cache
date: Sun, 10 Oct 2021 17:49:32 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC2bSXnOujPrJTABHZCEUj8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 600A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESECzCqdxRzcrz7Ee7jRKxfT4&google_cver=1

43 B
1008 B

13ms
13ms

Image
image/gif

185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESECzCqdxRzcrz7Ee7jRKxfT4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI-FFBDqij8YloC6tQEwAQ&v=APEucNUvA7CcnR1rAeJHdInhsZBr3bS_vZErYjgFnjavfk4xT1S2M1rUvKLdvNpyle1mURUsmT-LLcDWmrwu2LChTdi5ntsaIg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 10 Oct 2021 17:49:32 GMT
X-Proxy-Origin: 216.131.114.162; 216.131.114.162; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: dd79030e-66c3-4ae3-ad1e-3fee94bfdda5
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 10 Oct 2021 17:49:32 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESECzCqdxRzcrz7Ee7jRKxfT4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 600A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE2NDM5OTE3MDQ0ODQ5NjU2Ng%3D%3D

170 B
188 B

18ms
17ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE2NDM5OTE3MDQ0ODQ5NjU2Ng%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Oct 2021 17:49:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 10 Oct 2021 17:49:32 GMT
X-Proxy-Origin: 216.131.114.162; 216.131.114.162; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f5f07008-f028-460b-87b2-ee86cdf40ae8
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE2NDM5OTE3MDQ0ODQ5NjU2Ng%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211006/r20110914/ Frame 0D5E 23 KB
9 KB 8ms
7ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211006/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C9Kzm-B93e5bXCixWNAnP8Nru_MOMCjBImh65bcMmNS7LQeGdRkwhU1cdoP-JB3FOn1lQT_2tfp9LCJ-iV-Ik2bdvSbCM5M8HK4FrEruu3zAev0pukkgoDIuFvDSA_AOiO7PmieMeCToc_0eK2IzDL7RY6lA&dbm_d=AKAmf-D942kW1-rVzarTiq4tJD4la4tPefG4vbsYVc9VHk7cja3P7uFhBuATpI-BjJCy1VG_zLmr9fprWRknKdcU68_YWAYHLyJaf3UpuTgeQhcEBK3aDub5Jif2jl0qLWeBWTUOMO9OTVUbljGE9YxAt2vgoNSOxcmPJCvYJVzK9yaXKmWexQBIB2XFWD3JeKaRgHGxIJPJVS7IT98DyJ3k2zq8WOrVHO1934ADM8h853Jg0og2aJFlFkKQJ7iyHpu_QiNw00EMbCilDky9BmWjDGdGqKeeKn3ak9FhLwgKw7E1bayMyJmR0eKcIwUSkLcTBFFT5yhDpdR3PbBeQzrp5tCYXhbuly1CFz4XrLJNfhb2Qh9aOTNX2_3OXTnQYp19t2_-7Bz-JCypfdGIanv5OZNx8QljhmjHXKKNafeotP-WfNPr08J3HzF3HVvtvtYrIo6KeHp_gS6q8XBZ3uyZHX8MpJqD1POXVrbp7MnTRJo1mMK_A_NeaIVkdwq6LYCtDoyT5HLm8mLy7mYz6pWa5LcjPuieCHpQ87g3tQ55gISTJvyD41x8n8rwtsxkGGcs8QWPUGDOkLu1wI7xJPFiPJU93EfdhCmDV9oAy8bcQF27Vd4hnQeVPGTEygW_GlVkXfB7KOi49P5yyDgd0ekz6Vn5RXAIy2ocMGPnlR2CPDYvRbNFs5vKL4YbHqfn59UyUJduOkZjZHTDAszv4053x6DeNXUxrA4wLnS5Skb0WaeetgZUIkgR9nEktTQbZpIiHdn7vSv0jcMFpx0jiyS7PVWw-2oHNR1bGOEmi59T_gVvTgf-b3lXGWeV5oRdwSQBsOdcztr1qfsuuEefzZVM6EjufQF9kMee9LVCMrraHCcii2wLRUAfJR7Tjt4QIgF3JT_8kVZImYAJrNOlXAtFwitgAELCC91OHGGEkQcMgyoEcdeeNPcOutrEoQOAU4Yo9HQaZsU8evl7wvHtFsRfmiGe47CKwFEBOf9PkRace8SMd3K_2QeNIZ4IN3-bDyYV7NR2qYZTAs6fSUgl2fwapyyXCaRYnsJqI0imBewIPypA8yPNfZubamQb_H-AvxnBpWHiBvAa65y9qLqTTHxYEJwhvldDrBlzC0I947_tURhMPJvNcH3ALHONOe-ybWIs-AmhT4Nkma7qaTwr5Y4LJ9bTVums6izqT1wy0mU0HEj88ZsavrPHcwgEyUog973B2VJ2j-AbU1-5mdaeZwTlOz7XU5zfFfdWjy4IycECy2x4MA0s49F1H36J40QIbyZEuFs9tx6X2MoSU6n2ZuFex1ZHkSs7Fn9hQIgBxVLMGRqPiZeVXGRL5dCLMndAQ1KgtGkY8ziNULzTTpAbkv6Fko8ZW92A4QjKeYN990_GApsvxCmlvUin_sgcUDytA2mBadi7E-JyL2IqZbSN4hUAuH5MF9dfLlYesl0l8K_aat0qUr5YMRkjHtVkZTDgA610i0Rrn_DgcRJ2LcwguIDqNNmbi8hwKpqMidiFa8ypwrwJNdrkRynPG0bjyKX6-nLYFBn6CZewtBEudmWF_bR2N8FnPoMq5ltwFdoEqzXauK83hjohZALLHFEQ2Oxq_BA3p3YYAZ6KmM6wytVMjR_6QSE0MEV2G0WYPgHEaLsXquurAYtwSF12Wr6o-8YXJs2C7lq3SfpY3k-pOjHanWjETfQeTCRsGVDdtMezBNL1YF3EKg_aXquhj3RusD55C3eXAsmcrcBPpOK_TxUURlz68lARjsoUggASqtOzWkbuT50Hdh7YQhGq5elgRZUObrOuQd-G3a9lsR2GQXtSTC5kGhJ3FZzIlFMej76-H2MC5bCKO81KFaKTZivEgMVVnS3z5Zie9upARq5FwPJZaBZeRN4yHuFFjfCptKCcHGa8e0r2hNifjke8V-V9ugXqTxVI1YAAT-FdneJuo-6JVbIE2xGgAmJTNr7tvK1V34V8Xt3iFUin-THXCPwJBHZBVebtzIY-btxyYQZ34jyIPxANarX2quQdAWwsZtTctZIsdBOdbJzAbB8DewuJWxMdlXQZTrOvU4VcDD06R35KJaYY34g039UYwahJHMrpFg_D4z-hcuonRCnOYGP_RB6_PAY5TTBjYtB-V6xl3sD1CQwOpGLVwM6tK8IcmzfpWpCBGBRtY0pMdLansNww3Ri2D19swEFsuDEW6s-qZ4JOVIEjMdV9VGesti6keprY7DfE-K0nWZmbR_INUv7qhQw_wMi4LKipnhv4CCIKuQK_wegN7H6Pmj9qsksiLpsUgvqUcc9aRrJMv440SweNS7iOxIgNcsZ8Fkixe8hhYCt4wCz5ExAknTSM9V33pyhlszAe1w48-ILd1cu5npIwE0-OEWCD__Z7PRK2UtihDiIOjRwnAvo4dhO6Tqo4alfdpVeS2LEXqFj3S_k-6lIVHfJqimKQ-q-L6esNBfoYoFhgqhkbuKDXR31ApvigzL7bvfCudCo2VY6aXluiKp0Lkd7odjb0RRRaq5il8dTnuxXrv0u2yxGwC4qQkiJaAyqENzX3FrpxAJFdj4qHlxAzaM8dMV47QneBiBezBRoQjuMJoyT-C56GivhXo0pximIEJdtMyarXvgLScaRXTb9KFD1XW9gXpvIXvgvFTFXR3KEOWhG7wydXbTZ7RZyL5MKr2CEgQUS2Mx8rnsDul2uBA1Dm0QNPkGxiKkMyYNkXICjP4a-y0336P_CzXsCFuXa5g2RpWLlMAx8UJrAUWMs80-SCintJ6ghedPeF&cid=CAASBORoeGU&rfl=2%2Chttps%253A%252F%252Fwww.thegimp.fr%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

0b4cc12ccd09adacbf7695b7ae68d146a6b9bfa7a2058dbd4e58f31c14ec5e7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:44:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 278
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9203
x-xss-protection: 0
server: cafe
etag: 15223966529599630443
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 17:44:54 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211006/r20110914/elements/html/ Frame 0D5E 8 KB
3 KB 8ms
8ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211006/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:47:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 119
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3128
x-xss-protection: 0
server: cafe
etag: 3658073882064373855
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 24 Oct 2021 17:47:33 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0D5E 0
24 B 95ms
79ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssev3czmEmRJYWHl3gMH_3DPfwLplw3dUTYPLqBj9QrdBYj-wON99dj_vGOJkzIu6Mq5-Z4nEOsZzGt0i5U7T17L8407RPIXT_Qnfh1ZqJFBi3wuF81lQqsnUjd5fr6WYv58-Zoc2WCQDRdP-cvkao6EH1TO7F1f88XUvokTK0tRtnU7sYL3BJzLQs1Be4SfOJUZY7dAbJVrsxJfK7CdLV_W_QozPq1vmlawTRZaUE8b-hTwwqAG6JRksIEAf9VGWxqtj8UYD-P6CGQbb4dvLALkNJ98v9TwQqsJotk0DV8DABwCtJ4XvXmBH45LslvU_ol1cioXpe69fd88NiB79kxwjbOoAOVQcxbFQvIH5deV2k1eWyzbr_OLxvZOLT7DlNFOFVVsm1U7k9_530xF32uiexLobR77XE1Q6R-RB6omVTbYni7xd6H3bxuOlmSGSI6JYwbWje57qha4TLCkDCXTEqAOjz0OV-fa_oYSHfBL-3IrhzBlpAzzHaz7HN17XBSqxs5laPEDIIAP_ZnrP-dh6_TQyNz_fqnp8sbQN_e6ig8pZOdNXc7yQMgmMngBUTHNcVoQ-5nfP9AfbPjbwGj0DtV_dv0RnEVPjkuBXUA4Vmsuj3UqsPU-64JXQ8vHlTrIygxXhYIyLyu-C3FvkD6Gg84rVCQBzYdAmnmxnFKyPRl6wdleha8Df6KUL58EOZKxCK8G6tRw5OYhqXas6kbXiNhRh6-iKvvW30XWrZL8YtpGuQP7lHoqFGUANzkyzBrLpSyCBTk0CKCU8pUHFgk1bDK3XguofDmy296woBUNNdu-U3_rBwpB2bH9e4-9S8zwRDkE_eM6Pd0bV1ASWGmqcGUMk5AAtGJdskfp1hdbGYBmqAvgH6Hnmw-ASg60N9fmsUfMzWG3Fxp_8_vfyag6y4sr7i-bS3DLnt2UP7SB_DAJgfkAVUgnUt6AAfFZYkHUIJxlbFimvzgAmJ8XUxjTI-aJrtQ33Z5otNQ9L7O_6rFlfelPX-ojC2gky3uc04C-Dd2gsGpg6d5JUIRSakgsNKO6Ed6-P5ufTM93ewhqaIwa0sxyxUO66gnsSQiIkgYrWyvXRbBfNLNT-tr9RIwYuob9kAiC5Gj&sai=AMfl-YQT8b3TVxCN9JLRgi6A1c_qLK2wM7t6r6xiKqCMZ63NQqwgbcLbsShk1DQUIPaY6NsOsdeco_dkL5m1FBW2Uo32LYfwU4toZAwHOymb2eOGmKcDlAYSVmHBpcTg50oKeeQh&sig=Cg0ArKJSzEyKQG4dFLBiEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211006.75091&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sun, 10 Oct 2021 17:49:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 0D5E 41 KB
15 KB 8ms
7ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 14:33:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 270975
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Fri, 07 Oct 2022 14:33:17 GMT

GET
H3 200 09232021-023720120-300x50.gif
s0.2mdn.net/5472331/ Frame 0D5E 14 KB
14 KB 43ms
17ms Image
image/gif 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/5472331/09232021-023720120-300x50.gif

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

sffe /

Resource Hash

706fe44137e1a2ffee5e35cc88317027decf1b8c630197e1a2d616cc4e67249e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:10:47 GMT
x-content-type-options: nosniff
age: 2325
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14804
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 09:37:20 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Oct 2021 17:10:47 GMT

GET
DATA 200
OK truncated
/ Frame 0D5E 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ed95149794e5ca06c633c9ba387ac75fd0f0e2007691386357db86edb284aa4f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame D8CD 22 KB
8 KB 7ms
7ms Document
text/html 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Thu, 07 Oct 2021 14:33:17 GMT
expires: Fri, 07 Oct 2022 14:33:17 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 270975
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0D5E 0
23 B 31ms
30ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sun, 10 Oct 2021 17:49:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame CE7B
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

47ms
47ms

Document
text/html

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211006/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUlLRjQ-GVSGnt2RgQe_k5FaZtEux-8j-hN6Z1LwBuXqDHl6IUrwf-njSBmkTcg; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 10 Oct 2021 17:49:32 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sun, 10-Oct-2021 18:49:32 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 10 Oct 2021 17:49:32 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 10 Oct 2021 17:49:32 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 05D0 0
20 B 42ms
42ms Image
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BOFzuqydjYc3FJLLm7_UP86mp8AoAAAAAOAHgBAI&bg=!ICOlI2fNAAbGFvHlxhY7ACkAdvg8WuYBxQx3t-w4wz0jlluVk3SX27BWcEXsvpYL7h9kgaOMDNX8UwIAAACoUgAAADtoAQeZAwZ94o1qvV3Q8YdW1mHps9RbJZA8zBaLmFdg0Hp_Vp9CKnvIsrFPdzbwWYYD8HDEXk1GM72lvXIuz0R58Rk_ybzhfDMZf05AdZfOvBUbMIrk4op8d_aNCTml8YcMct2x7NEhb2MFax7X1pcjLDu7mvGGBn0kRZZr6osYpSDr9pAkclpFBkQ6UCdSeVmH1UzFNRPjQ-7va3IOp3TKNlPGVmCCZVb2cKA6wftybI9DlJ64IrpmtXIKwmp0uMS_VDNjuuBRi6PssMxPGMo-ES5vZIjINJdFyNQUbgXe1zUI5y8EFPo4qHh_x_jU4fdVHeYUSxE6xQYmnF4oggcQXdwmxN389TdAIHprWoyTeYShsPuNIYG29xFoNRgf2lfHK_LGniHmUqc_I58bcDHx3nzAMODVKIEcGBnvbLq0ORXlWjUpDHO5jHWQP2djFYddSqokK3M8FahHYmaegIqVw04pFHpjgPLVaQy9F0IvottsThKDU2uK_-BiehAa3tw13NijqcEo4wxMJuGlaBqcVgPRcmVeKdx42X9YlI4wnECJHiHdiSA_YDGr3UvFQbqpxmrFX96ul7wObgJxSojqzdAzxJoVNL8mvw8wlL1lBVNsA3Nhw8QmOse2U-ccZrW9iOJM0o5Cp83UYV7LZpw_N5-mQk35k8djRXQI9vHgZq_4Ezlwl0V-BJEBwlA1PCFI7YKV6S842rKvJV59fRvft2hKlqCqSm2NHAUJeMKBUb9Eue4Z6wCJsZqoxJgnaQrvNfc1qJ45fDRCrxSbF2CY9Lv5BTCXYTrSO6NBL-pdEu8d6cCSTTiKFMfdZW_JNLq5BPKMdcYgC_tYhGvoQBjMCw9LKZqzaLHaBJmyGNA-O39VlWCjn1BCr1eow-9z2N1XbtD5C_fn8arkADS1N6UMF__rkPa2i0ubKSktK3Ialf9SQfb5cGMAUNt9HtfZ6Syjrc2nuBcwbbpqwAxP_R0ugINEbYWrkpZIyZGhz-AqQlyDG4qpwCu7XVs2RtaflEstxDfd_CpixjXWv0g

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Oct 2021 17:49:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Op0h1o4bLATv4Gekw87wLIhuIhk3mUgQ1PXLVSVUXpk.js Show response
pagead2.googlesyndication.com/bg/ Frame D8CD 35 KB
13 KB 7ms
7ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Op0h1o4bLATv4Gekw87wLIhuIhk3mUgQ1PXLVSVUXpk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

sffe /

Resource Hash

3a9d21d68e1b2c04efe067a4c3cef02c886e221937994810d4f5cb5525545e99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 09 Oct 2021 16:17:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 91908
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13306
x-xss-protection: 0
last-modified: Tue, 05 Oct 2021 11:38:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sun, 09 Oct 2022 16:17:44 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 38ms
22ms XHR
application/json 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20211006&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110040101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

66fd760cc70fedce8741713f9c3beca1582e88e7e3d0f585bb07f3166f89cd09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 10 Oct 2021 17:49:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8580
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 34ms
34ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110040101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 10 Oct 2021 17:49:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 10 Oct 2021 17:49:32 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D8CD 0
20 B 43ms
43ms Image
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B07QVrCdjYf21Idy03gPpt7HYBAAAAAA4AeAEAg&bg=!vr2lvfnNAAbGFvHlxhY7ACkAdvg8WuMkBw6w6Sygq3gCqAxYRmHZQusFsSyijEbjf0HSrWnmZhOyrwIAAABtUgAAAAtoAQcKAAKFXJkC99sObydI9uvVvgpQxLUTpp6gX8H0SAsxxagAOq0YBHVBA2Gs_kjBie141YPIirInfI5PZh0viNV7JAPmvCeIkEFk6gMSTgbsUEZo2dQINQ0i7SAqMszDVeJ1tYeEv-42WTMiqcpqJOhTBjqe73fprLP-sBrWRkx30EQxDl-mF3aBDSFoNme_QMddQL4EodncKxFDFj7nbyLy4HAKcLYANohmaj0PSJ02qe3srQjOv3EKrzZoyD_VhZrTefTftBYjZfK4mOxuBWN4FJ49JcVQbBqV9HJEj-DKrWPZOZ6A2vwyA1L5wdbKRcSlIRGymsrWwFp8CU3pD_bmV8feMEz0VexMTiegkixHCUzoNm0i226YSD1As5T7iZ4Huu1OyaX8XSFB9_fLl3Sz15WcBLS3AN2lwTZ1umLpEpqpFvp8NDaf3cErK9QaHQiCYocHrrUF7jvfoM0T1b5TBjjojvcRJObjeg4a3zoDpH1DkD-LkfvTW4JsT8ahZy3nI-MitM85rB56tr7uYQ_nDUzqzxf2gPBzh1HAPoAqIvqW3Ic8mVc1hBvdxdxliKVHQBGTSJa-MtSuSxdgaPh3RjkFcg3k9bVAkJsuE_k8dlXUvQWJOuxOrFrf1Y0SfMdTXeiySjUDrc7Ni2Cji7Be4r7mBG_4fXqYpW85GbnHuN8dkS72todyBM3GJ497nCKXSPMg3SlX9VmNGSb5PVEq3DFOZD2THnIe0g_Xup-RcF-NPlGN9qbqzSzdTY7DXPDOz0xy0o4yyTzLli9Sii5CnsPpGRgc944WNcyGnlx7pddVNHmouVDdE0aYzGA7RBpR4Pj1BzLkUwpO3-bf87XTDQGIiFKAku0tD9N_IBwzRNYoLMkSIbDzGhMgw3lYuXe1XKU_WRqjRXcu-xM6Ab73pHo0yWrO8ITxyyr_NmauM-KA4orRa_g-UHYasX5xMmHU5NwBxtso8MOJaBWdw_BarZDX_drRmCEMpSRMNR8z3jvusE6VItF1mB7_7kC5xw

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Oct 2021 17:49:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 22A6 12 KB
5 KB 7ms
7ms Document
text/html 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f1.1e100.net

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thegimp.fr/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Sun, 10 Oct 2021 09:34:42 GMT
expires: Mon, 10 Oct 2022 09:34:42 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 29690
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame E68D 783 B
537 B 17ms
16ms Document
text/html 142.250.185.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f4.1e100.net

Software

GSE /

Resource Hash

0db37cb5ed219162f4c1ed1b5f41f80774539216c9231a12270d0134688cd640

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-j1oPpR4+TXk5Uv7kZ5pT7Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.thegimp.fr/
accept-encoding: gzip, deflate, br
cookie: NID=511=iEQEMg71fCahFLWIti4lyWH6RYGckAa_BaI_dU7ZwGdpgc__Ry3NQ3_htL3d7toF-uMW67S8Ed-6__DQXLfpRwNr0ll7LQAX693hjJq3y8l8dywo3ohtM5NMTWaBghBlmk2I3fa78fPWACNl8iVnbWmoADdsnAavfLOlLFb9DgU
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Sun, 10 Oct 2021 17:49:32 GMT
date: Sun, 10 Oct 2021 17:49:32 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-j1oPpR4+TXk5Uv7kZ5pT7Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 515
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Op0h1o4bLATv4Gekw87wLIhuIhk3mUgQ1PXLVSVUXpk.js Show response
pagead2.googlesyndication.com/bg/ Frame 22A6 35 KB
13 KB 7ms
7ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Op0h1o4bLATv4Gekw87wLIhuIhk3mUgQ1PXLVSVUXpk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

sffe /

Resource Hash

3a9d21d68e1b2c04efe067a4c3cef02c886e221937994810d4f5cb5525545e99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 09 Oct 2021 16:17:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 91908
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13306
x-xss-protection: 0
last-modified: Tue, 05 Oct 2021 11:38:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sun, 09 Oct 2022 16:17:44 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame E68D 0
0 43ms
43ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gda_r20211006&jk=37472944995510&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s52-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 44ms
44ms Image
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20211006&jk=37472944995510&bg=!WVqlWh7NAAbGFvHlxhY7ACkAdvg8WjMLiYLA7NGs7Qh91Obin1MJYv3emqFC_b-O4XrJRis0s6KgRgIAAABqUgAAAApoAQeZAqpT539weg4t8jJrN19ticuN7K2n_e_0iK5Aq5y2fYknIDT3GSh5vtfQm7F8P5fA8TVB83UzFF5G3WZlRONdsx9Ktz6OyoGx6EI6Qo2CooRB17oV34IUn1g-lB22AMhS4U5oFRyFR0kkLwY7LXeVymOwP5gKgi8IugLTjoLcN9JX__08dQKPUX-W1sgEANlRwIy2SWYIsPJlRw9Bay-8LEVJzqm-KezyjJKmHToLez56DEFIj61XP6AQ4waazt_2oEYfF3ON04Na8Pt0R3bekdsEgKxQ-LgbLfqVUKSBZfPPU4so1PSRZYP1w-k-rsriCmk4dVqLysT6rQPeuGY0Z-KK0UTJ-Cu9od6cc_BEGl40JAQSd_SyV4O0bIj-fSxVEW787Gr5IRbWD9poh1vI8GYHCcadzOV1Lht8T-lVqCfbG8pjcE0D6VKLswWVTHUfhcmQXP4yhxWalUpLaYwn52amFfl6yBf8OD-oXyMFAJbObQYIalKtLFccKGQe8ncr_azigqxNTtEPuQXCG2D03yvH5D4qClKjELrOu9q4WwJ-okxTxC-40S6W7Thgr1Q48tq-4Is0KlbAkUzOZR9WcdrcUtgk66AzVlI-zf69Bo0FhxAFcxhvTYcP7A7TgeYbG9LTQDCry9rYmw9dhphSSYVky2SZm4xzLtRD5r-3gH0As5gOYKeNciKuOc-uU77V4WO24agJ6WE4ozjnowzLVu-9J8wEXeaPYumhRdHS6HBXCOs6dhj8oY6unuoQmC7_6gker0yVD-gbtiib0l6arFDhX9z--bW-iy6oM1UMxGoGOJbMCcsTyMaSYyaJW4acw5DvwWKKy_SkxLIvBGAkzzdNlKYWocCFmtamVBogYWEjSbf3pXXEANT1Kx1T2nlqf0KIFS4VIygwkDFd

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.thegimp.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Oct 2021 17:49:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3A38 42 B
64 B 43ms
42ms Fetch
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssXx4VHLlopg_fOngG2mNR0svC7s1IASQz0EJ8sEpySYIjGxmEbZYKoAqURddfD6-zP-3By57__MQhQpp6Ia6wcXbA6-dA17hSx4WTKJvT12TOiPrU&sai=AMfl-YQFXaGtZxY17gpp0FUbJKjSy9wFxzSlFP2TkPROfM7cEsPybQy6k7mRCE8qvErD6bhzoYG1UctHwiWv&sig=Cg0ArKJSzEDv58dOyQbCEAE&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211006&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=2291775438&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1633888171548&rpt=928&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Oct 2021 17:49:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 581A 42 B
64 B 41ms
41ms Fetch
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvhL0_AmHe5etAZGGhvVpiG1OF-o7oaTGYJ9R5-mSi_gx4NS14KVE8S1yC3U286tD54IayiigbLazbB888wL0gXNUJklwfUrb9igrOWRQucbbMPCoA&sai=AMfl-YTP9yCrXddtpzUyGNksJH18923KPFbGkgF1fQTYM4ywid9MhgVfckXdUS2qaPhhkLIJg0Za85cdEfkc&sig=Cg0ArKJSzFgN-SM-Zr4KEAE&cid=CAASBORoeYQ&id=lidar2&mcvt=1000&p=0,0,54,320&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20211006&bin=7&avms=nio&bs=0,0&mc=0.93&if=1&app=0&itpl=20&adk=2993391561&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1633888172280&rpt=395&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Oct 2021 17:49:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/show_ads.js

Domain: s7.addthis.com
URL: http://s7.addthis.com/js/200/addthis_widget.js

Verdicts & Comments Add Verdict or Comment

74 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

17 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.google.com/	1970-01-20 02:14:59	Name: NID Value: 511=iEQEMg71fCahFLWIti4lyWH6RYGckAa_BaI_dU7ZwGdpgc__Ry3NQ3_htL3d7toF-uMW67S8Ed-6__DQXLfpRwNr0ll7LQAX693hjJq3y8l8dywo3ohtM5NMTWaBghBlmk2I3fa78fPWACNl8iVnbWmoADdsnAavfLOlLFb9DgU
.thegimp.fr/	1970-01-20 15:22:40	Name: __utma Value: 226517848.2125498307.1633888171.1633888171.1633888171.1
.thegimp.fr/	1969-12-31 23:59:59	Name: __utmc Value: 226517848
.thegimp.fr/	1970-01-20 02:14:16	Name: __utmz Value: 226517848.1633888171.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.thegimp.fr/	1970-01-19 21:51:28	Name: __utmt Value: 1
.thegimp.fr/	1970-01-19 21:51:28	Name: __utmt_~1 Value: 1
.thegimp.fr/	1970-01-19 21:51:29	Name: __utmb Value: 226517848.2.10.1633888171
.thegimp.fr/	1970-01-20 07:13:04	Name: __gads Value: ID=bee085f7f03509fb-2265369ef0ca00dc:T=1633888171:RT=1633888171:S=ALNI_MZ1xz1wukyBnTwrxygETQQyGAMAhQ
.doubleclick.net/	1970-01-20 15:22:40	Name: IDE Value: AHWqTUlLRjQ-GVSGnt2RgQe_k5FaZtEux-8j-hN6Z1LwBuXqDHl6IUrwf-njSBmkTcg
.doubleclick.net/	1970-01-19 21:51:31	Name: DSID Value: NO_DATA
.adnxs.com/	1970-01-20 00:01:04	Name: anj Value: dTM7k!M41.D>6NRF']wIg2E>3mXX`w!]tbPl1M>e)ZlrFUfJ+tGXxoaU$lE.:<V!+?6ja0[i1]/KABapQ<8WS7q)tj%nugO%v4VB%nmje*%BTx
.adnxs.com/	1970-01-20 00:01:04	Name: uuid2 Value: 7164399170448496566
.casalemedia.com/	1970-01-20 00:01:04	Name: CMPS Value: 3188
.casalemedia.com/	1970-01-19 21:52:54	Name: CMST Value: YWMnrGFjJ6wA
.casalemedia.com/	1970-01-20 06:37:04	Name: CMRUM3 Value: 2d616327ac2760CAESEC2bSXnOujPrJTABHZCEUj8
.casalemedia.com/	1970-01-20 06:37:04	Name: CMID Value: YWMnrJJehmCgJMZp25aSWwAA
.casalemedia.com/	1970-01-20 00:01:04	Name: CMPRO Value: 1181

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://www.thegimp.fr/(Line 1) Message: Mixed Content: The page at 'https://www.thegimp.fr/' was loaded over HTTPS, but requested an insecure element 'http://www.easycommander.com/img/favicon.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	URL: https://www.thegimp.fr/ Message: Mixed Content: The page at 'https://www.thegimp.fr/' was loaded over HTTPS, but requested an insecure script 'http://pagead2.googlesyndication.com/pagead/show_ads.js'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://www.thegimp.fr/ Message: Mixed Content: The page at 'https://www.thegimp.fr/' was loaded over HTTPS, but requested an insecure script 'http://s7.addthis.com/js/200/addthis_widget.js'. This request has been blocked; the content must be served over HTTPS.
security	warning	URL: https://www.thegimp.fr/ Message: Mixed Content: The page at 'https://www.thegimp.fr/' was loaded over HTTPS, but requested an insecure element 'http://www.easycommander.com/img/favicon.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
javascript	warning	URL: https://www.thegimp.fr/(Line 305) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ssl.google-analytics.com/ga.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.thegimp.fr/(Line 305) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ssl.google-analytics.com/ga.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.thegimp.fr/(Line 315) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ssl.google-analytics.com/ga.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.thegimp.fr/(Line 315) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ssl.google-analytics.com/ga.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
apis.google.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
pagead2.googlesyndication.com
partner.googleadservices.com
s0.2mdn.net
s7.addthis.com
ssl.google-analytics.com
tpc.googlesyndication.com
www.easycommander.com
www.google.com
www.googletagservices.com
www.gstatic.com
www.thegimp.fr
pagead2.googlesyndication.com
s7.addthis.com
104.16.18.94
142.250.181.226
142.250.185.164
142.250.185.168
142.250.185.194
142.250.185.195
142.250.185.226
142.250.185.234
142.250.185.66
142.250.185.70
142.250.186.110
142.250.186.34
142.250.186.35
172.217.18.97
185.33.221.90
2.21.17.14
213.186.33.2
07071c90dd3c06ab4617213c0a7c21df43689ab7a64e03864af1dccc4f81a04f
09e713d454197ae2595b33c1c348a87377f62ec048e4089aa19fce9c6df98771
0b4cc12ccd09adacbf7695b7ae68d146a6b9bfa7a2058dbd4e58f31c14ec5e7e
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0db37cb5ed219162f4c1ed1b5f41f80774539216c9231a12270d0134688cd640
0f0ce648ea1b5faec971bbdac56ea40e5250f6ca85a0002a8a07f8a272deb64c
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
128e00f73e558e2af3acde1cc54c719f71803f51aa4fc5f9086bea6997b01edd
13e183edb5256c2eedeae5900baf0415fbc5e02e0f3ede809931d60666057fe4
174ba958ca59b0797146859b55bd2d3df7b9a1fe3c3fcb510a4b24dae3d46a1c
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
193ddff54438442c762c9720df54f159c9d40a46fee7c0969d30cde685d06d13
19f362b8270f24033bb3822bc08eeee3f431c8e2ad0c2e33cbf83bfbc8f70dc6
1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d
1e58ae72fdc6ace4f2f82a0b627902a2f1b86db0c97180ed2dd449932bdefe75
1ea4436f58dfee0b4498e04dc5b5fdd9edc379f49092ef4eff7a6ff8970122f3
24fa0ccbcb12952cd6d03deaedd6f968e61968a9d93765901c1fd8fd49e0b157
2a010828e3fbdef5966918ac3fbe3e634e618c827e619e9e64c350a823fe602a
2c4293997c3d3617d95a0a7c1b50ade28d236ba0786d66e3d33a4afadd784182
2cc69f1fd4bbd358cad9152802d616d0d8886fe4875c6c738c0c14b694cf72ae
2df1e67459f1d7eda2c4c5af7e07c73f911f6c898f3d061d8f3e9a32ad63fe31
2ecc45ef1d382035c1367ab078ad6f52bae305feaa6dc5ac2c17908d8f7e2a55
2fec39b2741a618c1ee273eb5109850ddee3c6dcd3c7f830c173c3cd12edf05a
329cc81eab63122ade7bcc69e9d2fb09068f804dd8084f4ca241a4715463242b
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
3a9d21d68e1b2c04efe067a4c3cef02c886e221937994810d4f5cb5525545e99
3d1246d2fe982f57c0a911530b2fa93a679e42c0d897151f39cffa4762c55f5d
456ab1a71507ed91abae14c9d08faffb373a7bc711a66e44341b7b8b7bb72ab4
462d8dd38077886b5369748ca71069dba9865eb2fa6bc22c608daed91384506b
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4dbcdf350709e1d65c3e10470d7fb528866688b64c36cad124bed85a537b13bc
4ee750477e19621c8e85783d47c22bac97e1866ea1969a5f06d5c301ef2b160a
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
5120f35e394e169ac0839405dbd6e680163a4e02f060f5a6a833ebfacf35d966
51896cb4e932803b983cf59d85b20c705f42a891fa0c9c408e3cb267b5bb949c
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
6500bd4cd278cdd0e00b473891ec40860e4dde8e5a7f02ab1d2ad6e30dfb0ce4
66fd760cc70fedce8741713f9c3beca1582e88e7e3d0f585bb07f3166f89cd09
677cdfd3f90bb4ed80611c63d0517e15725b9f87fb28338bc075870a900c8fa2
67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab
6f379d66d0fac0f93548871ae54d5273ac2637f44fb1c4a9c3edf4a8fba08e5b
706fe44137e1a2ffee5e35cc88317027decf1b8c630197e1a2d616cc4e67249e
82a08ec3d30b6463635243a96801b3d6c194b2a7e247fdf5e5bcb0cd41c0665b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
835028b83e76f77bfd87a4baebdfc603c9c6ee55516af930d3fe75f463a4ff3d
8427cab0fd9efbeaed1fa2377dadc2e2a89aaf60aa6a888e3b1db382c6453839
8db4fb2f786d9fe30223f0ef15d76bc88f6da6a13aa2fd446022c430696e2e2e
8df3faf208906f6cac37199c28b330d7672ac51aec03298822b9dac4c116bad0
9d4b879e7fb9539f59e30a0c8b0fe2fa020c99e58caa9a7e616d459a5e017e03
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a046ab3920b517dd0276090ef75b7c18de4301538fe1562c5144e50c4552f844
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4be1b49356308cc3808653f386bfa67264efd252362c690a6b0de75538a6dc3
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a92ed2c37ede90cdc2e756dcb4f255999f3d0ce688b767c0ab12bbd46c65c921
a9feb2844d245e7bd95681cf923345ab84b39157593a0fd9cfddf92e99fae8f9
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
ab79f20c51a2afc5bfd43cc8f688ac4708fa6a4495c30405e75b11e8246f6aba
ac5cb763f5965a515ebce985064a978d70d5ec46b1faaae408e3a61e40d18eae
af4c6683814aa527caf53bde3d021e6aafe00833b45f2dead043c87ed7864674
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b553178e7570cddd887449ce86817e1b977881c46048d04b3abc32def4adc2e7
becadbd507adae917ccd1498c88f26a85a348c349c45471af0cf23529b424c70
c05d6f17aa147a79f4ee09f7cb8fe2b037a90b2cd13619d194da9cc642498616
c41b97f23e59bb8ee559591c311c5014e2b839614176280030ad77c9d7358839
c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f
c90ed31c95e1a425d9cb4ef1ddf86cb026aff41efe14b9620a464601fb192324
cb50543ea98a767ec78df733a059f1cc6999d813694d21d22a6e35c28bbc931a
cd1aa1b17ad107887c38eedf2e24ab209a184dfd3abdae3484d36e10d74cbbb2
cd8d0ffcf6236ed535ea7d6a086b468477ac11433bb2376212bac55ef0ac20f2
cf4aa82a277dcc9151be7cad6bec03563daf4ac182b606f652b6265fdd010157
cf927a27d0dc6c1badc04f8d25e436d76213d91267a068613229493e58c65cc7
d375b958c605f2c7d6fdc81e3be171709da862eedcd0bb078336446a411e7a48
d4d56abcb8521ee277e7ed0a204ef9ce8ead2c42f33f1db089146fb96164c735
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e59f39fd9be6b3737942676248d273b23f94ab60f7b7e608230d6a107dccb7ac
e96cb07afdac92a8c77fbd5b9bb721e548070f4657f4f1e71329d2fd9032be47
ed34118646072361d7456861a2a67dc23a9666e1df865b936d60a3637941dafa
ed95149794e5ca06c633c9ba387ac75fd0f0e2007691386357db86edb284aa4f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fb9268e99659f17a183de7aa0d4e27453f96c159a7ba99d6482522f8f72d1009

www.thegimp.fr Open in urlscan Pro 213.186.33.2 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

123 Requests

76 %HTTPS

0 %IPv6

15 Domains

21 Subdomains

18 IPs

5 Countries

1017 kBTransfer

2437 kBSize

17 Cookies

18 Outgoing links

Redirected requests

123 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.thegimp.fr Open in urlscan Pro
213.186.33.2 Public Scan

Screenshot
Live screenshot

Full Image

123
Requests

76 %
HTTPS

0 %
IPv6

15
Domains

21
Subdomains

18
IPs

5
Countries

1017 kB
Transfer

2437 kB
Size

17
Cookies

123 HTTP transactions
3 data transactions