sharemods.com Open in urlscan Pro
172.67.73.233 Public Scan

ns3203177.ip-141-95-33.eu

Software

nginx/1.21.3 /

Resource Hash

983775b438c242df7cb0ceb87bd2582f96ff0d4e8043f822adf3a3e93261b9a8

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:45 GMT
an-x-request-uuid: ce5420b2-de86-400a-ac68-a6cb68b6a042
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://sharemods.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.7.108; 80.255.7.108; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 48
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ 2 KB
2 KB 173ms
81ms XHR
application/json 185.106.140.18
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: c1fcd901224cfd2a7b5d9c6accea18ca25e7e402b20c730a97415f341e4fde98

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sun, 30 Jul 2023 17:07:45 GMT
Server: nginx
X-Prebid: pbs-go/unknown
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://sharemods.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1836
Expires: 0

POST
H2 204 ortb Show response
bid.contextweb.com/header/ 0
191 B 186ms
43ms XHR
text/plain 208.93.169.131
WEBMD-IDC1-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.contextweb.com/header/ortb?src=prebid

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/3928

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

208.93.169.131 , United States, ASN46244 (WEBMD-IDC1-AS, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://sharemods.com
access-control-expose-headers: Access-Control-Allow-Origin
strict-transport-security: max-age=15768000
access-control-allow-credentials: true
x-no-bid-reason: Passback by decision

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
192 B 185ms
71ms XHR
text/plain 2a02:2638:d::a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.6.0&cb=22553235179

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/3928

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://sharemods.com
date: Sun, 30 Jul 2023 17:07:44 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
176 B 142ms
43ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://sharemods.com
date: Sun, 30 Jul 2023 17:07:45 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
169 B 140ms
42ms XHR
text/plain 147.75.84.158
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.84.158 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

x-nbr: 8
date: Sun, 30 Jul 2023 17:07:44 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://sharemods.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1

POST v1
prg.smartadserver.com/prebid/ 0
0

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 171 B
556 B 500ms
132ms XHR
application/json 185.86.139.96
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.96 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 8b9b81833890ca4d17a848f43d9e0a2f9901c114841bfda055c7b0855c8ba861

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:44 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://sharemods.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

POST v1
prg.smartadserver.com/prebid/ 0
0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 507 B
2 KB 144ms
44ms XHR
application/json 2602:803:c003:200::61
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=13606&site_id=154926&zone_id=1969856&size_id=2%3B15%3B15&alt_size_ids=55%2C57%3B2%2C16%2C57%3B2%2C16%2C57&rf=https%3A%2F%2Fsharemods.com%2Fgg9zios3hjxy%2FWeMod_Premium.zip.html&tk_flint=pbjs_lite_v6.6.0&x_source.tid=1f344ad4-2151-4c1a-a205-022b31fc8b83%3Bd9e72b1e-7a1b-48bd-9220-d176ba25f6df%3Ba8e89985-b71d-4787-8219-f9b40a4ec426&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=3&rand=0.5614001984000172
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 389b0e57a8df0181d9187bd6a9e597b601f93302368733721d46ea08bcd32ab1

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:45 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://sharemods.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 536 B
885 B 237ms
132ms XHR
application/json 185.255.84.150
IGUANE-

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fsharemods.com%2Fgg9zios3hjxy%2FWeMod_Premium.zip.html&PublisherDomain=https%3A%2F%2Fsharemods.com

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/3928

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.255.84.150 , France, ASN200271 (IGUANE-, FR),

Reverse DNS

Software

ayl-lb-fra02 /

Resource Hash

8f9cf1d8fcd8666b42ee4455fe38828413d150f5f90ba3ad514fb2016033015b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:44 GMT
x-content-type-options: nosniff
server: ayl-lb-fra02
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://sharemods.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 83
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
content-length: 536
expires: 0

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
334 B 173ms
55ms XHR
application/json 18.200.105.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.200.105.34 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-105-34.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: c4ce3639d01555a6234b16161e48a81f4e5ae578fa2f4be2f6b3fb98017480f9

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:45 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://sharemods.com
cache-control: no-cache
x-server: 10.45.28.191
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fsharemods.com%2Fgg9zios3hjxy%2FWeMod_Premium.zip.html&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fsharemods.com%2Fgg9zios3hjxy%2FWeMod_Premium.zip.html&rid=esp&cc=1

85 B
204 B

152ms
152ms

Fetch
application/json

34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fsharemods.com%2Fgg9zios3hjxy%2FWeMod_Premium.zip.html&rid=esp&cc=1
Requested by: Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html
Protocol: H2
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: f1a8cd06cfbfb8d8b09e1ec3108764afd4c134144f5e77c49dcac0e303900770

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:45 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-7X4qc3djbTcEPCXQVdSiqDgw3jQ"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://sharemods.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Sun, 30 Jul 2023 17:07:45 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://sharemods.com
location: /esp?url=https%3A%2F%2Fsharemods.com%2Fgg9zios3hjxy%2FWeMod_Premium.zip.html&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1 204 increment Show response
id5-sync.com/api/esp/ 0
322 B 183ms
42ms XHR
text/plain 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://sharemods.com
date: Sun, 30 Jul 2023 17:07:44 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 40ms
40ms XHR
application/json 108.138.1.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fsharemods.com&pubid=d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.1.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-1-25.fra56.r.cloudfront.net
Software: Server /
Resource Hash: dad72ba1ea49fc0e2b309554b5212343e2f691ed8eb2b32df21d11a6d36356d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 14:40:33 GMT
via: 1.1 6278ee254a7d35c23aae5e936b5a56ee.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P6
age: 8831
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://sharemods.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 3623
x-amz-cf-id: gbAJcMfepy41cIiND87urVmvGU62iH1cTxb09aCcoUQkv8MDEAcjyg==

GET
H2 200 %7B%22_tl%22%3A%22aps-tag%22%2C%22_type%22%3A%22featureUsage%22%2C%22src%22%3A%22kraken%22%2C%22pubid%22%3A%22d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac%22%2C%22p%22%3A%5B%7B%22cat%22%3A%22log%252Flibrar... Show response
aax.amazon-adsystem.com/x/px/p/PH/ 43 B
415 B 172ms
68ms Fetch
image/gif 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/x/px/p/PH/%7B%22_tl%22%3A%22aps-tag%22%2C%22_type%22%3A%22featureUsage%22%2C%22src%22%3A%22kraken%22%2C%22pubid%22%3A%22d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac%22%2C%22p%22%3A%5B%7B%22cat%22%3A%22log%252Flibrary%252FdidError%22%2C%22feat%22%3A%22started%22%7D%5D%2C%22u%22%3A%22https%253A%252F%252Fsharemods.com%252Fgg9zios3hjxy%252FWeMod_Premium.zip.html%22%2C%22lv%22%3A%2223.725.1446%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:45 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 10f3c0984ab3eaba3e5720ed830a77b6.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: GMXGC2AH302G5A02VR1H
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: no-cache
content-length: 43
x-amz-cf-id: KXuqO_4bFgldbjPdDqhLcoDOaVonolMlEC6qJEmw2zZafv_8GGgHWQ==

GET
H2 200 %7B%22_tl%22%3A%22aps-tag%22%2C%22_type%22%3A%22featureUsage%22%2C%22src%22%3A%22kraken%22%2C%22pubid%22%3A%22d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac%22%2C%22p%22%3A%5B%7B%22cat%22%3A%22log%252Flibrar... Show response
aax.amazon-adsystem.com/x/px/p/PH/ 43 B
417 B 164ms
65ms Fetch
image/gif 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/x/px/p/PH/%7B%22_tl%22%3A%22aps-tag%22%2C%22_type%22%3A%22featureUsage%22%2C%22src%22%3A%22kraken%22%2C%22pubid%22%3A%22d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac%22%2C%22p%22%3A%5B%7B%22cat%22%3A%22log%252Flibrary%252FdidUseFeature%22%2C%22feat%22%3A%22started%22%7D%5D%2C%22u%22%3A%22https%253A%252F%252Fsharemods.com%252Fgg9zios3hjxy%252FWeMod_Premium.zip.html%22%2C%22lv%22%3A%2223.725.1446%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:45 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 10f3c0984ab3eaba3e5720ed830a77b6.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: 60PB9V9R5DJTY6HJF4W3
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: no-cache
content-length: 43
x-amz-cf-id: wry2YCl42cJP237qoVGPNcOCzwSmWPRcQo4pBRx98HLtEB_ZQrDRnQ==

GET
H2 200 %7B%22_tl%22%3A%22aps-tag%22%2C%22_type%22%3A%22featureUsage%22%2C%22src%22%3A%22kraken%22%2C%22pubid%22%3A%22d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac%22%2C%22p%22%3A%5B%7B%22cat%22%3A%22log%252Flibrar... Show response
aax.amazon-adsystem.com/x/px/p/PH/ 43 B
416 B 165ms
72ms Fetch
image/gif 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/x/px/p/PH/%7B%22_tl%22%3A%22aps-tag%22%2C%22_type%22%3A%22featureUsage%22%2C%22src%22%3A%22kraken%22%2C%22pubid%22%3A%22d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac%22%2C%22p%22%3A%5B%7B%22cat%22%3A%22log%252Flibrary%252FdidUseFeature%22%2C%22feat%22%3A%22started%22%7D%5D%2C%22u%22%3A%22https%253A%252F%252Fsharemods.com%252Fgg9zios3hjxy%252FWeMod_Premium.zip.html%22%2C%22lv%22%3A%2223.725.1446%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:45 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 10f3c0984ab3eaba3e5720ed830a77b6.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: XE8SPQA2HAB46Q8QCBJN
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: no-cache
content-length: 43
x-amz-cf-id: N2uAqDtYPoftFIvJ_GwOekAWNQuIpU9QcIAChF13MUkCXECIae5_DQ==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
462 B 170ms
80ms XHR
text/javascript 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fsharemods.com%2Fgg9zios3hjxy%2FWeMod_Premium.zip.html&pid=a4ZL4DJ7onwBR&cb=0&ws=1600x1200&v=23.725.1446&t=500&slots=%5B%7B%22sd%22%3A%22sharemods_com_980x250%22%2C%22s%22%3A%5B%22970x250%22%2C%22728x90%22%2C%22970x90%22%2C%22980x200%22%2C%22980x250%22%5D%2C%22sn%22%3A%22%2F147246189%2C21696195204%2Fsharemods.com_980x250%22%7D%2C%7B%22sd%22%3A%22sharemods_com_970x250_2%22%2C%22s%22%3A%5B%22970x250%22%2C%22728x90%22%2C%22980x200%22%2C%22336x280%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F147246189%2C21696195204%2Fsharemods.com_970x250_2%22%7D%2C%7B%22sd%22%3A%22sharemods_com_970x250_3%22%2C%22s%22%3A%5B%22970x250%22%2C%22980x200%22%2C%22728x90%22%2C%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F147246189%2C21696195204%2Fsharemods.com_970x250_3%22%7D%5D&pubid=d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:45 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 2ba7b49ec4c4de4e67297e603c89a5e4.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: AQ2W5YHHFXS255ZW6VJ4
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://sharemods.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: w7pJ6PH5uixMAfxY_kORom3VeLCNelSD9mo2IPNt4Gk2Z8AzXa6jzg==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 183ms
103ms XHR
application/javascript 108.138.1.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.1.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-1-25.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-version-id: rBtfgJUMGYsy5fZuQwMAU7hSD.fVdF76
content-encoding: gzip
via: 1.1 6278ee254a7d35c23aae5e936b5a56ee.cloudfront.net (CloudFront)
date: Sun, 30 Jul 2023 01:25:00 GMT
x-amz-cf-pop: FRA56-P6
age: 56572
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Sat, 24 Jun 2023 09:19:11 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: E66ZypUPjHMvZtEXyFTADiPuu_oQa4s-pXlq0g_coKoqNKMk5h4YWQ==

GET
H2 200 %7B%22_tl%22%3A%22aps-tag%22%2C%22_type%22%3A%22featureUsage%22%2C%22src%22%3A%22kraken%22%2C%22pubid%22%3A%22d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac%22%2C%22p%22%3A%5B%7B%22cat%22%3A%22log%252Flibrar... Show response
aax.amazon-adsystem.com/x/px/p/PH/ 43 B
417 B 164ms
77ms Fetch
image/gif 52.222.239.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/x/px/p/PH/%7B%22_tl%22%3A%22aps-tag%22%2C%22_type%22%3A%22featureUsage%22%2C%22src%22%3A%22kraken%22%2C%22pubid%22%3A%22d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac%22%2C%22p%22%3A%5B%7B%22cat%22%3A%22log%252Flibrary%252FdidUseFeature%22%2C%22feat%22%3A%22cancelled%22%7D%5D%2C%22u%22%3A%22https%253A%252F%252Fsharemods.com%252Fgg9zios3hjxy%252FWeMod_Premium.zip.html%22%2C%22lv%22%3A%2223.725.1446%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.239.116 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:45 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 10f3c0984ab3eaba3e5720ed830a77b6.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P4
x-amz-rid: 6SC69S3B3TF8SWQXFMXV
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: no-cache
content-length: 43
x-amz-cf-id: 5wvf9RvPcNYq_y9NRwmrQDljWnksBlRQBEHtp0DQODKpS27-mOeMLQ==

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
361 B 58ms
57ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 4728156736da0a0463df65596ab575f7a8668c9ead331f7b4523135209dae346

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 30 Jul 2023 17:07:45 GMT
via: 1.1 google, 1.1 google
server: Google Frontend
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: 91a3c44df01aef09571d01f5c9cc8475
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265

OPTIONS
H2 200 encrypt
esp.rtbhouse.com/ Frame 0
0 146ms
58ms Preflight
text/plain 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://sharemods.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST, GET
access-control-allow-origin: https://sharemods.com
access-control-max-age: 600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
content-type: text/plain; charset=utf-8
date: Sun, 30 Jul 2023 17:07:45 GMT
server: Google Frontend
vary: Origin
via: 1.1 google, 1.1 google
x-cloud-trace-context: 4f792678e51d4a6287e6ef5dcd9cb7d3

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 133ms
44ms Script
application/javascript 184.30.211.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.211.26 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-211-26.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:45 GMT
content-encoding: gzip
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
server: Apache
etag: "38c0-5e92054540ea5-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 5252
expires: Sun, 30 Jul 2023 17:22:45 GMT

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 132ms
44ms Script
application/javascript 184.30.211.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.211.26 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-211-26.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:45 GMT
content-encoding: gzip
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
server: Apache
etag: "d734-5f2f3919e751f-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17407
expires: Sun, 30 Jul 2023 17:22:45 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 38 KB
12 KB 43ms
43ms Script
text/javascript 65.9.66.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-68.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6e91aaec2cb3510b97bb0655abdb08942dbefd617b169d0cd97b23fc48e68b2b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 02:25:57 GMT
content-encoding: gzip
via: 1.1 afcdbc9d4d397c4a65e6b312552ff7ee.cloudfront.net (CloudFront)
last-modified: Wed, 31 May 2023 20:34:15 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 52909
x-amz-server-side-encryption: AES256
etag: W/"560498a44e7d42477433425cdafd6a16"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: SuQdfAtjkX5Qntacr7ok89TpLCcHz-tWi_PJuVoNr_b5JrP-DXfsZA==

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 55 KB
10 KB 147ms
53ms Script
application/javascript 2606:4700:10::ac43:246e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fsharemods.com%2Fgg9zios3hjxy%2FWeMod_Premium.zip.html&ref=&_it=amazon&partner_id=533
Requested by: Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:246e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9e9d6c9d3b76ddbbaf7cd44bbcb5e7c0eb9cdb69bb4c3895117f2341474b75f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:45 GMT
content-encoding: gzip
cf-cache-status: HIT
cf-bgj: minify
last-modified: Mon, 22 May 2023 16:51:11 GMT
server: cloudflare
x-amz-request-id: D9H0BKD49BT4VXPH
age: 2199
etag: W/"82b3b53182a6a8dbe6684806275e839a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 7eef331f5fc31c24-FRA
x-amz-id-2: NYMqTPppEBiG4bbM2+rgByDV6NSeJDUeioacPP/TyAP0fbAmvOO4RCVRrzA/p/xpSBZuJnb15Hs=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 101 KB
25 KB 49ms
49ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd08be9cbf5f35486ce3011abc8286e9e2f59ac1de1ff9840377332383263f19

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:45 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 22 Jun 2023 08:35:03 GMT
server: cloudflare
x-amz-request-id: BD40DJT7KN67EDSE
age: 3523
etag: W/"bb626f116ff54963039a9ea05c53620b"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7eef331ec9a4901c-FRA
x-amz-id-2: BXq2klHOlDwCQitMv5cAqNz27G3QILBAm+E5fpwK1vk8nK0iqTKXMrSNSyhsQlr93LqAyyqiSSk=

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
333 B 55ms
54ms XHR
application/json 18.200.105.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.200.105.34 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-105-34.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: e87d7270e464b250ec9c314fdae04cd98f86032cff85916f2f6937b6d3aa234a

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:45 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://sharemods.com
cache-control: no-cache
x-server: 10.45.31.100
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 98 B
287 B 147ms
147ms XHR
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=533&sync=0&domain=sharemods.com&url=https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fsharemods.com%2Fgg9zios3hjxy%2FWeMod_Premium.zip.html&ref=&_it=amazon&partner_id=533
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c0fbf870cdc01d0a6280eaa1ed2f2ae04f4d09bdac39bd094798c6fb6ad2c0d1

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 30 Jul 2023 17:07:45 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
content-type: application/json
access-control-allow-origin: *
cache-control: private,max-age=30
access-control-allow-credentials: true
debug: NON-OPTIONS
access-control-allow-headers: authorization
cf-ray: 7eef3322cbb537cb-FRA

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 485ms
148ms Preflight
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=533&sync=0&domain=sharemods.com&url=https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://sharemods.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 7eef3321da3f37cb-FRA
content-length: 0
content-type: application/json
date: Sun, 30 Jul 2023 17:07:45 GMT
debug: OPTIONS block
expires: Mon, 29 Jul 2024 17:07:45 GMT
server: cloudflare

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 40ms
40ms Script
application/javascript 184.30.211.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.211.26 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-211-26.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:45 GMT
content-encoding: gzip
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
server: Apache
etag: "c4b6-5e920545406d3-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17042
expires: Sun, 30 Jul 2023 17:22:45 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame EEC8 15 KB
6 KB 54ms
54ms Document
text/html 2a02:2638:d::d
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=sharemods.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::d , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

645709dcb09b2700fd5a5938dbdf783ac90a88334e5104041db53302441f33e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 30 Jul 2023 17:07:44 GMT
server: Kestrel
server-processing-duration-in-ticks: 300453
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
397 B 163ms
43ms XHR
application/json 2a02:fa8:8806:13::1460
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:fa8:8806:13::1460 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:45 GMT
server: nginx
vary: Origin
content-type: application/json
access-control-allow-origin: https://sharemods.com
cache-control: max-age=1800
access-control-allow-credentials: true
content-length: 190
expires: Sun, 30 Jul 2023 17:37:45 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame EEC8
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=sharemods.com&sn=ChromeSyncframe&so=0&topUrl=sharemods.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=FYYuHXxxdmhOMzRVbldOeFNTRTJ4UVdwZVNnN21WUlZFOW8va21xMFlwRDNqWmF1M3l2a1I0SjVZaTdZb04xcTRUUVVEa2VKUktZUVE4OGIwTDBGaGJEcXN3STNndnZFYitLbXlhN3BaTHRqMEEvaGpnTmJRbHd4TDlidE...

428 B
655 B

158ms
51ms

Fetch
application/json

178.250.7.13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=FYYuHXxxdmhOMzRVbldOeFNTRTJ4UVdwZVNnN21WUlZFOW8va21xMFlwRDNqWmF1M3l2a1I0SjVZaTdZb04xcTRUUVVEa2VKUktZUVE4OGIwTDBGaGJEcXN3STNndnZFYitLbXlhN3BaTHRqMEEvaGpnTmJRbHd4TDlidEhZRGNCd0d6TjM4MUtRanBlWkJ0eVRSbVVab2hDY1ZvVmNQY1VjbzFPRkhOUld3LzFjUkE1RSt2RGpuOUZaZ1dqc1BKY3FvK3F2UXhLYzF2YnUzWHhlNFdySTN2ZU1RMFdDUkM2ZlBnZ09tRXErZnZYKzIxMTQ4UERXWWpyYXJGUUhZYWtmL25hWmo5L1BCY1IwaWozVlV4cVFMNW0vZz09fA&cppv=2

Protocol

Server

178.250.7.13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

3ffb32a20c67dd902983357289476eec47438e55523edf4edc49e85d44c07f5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:44 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1566225
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:44 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=FYYuHXxxdmhOMzRVbldOeFNTRTJ4UVdwZVNnN21WUlZFOW8va21xMFlwRDNqWmF1M3l2a1I0SjVZaTdZb04xcTRUUVVEa2VKUktZUVE4OGIwTDBGaGJEcXN3STNndnZFYitLbXlhN3BaTHRqMEEvaGpnTmJRbHd4TDlidEhZRGNCd0d6TjM4MUtRanBlWkJ0eVRSbVVab2hDY1ZvVmNQY1VjbzFPRkhOUld3LzFjUkE1RSt2RGpuOUZaZ1dqc1BKY3FvK3F2UXhLYzF2YnUzWHhlNFdySTN2ZU1RMFdDUkM2ZlBnZ09tRXErZnZYKzIxMTQ4UERXWWpyYXJGUUhZYWtmL25hWmo5L1BCY1IwaWozVlV4cVFMNW0vZz09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 235513
content-length: 0
expires: 0

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 207E 0
177 B 149ms
49ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Sun, 30 Jul 2023 17:07:45 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 233 KB
64 KB 1333ms
1333ms XHR
text/plain 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=121402910606901&correlator=3148772725373320&eid=31075148%2C21065725&output=ldjh&gdfp_req=1&vrg=202307250102&ptt=17&impl=fifs&iu_parts=147246189%3A21696195204%2Csharemods.com_970x250_2%2Csharemods.com_980x250%2Csharemods.com_970x250_3%2Csharemods.com_interstitial&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=970x250%7C728x90%7C980x200%7C336x280%7C300x250%2C970x250%7C728x90%7C970x90%7C980x200%7C980x250%2C970x250%7C728x90%7C980x200%7C336x280%7C300x250%2C1x1&ifi=1&adks=605329121%2C3771485005%2C1413971331%2C3462287164&didk=122412821~587753367~122412822~2009814026&sfv=1-0-40&ists=1&fas=0%2C0%2C0%2C8&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7C&eri=1&cust_params=origin%3Ddirect%26ECT%3D4g%26hb_rf%3D0&sc=1&cookie_enabled=1&abxe=1&dt=1690736865416&lmt=1690736865&adxs=315%2C220%2C315%2C-9&adys=587%2C339%2C669%2C-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C-1&ucis=1%7C2%7C3%7C4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fsharemods.com%2Fgg9zios3hjxy%2FWeMod_Premium.zip.html&frm=20&vis=1&psz=970x0%7C1160x0%7C970x0%7C0x-1&msz=970x0%7C1160x0%7C970x0%7C0x-1&fws=4%2C4%2C4%2C2&ohw=1600%2C1600%2C1600%2C0&ga_vid=332407107.1690736865&ga_sid=1690736865&ga_hid=358450589&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0dyUvpoxSABSAghkEhkKCnB1YmNpZC5vcmcY192UvpoxSABSAghqEu4BCghydGJob3VzZRLYAWlCK2kvNGJCUzB3Y0xZOXlmWVF3cENIdGxXaXVnQWJuWjg5V2d0dG9GSTR3Ym1nSnp6Q2hVNHVUbTlDMnFQaXI0NHFrRENGcWExajhQM3hTUUtES0I2QkRFUGlPQUFQcDNUMlB4QzJOcEtmTDZYemZXU3VsN3hRaEpIdlViREJhUkVUam1yNlJBRzMyOUFSaFhSenpobE5RVnNEcnAyTnV5TE55MWtLbDVhUWFKd3llUTNuT0RKQTk0SlZQVkdlWEw5Tmptb1hoSjhPWGY5T2xDSXFPQXc9PRj535S-mjFIABIdCg5lc3AuY3JpdGVvLmNvbRjR3JS-mjFIAFICCGQSGQoKdWlkYXBpLmNvbRjR3JS-mjFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pWkc5QmJVeHlTak5UVldWVVRGRnNSV1Y2V2s5WVVUMDlJbjA9GPTglL6aMUgAEhsKDGlkNS1zeW5jLmNvbRir35S-mjFIAFICCGo.&cbidsp=CqwDCAESHQoJYWRmb3JtUzJTEPoBIAM4AlIJYWRmb3JtUzJTEh8KCnJ1Ymljb25TMlMQ-gEgAzgCUgpydWJpY29uUzJTEhUKBmFkZm9ybRC3AiACUgZhZGZvcm0SFQoGb25ldGFnEJkBIAJSBm9uZXRhZxIZCghwdWJtYXRpYxCuASACUghwdWJtYXRpYxIZCghhcHBuZXh1cxCXASACUghhcHBuZXh1cxIdCgpsdXBvbm1lZGlhELEBIAJSCmx1cG9ubWVkaWESHQoKcHVsc2Vwb2ludBC8ASACUgpwdWxzZXBvaW50EhUKBmNyaXRlbxC7ASACUgZjcml0ZW8SGQoIcnRiaG91c2UQkQEgAlIIcnRiaG91c2USIwoNc21hcnRhZHNlcnZlchD0AyADUg1zbWFydGFkc2VydmVyEhcKB3J1Ymljb24QkwEgAlIHcnViaWNvbhIbCglhZHlvdWxpa2UQ7wEgAlIJYWR5b3VsaWtlGAIiJGQ5ZTcyYjFlLTdhMWItNDhiZC05MjIwLWQxNzZiYTI1ZjZkZioECAMgADIGdjYuNi4wQPoBSgA.~CqwDCAESHQoJYWRmb3JtUzJTEPoBIAM4AlIJYWRmb3JtUzJTEh8KCnJ1Ymljb25TMlMQ-gEgAzgCUgpydWJpY29uUzJTEhUKBmFkZm9ybRC3AiACUgZhZGZvcm0SFQoGb25ldGFnEJkBIAJSBm9uZXRhZxIZCghwdWJtYXRpYxCuASACUghwdWJtYXRpYxIZCghhcHBuZXh1cxCXASACUghhcHBuZXh1cxIdCgpsdXBvbm1lZGlhELEBIAJSCmx1cG9ubWVkaWESHQoKcHVsc2Vwb2ludBC8ASACUgpwdWxzZXBvaW50EhUKBmNyaXRlbxC7ASACUgZjcml0ZW8SGQoIcnRiaG91c2UQkQEgAlIIcnRiaG91c2USIwoNc21hcnRhZHNlcnZlchD0AyADUg1zbWFydGFkc2VydmVyEhcKB3J1Ymljb24QkwEgAlIHcnViaWNvbhIbCglhZHlvdWxpa2UQ7wEgAlIJYWR5b3VsaWtlGAIiJDFmMzQ0YWQ0LTIxNTEtNGMxYS1hMjA1LTAyMmIzMWZjOGI4MyoECAMgADIGdjYuNi4wQPoBSgA.~Cv8CCAESHwoKcnViaWNvblMyUxD6ASADOAJSCnJ1Ymljb25TMlMSFQoGYWRmb3JtELcCIAJSBmFkZm9ybRIVCgZvbmV0YWcQmQEgAlIGb25ldGFnEhkKCHB1Ym1hdGljEK4BIAJSCHB1Ym1hdGljEhkKCGFwcG5leHVzEJcBIAJSCGFwcG5leHVzEh0KCmx1cG9ubWVkaWEQsQEgAlIKbHVwb25tZWRpYRIVCgZjcml0ZW8QuwEgAlIGY3JpdGVvEhkKCHJ0YmhvdXNlEJEBIAJSCHJ0YmhvdXNlEg8KA2FteBCQASACUgNhbXgSIwoNc21hcnRhZHNlcnZlchD0AyADUg1zbWFydGFkc2VydmVyEhcKB3J1Ymljb24QkwEgAlIHcnViaWNvbhIbCglhZHlvdWxpa2UQ7wEgAlIJYWR5b3VsaWtlGAIiJGE4ZTg5OTg1LWI3MWQtNDc4Ny04MjE5LWY5YjQwYTRlYzQyNioECAMgADIGdjYuNi4wQPoBSgA.~&dlt=1690736864170&idt=657

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307250102/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

16d55451d82ebc32bd39381549a7db5c608714f1c1bd2c2f5f89057bf9553452

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:46 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65094
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://sharemods.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
12 KB 183ms
92ms XHR
application/json 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202307250102&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307250102/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

311d6c80f0b0f6d4fc9346e65c94812140ad1602a547fce67d8ba4e9b11dbefe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11826
x-xss-protection: 0

GET
H2 200 container.html Show response
9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 144C 6 KB
3 KB 162ms
47ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307250102/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Jul 2023 17:07:45 GMT
expires: Mon, 29 Jul 2024 17:07:45 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307250102/ 37 KB
13 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307250102/pubads_impl_page_level_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307250102/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f1f6a0eb0cb65da087a09348dcd1985769d431849ceb7087c9c52fe0e06edd3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 04:16:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46250
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13152
x-xss-protection: 0
server: cafe
etag: 13758367090610680476
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Mon, 29 Jul 2024 04:16:55 GMT

GET
H2 200 publishertag.prebid.117.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 65ms
65ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.117.js

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/3928

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

78cf7f92ec9841d3afea2c9db9cc22e4ff8acc52bee7060b50a28a71cb262093

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 06 Apr 2023 09:13:32 GMT
server: nginx
etag: W/"642e8d3c-15c1d"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 31 Jul 2023 17:07:45 GMT

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 197 KB
58 KB 43ms
43ms Script
application/javascript 184.30.211.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.211.26 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-211-26.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: bf5b5a4196e2df193d794a6e8b0228e41b49e6bcc4531179b8ed8d5293300586

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:45 GMT
content-encoding: gzip
last-modified: Thu, 13 Oct 2022 18:23:24 GMT
server: Apache
etag: "31332-5eaee9adb933b-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 59461
expires: Sun, 30 Jul 2023 17:22:45 GMT

GET
H2 200 ats.js Show response
ats.rlcdn.com/ 236 KB
78 KB 150ms
46ms Script
text/javascript 143.204.98.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ats.rlcdn.com/ats.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-71.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e820733377d4af31fd643ac9a24856e8f33ca799f97259e59c868302a513c874

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-version-id: L2Uqg18UIi_4fqt_LD1.VZwHoDyvOGyd
content-encoding: gzip
via: 1.1 fa5a3d5abd34c6fac657b045a4dcbdc4.cloudfront.net (CloudFront)
date: Sun, 30 Jul 2023 01:35:06 GMT
last-modified: Thu, 08 Jun 2023 08:56:13 GMT
server: AmazonS3
x-amz-cf-pop: FRA50-C1
age: 55960
x-amz-server-side-encryption: AES256
etag: W/"a23e5e8674928ef24c6825d63b8d2927"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: fHNFBGx666RthUgUN36Khx-J5AjTp-vsw4RLNnOnXy1DhvAEoUVbuw==

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 136ms
48ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307250102/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 30 Jul 2023 17:07:45 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 04C7 13 KB
5 KB 40ms
40ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 9345
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Jul 2023 14:32:00 GMT
expires: Mon, 29 Jul 2024 14:32:00 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame CB69 783 B
1 KB 137ms
50ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

4c5d0abe4432b8642c8ebec04957bd5b637f237ee49df81ce1346636deae0a89

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-wN9VN7BDdYuEKJhqJOsVww' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-wN9VN7BDdYuEKJhqJOsVww' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 30 Jul 2023 17:07:45 GMT
expires: Sun, 30 Jul 2023 17:07:45 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js Show response
pagead2.googlesyndication.com/bg/ Frame 04C7 37 KB
14 KB 120ms
39ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c471d1bf07ba5441702ad12d43d231b01425b440789f166b19307c5c6e5aede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 21:53:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69256
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14619
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 28 Jul 2024 21:53:29 GMT

GET
H2 200 533 Show response
a.ad.gt/api/v1/u/matches/ 11 KB
4 KB 154ms
55ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/533?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fsharemods.com%2Fgg9zios3hjxy%2FWeMod_Premium.zip.html&ref=&_it=amazon&partner_id=533
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 207c5e1770c52f0d4fa55514ab7f01520af9554d1e350cdc84d2ba832b2809ca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:45 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sun, 30 Jul 2023 17:05:24 GMT
server: cloudflare
age: 141
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cross-origin-resource-policy: cross-origin
cf-ray: 7eef33245fbabb7a-FRA

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame CB69 0
0 141ms
140ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202307250102&jk=121402910606901&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 04C7 0
10 B 39ms
39ms Image
text/plain 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?ChNOZQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:46 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 146ms
145ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202307250102&jk=121402910606901&bg=!2Nul24_NAAZGOVy5Zjk7ADkAdvg8WrROF-qV6A9kirkMwEA-cW0gA14AZh6G059PSMoUBvgOxlJuLPD1EWed9jqx0dGiH1CpZnQCAAAAUlIAAAAHaAEHCgABkpkCtCq37H63Ts-CYGhlYc53ZCCQQkO_p2numl6_BH9f-hFvW27bcf5mzfCPqPoWtWZHuzFv6Z1YN_c8MNyGCWmw-kjA1M_80Ma8aF4m53aOk8HLEFiPmyHeyNkf_mudEUD20rATKJqTYyI_6LG_DLP1TenGWv-wDY7rlNiOU9VKsQk6NknHo1hdOz2UlUBIOKLWR_dF97oCGSkGmX9yGiKyDVGCA2fgaNA58Td8qriBQlPrcCW370rBG3-a4Zjj9RLGJXBKym--YAMRrAalDAK24k99_HRIXVo_Zo0vgAosAfnCVU1LpxTpJ7SD-0CtAWwffcHMPU5Xl2j_ZshzTYI0jQmky_Z3Yd8hWpqIBVg9B_SZwxleyk27e9iNQSKsX3wCrwnVNFxRgtnrfvSkaPv3hKDWe3AerbVghhQSQuhmT66Wvx7gK05ZP7Qvu95TpA-QqEu1aukoCwq059VqpITD_il81Hdh-y_9sEoacmThskuMOOhVx1oyLGsmmiUXVlm05c7_sIa0wk35U-B5SZhSl5rkzZ_RsuhOM1sucXUpJGpxbXsxFLvcIMYaFwancBBuymRvhuH9ngssxjsf0cH3CEWQt3oLuSvxEWdbSWeDMt-gjWa240LD_mF24paI7vYOBYnCgzbKHvB5kUJiZ2zlMdeqTnvQYXNXsYU3GpNAyRzsme98GtcDnMNgDBKAkPzBxqAJOBsjxY5yWD95u5QO9BjlI4Zo_-DfypfDOv8TQJuBxdl86ugRzVYS1hE2Ome4Cg03pFxu_nRnOp2HQi3WuhYJoKWbOAsRIBF31UYr8fjT6vCdZMGezWAFt75vAQHL5Aiam1xxpVG4F-4212hXOR5i1VWz9Z3hJX3e4JOoJORMPqboleyvzrR9WKLxJJGqwKCyOW8u2KJHnQ9F4xPHGycwQ64i
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

GET
H2 200 container.html Show response
9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 2C94 6 KB
3 KB 40ms
39ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307250102/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Jul 2023 17:07:45 GMT
expires: Mon, 29 Jul 2024 17:07:45 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame F407 6 KB
3 KB 40ms
39ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307250102/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Jul 2023 17:07:45 GMT
expires: Mon, 29 Jul 2024 17:07:45 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 1C14 6 KB
3 KB 39ms
39ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307250102/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Jul 2023 17:07:45 GMT
expires: Mon, 29 Jul 2024 17:07:45 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 8917 6 KB
3 KB 39ms
39ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202307250102/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Jul 2023 17:07:45 GMT
expires: Mon, 29 Jul 2024 17:07:45 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4855 624 B
505 B 178ms
86ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGP3HqPEBMAE&v=APEucNW6zDE4Vg9FNb-DPrJU8NI77DSOEt0D5gdeOWysRVBgVBYF5oFKT8ufSVAxzgI5B868GYWKnim0fYqeCbmhybGj-E0KT8DnuYiUMkmliodpLPzlc0zPF89_HCtVoIfZKOqER8cvABkvHTO36vB6tfD6RmGF46dPClg8a__q36kJUzON0RfYt0u2d14FvYM2dZoWQ0gLZJ8Bw6LFq-RQFILjawunEQ

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Jul 2023 17:07:47 GMT
expires: Sun, 30 Jul 2023 17:07:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 2C94 85 KB
29 KB 86ms
85ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b5c05892bdce212e19d0503253b600faaeedca47fa2db97964d412c8c11934e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29781
x-xss-protection: 0
server: cafe
etag: 4315658989838864570
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 30 Jul 2023 17:07:46 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C94 42 B
63 B 74ms
73ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AnfXm7zj-vJKH4Guk2MNOUOOnyWCi2yJ9yIYj0kuo9Dz_bVf7FgrxAUzL_haMWnZ_aoAy1Qldl_jXZ-AL3msfG5Dtt2qnQgjxiq8kNlDYYGlghXrQ

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C94 0
20 B 75ms
73ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=6721952850924366855&x=1&ct=76

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/ Frame 2C94 3 KB
1 KB 42ms
40ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/window_focus_fy2021.js

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 14:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9346
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Aug 2023 14:32:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/ Frame 2C94 20 KB
8 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 03:48:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47956
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Aug 2023 03:48:30 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2C94 179 KB
57 KB 149ms
54ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b7d1e63e50218b22558bc94b9d37faac51551fcdb29a7390226a6669d24d8de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57355
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690371356542162"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 30 Jul 2023 17:07:46 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame FBD6 624 B
531 B 157ms
84ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGP3HqPEBMAE&v=APEucNUsK0CUVy3ozs4PU5Sw-GgDGVctgfebXnBtVyQTbF0ArC3wonUEixI1stlk5SEmYUCtbATmHnEI7LAdMDK9ENJiWdIKPN9MVvKO_ng21lxMkViosJCmL7jI3a4vSljiXNyVv7dzvKFVQIu5jKq5F9w-wwkIO4DNF5AJ9RJrKtZheSvahOWr7VPJPB5RY2CxbDUu5JlD5cbz5aLGUPnvzxUO_TdRdw

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Jul 2023 17:07:47 GMT
expires: Sun, 30 Jul 2023 17:07:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame F407 85 KB
29 KB 154ms
153ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b5c05892bdce212e19d0503253b600faaeedca47fa2db97964d412c8c11934e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29781
x-xss-protection: 0
server: cafe
etag: 4315658989838864570
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 30 Jul 2023 17:07:46 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F407 42 B
63 B 95ms
94ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DrX7pOIeUp76PCtMk7nrk_qAHJ5vRDbq3zyM31mEJIfbYZtvzJUjVNT8p1Q2fRBhmx7Bpatb4z0WFWz3Hguc4wfJDhm5ybR_pNrprHwZn24Tim-ws

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F407 0
20 B 95ms
94ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=7862646770765939418&x=1&ct=76

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/ Frame F407 3 KB
1 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/window_focus_fy2021.js

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 14:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9346
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Aug 2023 14:32:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/ Frame F407 20 KB
8 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 03:48:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47956
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Aug 2023 03:48:30 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F407 179 KB
56 KB 196ms
119ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b7d1e63e50218b22558bc94b9d37faac51551fcdb29a7390226a6669d24d8de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57355
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690371356542162"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 30 Jul 2023 17:07:46 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9205 624 B
829 B 138ms
82ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGKvBqPEBMAE&v=APEucNX2cZ3amsJIAFCnuPg0xk4WfJPmURltJj_1XSl8GPU64un93Gi0ACNtazt5yGovnK-Fo5n4Q1wdk8KBZ9BV_h1F4mVQOhBRc2eASZ5I0ZBKAPhRrIrhSZhg8qdcatyX-mpAznG3auL9v0TKfeK-fzbTsr84_vGQzIqp_C_m42yAbuApH78oQUdMKWaSyYQovizJ6BHHAMB33VYmELwXtZnApo3gdA

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Jul 2023 17:07:46 GMT
expires: Sun, 30 Jul 2023 17:07:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 1C14 85 KB
29 KB 140ms
140ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b5c05892bdce212e19d0503253b600faaeedca47fa2db97964d412c8c11934e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29781
x-xss-protection: 0
server: cafe
etag: 4315658989838864570
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 30 Jul 2023 17:07:46 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1C14 42 B
63 B 79ms
78ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DRSOVSq2RrO8EmZZgTzqlShOCdUhUuCI2H-Yl12MeT52CMre6-3PaRbazWZHM4dJnkvxP5zljHQT1EOa6zr3RK8rW9M9yeJirvzDv5w5rSb4Z0qx0

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1C14 0
20 B 79ms
78ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=6171422387587972245&x=1&ct=76

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/ Frame 1C14 3 KB
1 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/window_focus_fy2021.js

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 14:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9346
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Aug 2023 14:32:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/ Frame 1C14 20 KB
8 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 03:48:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47956
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Aug 2023 03:48:30 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1C14 179 KB
56 KB 188ms
129ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b7d1e63e50218b22558bc94b9d37faac51551fcdb29a7390226a6669d24d8de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57355
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690371356542162"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 30 Jul 2023 17:07:46 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame 8917 4 KB
770 B 51ms
51ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 30 Jul 2023 17:07:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 30 Jul 2023 15:46:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 30 Jul 2023 17:07:46 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame CF32 6 KB
781 B 50ms
49ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 30 Jul 2023 17:07:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 30 Jul 2023 15:54:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 30 Jul 2023 17:07:46 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/ Frame CF32 2 KB
892 B 40ms
40ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 22:55:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 65516
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 12 Aug 2023 22:55:50 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/ Frame CF32 23 KB
9 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/abg_lite_fy2021.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93028274da1d373cd41165f6a442568ddd482370e8093e45d14a4ad0f6981f19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 15:09:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7074
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9132
x-xss-protection: 0
server: cafe
etag: 17712579318771444318
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Aug 2023 15:09:52 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/ Frame CF32 3 KB
1 KB 65ms
65ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/window_focus_fy2021.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 14:32:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9346
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Aug 2023 14:32:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/ Frame CF32 20 KB
8 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecb4fb492aee0a820dfc4a395fb80e2ac2e864bbf38aa1ae28d6d70fb9e6da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 03:48:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47956
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8293
x-xss-protection: 0
server: cafe
etag: 11502554701003060455
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Aug 2023 03:48:30 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CF32 179 KB
56 KB 211ms
174ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b7d1e63e50218b22558bc94b9d37faac51551fcdb29a7390226a6669d24d8de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57355
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1690371356542162"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 30 Jul 2023 17:07:46 GMT

GET
H2 200 92cd137fb2ab4f826a326c70369c8a48.js Show response
www.gstatic.com/mysidia/ Frame CF32 33 KB
14 KB 132ms
39ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/92cd137fb2ab4f826a326c70369c8a48.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

541fb110d3896cc361dd08f655c22accc06bed9c580cc3367e3ef09deff5503d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 16:23:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 89043
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14171
x-xss-protection: 0
last-modified: Thu, 27 Jul 2023 20:56:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 27 Oct 2023 16:23:44 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230726/r20110914/elements/html/ Frame 8917 20 KB
8 KB 44ms
43ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230726/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6f4407e58a52926a78be27a8cdba65b8ccf8161463db84cee6cc81c7b7b1fb91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 15:22:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6301
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8601
x-xss-protection: 0
server: cafe
etag: 3714838898622182897
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Aug 2023 15:22:45 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 8917 205 B
520 B 137ms
50ms Image
image/png 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 18:33:35 GMT
x-content-type-options: nosniff
age: 81252
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 28 Jul 2024 18:33:35 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 8917 604 B
696 B 137ms
50ms Image
image/png 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 04:02:58 GMT
x-content-type-options: nosniff
age: 219889
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 27 Jul 2024 04:02:58 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C94 0
20 B 86ms
86ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5223638906202&version=m202306200101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C94 0
20 B 83ms
83ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5223638906202&version=m202306200101&ct=76&x=1&cor=6721952850924367000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2C94 106 KB
41 KB 82ms
81ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AhmVpKe0LWA4Xs3hi-Fq4UIXzhJSzEFZlPwU8cHjnAuSl4aKAfLoBP5vs1UDWYJd34kyrx_HpX3ImGBrerE5URX1sE6dRvSbgFlkelMqgqKP2lJrIOqcnsnKJKw0U-fj-6U4jMfMICIZk885OykbUXqxRMgbAJdvYm-5Zn4OcqJpSknfU&dbm_d=AKAmf-An0D-rqZzkwaHbVRMkn7UK2OHbhjGx4e4J9Gk2E7FvPZbC7BjdKJ_t96-45t1aVOmUX1QG9Z7C4NJ1UZMjUYK2912cOgknsaI0TdRraPhbh-ZQA8Ys0ZRhJ_gnngRJyLnJ4j4C68kIldWMTADNNW7pRM2a5RIaBIcAvccq5zTS68tTfUN1TSM8s2Ep3g1kEN9TOzk8iSXTD5O22A_PpXnKsd0k49s79tRHa86t3s07INi8FGEvcNlghs8Afuqsn0NDiBqHjAueAFYHHc1i4O038Y-xXUb5UGq9MNemt_RktVWjTJKVderE2wwNN_rPu4j2M0G3kK8A0GgEk0Y9C6zZC-mSLJkh8eahijFLUbybwKLFLJegH62prNPJ0sHEBJjEViRvHGOdQjlr9uE3L4sU4xZvIN1zJwQbH-d2Af0PZizw6oIugn-Qrur7gobYY32woasZGJXrCYItik9A6SAFWYqKSXuMa5H1TUt3zR90OVpvL29PX_p4AQFobM5KXC0reB9aAUeRkjcKEeeTk0LkZiL3pVn_0zRJEgkoWiIMxGCkdOPpaXN2W1sY6vShUr2I0h3xfNYw3QxSVrvy4kEWlVmdpxqD_rpCqpzE8j8eDvP0rOtlubT-L8OfIfeYm3zvuNNxo3f8ZNVPyAF0dg-3wUkkgC8MZOnrTeHT03iVFqRaFOR4LByygTSE6ZNQLGWDS4811EioDRs716KK2XDKz-AfmCCFYgqHXEe2V1Qv2UH6_vzCYS_GdqorZbOCTBteYREOO_l2MuRUXUV_HraxkhEgxGFF6gC5JKWEOTncZHE6DYSdnkEPRqHC3-_vsuGEpj1Pmwvs3DJh979GOBsSvilioLIegFC6dyo6vcd8FHkaF2LyhnSBFzm1vymvO2EsZIsYBNlmGSAd30uxmTQZ28x69BXDjRhXOSiyt9YV8hBmCx6r7CR_Oj3wNwmxuIbTDPkCxwDY7ur7Hlt4xAFEUT2urHs7vACZHiHaNUdkn05m8Z_0JjyzOKeJyuHp7b4wxCfWmKZT_UbkmdkWRnn5Qvs_1WcP9oHTkT7DCgUUHU8ncpEBzcdpzsbLZEIMz3xVXy8MtlgBGgYDg1_eNtMA8_nVl84NoSTMaxZbAl5IsQZc_94wEvEeY9Dhwg1B3OHtADQzrrWLuU6wvvKNXHvCU2om7Dh99vKRYEbFSmVVvhqgqdp2YJehZEvEB6mejSFHgU9p21fs8LVEEUuXmrWV8dUpJTrTzzAuNiERMBFFrDbFURJwfZ8WCvwNOWHmHykbdY5_cmQgwhN1HnFvvESf6exWyXwcKc1NdDyZz5naT8Vkv9seceTTA9Xz_PdvTxlkKhCa-QPRBNuutvd-3MLgWtl1pxWLNrHdk0gSqaCN25EysxTEykfZ3_MZ48TGsTSqVXmjSEBE2Pb9SMeQJ-B_YWvHIqsnYxQH6aSQVx-8hJ6kc2k0lLV2lf_hpUoldlHXBXpgSsrW19jxYn_n37LmcReZASB_XwudnX4rZ_AJ0MSf677VeOvcnT8ok_zP4SG4Nm5J14jSDdNRVp9nk6FoNb3JFlwphvZzOUAXEVlRgTX0-9ihO4Lmtd0pIe_uAarasAv9AfsSaq8CPStq8LPRPdzzoDVlCMzJPlbThCiQ1ZkVJpXP51993ZRHjRe1RJ1CV414Fb7hfCHhSbSDHfOdsN-NEtNDWmKyofDygzCUp4ctE0bepbxnLQnV1G6oD9Pp79-5g_vUKeB2f3-fRgZfQ7sMOkHEPhGkwhLAcK_Blk9vu9lcIE1G4NeRRLwhoJB-e-amgT4FfqXPhsAg5RDJ8CYl7HuX1_HREUKEnMgw_Y9I1DZHo8cTWoz2fuqpM_IENJK8y-u7jOlEmpIoF4fUQtYsvl-O3Vr_BA7X_AsY17oHPeQdSrGKMfxF2uu73FJnwCnQMbSzw8D9wFl-iIk8bHpRCo-EUk6ncx-rYH6SzUIVx4Ww23GDVEE-eDOTDXDqUuc094oh2cg_FW9nE2YwvNpDPFhNOkuXvqXG2KdelOc9yCVSn0mUF1wOj_2jzyyNDPwql3jQen8FnuL34bRxBaShhLKTHhOTgS0ZlQtXZsGysF3OKWEC3-OA8paE0Wp_HX3Yt2x6Ec5tl-sqpgfcSztb82AJoLv9y-qTaUj_lXBAwZOY2AxxjFTYtUYIxInu0EOl9RCd50p6ythv5U8ps2iTkUiB6AqtgJEQBOBlDiZ4Mn59tBlsMnWS0D1V4qojw4cGKfIx2yt96mwfCkkdJqE5RdLWOv8pgTE43giGwYSGvz3Ac2VvIOrVHliN23j2eqNk_QPpZshoLAcH8SOt99YYG2Cnsmhpb6g8LXfIkaqmp4DpV47fClWqcBjzoxNlp5U4Ur3hvAjHCgP4zM7uhw4J2X-3I1CZzi3FJnQU_EShOZChhdJXqjezDD7wvak-rOtkGSlOUFM7qRjLOZ4USZ5GpWaYZoKVjhLQqzXqATFrr-hz8OjGzF9e01WC-8hG6Irp5x6XkQtFm1oF5jZxiCuIbc_llqwrU3zFHAT8-TgpEKLdzcV473Qnic_c5y0QtrJKadZDtTlzmwB67gwCOc9pY7W4Q0z1Tt6E7M3Oihh9mW5RradiAQH2PENLW_moHqr3vXYc986TeRgetwGzyUO1DoDk_zYMXZb4br9tRVk459BgrmMi43kuyqyotrGQkakzti6zHpSGfOniyVDODqvRJ-3UrGSqPhNWlzioKVMNH1z4h72T914Hwa2gwlX8blbInWKwl2AkCxXjFOwbBHrzSb2Z-ne67SAiqjgdJltzD3A_kqjru4sFFzdpiopqp48Xf7l2-3Pdn79rfHv_R-JPDVJOoVtN1-5M-KJMYlNzeyf73N-eaUH2NQHYSkiiSmjGeNJALR1hNk1arMwTaNaMTIx2IC2ivdPXefzRpeA74oL4iUgnR3orsc11E5hdIDoLiWbWkGJDYB2XeKZYivGSCYDjIImB7KTkiZgU8jATEP4_0q_n1HwTzItAnidXxCghjdI3Ep1Lt1rdkD6gbTpLxrnvnadbe371XifenitTeaFFFraOBnBVJzvJlt1b_S-WjMrALohlje2_8HnJdLDjT1xp5erXrRmrOKX-tgZSJ8VYR3sllJlmPajc9XFITZ0QkL980tirxZQdAHa1Y-yjUHa9_XCMNsRp5V1ABvZHnRKYTVV1uJVVJkuLj_4foGA_PYGEVnbRi4p9AsXcMwr7LuDhNHPQeef0IIM7NwCAFMyWssLkgx_l31dH5GfvBSEVXwGAvTWbNMmat5gYxnAeZxcblvbhRRtdxOKi-1W4yPE4HRk-cPfpO4FvhRhJREOxL7kWwcpVGf9vO7szQ6210Pyhf9oCRNMUeHkgSA5KhYavnYu8TFyVvrvrapyH8afoobmxAPtH_hHMxaOHKzIAVH2B6btg7WB0Z6R4Cl0OX4oKpCj9Okw6Mmrn6BhE2TWMS6NO-9qmwgb-WtlYEEdpBoyEv9WjAwIWP8YLHrhQgYUNM0lmwkHMjb1QI4K-CQoyxp98Xoytg5XqB-qIJWlm-idqOfAqPOl9jWikUPdm-sa-IJrwpe4-Loqe6fQ0QoYwHDzWT9R5AIjHRm2qQSE_Nfw8QI60cYgBhHT5qB6wkCywO4_rkvQhaBIJunGWloRM_kKVi1nKRfDV1U2T-8cVKoiRDVpiGz9DpTocAtcM8v0fD-TjhzUji8DphSiLQvHP5Kcub8Nj_SZO6xlCOxNw-wU_1Nemd1Iwlr8D5K1DOib0iqlKX0VHIjbP0LOzbihEyMFTv_E35uChQ8aBWtIz4Q&cid=CAQSSwBpAlJWIA3oPO780tOTM3SzL4bf69lJGNK7gC8SSKBNGHbdUnjOmTdlnzKq0lYx1cfXjtAColwpPYveH_NC9Fr_rrhMzap4O8CFmRgB&dv3_ver=m202306200101&rfl=https%3A%2F%2Fsharemods.com%2F&ds=l&xdt=1&iif=1&cor=6721952850924367000&adk=2228999115&idt=114&cac=0&dtd=18

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c147cbdea4a4be7a06ee402be95d5d14bfb334fd0a8e26f94d1789bf20a37d4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41198
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9205
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAWU4TIQ-FwM1biInJ5SpD4&google_cver=1

43 B
766 B

42ms
41ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAWU4TIQ-FwM1biInJ5SpD4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGKvBqPEBMAE&v=APEucNX2cZ3amsJIAFCnuPg0xk4WfJPmURltJj_1XSl8GPU64un93Gi0ACNtazt5yGovnK-Fo5n4Q1wdk8KBZ9BV_h1F4mVQOhBRc2eASZ5I0ZBKAPhRrIrhSZhg8qdcatyX-mpAznG3auL9v0TKfeK-fzbTsr84_vGQzIqp_C_m42yAbuApH78oQUdMKWaSyYQovizJ6BHHAMB33VYmELwXtZnApo3gdA
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 30 Jul 2023 17:07:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAWU4TIQ-FwM1biInJ5SpD4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9205
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZMaY4zmEL-1Ww3MYU8TV3AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENuD_6y68cbMJLA1tGTHhFc&google_cver=1

43 B
632 B

41ms
41ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENuD_6y68cbMJLA1tGTHhFc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGKvBqPEBMAE&v=APEucNX2cZ3amsJIAFCnuPg0xk4WfJPmURltJj_1XSl8GPU64un93Gi0ACNtazt5yGovnK-Fo5n4Q1wdk8KBZ9BV_h1F4mVQOhBRc2eASZ5I0ZBKAPhRrIrhSZhg8qdcatyX-mpAznG3auL9v0TKfeK-fzbTsr84_vGQzIqp_C_m42yAbuApH78oQUdMKWaSyYQovizJ6BHHAMB33VYmELwXtZnApo3gdA
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 30 Jul 2023 17:07:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENuD_6y68cbMJLA1tGTHhFc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 9205
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGsqX_oCzt0FW6uwVwZ0nYE&google_cver=1

43 B
839 B

40ms
40ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGsqX_oCzt0FW6uwVwZ0nYE&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGKvBqPEBMAE&v=APEucNX2cZ3amsJIAFCnuPg0xk4WfJPmURltJj_1XSl8GPU64un93Gi0ACNtazt5yGovnK-Fo5n4Q1wdk8KBZ9BV_h1F4mVQOhBRc2eASZ5I0ZBKAPhRrIrhSZhg8qdcatyX-mpAznG3auL9v0TKfeK-fzbTsr84_vGQzIqp_C_m42yAbuApH78oQUdMKWaSyYQovizJ6BHHAMB33VYmELwXtZnApo3gdA

Protocol

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
an-x-request-uuid: ead68edd-e401-4040-b326-029878ac0ef4
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.7.108; 80.255.7.108; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGsqX_oCzt0FW6uwVwZ0nYE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 9205
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTAxMDg5MDU1MDY3ODEzODY4MQ%3D%3D

170 B
244 B

51ms
51ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTAxMDg5MDU1MDY3ODEzODY4MQ%3D%3D

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
an-x-request-uuid: 95a8b124-fb78-48b8-bfde-e59090e0ba30
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTAxMDg5MDU1MDY3ODEzODY4MQ%3D%3D
x-proxy-origin: 80.255.7.108; 80.255.7.108; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame FBD6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAWU4TIQ-FwM1biInJ5SpD4&google_cver=1

43 B
632 B

42ms
42ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAWU4TIQ-FwM1biInJ5SpD4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGP3HqPEBMAE&v=APEucNUsK0CUVy3ozs4PU5Sw-GgDGVctgfebXnBtVyQTbF0ArC3wonUEixI1stlk5SEmYUCtbATmHnEI7LAdMDK9ENJiWdIKPN9MVvKO_ng21lxMkViosJCmL7jI3a4vSljiXNyVv7dzvKFVQIu5jKq5F9w-wwkIO4DNF5AJ9RJrKtZheSvahOWr7VPJPB5RY2CxbDUu5JlD5cbz5aLGUPnvzxUO_TdRdw
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 30 Jul 2023 17:07:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAWU4TIQ-FwM1biInJ5SpD4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame FBD6
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZMaY4zmEL-1Ww3MYU8TV3AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENuD_6y68cbMJLA1tGTHhFc&google_cver=1

43 B
632 B

41ms
41ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENuD_6y68cbMJLA1tGTHhFc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGP3HqPEBMAE&v=APEucNUsK0CUVy3ozs4PU5Sw-GgDGVctgfebXnBtVyQTbF0ArC3wonUEixI1stlk5SEmYUCtbATmHnEI7LAdMDK9ENJiWdIKPN9MVvKO_ng21lxMkViosJCmL7jI3a4vSljiXNyVv7dzvKFVQIu5jKq5F9w-wwkIO4DNF5AJ9RJrKtZheSvahOWr7VPJPB5RY2CxbDUu5JlD5cbz5aLGUPnvzxUO_TdRdw
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 30 Jul 2023 17:07:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENuD_6y68cbMJLA1tGTHhFc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame FBD6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGsqX_oCzt0FW6uwVwZ0nYE&google_cver=1

43 B
839 B

88ms
87ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGsqX_oCzt0FW6uwVwZ0nYE&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGP3HqPEBMAE&v=APEucNUsK0CUVy3ozs4PU5Sw-GgDGVctgfebXnBtVyQTbF0ArC3wonUEixI1stlk5SEmYUCtbATmHnEI7LAdMDK9ENJiWdIKPN9MVvKO_ng21lxMkViosJCmL7jI3a4vSljiXNyVv7dzvKFVQIu5jKq5F9w-wwkIO4DNF5AJ9RJrKtZheSvahOWr7VPJPB5RY2CxbDUu5JlD5cbz5aLGUPnvzxUO_TdRdw

Protocol

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
an-x-request-uuid: 8960a73a-c2c2-4e15-89c2-d9be0f33819c
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.7.108; 80.255.7.108; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGsqX_oCzt0FW6uwVwZ0nYE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame FBD6
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODYzMzI4MDc3NjU4NDM3NzMzOA%3D%3D

170 B
233 B

52ms
51ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODYzMzI4MDc3NjU4NDM3NzMzOA%3D%3D

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
an-x-request-uuid: 515c73f5-33ec-48a9-beb8-b7da7ae3aeea
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODYzMzI4MDc3NjU4NDM3NzMzOA%3D%3D
x-proxy-origin: 80.255.7.108; 80.255.7.108; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4855
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAWU4TIQ-FwM1biInJ5SpD4&google_cver=1

43 B
632 B

42ms
41ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAWU4TIQ-FwM1biInJ5SpD4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGP3HqPEBMAE&v=APEucNW6zDE4Vg9FNb-DPrJU8NI77DSOEt0D5gdeOWysRVBgVBYF5oFKT8ufSVAxzgI5B868GYWKnim0fYqeCbmhybGj-E0KT8DnuYiUMkmliodpLPzlc0zPF89_HCtVoIfZKOqER8cvABkvHTO36vB6tfD6RmGF46dPClg8a__q36kJUzON0RfYt0u2d14FvYM2dZoWQ0gLZJ8Bw6LFq-RQFILjawunEQ
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 30 Jul 2023 17:07:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAWU4TIQ-FwM1biInJ5SpD4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4855
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZMaY4zmEL-1Ww3MYU8TV3AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENuD_6y68cbMJLA1tGTHhFc&google_cver=1

43 B
766 B

40ms
40ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENuD_6y68cbMJLA1tGTHhFc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGP3HqPEBMAE&v=APEucNW6zDE4Vg9FNb-DPrJU8NI77DSOEt0D5gdeOWysRVBgVBYF5oFKT8ufSVAxzgI5B868GYWKnim0fYqeCbmhybGj-E0KT8DnuYiUMkmliodpLPzlc0zPF89_HCtVoIfZKOqER8cvABkvHTO36vB6tfD6RmGF46dPClg8a__q36kJUzON0RfYt0u2d14FvYM2dZoWQ0gLZJ8Bw6LFq-RQFILjawunEQ
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 30 Jul 2023 17:07:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENuD_6y68cbMJLA1tGTHhFc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 4855
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGsqX_oCzt0FW6uwVwZ0nYE&google_cver=1

43 B
839 B

53ms
53ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGsqX_oCzt0FW6uwVwZ0nYE&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGP3HqPEBMAE&v=APEucNW6zDE4Vg9FNb-DPrJU8NI77DSOEt0D5gdeOWysRVBgVBYF5oFKT8ufSVAxzgI5B868GYWKnim0fYqeCbmhybGj-E0KT8DnuYiUMkmliodpLPzlc0zPF89_HCtVoIfZKOqER8cvABkvHTO36vB6tfD6RmGF46dPClg8a__q36kJUzON0RfYt0u2d14FvYM2dZoWQ0gLZJ8Bw6LFq-RQFILjawunEQ

Protocol

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
an-x-request-uuid: 5953eab3-3e3a-48d0-871b-004a6186a6f8
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.7.108; 80.255.7.108; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGsqX_oCzt0FW6uwVwZ0nYE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 4855
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTgxODI4MDk5NjMyMzAwNTcyNg%3D%3D

170 B
233 B

52ms
51ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTgxODI4MDk5NjMyMzAwNTcyNg%3D%3D

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
an-x-request-uuid: 49724a87-7402-46ed-8b79-6931b726cfb7
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTgxODI4MDk5NjMyMzAwNTcyNg%3D%3D
x-proxy-origin: 80.255.7.108; 80.255.7.108; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F407 0
20 B 72ms
72ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4012314549952&version=m202306200101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F407 0
20 B 72ms
72ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4012314549952&version=m202306200101&ct=76&x=1&cor=7862646770765940000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F407 106 KB
40 KB 87ms
84ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DPh4KamcqiN2YjBwwSd-fvN_wNN6Gkf0e8bR6tdRwsRPPzXeAYOU8SLDSwAOmsTOQ3DPl2SUHyfgjaq9-OtnF-d7jSAj7ZtJwTv3IMX5iJBXARUXtaI1VeYaL86nRpIvgopez2-9KdpeCu8KNXVb1sakJFMx_Or8uoHqyDe2VcV2trWr0&dbm_d=AKAmf-AZDmqV9EMYzQ5FqsvINiJqlF87yFL0o3g6kMG5A9x_J1hk5rR6edaF05Ak841S8trNhXOythDvb0eSV-P1x-rEmmjqS42hd04YXUh4JQBj540SopaX_SXkSY8qnuu-DAzaA-9_g0gcuCvcW7wRWqsnUGmxp3227y9IXAdVttIzOQ57fGOXtKB-UXBUKxMOPUjp8J5NnivFtS0LaLALpLO6Cp_m_XQJ7aGZVqhAjqB-hvcUoWXeKObEi75JB1pCtdw9hDc86kFkgW_E6vNnvOEKNVEusbEEqTTUiJ4Wrc5uYhjDNlLMAL2pdz5QYH1bK3TrOkjT9WSZ0CFLqfWc2wDe3fWKItz3L5BYqTNcIzGmYBCvTi3u5cEOffCpxoIHESpFw7KCpc-arw57XbNed2DrREIidFYperXt2q5Nqji3kGVBqC9v2s6AKHVb-Q6-f5UcTSqnVn25UDXHhiGh9ZWIaU3rqwEh6Gainvfo70svB_tXWPRPb8Eg3cc-zNc0WEXeLQmHZG7fb12-a8jGqWWErWlVTuVMde0RXMXKG_DfNCmjIPjnlBA0SSzLNYXT8s03-cqLRPEdz0ufj2gislSdiRedoSQt2CQzz5yqDYDOwqe27PIA09VodsOnn8mBaPUSHP-AtF7ZXIpn4NEncU0HTPLhV035MCUWhBUsSj8Xan1jkhmfYZdVcNZX9JiG93TS_4RiHe8Rjb7dYhxeyAjxIFrKF5nJ7BJ2_nGLPZiYtgusP4BNW3-AKCR73P-JWfkSjeXyv5DTIoN8O1H2ITGieXbGWYeH8scX0eEGu6I9tpyKtqY8CNd3FRw3pXSMVsDP70e75hI-Fg7TigQFuyQLEPnc_irR_XIP2umVnrNrDSBjfkFUnozjDlaDIjaLPvXMEOievBiTve9ZgEW892PfN96V-pgv29F1Q8yjC9SPPOuCiPriJK6Uw-mzpdjTTR9YKWLnh46c9k93PI5uTbm_hO-Hew5XINf9WjKeyHQW8qEIZh4jPjKJj9e3H4X6NVWD6x03KopOdQdOb5iHxhx3CsgxSV_2qwPKlc7xOsNEWmO7LXT62I7lsPE6GK9S8ohLX1nNQnx42-7XskNbiL1TVlkWlsciC8FZUtr4N3Pdh5j89YjuRDbWrqfnok6oPEiEt5bV5EXwVkBq4z2NcUq1B92Yf6nR9i06oj7ceOFbmqVwjY7UTVJrblPvZ6orKwocJW0AoW9jnYFVjWaZUv2kfhHJlNN2JE5mks8DINIOP6fcwxxEUryPJU1EDnwH_oba_JrlhJkWFlnGh9ngTKPmo5HhnQvzNcvB4vRedWFLXVw2swesQNWNgGC02O2uM9QMOZmE1tED0ACJ7aliG2RMVVT7R9H69pb4i1-kGBJYKINUSAeDq2LaB1h3GVQ3iqpjvi3rDBbfucqygwtqY4wGBrAp6vNChb1Y7qNHp6B7Y1CtztS51gAeYUQv-ohp6Jqj5LuCsQP660RohMyP3V7WfAq4KAzn4M6077sGRAxHQKtQQrBx7bKT3ibg14ovz_KWHPGyUkDWTiC7VIyR5CGeJWAqKGC3OdOozI670807ggAeIXELbuOY4kxaQDAR-dRAtkDdPM6EEo4Uwi9RvYUT3HD_W4L7za2kUnfqNXnVrLdL2AXcfaWpkrC8ZglDk9iseW8_f11ZX9YaMJkrfuzGMqkkCviTuD7NTxPQAAGv8rI1P1s2wqgbOtJMwn2i19v4rwaDlrlXMOjGG6VVseLhlltf-PI91DMRekuT-xc7mzWT5Gl8sp7wnbvhODcnbxeIXaf-BJqLdDwRQwFu0TzmOhS6WM5aq019ok2LtAG6Jq28Kr7wBQq8AudmkCetqnG90VTpWTNn8hhI1ApaTu0iO40pIwF2ttQTPotB_hVuS9nhFT3RA7-y5XIoL8lUWKV7ykq9BfpZtZtoGVK7GZc9n3o7TJjVI5mVlOjokLnkLuONsraN3R0ZBFzfRu5Zxiv_7A5kZW4D667Soi1r4ezh_m9wKA9l08VraTwo5Np6m9jEEyzeXKstIfmkaYcBGhlmgbOE4BERthBDPNqKv_ioESsNiJcDbqzrTRo5l1HtzI5aH1416QkAxCzn8lJmX1GTw-qNB7BMrMHz7lFYIVYYBQ53Saag5CU3LQ3lfDnw-PVNn0J-K3qSq1jiw_HLMuj3Uyh-Cq_YvNXnUh9R6sRIDyjN2fReO2NLK_4vNs5jS1jTYWH_lv_9gCMkOOB0QH1gTm0bAXDsxcwDa8usfp8qodPxk760kZZfkI9GW4MMoffHHPuH5U2wAFlOB5C4nEMyYoLq0dYEAgK1JmuSoilDSw9PiVG2BBFqox3qm7WD8DVJlAKYXaQo7_ofBnS0n4-RepyfSIz2RTXVJ6ePfe5muxgrizYWrh27vlC1RJcTmJmmJPIFKvcgT4BAPJMqkFSWnRKpcTKCtmfzr_KXCFXfYpn4e1cH1thZ5TamFQV7bejg-M__ovotYfruZ2f0KcIWvRf01YzmqpqA1t_m0oMHiMZuQNiH3S45eZUjQt4ezm5IomO-W-RNj9fU_T3tNwe_UPkMcCZOxtRc3dDrvHCmz1XplzT22ua8AQiJA911I3BtZrXj8ivvP9kmI9TJIXJAaCLg6kctFt27TwD_OUMIoJ4jwzh_CIc0pf4BFUg9MZ-AAfvvlop7ZmvJzwGIXIoK-i1UZ32NWsKLX0Q06xZpqmcQv6OVYTLKw18iQr9F3SOenEmyxydtj-KW3DwPDFLA8vJaiwulKOKNa5iz_EEcoJ1d6kc5sEW01GKAdxo3BNtQZhfM1uncdOtV66BgNkmEqpAZbg3gSZsyj6jUKxCz4kF0Mea2F2-wRpfcjhbVIQXTQsqSpQCZU2bH4R4SfcF4fwkA0Qkk42QAWIVL9kmUt_vSiBZ1awzBcd2239P6_a9NGcNopgARSTKnIFJHTJcUUvO2cOu98VPwaixfFRQfzTl5w3BSoELtO6CjyFlLcD-vMhiJ52GVru5On2YY8FhEqKX2fIfhqSyQ2y1p1CyjnEbRieuAeFibtP251SVcIRxQ6rDbBwTsDWPMD11eJyer_WucL1JhuYuZBMMfKuZMiJ-2PXP-t0q-T5Vdde8gxAsCN70cLJqhmq_mLLo_VOny97m7ny8hltdsnjL5y_nLMlYQpSjGtZ9SPOLNts_LJ-pPHo2e-ifVmwdktCEWcfgWkwB1407XYcYeKauSALyszLdEZb9ZvAD7_fmNiVKPVmxRbwgIaY7xhRToS30l5AKj-3CcgVg9-OQnVq9MlM4CWnEshKNIG8MfhEgsr9TXAskAY41CJGIpXx8oJDz7HOaiTu8hGT8tnqUxLXjtrx1RHgnQjvpqL2D17FKIYSBN-NbzzRQggDd9ItqhcuO4HtBLB3P9R6VHlAV9sOkCj4tz4WiMROVPLnPEepR_KmSOA_IWEZx13OYzqBkwMxw0-Jb2xla4WiYIOuleFkU2enJG4YeJADps33chKiYgW8ZZM1qUvT8zqwR5xwituiRrgf-dTdnIo_mDNo7VlJqXOS1oHIJsm99-JhQtikaL3ulTIjxB4fCbcMJbO8xGNG3PJLgnqI9TlgVzCGp1aC8StV2jmvizVnta8rWKQEsMC-tf48L4oGkLLd8NK3Xr8Z1xUbwBQua_6zO46sEY3eQ1LVFyuFE-oAowna3M2-K8sm_ufiSQAUFhsKFU9XPfM0WZLl-oaKli5aih47QxxJe8NSOcwH3dnaNND2ZdcNCGKuE5waOXfuFzb_cTMGVNZPyHo4PWzxYKWm2C4TSGFHodjmV71_JBGY8qKiv_p8WiWICbrHS6g5U&cid=CAQSSwBpAlJWIA3oPO780tOTM3SzL4bf69lJGNK7gC8SSKBNGHbdUnjOmTdlnzKq0lYx1cfXjtAColwpPYveH_NC9Fr_rrhMzap4O8CFmRgB&dv3_ver=m202306200101&rfl=https%3A%2F%2Fsharemods.com%2F&ds=l&xdt=1&iif=1&cor=7862646770765940000&adk=3047537735&idt=178&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

947923440d7cba68146e650658864be453709c4970402a20013b4964233e3781

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41074
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1C14 0
20 B 73ms
73ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7121173728655&version=m202306200101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1C14 0
20 B 73ms
73ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7121173728655&version=m202306200101&ct=76&x=1&cor=6171422387587972000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 1C14 106 KB
40 KB 101ms
101ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A7m1NsdxOAU_lR-QffRh1gJAOjUNPXh-cxr9BLekDgcKawkj7I9rxHgrzrRk-jBjgcrEbL_s0gxPEp2YUacd9yhwpP-TSI495M6K-7cr-ysvcOSDFeRuR0q1emHtPLSxfKg-lSOA2WqdmrrN3LigD6qMUCT0oGxb68FrjCCpvXZc2UA8s&dbm_d=AKAmf-DD3loAV_rNN8jqog2jHzTNbcC-lnXzH1fgfRGRO4T5nfdhE0CGwTUpl6daIgEBXCecSYdsaEupmLrig1bEXHaToSJmC8o82XXMw56t3oKbKFRbR_rjJobBGXbdZaWkpg0DlS9vBqpaOICckhPUU10OGSMlYNuhRBFQoMY29iBk2Rz-TDm8TlGV-eDEORxo9yQ7HMWtuCF5WiLKt47cM6AG15O65GBunMDoB7ZXL_xcQfDDNLxlj0DMUWsb5DJNVXOoZSG7uTy4Rlx28YbqHe6UmKAoTt3W4N390oas8TislPioAfdAxPAxAp6OI6BbnrbKfo7sprYdf3sQ6_lKfAR9IXUW4XQsDUB0PUgm32UQfavVMU6gt2dyRScyIlW71X1PLW2BXaczhmAHMhRRo6K1jpEim1O17n1paCkAZ3_SafaIFIcNBACwlbZg0rFuZVIUr-5RFCOrCFlaU3HA0T28cZ7bBnqoqvodugYfy9NIjQGXwHMgMTxg5-XvmTOO9D0d-eKdnNCK36VDrmgvS73WVQ728YAsQZnNv_GISos1s8sCht0l0Bs2khOGQB2gUDu8FZe066d1GZ2Jj-j0V0cJFZ4uyN6RV40uc1XbWWYL0uL_6BJUMM_xgim7sXE-2ryu_17m6dhHC_Pn2rl6CClMclH_mrtoJwwm_COD4N7RuRYUzhAvNUCz0l8ly4JhBG2KDWzaCsi_shzfpfYjPahD9suUyMEgF1SRjzHajHZ7LjCSqKV--CfVvWMbOYFv2f4-NdUcWJhu1qNvoF3YWxDcmOQedBESy0FYO7EfhDRwb479lKzZHjHCLQRXloTinjpmMEfVepjKlaTdklXw6AjfNCIDKtUOIV_CXKCwRBCinxWtRJTRCuafQXkD-8c0pcbuJcTOXLP49SbVBkVat2gGbc_W9Tt1jaWl3cTeKGKUnBr3Jyvf1xHOIeg7bk9Dsgwp8cHUHgj1DP3oi4EJkADmPI2RLNhrfqpj2UlYr8DPTvwOId8PbKFZsD1NuvbpiY1d1Snii8t32ESX39TXmKmlmSSIp2Mz_wZpDF_bpI9Ggi6C3alnl9D2UGDR2TpH6IgXaxqRQQI58X0QNeel6HJkyexsKMFts9wc8H9mJF8Ta7bP66TsHE2ciNaZLIWe7B-uwRgqjThmmV1oJC_rFMwEl_-KFcY6ANZAJ01JpB2vDK69T1CffO36_tJ5mtnkksHafPivZtbwTi49hXYAa_V-3QXAYPbhkuWYe1KBmlBqdo55MDDZihwfP9BXgGC6YRsaBf3IHa5lRWX1FrS3gQNidEUCMyqW4_WFNs4VRsZ4se3PF54LVjU2LUFTaujSHqM-HPjMTu4s2MKPEQtPQb0zZ3rCL2sVbrJnDFz0Mwcvo5pB6MqfG6iNfg86fmt_14rpX8Xr0XT7OzgEZ5APGOctUKnn_OSltSb7qe-uGYYCLRy_Z1dLkwEzl-4B0c9YQ8n2roK9dR6Y4ISXu3yHx4hkRmgx7pJbxBqmPXqt4gM934Iw9JfViAT_VADHtViM8AQP08khT8-3MhpxZysuQhhgBKfLA2iOFL7mgolIGFHnxBc4cYhmkCXi2SvC2LGc6y6wn09w_a-HztWOU1LkjEKt2IR5Ibv9NGCJiju6gHpD4b76bec0ppj1gDCeHtYPkonaw477m1BdYsUIck3Q9BNe9GfcauK6rBajQYrfLI3iA7YuDI6u5-u5PeZUFCkFcR8u-4xj0g_uk-ZfEcDBtgpEwCFtqnvmcAFMi2OKbU-UHgs7Jvpi7udTyLRjr7cO3_1cZpLuiOcVlimCkoJ5SloRXIiUQVmoi_nJFnaFGaySUbgQOPeBF598Mn_hDx-gdJmFKoXv06nycyS6xNDQJg1wE0P-8ASeCKlHjD1VEj_cFCKe4qSd_mMKiQEdvaby86X-TW6cP8V1KHdL-Us74xeOAHE4ZSUS1RgqPDQmLu2XRs-IL2uKhr-1YM_ZGte1iSfiqeN8j0632IfQKbL7PblLg1RvmBsI_OCYSXBCnsBVfSCk3WJeJgdozE_8-_w61PlMwOwaSbONsj1w-VVmoxrpcC6brLcZ_k9q18qGtccB0L4tHiz-pFLMreiQXfCzS6_qLt8X3NSHuELioEOx0nrWWN1HW_WdH4yhmMpTesnK0FUbAugujVm68ym7BiI0rLt6fQWFEd5K5nsR_tvxmw-kv5rWzcR0N_6QeuY1EIHhKhw-TSNSJyaxG1zgMF6mi0uk5ZwdiaHTq4IIeQc0hcqedhbctELm2uZh6WvohuvloN4sU_JhqOwhgZg2F1w-QOokVHo_kxZxW9yVvk8c_f6RFur_VOlLW3M-pQHCAbxIwtT5i5HVvpRCG-uJXIQLegRXsjFUDwsC3oSwLqpxpPvMJWwwcejGxLhthnvo6ezjyq3DHD5Z5VxhLHf_zKvHQV9fpN6n0BHuWg6hC4filapM5LKJNRl8esW6fyFGRtNZAoTEqDXiu2sJ0iGQndG0uzJRpUcqRkhebN1AS47cWyvlBrhMxee83K0vnNK0BV7YwUOU9gb5TO5tGd57YSIX2CpsofwftNOUMtO2dtILRfPvX_znHjxidSG_hDLJ3d-RUHiRVwHNDEfDAgljZbY0iE0V9ok3OQdie2ONPId6uFnmEwmikY-fv9xQF0i0G4bGWV-z_bQGLq6T8UQZpUUITn3qk_-6OcEFrd_PlX3trDQMUAoqhgqYmVhwaVcYdQXnQ4ESfc8NElFWibBncrXc02TKsk3pky01qNWRqhnxobMwuhPhpw1IV4CuoCN5NoBOjCj9GIlLZ0MuXE4644qqhzkXQ87qm7ADPJnsB-p9SmTJxReokvuPI0xgu_1Wu8f4ZFqTnQbA_fHYJ5Xnt1M3R3sk5-AGJBGggeO2-X7PgPx-BvZ7o6ASVlC1NFRV-KHcu45Q1PsuKllkVPHBasnNOeVkAGcW0-BNJh5AGIEaBxWBWMmXxYCEVlfXHY1VoQBO8ZvT3FHc21JbpxsPOZcyKCwu3HUS8p-7fVydjc41CiLzgcGGiX0QR0tQiMwO66yXz-09n3hjat7Xz2JhQSJOkrrrxyspee5fbT8VmDSykf7BL_cT4jJqrcg1FttcHi20RO2QTdPfnRXINSakeZ5Tje7Yjhkxae-TDnYCt9wscavBw36bsTqLxu2D19vXlgtZTWTUouqhDboTJbrwOd9GsgS5rosA2c4lGbQj26Ks1OZIt5pUUc_XAFm_4uQmKkraPBlRV1rasOF_z2gDVm2tOfYfEa-nwam9k0cJFabvgiGmdKptkXlMHmHP6PmXlYk6LJMMqHI6OwOWuH7oes2cAnyhc-Xv7m64WLxS4B60V3VnnsoXBo7eA6miZQGhVi0xs3Oalmtv9qWEGRdkAHAjstI5h4Trpgl7X3xyuRUsQNz7-ukJOgxDQMrKYPwS2aiGUEipnlMdupamJbpqrydxDnL7pGDnfy3OpRiBzXSMMSVADGga9KNnsXQ_0XLUJ6oDr8AVzQ2cSX9AfpDNGs27alAaE_-_o--tf8cXJMGrPZghacadIFx8VVPnD0KXEGj9mbquHCWIvClMS1hRyxgRb7s-M5bwAdo7GgSKBbOmZLANL7U5EQ9Nmv1XjIqFo-u3cIq4vtjhSZt2jnXsacysdRQlcbpsn7IQqPhT0dPcShv3zyeTZIJC4xrmfSvuxaLvT4uFkK3NkoGH9hv05XQDt-uVmfdEMZuYgvSwL9G3nJ8iqrYNmhWPqR7WtHw4AG0RoAWmVLj7YafPRfYF6u9WaCqWe3yMx_x-5cTxoxNg-J393nkeDan3TrkcS9ljmLSGXeF34WU&cid=CAQSSwBpAlJWIA3oPO780tOTM3SzL4bf69lJGNK7gC8SSKBNGHbdUnjOmTdlnzKq0lYx1cfXjtAColwpPYveH_NC9Fr_rrhMzap4O8CFmRgB&dv3_ver=m202306200101&rfl=https%3A%2F%2Fsharemods.com%2F&ds=l&xdt=1&iif=1&cor=6171422387587972000&adk=2857193498&idt=168&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ce8c4617f8402af53de1563ea62bf55ef0d9e28e0fc0053e4cbe540370533986

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41166
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1574389/72805578/ Frame 2C94 46 KB
12 KB 186ms
59ms Script
application/javascript 3.248.22.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1574389/72805578/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1013543513&ias_pubId=pub-7383171830614216&ias_chanId=1&ias_placementId=20390324281&bidurl=https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0g_eJ-MO7Mzd7jJiNQxlBhC
Requested by: Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.248.22.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-248-22-18.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: c37b96a3dd06872f4cb1d00c9c229dab50f91b74d8fa2f19d059e69582242bf3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 2C94 111 KB
39 KB 128ms
41ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
Origin: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 04:51:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 44175
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 31 Jul 2023 04:51:32 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230726/r20110914/elements/html/ Frame 2C94 11 KB
4 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230726/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AhmVpKe0LWA4Xs3hi-Fq4UIXzhJSzEFZlPwU8cHjnAuSl4aKAfLoBP5vs1UDWYJd34kyrx_HpX3ImGBrerE5URX1sE6dRvSbgFlkelMqgqKP2lJrIOqcnsnKJKw0U-fj-6U4jMfMICIZk885OykbUXqxRMgbAJdvYm-5Zn4OcqJpSknfU&dbm_d=AKAmf-An0D-rqZzkwaHbVRMkn7UK2OHbhjGx4e4J9Gk2E7FvPZbC7BjdKJ_t96-45t1aVOmUX1QG9Z7C4NJ1UZMjUYK2912cOgknsaI0TdRraPhbh-ZQA8Ys0ZRhJ_gnngRJyLnJ4j4C68kIldWMTADNNW7pRM2a5RIaBIcAvccq5zTS68tTfUN1TSM8s2Ep3g1kEN9TOzk8iSXTD5O22A_PpXnKsd0k49s79tRHa86t3s07INi8FGEvcNlghs8Afuqsn0NDiBqHjAueAFYHHc1i4O038Y-xXUb5UGq9MNemt_RktVWjTJKVderE2wwNN_rPu4j2M0G3kK8A0GgEk0Y9C6zZC-mSLJkh8eahijFLUbybwKLFLJegH62prNPJ0sHEBJjEViRvHGOdQjlr9uE3L4sU4xZvIN1zJwQbH-d2Af0PZizw6oIugn-Qrur7gobYY32woasZGJXrCYItik9A6SAFWYqKSXuMa5H1TUt3zR90OVpvL29PX_p4AQFobM5KXC0reB9aAUeRkjcKEeeTk0LkZiL3pVn_0zRJEgkoWiIMxGCkdOPpaXN2W1sY6vShUr2I0h3xfNYw3QxSVrvy4kEWlVmdpxqD_rpCqpzE8j8eDvP0rOtlubT-L8OfIfeYm3zvuNNxo3f8ZNVPyAF0dg-3wUkkgC8MZOnrTeHT03iVFqRaFOR4LByygTSE6ZNQLGWDS4811EioDRs716KK2XDKz-AfmCCFYgqHXEe2V1Qv2UH6_vzCYS_GdqorZbOCTBteYREOO_l2MuRUXUV_HraxkhEgxGFF6gC5JKWEOTncZHE6DYSdnkEPRqHC3-_vsuGEpj1Pmwvs3DJh979GOBsSvilioLIegFC6dyo6vcd8FHkaF2LyhnSBFzm1vymvO2EsZIsYBNlmGSAd30uxmTQZ28x69BXDjRhXOSiyt9YV8hBmCx6r7CR_Oj3wNwmxuIbTDPkCxwDY7ur7Hlt4xAFEUT2urHs7vACZHiHaNUdkn05m8Z_0JjyzOKeJyuHp7b4wxCfWmKZT_UbkmdkWRnn5Qvs_1WcP9oHTkT7DCgUUHU8ncpEBzcdpzsbLZEIMz3xVXy8MtlgBGgYDg1_eNtMA8_nVl84NoSTMaxZbAl5IsQZc_94wEvEeY9Dhwg1B3OHtADQzrrWLuU6wvvKNXHvCU2om7Dh99vKRYEbFSmVVvhqgqdp2YJehZEvEB6mejSFHgU9p21fs8LVEEUuXmrWV8dUpJTrTzzAuNiERMBFFrDbFURJwfZ8WCvwNOWHmHykbdY5_cmQgwhN1HnFvvESf6exWyXwcKc1NdDyZz5naT8Vkv9seceTTA9Xz_PdvTxlkKhCa-QPRBNuutvd-3MLgWtl1pxWLNrHdk0gSqaCN25EysxTEykfZ3_MZ48TGsTSqVXmjSEBE2Pb9SMeQJ-B_YWvHIqsnYxQH6aSQVx-8hJ6kc2k0lLV2lf_hpUoldlHXBXpgSsrW19jxYn_n37LmcReZASB_XwudnX4rZ_AJ0MSf677VeOvcnT8ok_zP4SG4Nm5J14jSDdNRVp9nk6FoNb3JFlwphvZzOUAXEVlRgTX0-9ihO4Lmtd0pIe_uAarasAv9AfsSaq8CPStq8LPRPdzzoDVlCMzJPlbThCiQ1ZkVJpXP51993ZRHjRe1RJ1CV414Fb7hfCHhSbSDHfOdsN-NEtNDWmKyofDygzCUp4ctE0bepbxnLQnV1G6oD9Pp79-5g_vUKeB2f3-fRgZfQ7sMOkHEPhGkwhLAcK_Blk9vu9lcIE1G4NeRRLwhoJB-e-amgT4FfqXPhsAg5RDJ8CYl7HuX1_HREUKEnMgw_Y9I1DZHo8cTWoz2fuqpM_IENJK8y-u7jOlEmpIoF4fUQtYsvl-O3Vr_BA7X_AsY17oHPeQdSrGKMfxF2uu73FJnwCnQMbSzw8D9wFl-iIk8bHpRCo-EUk6ncx-rYH6SzUIVx4Ww23GDVEE-eDOTDXDqUuc094oh2cg_FW9nE2YwvNpDPFhNOkuXvqXG2KdelOc9yCVSn0mUF1wOj_2jzyyNDPwql3jQen8FnuL34bRxBaShhLKTHhOTgS0ZlQtXZsGysF3OKWEC3-OA8paE0Wp_HX3Yt2x6Ec5tl-sqpgfcSztb82AJoLv9y-qTaUj_lXBAwZOY2AxxjFTYtUYIxInu0EOl9RCd50p6ythv5U8ps2iTkUiB6AqtgJEQBOBlDiZ4Mn59tBlsMnWS0D1V4qojw4cGKfIx2yt96mwfCkkdJqE5RdLWOv8pgTE43giGwYSGvz3Ac2VvIOrVHliN23j2eqNk_QPpZshoLAcH8SOt99YYG2Cnsmhpb6g8LXfIkaqmp4DpV47fClWqcBjzoxNlp5U4Ur3hvAjHCgP4zM7uhw4J2X-3I1CZzi3FJnQU_EShOZChhdJXqjezDD7wvak-rOtkGSlOUFM7qRjLOZ4USZ5GpWaYZoKVjhLQqzXqATFrr-hz8OjGzF9e01WC-8hG6Irp5x6XkQtFm1oF5jZxiCuIbc_llqwrU3zFHAT8-TgpEKLdzcV473Qnic_c5y0QtrJKadZDtTlzmwB67gwCOc9pY7W4Q0z1Tt6E7M3Oihh9mW5RradiAQH2PENLW_moHqr3vXYc986TeRgetwGzyUO1DoDk_zYMXZb4br9tRVk459BgrmMi43kuyqyotrGQkakzti6zHpSGfOniyVDODqvRJ-3UrGSqPhNWlzioKVMNH1z4h72T914Hwa2gwlX8blbInWKwl2AkCxXjFOwbBHrzSb2Z-ne67SAiqjgdJltzD3A_kqjru4sFFzdpiopqp48Xf7l2-3Pdn79rfHv_R-JPDVJOoVtN1-5M-KJMYlNzeyf73N-eaUH2NQHYSkiiSmjGeNJALR1hNk1arMwTaNaMTIx2IC2ivdPXefzRpeA74oL4iUgnR3orsc11E5hdIDoLiWbWkGJDYB2XeKZYivGSCYDjIImB7KTkiZgU8jATEP4_0q_n1HwTzItAnidXxCghjdI3Ep1Lt1rdkD6gbTpLxrnvnadbe371XifenitTeaFFFraOBnBVJzvJlt1b_S-WjMrALohlje2_8HnJdLDjT1xp5erXrRmrOKX-tgZSJ8VYR3sllJlmPajc9XFITZ0QkL980tirxZQdAHa1Y-yjUHa9_XCMNsRp5V1ABvZHnRKYTVV1uJVVJkuLj_4foGA_PYGEVnbRi4p9AsXcMwr7LuDhNHPQeef0IIM7NwCAFMyWssLkgx_l31dH5GfvBSEVXwGAvTWbNMmat5gYxnAeZxcblvbhRRtdxOKi-1W4yPE4HRk-cPfpO4FvhRhJREOxL7kWwcpVGf9vO7szQ6210Pyhf9oCRNMUeHkgSA5KhYavnYu8TFyVvrvrapyH8afoobmxAPtH_hHMxaOHKzIAVH2B6btg7WB0Z6R4Cl0OX4oKpCj9Okw6Mmrn6BhE2TWMS6NO-9qmwgb-WtlYEEdpBoyEv9WjAwIWP8YLHrhQgYUNM0lmwkHMjb1QI4K-CQoyxp98Xoytg5XqB-qIJWlm-idqOfAqPOl9jWikUPdm-sa-IJrwpe4-Loqe6fQ0QoYwHDzWT9R5AIjHRm2qQSE_Nfw8QI60cYgBhHT5qB6wkCywO4_rkvQhaBIJunGWloRM_kKVi1nKRfDV1U2T-8cVKoiRDVpiGz9DpTocAtcM8v0fD-TjhzUji8DphSiLQvHP5Kcub8Nj_SZO6xlCOxNw-wU_1Nemd1Iwlr8D5K1DOib0iqlKX0VHIjbP0LOzbihEyMFTv_E35uChQ8aBWtIz4Q&cid=CAQSSwBpAlJWIA3oPO780tOTM3SzL4bf69lJGNK7gC8SSKBNGHbdUnjOmTdlnzKq0lYx1cfXjtAColwpPYveH_NC9Fr_rrhMzap4O8CFmRgB&dv3_ver=m202306200101&rfl=https%3A%2F%2Fsharemods.com%2F&ds=l&xdt=1&iif=1&cor=6721952850924367000&adk=2228999115&idt=114&cac=0&dtd=18

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 19:13:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78877
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 12 Aug 2023 19:13:10 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230726/r20110914/ Frame 2C94 30 KB
11 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230726/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b2c524428c1a3604e3d1cdc61c2ae371a8f2fc767f801180fcf892db9e07c3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 04:32:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 45340
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11572
x-xss-protection: 0
server: cafe
etag: 5014499061205845695
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Aug 2023 04:32:07 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2C94 41 KB
13 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 05:44:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 127379
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 28 Jul 2024 05:44:48 GMT

GET
DATA 200
OK truncated
/ Frame 2C94 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bf470cebbb258ee1ea098355a615a90c93b291bc016922d2fa0099e66e04dd52

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1574389/72805578/ Frame F407 46 KB
12 KB 83ms
59ms Script
application/javascript 3.248.22.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1574389/72805578/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1013543513&ias_pubId=pub-7383171830614216&ias_chanId=1&ias_placementId=20390324281&bidurl=https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0i62-VRZTlYG4W7AdVITpeh
Requested by: Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.248.22.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-248-22-18.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 865b585e0dd6a55fda4c15ba57d51a9e87de1756a812c02fef8d07f7a0c371e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame F407 111 KB
39 KB 78ms
78ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
Origin: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 04:51:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 44175
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 31 Jul 2023 04:51:32 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230726/r20110914/elements/html/ Frame F407 11 KB
4 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230726/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DPh4KamcqiN2YjBwwSd-fvN_wNN6Gkf0e8bR6tdRwsRPPzXeAYOU8SLDSwAOmsTOQ3DPl2SUHyfgjaq9-OtnF-d7jSAj7ZtJwTv3IMX5iJBXARUXtaI1VeYaL86nRpIvgopez2-9KdpeCu8KNXVb1sakJFMx_Or8uoHqyDe2VcV2trWr0&dbm_d=AKAmf-AZDmqV9EMYzQ5FqsvINiJqlF87yFL0o3g6kMG5A9x_J1hk5rR6edaF05Ak841S8trNhXOythDvb0eSV-P1x-rEmmjqS42hd04YXUh4JQBj540SopaX_SXkSY8qnuu-DAzaA-9_g0gcuCvcW7wRWqsnUGmxp3227y9IXAdVttIzOQ57fGOXtKB-UXBUKxMOPUjp8J5NnivFtS0LaLALpLO6Cp_m_XQJ7aGZVqhAjqB-hvcUoWXeKObEi75JB1pCtdw9hDc86kFkgW_E6vNnvOEKNVEusbEEqTTUiJ4Wrc5uYhjDNlLMAL2pdz5QYH1bK3TrOkjT9WSZ0CFLqfWc2wDe3fWKItz3L5BYqTNcIzGmYBCvTi3u5cEOffCpxoIHESpFw7KCpc-arw57XbNed2DrREIidFYperXt2q5Nqji3kGVBqC9v2s6AKHVb-Q6-f5UcTSqnVn25UDXHhiGh9ZWIaU3rqwEh6Gainvfo70svB_tXWPRPb8Eg3cc-zNc0WEXeLQmHZG7fb12-a8jGqWWErWlVTuVMde0RXMXKG_DfNCmjIPjnlBA0SSzLNYXT8s03-cqLRPEdz0ufj2gislSdiRedoSQt2CQzz5yqDYDOwqe27PIA09VodsOnn8mBaPUSHP-AtF7ZXIpn4NEncU0HTPLhV035MCUWhBUsSj8Xan1jkhmfYZdVcNZX9JiG93TS_4RiHe8Rjb7dYhxeyAjxIFrKF5nJ7BJ2_nGLPZiYtgusP4BNW3-AKCR73P-JWfkSjeXyv5DTIoN8O1H2ITGieXbGWYeH8scX0eEGu6I9tpyKtqY8CNd3FRw3pXSMVsDP70e75hI-Fg7TigQFuyQLEPnc_irR_XIP2umVnrNrDSBjfkFUnozjDlaDIjaLPvXMEOievBiTve9ZgEW892PfN96V-pgv29F1Q8yjC9SPPOuCiPriJK6Uw-mzpdjTTR9YKWLnh46c9k93PI5uTbm_hO-Hew5XINf9WjKeyHQW8qEIZh4jPjKJj9e3H4X6NVWD6x03KopOdQdOb5iHxhx3CsgxSV_2qwPKlc7xOsNEWmO7LXT62I7lsPE6GK9S8ohLX1nNQnx42-7XskNbiL1TVlkWlsciC8FZUtr4N3Pdh5j89YjuRDbWrqfnok6oPEiEt5bV5EXwVkBq4z2NcUq1B92Yf6nR9i06oj7ceOFbmqVwjY7UTVJrblPvZ6orKwocJW0AoW9jnYFVjWaZUv2kfhHJlNN2JE5mks8DINIOP6fcwxxEUryPJU1EDnwH_oba_JrlhJkWFlnGh9ngTKPmo5HhnQvzNcvB4vRedWFLXVw2swesQNWNgGC02O2uM9QMOZmE1tED0ACJ7aliG2RMVVT7R9H69pb4i1-kGBJYKINUSAeDq2LaB1h3GVQ3iqpjvi3rDBbfucqygwtqY4wGBrAp6vNChb1Y7qNHp6B7Y1CtztS51gAeYUQv-ohp6Jqj5LuCsQP660RohMyP3V7WfAq4KAzn4M6077sGRAxHQKtQQrBx7bKT3ibg14ovz_KWHPGyUkDWTiC7VIyR5CGeJWAqKGC3OdOozI670807ggAeIXELbuOY4kxaQDAR-dRAtkDdPM6EEo4Uwi9RvYUT3HD_W4L7za2kUnfqNXnVrLdL2AXcfaWpkrC8ZglDk9iseW8_f11ZX9YaMJkrfuzGMqkkCviTuD7NTxPQAAGv8rI1P1s2wqgbOtJMwn2i19v4rwaDlrlXMOjGG6VVseLhlltf-PI91DMRekuT-xc7mzWT5Gl8sp7wnbvhODcnbxeIXaf-BJqLdDwRQwFu0TzmOhS6WM5aq019ok2LtAG6Jq28Kr7wBQq8AudmkCetqnG90VTpWTNn8hhI1ApaTu0iO40pIwF2ttQTPotB_hVuS9nhFT3RA7-y5XIoL8lUWKV7ykq9BfpZtZtoGVK7GZc9n3o7TJjVI5mVlOjokLnkLuONsraN3R0ZBFzfRu5Zxiv_7A5kZW4D667Soi1r4ezh_m9wKA9l08VraTwo5Np6m9jEEyzeXKstIfmkaYcBGhlmgbOE4BERthBDPNqKv_ioESsNiJcDbqzrTRo5l1HtzI5aH1416QkAxCzn8lJmX1GTw-qNB7BMrMHz7lFYIVYYBQ53Saag5CU3LQ3lfDnw-PVNn0J-K3qSq1jiw_HLMuj3Uyh-Cq_YvNXnUh9R6sRIDyjN2fReO2NLK_4vNs5jS1jTYWH_lv_9gCMkOOB0QH1gTm0bAXDsxcwDa8usfp8qodPxk760kZZfkI9GW4MMoffHHPuH5U2wAFlOB5C4nEMyYoLq0dYEAgK1JmuSoilDSw9PiVG2BBFqox3qm7WD8DVJlAKYXaQo7_ofBnS0n4-RepyfSIz2RTXVJ6ePfe5muxgrizYWrh27vlC1RJcTmJmmJPIFKvcgT4BAPJMqkFSWnRKpcTKCtmfzr_KXCFXfYpn4e1cH1thZ5TamFQV7bejg-M__ovotYfruZ2f0KcIWvRf01YzmqpqA1t_m0oMHiMZuQNiH3S45eZUjQt4ezm5IomO-W-RNj9fU_T3tNwe_UPkMcCZOxtRc3dDrvHCmz1XplzT22ua8AQiJA911I3BtZrXj8ivvP9kmI9TJIXJAaCLg6kctFt27TwD_OUMIoJ4jwzh_CIc0pf4BFUg9MZ-AAfvvlop7ZmvJzwGIXIoK-i1UZ32NWsKLX0Q06xZpqmcQv6OVYTLKw18iQr9F3SOenEmyxydtj-KW3DwPDFLA8vJaiwulKOKNa5iz_EEcoJ1d6kc5sEW01GKAdxo3BNtQZhfM1uncdOtV66BgNkmEqpAZbg3gSZsyj6jUKxCz4kF0Mea2F2-wRpfcjhbVIQXTQsqSpQCZU2bH4R4SfcF4fwkA0Qkk42QAWIVL9kmUt_vSiBZ1awzBcd2239P6_a9NGcNopgARSTKnIFJHTJcUUvO2cOu98VPwaixfFRQfzTl5w3BSoELtO6CjyFlLcD-vMhiJ52GVru5On2YY8FhEqKX2fIfhqSyQ2y1p1CyjnEbRieuAeFibtP251SVcIRxQ6rDbBwTsDWPMD11eJyer_WucL1JhuYuZBMMfKuZMiJ-2PXP-t0q-T5Vdde8gxAsCN70cLJqhmq_mLLo_VOny97m7ny8hltdsnjL5y_nLMlYQpSjGtZ9SPOLNts_LJ-pPHo2e-ifVmwdktCEWcfgWkwB1407XYcYeKauSALyszLdEZb9ZvAD7_fmNiVKPVmxRbwgIaY7xhRToS30l5AKj-3CcgVg9-OQnVq9MlM4CWnEshKNIG8MfhEgsr9TXAskAY41CJGIpXx8oJDz7HOaiTu8hGT8tnqUxLXjtrx1RHgnQjvpqL2D17FKIYSBN-NbzzRQggDd9ItqhcuO4HtBLB3P9R6VHlAV9sOkCj4tz4WiMROVPLnPEepR_KmSOA_IWEZx13OYzqBkwMxw0-Jb2xla4WiYIOuleFkU2enJG4YeJADps33chKiYgW8ZZM1qUvT8zqwR5xwituiRrgf-dTdnIo_mDNo7VlJqXOS1oHIJsm99-JhQtikaL3ulTIjxB4fCbcMJbO8xGNG3PJLgnqI9TlgVzCGp1aC8StV2jmvizVnta8rWKQEsMC-tf48L4oGkLLd8NK3Xr8Z1xUbwBQua_6zO46sEY3eQ1LVFyuFE-oAowna3M2-K8sm_ufiSQAUFhsKFU9XPfM0WZLl-oaKli5aih47QxxJe8NSOcwH3dnaNND2ZdcNCGKuE5waOXfuFzb_cTMGVNZPyHo4PWzxYKWm2C4TSGFHodjmV71_JBGY8qKiv_p8WiWICbrHS6g5U&cid=CAQSSwBpAlJWIA3oPO780tOTM3SzL4bf69lJGNK7gC8SSKBNGHbdUnjOmTdlnzKq0lYx1cfXjtAColwpPYveH_NC9Fr_rrhMzap4O8CFmRgB&dv3_ver=m202306200101&rfl=https%3A%2F%2Fsharemods.com%2F&ds=l&xdt=1&iif=1&cor=7862646770765940000&adk=3047537735&idt=178&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 19:13:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78877
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 12 Aug 2023 19:13:10 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230726/r20110914/ Frame F407 30 KB
11 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230726/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b2c524428c1a3604e3d1cdc61c2ae371a8f2fc767f801180fcf892db9e07c3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 04:32:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 45340
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11572
x-xss-protection: 0
server: cafe
etag: 5014499061205845695
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Aug 2023 04:32:07 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame F407 41 KB
13 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 05:44:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 127379
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 28 Jul 2024 05:44:48 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1574389/72805536/ Frame 1C14 46 KB
12 KB 75ms
60ms Script
application/javascript 3.248.22.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1574389/72805536/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1013543513&ias_pubId=pub-7383171830614216&ias_chanId=1&ias_placementId=20390324281&bidurl=https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0jLVf7c2xAheHkd9zhLv0dA
Requested by: Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.248.22.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-248-22-18.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 1f9c9c74917d405e85abead9b5835c467badd3a12720b839950949cae903ba4d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 1C14 111 KB
39 KB 101ms
101ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
Origin: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 04:51:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 44175
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 31 Jul 2023 04:51:32 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230726/r20110914/elements/html/ Frame 1C14 11 KB
4 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230726/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A7m1NsdxOAU_lR-QffRh1gJAOjUNPXh-cxr9BLekDgcKawkj7I9rxHgrzrRk-jBjgcrEbL_s0gxPEp2YUacd9yhwpP-TSI495M6K-7cr-ysvcOSDFeRuR0q1emHtPLSxfKg-lSOA2WqdmrrN3LigD6qMUCT0oGxb68FrjCCpvXZc2UA8s&dbm_d=AKAmf-DD3loAV_rNN8jqog2jHzTNbcC-lnXzH1fgfRGRO4T5nfdhE0CGwTUpl6daIgEBXCecSYdsaEupmLrig1bEXHaToSJmC8o82XXMw56t3oKbKFRbR_rjJobBGXbdZaWkpg0DlS9vBqpaOICckhPUU10OGSMlYNuhRBFQoMY29iBk2Rz-TDm8TlGV-eDEORxo9yQ7HMWtuCF5WiLKt47cM6AG15O65GBunMDoB7ZXL_xcQfDDNLxlj0DMUWsb5DJNVXOoZSG7uTy4Rlx28YbqHe6UmKAoTt3W4N390oas8TislPioAfdAxPAxAp6OI6BbnrbKfo7sprYdf3sQ6_lKfAR9IXUW4XQsDUB0PUgm32UQfavVMU6gt2dyRScyIlW71X1PLW2BXaczhmAHMhRRo6K1jpEim1O17n1paCkAZ3_SafaIFIcNBACwlbZg0rFuZVIUr-5RFCOrCFlaU3HA0T28cZ7bBnqoqvodugYfy9NIjQGXwHMgMTxg5-XvmTOO9D0d-eKdnNCK36VDrmgvS73WVQ728YAsQZnNv_GISos1s8sCht0l0Bs2khOGQB2gUDu8FZe066d1GZ2Jj-j0V0cJFZ4uyN6RV40uc1XbWWYL0uL_6BJUMM_xgim7sXE-2ryu_17m6dhHC_Pn2rl6CClMclH_mrtoJwwm_COD4N7RuRYUzhAvNUCz0l8ly4JhBG2KDWzaCsi_shzfpfYjPahD9suUyMEgF1SRjzHajHZ7LjCSqKV--CfVvWMbOYFv2f4-NdUcWJhu1qNvoF3YWxDcmOQedBESy0FYO7EfhDRwb479lKzZHjHCLQRXloTinjpmMEfVepjKlaTdklXw6AjfNCIDKtUOIV_CXKCwRBCinxWtRJTRCuafQXkD-8c0pcbuJcTOXLP49SbVBkVat2gGbc_W9Tt1jaWl3cTeKGKUnBr3Jyvf1xHOIeg7bk9Dsgwp8cHUHgj1DP3oi4EJkADmPI2RLNhrfqpj2UlYr8DPTvwOId8PbKFZsD1NuvbpiY1d1Snii8t32ESX39TXmKmlmSSIp2Mz_wZpDF_bpI9Ggi6C3alnl9D2UGDR2TpH6IgXaxqRQQI58X0QNeel6HJkyexsKMFts9wc8H9mJF8Ta7bP66TsHE2ciNaZLIWe7B-uwRgqjThmmV1oJC_rFMwEl_-KFcY6ANZAJ01JpB2vDK69T1CffO36_tJ5mtnkksHafPivZtbwTi49hXYAa_V-3QXAYPbhkuWYe1KBmlBqdo55MDDZihwfP9BXgGC6YRsaBf3IHa5lRWX1FrS3gQNidEUCMyqW4_WFNs4VRsZ4se3PF54LVjU2LUFTaujSHqM-HPjMTu4s2MKPEQtPQb0zZ3rCL2sVbrJnDFz0Mwcvo5pB6MqfG6iNfg86fmt_14rpX8Xr0XT7OzgEZ5APGOctUKnn_OSltSb7qe-uGYYCLRy_Z1dLkwEzl-4B0c9YQ8n2roK9dR6Y4ISXu3yHx4hkRmgx7pJbxBqmPXqt4gM934Iw9JfViAT_VADHtViM8AQP08khT8-3MhpxZysuQhhgBKfLA2iOFL7mgolIGFHnxBc4cYhmkCXi2SvC2LGc6y6wn09w_a-HztWOU1LkjEKt2IR5Ibv9NGCJiju6gHpD4b76bec0ppj1gDCeHtYPkonaw477m1BdYsUIck3Q9BNe9GfcauK6rBajQYrfLI3iA7YuDI6u5-u5PeZUFCkFcR8u-4xj0g_uk-ZfEcDBtgpEwCFtqnvmcAFMi2OKbU-UHgs7Jvpi7udTyLRjr7cO3_1cZpLuiOcVlimCkoJ5SloRXIiUQVmoi_nJFnaFGaySUbgQOPeBF598Mn_hDx-gdJmFKoXv06nycyS6xNDQJg1wE0P-8ASeCKlHjD1VEj_cFCKe4qSd_mMKiQEdvaby86X-TW6cP8V1KHdL-Us74xeOAHE4ZSUS1RgqPDQmLu2XRs-IL2uKhr-1YM_ZGte1iSfiqeN8j0632IfQKbL7PblLg1RvmBsI_OCYSXBCnsBVfSCk3WJeJgdozE_8-_w61PlMwOwaSbONsj1w-VVmoxrpcC6brLcZ_k9q18qGtccB0L4tHiz-pFLMreiQXfCzS6_qLt8X3NSHuELioEOx0nrWWN1HW_WdH4yhmMpTesnK0FUbAugujVm68ym7BiI0rLt6fQWFEd5K5nsR_tvxmw-kv5rWzcR0N_6QeuY1EIHhKhw-TSNSJyaxG1zgMF6mi0uk5ZwdiaHTq4IIeQc0hcqedhbctELm2uZh6WvohuvloN4sU_JhqOwhgZg2F1w-QOokVHo_kxZxW9yVvk8c_f6RFur_VOlLW3M-pQHCAbxIwtT5i5HVvpRCG-uJXIQLegRXsjFUDwsC3oSwLqpxpPvMJWwwcejGxLhthnvo6ezjyq3DHD5Z5VxhLHf_zKvHQV9fpN6n0BHuWg6hC4filapM5LKJNRl8esW6fyFGRtNZAoTEqDXiu2sJ0iGQndG0uzJRpUcqRkhebN1AS47cWyvlBrhMxee83K0vnNK0BV7YwUOU9gb5TO5tGd57YSIX2CpsofwftNOUMtO2dtILRfPvX_znHjxidSG_hDLJ3d-RUHiRVwHNDEfDAgljZbY0iE0V9ok3OQdie2ONPId6uFnmEwmikY-fv9xQF0i0G4bGWV-z_bQGLq6T8UQZpUUITn3qk_-6OcEFrd_PlX3trDQMUAoqhgqYmVhwaVcYdQXnQ4ESfc8NElFWibBncrXc02TKsk3pky01qNWRqhnxobMwuhPhpw1IV4CuoCN5NoBOjCj9GIlLZ0MuXE4644qqhzkXQ87qm7ADPJnsB-p9SmTJxReokvuPI0xgu_1Wu8f4ZFqTnQbA_fHYJ5Xnt1M3R3sk5-AGJBGggeO2-X7PgPx-BvZ7o6ASVlC1NFRV-KHcu45Q1PsuKllkVPHBasnNOeVkAGcW0-BNJh5AGIEaBxWBWMmXxYCEVlfXHY1VoQBO8ZvT3FHc21JbpxsPOZcyKCwu3HUS8p-7fVydjc41CiLzgcGGiX0QR0tQiMwO66yXz-09n3hjat7Xz2JhQSJOkrrrxyspee5fbT8VmDSykf7BL_cT4jJqrcg1FttcHi20RO2QTdPfnRXINSakeZ5Tje7Yjhkxae-TDnYCt9wscavBw36bsTqLxu2D19vXlgtZTWTUouqhDboTJbrwOd9GsgS5rosA2c4lGbQj26Ks1OZIt5pUUc_XAFm_4uQmKkraPBlRV1rasOF_z2gDVm2tOfYfEa-nwam9k0cJFabvgiGmdKptkXlMHmHP6PmXlYk6LJMMqHI6OwOWuH7oes2cAnyhc-Xv7m64WLxS4B60V3VnnsoXBo7eA6miZQGhVi0xs3Oalmtv9qWEGRdkAHAjstI5h4Trpgl7X3xyuRUsQNz7-ukJOgxDQMrKYPwS2aiGUEipnlMdupamJbpqrydxDnL7pGDnfy3OpRiBzXSMMSVADGga9KNnsXQ_0XLUJ6oDr8AVzQ2cSX9AfpDNGs27alAaE_-_o--tf8cXJMGrPZghacadIFx8VVPnD0KXEGj9mbquHCWIvClMS1hRyxgRb7s-M5bwAdo7GgSKBbOmZLANL7U5EQ9Nmv1XjIqFo-u3cIq4vtjhSZt2jnXsacysdRQlcbpsn7IQqPhT0dPcShv3zyeTZIJC4xrmfSvuxaLvT4uFkK3NkoGH9hv05XQDt-uVmfdEMZuYgvSwL9G3nJ8iqrYNmhWPqR7WtHw4AG0RoAWmVLj7YafPRfYF6u9WaCqWe3yMx_x-5cTxoxNg-J393nkeDan3TrkcS9ljmLSGXeF34WU&cid=CAQSSwBpAlJWIA3oPO780tOTM3SzL4bf69lJGNK7gC8SSKBNGHbdUnjOmTdlnzKq0lYx1cfXjtAColwpPYveH_NC9Fr_rrhMzap4O8CFmRgB&dv3_ver=m202306200101&rfl=https%3A%2F%2Fsharemods.com%2F&ds=l&xdt=1&iif=1&cor=6171422387587972000&adk=2857193498&idt=168&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

597e4ec7ca2b12f9150e02e04096849d6b06061b09c2d131f1d2225871eedfdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 19:13:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78877
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 16731591232229431525
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 12 Aug 2023 19:13:10 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230726/r20110914/ Frame 1C14 30 KB
11 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230726/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b2c524428c1a3604e3d1cdc61c2ae371a8f2fc767f801180fcf892db9e07c3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 04:32:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 45340
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11572
x-xss-protection: 0
server: cafe
etag: 5014499061205845695
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Aug 2023 04:32:07 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 1C14 41 KB
13 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 05:44:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 127379
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 28 Jul 2024 05:44:48 GMT

GET
DATA 200
OK truncated
/ Frame F407 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99e9e2e144c17187691b292ae39129c3800e5dba370de5b6c6a674c3f491b5b2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 1C14 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 040b25151a29ddac4af17304b97f19b43012ee06456f8478b6be0e3f7ba78c56

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FC24 22 KB
8 KB 40ms
40ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 244348
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 21:15:19 GMT
expires: Fri, 26 Jul 2024 21:15:19 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js Show response
pagead2.googlesyndication.com/bg/ Frame F5C3 37 KB
14 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c471d1bf07ba5441702ad12d43d231b01425b440789f166b19307c5c6e5aede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 21:53:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69258
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14619
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 28 Jul 2024 21:53:29 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 36BE 144 KB
24 KB 154ms
73ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45d23b2f9edacad6c769d8c9bf89290757456f30a6fb91d32e3efee4405131de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 219281
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 24394
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 04:13:06 GMT
expires: Sat, 27 Jul 2024 04:13:06 GMT
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2C94 0
0 181ms
86ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuw_wlwuSmHq_HaiUWcjyHo9gXwbX0RpOBQsodHkL1A-Ad2wWcOjliYhlc3xV6GoesOumUNcBTCDfbm_l4aLQZWl8g2jCrbaylQrrj9n114Wi125EtgiiSHkTFAcM4jra5y96-CUiiCvQrorcnqkMDpobuOmfURFPnjjDVtXOhCnAvLyfSsOVfZt920tduGV7O56OWkS_28unVez34wOfDe6ByadqseoDiY_A9J88haXAHX6wI6QNzyNOYaBOH-jU-S1fzKZbA7GU4_ZpBDu1A6S0NWNh0dgEQk85z93dGXRmT8eb2R3wSUorfYyGigm4Zwrpb_2RNB_55BF_9TCyxhAVLGRArlfuqQoaBN4iAoGP_Rksc_MBcfzozqjSMmrOhR7GVXsJSGLELnvN34ozwGAEHj6RJFKPUzF0bfIo2gMz7frgPNZQfZTqS4UWaLG_3FdcfYRmFrM7zfTM8EKjApejG3Pe4NPX0XkUCxdRT22VeHdSJGaOB-LMATWkdQdFroLT8w7-UYqnMmUtS7J44fE16aDzes-GuhiR2SKOcKS_JPPs6UhRvCaLA5Bf4kZyii_6w9SXs-00TottY-uyrs569iU2rQ51rYr5-yO0TpXiSVfycGJYUYHb3i0fP6c6zGLFvH697Hywri8vLF9FBMatnfTf6-7eOZEnZsHRNxtvPsAvO_vDQFQeRg-FRNn994GAkNsmd9uiou3KGOt_a9TA9pQTmycVv1AZF-4DmgXaILLVEMoZY9TQYtP3Tb5hruKA6VmKA_79BMz4UXuEyas1fGOt06efyhFVQjjIaDTS_GU730r8ndqho-KpGafizQIEnfJTe7tWirklUJl_gxqlAk3e3a_i9jVzqutAHJ0cHLkkY30cN7bpIUh-YMqLn81JDo1rZz1M48MIYQPRULg0vap_clYrFqcQyewGNaH4G5zArVVxAx0m6BPxFuoPE1vLC4yGnfAdxMO-Y7t7oPRR88-1Zx66P6I9HWY_RqLlNwCaSa7NoocxXzctdxFPm4IOZep4VXmm0w_OeGRVYOdamgRF3o0cD7t7f0H8BptpdDHWAYxgNQw0vqDsgnrtLv2iIP_UcmTv45fjmNguwRoc599gBSs_KvKIgnxJt0TF0Smi-ZuF75jqHbZL7bRFurjc_HB-Fuz6V4TfiUCNu_D9xnb-VRpXE0QmnuU8JBqsH0tdkJAleF-LD5hf5wq8mJnpYKSERmjfFyGDGpjucrdnAJudSS-TVz3Q7tepMiSA5mKkLF_WUXeRVtUO3Yywh0_cGTaP5XrMy6-QEjZzPSlSVtfAAGDPWOT6Yhx9nEmNkKH-t5Bun-aeXFKgeKItfyZCCrFiQvHMnE8odMCR0A&sai=AMfl-YTztweY9Y79hKPVFrgR9E9w1Y3S0lQlL5w_4vY6uP3WklXSfTo3_nSIuu-9i1zfD_o5a5rO7ia8Bu2ThVmPTUg38CrF5tj-Ca-cii8PjodZVseABUI36nvJzssvALp5yEYaFfHJUSQ1sqAxsjfcViNiY3QJ68SwhAas7seNslY3DPKsVuCI3akENyn5ckqI5dAIx-alzNJcvxn3PYbAjzKSxdK-BqKc264B0gJ8kY7uErlcppQ1JRhvR33vwyTkznvhlXE1q8QSuJHG589pHTQMAzjIcq1Q&sig=Cg0ArKJSzALZ7rDxPILZEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=234&cbvp=1&cstd=232&cisv=r20230726.53288&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 30 Jul 2023 17:07:47 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sun, 30 Jul 2023 17:07:47 GMT

GET
H2 200 93656
tags.bluekai.com/site/ Frame 2C94 62 B
570 B 289ms
182ms Image
image/gif 69.192.160.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/93656?limit=0&phint=event%3Dimp&phint=aid%3D6531095&phint=cid%3D30236776&phint=crid%3D195453191&phint=pid%3D372196317
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.192.160.219 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-219.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Sun, 30 Jul 2023 17:07:47 GMT
content-length: 62
bk-server: 41e
content-type: image/gif

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame D731 22 KB
8 KB 40ms
39ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 244348
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 21:15:19 GMT
expires: Fri, 26 Jul 2024 21:15:19 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 9DB2 144 KB
24 KB 113ms
41ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45d23b2f9edacad6c769d8c9bf89290757456f30a6fb91d32e3efee4405131de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 219281
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 24394
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 04:13:06 GMT
expires: Sat, 27 Jul 2024 04:13:06 GMT
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame F407 0
0 176ms
89ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstlijbtNa1EoWqX6YX8VeVeovjEeLejmzdRRzT-HW4E7wrHZhxb1gNx1QEhq9LHkIklAYmoQdawD9HuUmybFZnutdUstpYy_sIQiJQSUdige_QXr3cTZB3yhK-6UKrDDzJqQdCOeB5pXQtsXeuTvAUcv08lpTRG-W86T08tTr5NHcqIcWtfDIXzp0KTEuZgO4pKAmt87ZnPwU4daHwZtlDoJzfk9Ir11FMQADv6hiIUj7c-PvHsZIl6hav19ET2ruqzYIScUB53-ky00GJQ3Ly26oX8n7eeKAvKM5jGD1WPc_3WtmogK2We_oICu2d140NHa8z2-h1P_GMBlgqe0pPKns0E81AVPV5sbH3jGCnJakTwvxKI1k6HOYmiqLBspR4UFJOVo2w-QVF0ht8mSbjiAq9QKp6MfHGKR6EclOCd_HNyTJeYJz--kOAl71-DCrZCej-A5BwVb4eIj0rwVf71s7bd6phQ1bVaAuo2PZphPaADL15jIXYQcQ2J5mSMCAb00m8Bpq2ZHp7s3mjStQvgcJ-7VF3Jl-pe6-64cU3J6U_W-WJlIrLltuKe0oo-XgrBoPCmuqSV933KBV0VwGWZcpGHf_cgMa4qr8TM7vaMEjfPQAPDRhlqt6ryvEbxI_iFu1Ic4JnLNifqCinkuIj5MY4fMUtCFUl2d2fI5AqqXp8gdBM5z_kXJKcxwGgv91fkWDlPV3hZfXqAUvHyUH2IPn0H3w_lwVuoav4xYuSpIkd9g5-krvMc2V5edsD_LoFewhhx6l2repym0hN6ZU-Zf3IvhBPDejqRG1sgDnNAWriFDC26Te5LBYi_EgIsEFx6SDGwzIjhoLH7UKajEVb_kZsG7Aj-Hp5wA-8EwVxXKlCEUl-bx4XllM5Cae2RL5UuLul3Gl9I7PW9YxoU0XY5Fc_JgjlhB-LASaSyyeJWWKK6DaxSKGNMJEasZTlg9Zo-g0Q2EEH-J6irdHJ_Uqbqs4r12_yaJ6M2_FaNE_FgD58Ubf1GSUsr3WdSXqA-Veubo56KuTimCMLmmSOs6wTszjV4RgfphOyRqh23SEdq4S3M-M37zk1ZGPjnDrjnvgOomk7HYSVduEiIPl0MXOFfB4wZUDBO3ynabX4jsM9Jhn8qz3zZ3DzaMzNtdjQJojusT_B4mMI4CcJaFe0NuYxh6xEKuy5Biqp5t5BokMWI0OvL_1tdVOLMEce782TmeEqsJwplYgMl_otljYCfyaHy9HRbC692VH54lUGlb7PAZIhdQNgfX5_HZRYVxfjITk2mrQ849za6zlbBQ2UJyidakLEZbotu-HDtNC1RQtA4OSwW1zkV9PT_cojc0k1Ai8Gjxkgb6E9glTqpUE3X0NCq1_qiyA&sai=AMfl-YT4dzGRFc1JnHmQYzCNEnQ12ujOy_5ygQjFLYkdrSILHbWgYV06dZZGsPabAdwmFo1JUteXRhekrhDFWvggDFwu8kLzQpPtWWm-_gYhD86N3KlFGFFiZLTnQaOg7WJQDGOdOyaYq6IWsjF7ZLZ2Bg0veZEo2tAPfGda03t5X8Xq0Mq6nmuYFIom4G41HJOMVUlbUfHRP9iifrHQzup94RyTQxir2lT22uLkZ3CHDrDY2X6fQIaegwiD_BXu6PPxiF_HzVPESD8j2QoDlzsGvM0hnqwzWSUF&sig=Cg0ArKJSzNNP0_ABc6OVEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=140&cbvp=1&cstd=138&cisv=r20230726.60807&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 30 Jul 2023 17:07:47 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sun, 30 Jul 2023 17:07:47 GMT

GET
H2 200 93656
tags.bluekai.com/site/ Frame F407 62 B
571 B 456ms
356ms Image
image/gif 69.192.160.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/93656?limit=0&phint=event%3Dimp&phint=aid%3D6531095&phint=cid%3D30236776&phint=crid%3D195453191&phint=pid%3D372196317
Requested by: Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.192.160.219 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-219.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Sun, 30 Jul 2023 17:07:47 GMT
content-length: 62
bk-server: 2294
content-type: image/gif

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 996C 22 KB
8 KB 40ms
39ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 244348
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 27 Jul 2023 21:15:19 GMT
expires: Fri, 26 Jul 2024 21:15:19 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/17873952642992803351/Billboard/_export/ Frame 18F3 144 KB
24 KB 123ms
57ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17873952642992803351/Billboard/_export/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

19ba1e2e022493924700269f27eabf14f0aeefc4158afaf2c60a54c56d513a86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 171723
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 24373
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Jul 2023 17:25:44 GMT
expires: Sat, 27 Jul 2024 17:25:44 GMT
last-modified: Thu, 20 Jul 2023 11:20:18 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1C14 0
0 166ms
86ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssyEJGES3gUs6oxOHQ3Gm08UCTc0qLdDe1CrWByGkGD2OoAqnIAC9uM2KekLCFtmXa-VQj5nGsGYWnr4n4psDJt-S56bXdm2tOP8vFfuSfCmyTuKa-w8iM8weyRu-4czi8akjz_9H9kXcuHQGrIX3D6XgtGoelVzTrI2zh_xMpmXhYX1-mG-mOHHWZrG3zmFK7TUciedPS9kl7uWbXEKV0UNGkKM8yMy1QKsvP4q3lmsK3NGRo8bg3I4QECZIbCPhmhScKuLiEKUmCeDb5jG9x8zEpAZKsYzk8PQLHyBoC2BnOu8Wx44w6CuHsKZUlqgAZqg2RzTt-B90P0B2ReWtoy1l3Wa7GjjCcuYaLnNwqxJbh_xATARnIerWcU1TY9CUiXrIziC5deOsVC4VXNB8NguovFwecM__dHDSL7g51zZH7U5zgy-m5iByql7UyFMm2FGHOprwZzzV1hiK9DCjRCw-FF4XfwtBJEr5croc1N10NG7OmjM8yyiOlUGOAbz2EA3tXl1jCaxEBZRIJaRIUrhNdJW_q500p3heJ5hjo6-oxs_OoR2XsZiISaDPuLdHzY-DE-6Uo84DjTUq9z2r0z0WbDipG3iJH0UJLS-h8d6wjwxqxSo7tJ8CAN52tRrymhBgq3zUngmZ7PaLCl1Y8_e0MpDT8TboLuH2GUfiAGZLlxuj_EpwUERVLqd-02Ufi_oanPfWVIgk31Z-uMYcseO8f3a39ACPrBf2zGFqx21TnHU2yAEMG7GigKLIzggcOENPaF3xAjLzPPWuQgIuXydg9BkMDx1OCGV0FE7X61HPqNy31AZNKZ1E47m3hPbeAmLvmrefAnsGvsTVzlwQiCimg0kUUHme_JshMvJgteE-QNZiyWchumOQ2iHZj3KxXU7iiZ6mYUPG6cmMfEJoYL_7wNM4zbouYkRrYWZPac9yACtxezSGjVxaL2uVMp56YUqtSsb7b-7z3kEOnldkIU0NuBzDJI0m5JRWVh5TH08IcJoLpXM4FtIBur4XjsRoiDPhkmoGJJ6LY35C4c3PTYo77ZeQKdxoSS8LsUQvMfIkOQASURMIVesAOJmYAiL4cwuTWal7tMjIgheMOSMecbqGqhn28zt8PpFZlLkT4cfENk-rn0slA1eucEKW6MoNaC7-J4d64UlJMoc5L29NMRwyQz2_mpdoH_4CnU8dQukFnv93eqsN5L5Y_yhtu4M0zMVKazT0-wizNBx1Ou0OfSfr-X2LF-ArecthHkeOiDa0c04r4b8GiMhnxXOhYjaEagBbWaBl_5Q1iW98iDesdck4eUyE6hOPRGgua7o8rqBKnBxUEGJliPv4_LxiZGPZIWRIY5kB7NwE5jF0R9FC5G-zmZAw&sai=AMfl-YQRHPk9_kVFsAyrkrvd6bb1iYQ01-P5xp3W8Yltav8I45v3v_d7TiIXfwneTrur9YktENKU1qCd_8lM5f2qvST9LPwzHj0bE10Cr3woBZ-CqiVrIToSJAdcnJP4iZ_uhP-BI19jzFzi7LWVh_K7e7e93pRzE9ZO0licEpwzIQj43ay4vFhxdzzJzBSIMZ-L1x9ZWvyLxlroIGV2cokIk34YPwfrPL6dgb3V7tLyp54FRutQLhKcbdoycE3pxoiXjDOZaYOazlkuuagqVKcwVOd91MWQvZX0&sig=Cg0ArKJSzNsJEUvZrAuxEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=137&cbvp=1&cstd=136&cisv=r20230726.70802&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 30 Jul 2023 17:07:47 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sun, 30 Jul 2023 17:07:47 GMT

GET
H2 200 93656
tags.bluekai.com/site/ Frame 1C14 62 B
570 B 294ms
201ms Image
image/gif 69.192.160.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/93656?limit=0&phint=event%3Dimp&phint=aid%3D6531095&phint=cid%3D30236776&phint=crid%3D195453209&phint=pid%3D371870359
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.192.160.219 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-219.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Sun, 30 Jul 2023 17:07:47 GMT
content-length: 62
bk-server: 41e
content-type: image/gif

GET
H2 200 main.19.8.434.js Show response
static.adsafeprotected.com/ Frame 2C94 207 KB
65 KB 153ms
46ms Script
application/javascript 2600:9000:223f:3e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.434.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/1574389/72805578/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1013543513&ias_pubId=pub-7383171830614216&ias_chanId=1&ias_placementId=20390324281&bidurl=https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0g_eJ-MO7Mzd7jJiNQxlBhC
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:3e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4edf37d240c72f41cf96d12cfff4407d66226a3afa1f8109824d03ebe54be9d2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 24 Jul 2023 21:07:18 GMT
x-amz-version-id: qAsuaBHKvPMGjxqFerKb066Em7kDT_J7
content-encoding: gzip
via: 1.1 07a6f7d6fd9710cbcfc60fa67d44f04e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 504030
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 24 Jul 2023 19:17:38 GMT
server: AmazonS3
etag: W/"1f5f5321da98e6d89323d191f36c01c9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: 2yI8dBSnx2fI9n3ufryttqYHl8aE-Que8bJ92XfmoYCMJNr5-FWwwA==

GET
H2 200 main.19.8.434.js Show response
static.adsafeprotected.com/ Frame F407 207 KB
65 KB 200ms
100ms Script
application/javascript 2600:9000:223f:3e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.434.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/1574389/72805578/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1013543513&ias_pubId=pub-7383171830614216&ias_chanId=1&ias_placementId=20390324281&bidurl=https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0i62-VRZTlYG4W7AdVITpeh
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:3e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4edf37d240c72f41cf96d12cfff4407d66226a3afa1f8109824d03ebe54be9d2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 24 Jul 2023 21:07:18 GMT
x-amz-version-id: qAsuaBHKvPMGjxqFerKb066Em7kDT_J7
content-encoding: gzip
via: 1.1 07a6f7d6fd9710cbcfc60fa67d44f04e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 504030
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 24 Jul 2023 19:17:38 GMT
server: AmazonS3
etag: W/"1f5f5321da98e6d89323d191f36c01c9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: _gHuzAZy6iLlRDW6QneoPh3pvlZjAvfbOiHjQvhofEYK7cet-Pzekw==

GET
H2 200 main.19.8.434.js Show response
static.adsafeprotected.com/ Frame 1C14 207 KB
65 KB 234ms
136ms Script
application/javascript 2600:9000:223f:3e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.434.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/1574389/72805536/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1013543513&ias_pubId=pub-7383171830614216&ias_chanId=1&ias_placementId=20390324281&bidurl=https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0jLVf7c2xAheHkd9zhLv0dA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:3e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4edf37d240c72f41cf96d12cfff4407d66226a3afa1f8109824d03ebe54be9d2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 24 Jul 2023 21:07:18 GMT
x-amz-version-id: qAsuaBHKvPMGjxqFerKb066Em7kDT_J7
content-encoding: gzip
via: 1.1 07a6f7d6fd9710cbcfc60fa67d44f04e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 504030
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 24 Jul 2023 19:17:38 GMT
server: AmazonS3
etag: W/"1f5f5321da98e6d89323d191f36c01c9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: X9l9iNX75ummUp0ymbIncG9NjVAl0Kiz6yDnUjLkSAiOMebc6nvNwA==

GET
H3 200 fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js Show response
pagead2.googlesyndication.com/bg/ Frame FC24 37 KB
14 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c471d1bf07ba5441702ad12d43d231b01425b440789f166b19307c5c6e5aede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 21:53:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69258
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14619
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 28 Jul 2024 21:53:29 GMT

GET
H3 200 fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js Show response
pagead2.googlesyndication.com/bg/ Frame D731 37 KB
14 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c471d1bf07ba5441702ad12d43d231b01425b440789f166b19307c5c6e5aede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 21:53:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69258
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14619
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 28 Jul 2024 21:53:29 GMT

GET
H3 200 fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js Show response
pagead2.googlesyndication.com/bg/ Frame 996C 37 KB
14 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/fEcdG_B7pUQXAq0S1D0jGwFCW0QHifFmsZMHxcblrt4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c471d1bf07ba5441702ad12d43d231b01425b440789f166b19307c5c6e5aede

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 21:53:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69258
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14619
x-xss-protection: 0
last-modified: Mon, 24 Jul 2023 13:39:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 28 Jul 2024 21:53:29 GMT

GET
H3 200 DcmEnabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 9DB2 32 KB
11 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 06:58:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36587
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11558
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 31 Jul 2023 06:58:00 GMT

GET
H3 200 DcmEnabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 18F3 32 KB
11 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17873952642992803351/Billboard/_export/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17873952642992803351/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 06:58:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36587
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11558
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 31 Jul 2023 06:58:00 GMT

GET
H3 200 DcmEnabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 36BE 32 KB
11 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 06:58:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36587
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11558
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 31 Jul 2023 06:58:00 GMT

GET
H2

200

passback_970x250.js Show response
static.adsafeprotected.com/ Frame 2C94
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1574389/72805578/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1013543513&ias_pubId=pub-7383171830614216&ias_chanId=1&ias_placementId=20390324281&bi...
https://static.adsafeprotected.com/passback_970x250.js

3 KB
2 KB

40ms
40ms

Script
application/javascript

2600:9000:223f:3e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/passback_970x250.js
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:223f:3e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5d5e0d3e1cbfadb5c7a63053b5339d06457fe7a66c344a970a762a56123c5ec0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-version-id: .AUJIbFgg5lm.Sl5dxN6YT6RZNYioRMX
content-encoding: gzip
via: 1.1 07a6f7d6fd9710cbcfc60fa67d44f04e.cloudfront.net (CloudFront)
date: Thu, 27 Jul 2023 16:10:34 GMT
x-amz-cf-pop: FRA56-P5
age: 262634
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Fri, 18 Feb 2022 23:29:56 GMT
server: AmazonS3
etag: W/"094948b2d1170876fb8e76e432d87da6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: Ab-_55gYvIy_ca9JYShDigoxsjZyrrX4_ldoPtRO9vcVkHAGmyIe2A==

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
server: nginx
x-server-name: app12.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/passback_970x250.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 989F 91 KB
23 KB 44ms
44ms Script
application/javascript 2600:9000:223f:3e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:3e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 07a6f7d6fd9710cbcfc60fa67d44f04e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 26962291
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: TEHqwskXWJr3kZ0RGcmJcShAFzjl7M-wH4J96SyFuclUT8HWZa8edw==

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame F407 0
0 77ms
77ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstlijbtNa1EoWqX6YX8VeVeovjEeLejmzdRRzT-HW4E7wrHZhxb1gNx1QEhq9LHkIklAYmoQdawD9HuUmybFZnutdUstpYy_sIQiJQSUdige_QXr3cTZB3yhK-6UKrDDzJqQdCOeB5pXQtsXeuTvAUcv08lpTRG-W86T08tTr5NHcqIcWtfDIXzp0KTEuZgO4pKAmt87ZnPwU4daHwZtlDoJzfk9Ir11FMQADv6hiIUj7c-PvHsZIl6hav19ET2ruqzYIScUB53-ky00GJQ3Ly26oX8n7eeKAvKM5jGD1WPc_3WtmogK2We_oICu2d140NHa8z2-h1P_GMBlgqe0pPKns0E81AVPV5sbH3jGCnJakTwvxKI1k6HOYmiqLBspR4UFJOVo2w-QVF0ht8mSbjiAq9QKp6MfHGKR6EclOCd_HNyTJeYJz--kOAl71-DCrZCej-A5BwVb4eIj0rwVf71s7bd6phQ1bVaAuo2PZphPaADL15jIXYQcQ2J5mSMCAb00m8Bpq2ZHp7s3mjStQvgcJ-7VF3Jl-pe6-64cU3J6U_W-WJlIrLltuKe0oo-XgrBoPCmuqSV933KBV0VwGWZcpGHf_cgMa4qr8TM7vaMEjfPQAPDRhlqt6ryvEbxI_iFu1Ic4JnLNifqCinkuIj5MY4fMUtCFUl2d2fI5AqqXp8gdBM5z_kXJKcxwGgv91fkWDlPV3hZfXqAUvHyUH2IPn0H3w_lwVuoav4xYuSpIkd9g5-krvMc2V5edsD_LoFewhhx6l2repym0hN6ZU-Zf3IvhBPDejqRG1sgDnNAWriFDC26Te5LBYi_EgIsEFx6SDGwzIjhoLH7UKajEVb_kZsG7Aj-Hp5wA-8EwVxXKlCEUl-bx4XllM5Cae2RL5UuLul3Gl9I7PW9YxoU0XY5Fc_JgjlhB-LASaSyyeJWWKK6DaxSKGNMJEasZTlg9Zo-g0Q2EEH-J6irdHJ_Uqbqs4r12_yaJ6M2_FaNE_FgD58Ubf1GSUsr3WdSXqA-Veubo56KuTimCMLmmSOs6wTszjV4RgfphOyRqh23SEdq4S3M-M37zk1ZGPjnDrjnvgOomk7HYSVduEiIPl0MXOFfB4wZUDBO3ynabX4jsM9Jhn8qz3zZ3DzaMzNtdjQJojusT_B4mMI4CcJaFe0NuYxh6xEKuy5Biqp5t5BokMWI0OvL_1tdVOLMEce782TmeEqsJwplYgMl_otljYCfyaHy9HRbC692VH54lUGlb7PAZIhdQNgfX5_HZRYVxfjITk2mrQ849za6zlbBQ2UJyidakLEZbotu-HDtNC1RQtA4OSwW1zkV9PT_cojc0k1Ai8Gjxkgb6E9glTqpUE3X0NCq1_qiyA&sai=AMfl-YT4dzGRFc1JnHmQYzCNEnQ12ujOy_5ygQjFLYkdrSILHbWgYV06dZZGsPabAdwmFo1JUteXRhekrhDFWvggDFwu8kLzQpPtWWm-_gYhD86N3KlFGFFiZLTnQaOg7WJQDGOdOyaYq6IWsjF7ZLZ2Bg0veZEo2tAPfGda03t5X8Xq0Mq6nmuYFIom4G41HJOMVUlbUfHRP9iifrHQzup94RyTQxir2lT22uLkZ3CHDrDY2X6fQIaegwiD_BXu6PPxiF_HzVPESD8j2QoDlzsGvM0hnqwzWSUF&sig=Cg0ArKJSzNNP0_ABc6OVEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=465&vt=11&dtpt=325&dett=3&cstd=138&cisv=r20230726.60807&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:47 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 30 Jul 2023 17:07:47 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 2C94 43 B
216 B 491ms
234ms Image
image/gif 2600:1f18:1aca:4281:7da:fc2:b806:4edd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1574389&asId=510896fe-5ea6-51d3-6468-96f2afa8c103&tv=%7Bc:jS57PJ,pingTime:-3,time:321,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:970,h:250,t:272%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:321,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:272,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B62~0%5D,as:%5B62~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tLvVAJY+11%7C12%7C13%7C14%7C15%7C16*.1574389-72805578%7C161%7C1621%7C163%7C171%7C1721%7C173%7C181%7C1821%7C183%7C1911,idMap:16*,rmeas:1,rend:0,renddet:na,siq:273%7D&br=c
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:7da:fc2:b806:4edd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: nginx
x-server-name: dt22.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 2C94 43 B
216 B 374ms
120ms Image
image/gif 2600:1f18:1aca:4281:7da:fc2:b806:4edd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1574389&asId=510896fe-5ea6-51d3-6468-96f2afa8c103&tv=%7Bc:jS57PK,pingTime:-6,time:322,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:322,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:272,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B63~0%5D,as:%5B63~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tLvVAJY+11%7C12%7C13%7C14%7C15%7C16*.1574389-72805578%7C161%7C1621%7C163%7C171%7C1721%7C173%7C181%7C1821%7C183%7C1911,idMap:16*,rmeas:1,rend:0,renddet:na,siq:273%7D&tpiLookup=ao:sharemods.com*&br=c
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:7da:fc2:b806:4edd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: nginx
x-server-name: dt23.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1C14 0
0 77ms
77ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssyEJGES3gUs6oxOHQ3Gm08UCTc0qLdDe1CrWByGkGD2OoAqnIAC9uM2KekLCFtmXa-VQj5nGsGYWnr4n4psDJt-S56bXdm2tOP8vFfuSfCmyTuKa-w8iM8weyRu-4czi8akjz_9H9kXcuHQGrIX3D6XgtGoelVzTrI2zh_xMpmXhYX1-mG-mOHHWZrG3zmFK7TUciedPS9kl7uWbXEKV0UNGkKM8yMy1QKsvP4q3lmsK3NGRo8bg3I4QECZIbCPhmhScKuLiEKUmCeDb5jG9x8zEpAZKsYzk8PQLHyBoC2BnOu8Wx44w6CuHsKZUlqgAZqg2RzTt-B90P0B2ReWtoy1l3Wa7GjjCcuYaLnNwqxJbh_xATARnIerWcU1TY9CUiXrIziC5deOsVC4VXNB8NguovFwecM__dHDSL7g51zZH7U5zgy-m5iByql7UyFMm2FGHOprwZzzV1hiK9DCjRCw-FF4XfwtBJEr5croc1N10NG7OmjM8yyiOlUGOAbz2EA3tXl1jCaxEBZRIJaRIUrhNdJW_q500p3heJ5hjo6-oxs_OoR2XsZiISaDPuLdHzY-DE-6Uo84DjTUq9z2r0z0WbDipG3iJH0UJLS-h8d6wjwxqxSo7tJ8CAN52tRrymhBgq3zUngmZ7PaLCl1Y8_e0MpDT8TboLuH2GUfiAGZLlxuj_EpwUERVLqd-02Ufi_oanPfWVIgk31Z-uMYcseO8f3a39ACPrBf2zGFqx21TnHU2yAEMG7GigKLIzggcOENPaF3xAjLzPPWuQgIuXydg9BkMDx1OCGV0FE7X61HPqNy31AZNKZ1E47m3hPbeAmLvmrefAnsGvsTVzlwQiCimg0kUUHme_JshMvJgteE-QNZiyWchumOQ2iHZj3KxXU7iiZ6mYUPG6cmMfEJoYL_7wNM4zbouYkRrYWZPac9yACtxezSGjVxaL2uVMp56YUqtSsb7b-7z3kEOnldkIU0NuBzDJI0m5JRWVh5TH08IcJoLpXM4FtIBur4XjsRoiDPhkmoGJJ6LY35C4c3PTYo77ZeQKdxoSS8LsUQvMfIkOQASURMIVesAOJmYAiL4cwuTWal7tMjIgheMOSMecbqGqhn28zt8PpFZlLkT4cfENk-rn0slA1eucEKW6MoNaC7-J4d64UlJMoc5L29NMRwyQz2_mpdoH_4CnU8dQukFnv93eqsN5L5Y_yhtu4M0zMVKazT0-wizNBx1Ou0OfSfr-X2LF-ArecthHkeOiDa0c04r4b8GiMhnxXOhYjaEagBbWaBl_5Q1iW98iDesdck4eUyE6hOPRGgua7o8rqBKnBxUEGJliPv4_LxiZGPZIWRIY5kB7NwE5jF0R9FC5G-zmZAw&sai=AMfl-YQRHPk9_kVFsAyrkrvd6bb1iYQ01-P5xp3W8Yltav8I45v3v_d7TiIXfwneTrur9YktENKU1qCd_8lM5f2qvST9LPwzHj0bE10Cr3woBZ-CqiVrIToSJAdcnJP4iZ_uhP-BI19jzFzi7LWVh_K7e7e93pRzE9ZO0licEpwzIQj43ay4vFhxdzzJzBSIMZ-L1x9ZWvyLxlroIGV2cokIk34YPwfrPL6dgb3V7tLyp54FRutQLhKcbdoycE3pxoiXjDOZaYOazlkuuagqVKcwVOd91MWQvZX0&sig=Cg0ArKJSzNsJEUvZrAuxEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=466&vt=11&dtpt=329&dett=3&cstd=136&cisv=r20230726.70802&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:47 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 30 Jul 2023 17:07:47 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2C94 0
0 76ms
76ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuw_wlwuSmHq_HaiUWcjyHo9gXwbX0RpOBQsodHkL1A-Ad2wWcOjliYhlc3xV6GoesOumUNcBTCDfbm_l4aLQZWl8g2jCrbaylQrrj9n114Wi125EtgiiSHkTFAcM4jra5y96-CUiiCvQrorcnqkMDpobuOmfURFPnjjDVtXOhCnAvLyfSsOVfZt920tduGV7O56OWkS_28unVez34wOfDe6ByadqseoDiY_A9J88haXAHX6wI6QNzyNOYaBOH-jU-S1fzKZbA7GU4_ZpBDu1A6S0NWNh0dgEQk85z93dGXRmT8eb2R3wSUorfYyGigm4Zwrpb_2RNB_55BF_9TCyxhAVLGRArlfuqQoaBN4iAoGP_Rksc_MBcfzozqjSMmrOhR7GVXsJSGLELnvN34ozwGAEHj6RJFKPUzF0bfIo2gMz7frgPNZQfZTqS4UWaLG_3FdcfYRmFrM7zfTM8EKjApejG3Pe4NPX0XkUCxdRT22VeHdSJGaOB-LMATWkdQdFroLT8w7-UYqnMmUtS7J44fE16aDzes-GuhiR2SKOcKS_JPPs6UhRvCaLA5Bf4kZyii_6w9SXs-00TottY-uyrs569iU2rQ51rYr5-yO0TpXiSVfycGJYUYHb3i0fP6c6zGLFvH697Hywri8vLF9FBMatnfTf6-7eOZEnZsHRNxtvPsAvO_vDQFQeRg-FRNn994GAkNsmd9uiou3KGOt_a9TA9pQTmycVv1AZF-4DmgXaILLVEMoZY9TQYtP3Tb5hruKA6VmKA_79BMz4UXuEyas1fGOt06efyhFVQjjIaDTS_GU730r8ndqho-KpGafizQIEnfJTe7tWirklUJl_gxqlAk3e3a_i9jVzqutAHJ0cHLkkY30cN7bpIUh-YMqLn81JDo1rZz1M48MIYQPRULg0vap_clYrFqcQyewGNaH4G5zArVVxAx0m6BPxFuoPE1vLC4yGnfAdxMO-Y7t7oPRR88-1Zx66P6I9HWY_RqLlNwCaSa7NoocxXzctdxFPm4IOZep4VXmm0w_OeGRVYOdamgRF3o0cD7t7f0H8BptpdDHWAYxgNQw0vqDsgnrtLv2iIP_UcmTv45fjmNguwRoc599gBSs_KvKIgnxJt0TF0Smi-ZuF75jqHbZL7bRFurjc_HB-Fuz6V4TfiUCNu_D9xnb-VRpXE0QmnuU8JBqsH0tdkJAleF-LD5hf5wq8mJnpYKSERmjfFyGDGpjucrdnAJudSS-TVz3Q7tepMiSA5mKkLF_WUXeRVtUO3Yywh0_cGTaP5XrMy6-QEjZzPSlSVtfAAGDPWOT6Yhx9nEmNkKH-t5Bun-aeXFKgeKItfyZCCrFiQvHMnE8odMCR0A&sai=AMfl-YTztweY9Y79hKPVFrgR9E9w1Y3S0lQlL5w_4vY6uP3WklXSfTo3_nSIuu-9i1zfD_o5a5rO7ia8Bu2ThVmPTUg38CrF5tj-Ca-cii8PjodZVseABUI36nvJzssvALp5yEYaFfHJUSQ1sqAxsjfcViNiY3QJ68SwhAas7seNslY3DPKsVuCI3akENyn5ckqI5dAIx-alzNJcvxn3PYbAjzKSxdK-BqKc264B0gJ8kY7uErlcppQ1JRhvR33vwyTkznvhlXE1q8QSuJHG589pHTQMAzjIcq1Q&sig=Cg0ArKJSzALZ7rDxPILZEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=578&vt=11&dtpt=344&dett=3&cstd=232&cisv=r20230726.53288&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: sharemods.com
URL: https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:47 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 30 Jul 2023 17:07:47 GMT

GET
H2

200

passback_970x250.js Show response
static.adsafeprotected.com/ Frame F407
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1574389/72805578/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1013543513&ias_pubId=pub-7383171830614216&ias_chanId=1&ias_placementId=20390324281&bi...
https://static.adsafeprotected.com/passback_970x250.js

3 KB
2 KB

44ms
44ms

Script
application/javascript

2600:9000:223f:3e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/passback_970x250.js
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:223f:3e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5d5e0d3e1cbfadb5c7a63053b5339d06457fe7a66c344a970a762a56123c5ec0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-version-id: .AUJIbFgg5lm.Sl5dxN6YT6RZNYioRMX
content-encoding: gzip
via: 1.1 07a6f7d6fd9710cbcfc60fa67d44f04e.cloudfront.net (CloudFront)
date: Thu, 27 Jul 2023 16:10:34 GMT
x-amz-cf-pop: FRA56-P5
age: 262634
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Fri, 18 Feb 2022 23:29:56 GMT
server: AmazonS3
etag: W/"094948b2d1170876fb8e76e432d87da6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: PvVmUv7vNn2P4FIyCv02XGmNR9iXrHvmncyV3cmNtblh43vkSawz0g==

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
server: nginx
x-server-name: app04.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/passback_970x250.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame FE00 91 KB
23 KB 52ms
52ms Script
application/javascript 2600:9000:223f:3e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:3e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 07a6f7d6fd9710cbcfc60fa67d44f04e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 26962291
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: jJlANjTdxEWpMKcJVcRiJrjN-oEgUr8On_0nNasoy_GLvUGyMPngfw==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 2C94 43 B
216 B 334ms
118ms Image
image/gif 2600:1f18:1aca:4281:7da:fc2:b806:4edd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1574389&asId=510896fe-5ea6-51d3-6468-96f2afa8c103&tv=%7Bc:jS57Qo,pingTime:-2,time:362,type:a,im:%7Bsf:0,pci:%7Btdr:61%7D,pom:1,prf:%7BbeA:615,beZ:616,mfA:871,cmA:872,inA:873,inZ:877,prA:877,prZ:883,si:888,poA:889,poZ:902,cmZ:902,mfZ:902,loA:937,loZ:940,ltA:978,ltZ:978,mdA:617,mdZ:817%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:970.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:970,h:250,t:272%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:362,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:272,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B104~0%5D,as:%5B104~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tLvVAJY+11%7C12%7C13%7C14%7C15%7C16*.1574389-72805578%7C161%7C1621%7C163%7C171%7C1721%7C173%7C181%7C1821%7C183%7C1911,idMap:16*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:273,sinceFw:88,readyFired:true%7D&br=c
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:7da:fc2:b806:4edd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: nginx
x-server-name: dt02.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F407 43 B
216 B 318ms
120ms Image
image/gif 2600:1f18:1aca:4281:7da:fc2:b806:4edd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1574389&asId=a9dfcc90-f508-5502-ebd1-e78a6528ce77&tv=%7Bc:jS57QG,pingTime:-3,time:373,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:970,h:250,t:335%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:373,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:335,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B43~0%5D,as:%5B43~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tLvVAK5+11%7C12%7C13%7C14%7C15%7C161%7C1621%7C163%7C164%7C17*.1574389-72805578%7C171%7C1721%7C173%7C181%7C1821%7C183%7C1911,idMap:17*,rmeas:1,rend:0,renddet:na,siq:336%7D&br=c
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:7da:fc2:b806:4edd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: nginx
x-server-name: dt01.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F407 43 B
216 B 316ms
119ms Image
image/gif 2600:1f18:1aca:4281:7da:fc2:b806:4edd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1574389&asId=a9dfcc90-f508-5502-ebd1-e78a6528ce77&tv=%7Bc:jS57QH,pingTime:-6,time:374,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:374,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:335,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B44~0%5D,as:%5B44~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tLvVAK5+11%7C12%7C13%7C14%7C15%7C161%7C1621%7C163%7C164%7C17*.1574389-72805578%7C171%7C1721%7C173%7C181%7C1821%7C183%7C1911,idMap:17*,rmeas:1,rend:0,renddet:na,siq:336%7D&tpiLookup=ao:sharemods.com*&br=c
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:7da:fc2:b806:4edd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: nginx
x-server-name: dt26.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2

200

passback_970x250.js Show response
static.adsafeprotected.com/ Frame 1C14
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1574389/72805536/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1013543513&ias_pubId=pub-7383171830614216&ias_chanId=1&ias_placementId=20390324281&bi...
https://static.adsafeprotected.com/passback_970x250.js

3 KB
2 KB

43ms
43ms

Script
application/javascript

2600:9000:223f:3e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/passback_970x250.js
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:223f:3e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5d5e0d3e1cbfadb5c7a63053b5339d06457fe7a66c344a970a762a56123c5ec0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-version-id: .AUJIbFgg5lm.Sl5dxN6YT6RZNYioRMX
content-encoding: gzip
via: 1.1 07a6f7d6fd9710cbcfc60fa67d44f04e.cloudfront.net (CloudFront)
date: Thu, 27 Jul 2023 16:10:34 GMT
x-amz-cf-pop: FRA56-P5
age: 262634
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Fri, 18 Feb 2022 23:29:56 GMT
server: AmazonS3
etag: W/"094948b2d1170876fb8e76e432d87da6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: xQuBbwqNMdd7-mzOGxRdSgouMfxLhsOSGJi-7jkh54DKeOzA24HveA==

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
server: nginx
x-server-name: app14.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/passback_970x250.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 567A 91 KB
23 KB 41ms
41ms Script
application/javascript 2600:9000:223f:3e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:3e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 07a6f7d6fd9710cbcfc60fa67d44f04e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 26962291
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: rj8jsgjo4dfIWKrtvPU-tWQyQyXjhNplhTKxttwCHzkyfB689v6oQg==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F407 43 B
217 B 277ms
118ms Image
image/gif 2600:1f18:1aca:4281:7da:fc2:b806:4edd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1574389&asId=a9dfcc90-f508-5502-ebd1-e78a6528ce77&tv=%7Bc:jS57Rj,pingTime:-2,time:412,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:574,beZ:575,mfA:903,cmA:903,inA:903,inZ:904,prA:904,prZ:907,si:909,poA:910,poZ:918,cmZ:918,mfZ:918,loA:948,loZ:948,ltA:985,ltZ:986,mdA:575,mdZ:808%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:970.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:970,h:250,t:335%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:412,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:335,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B82~0%5D,as:%5B82~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tLvVAJY+11%7C12%7C13%7C14%7C15%7C16.1574389-72805578%7C161%7C1621%7C163%7C164%7C17*.1574389-72805578%7C171%7C1721%7C173%7C181%7C1821%7C183%7C1911,idMap:17*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:na,siq:336,sinceFw:76,readyFired:true%7D&br=c
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:7da:fc2:b806:4edd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: nginx
x-server-name: dt24.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C14 43 B
216 B 268ms
121ms Image
image/gif 2600:1f18:1aca:4281:7da:fc2:b806:4edd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1574389&asId=f283cf6e-9587-5286-cd16-d433421d8b17&tv=%7Bc:jS57Rv,pingTime:-3,time:422,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:970,h:250,t:395%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:422,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:395,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B32~0%5D,as:%5B32~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tLvVAK7+11%7C12%7C13%7C14%7C15%7C161%7C162%7C163%7C164%7C171%7C1721%7C173%7C174%7C18*.1574389-72805536%7C181%7C1821%7C183%7C1911,idMap:18*,rmeas:1,rend:0,renddet:na,siq:396%7D&br=c
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:7da:fc2:b806:4edd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: nginx
x-server-name: dt25.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C14 43 B
216 B 379ms
233ms Image
image/gif 2600:1f18:1aca:4281:7da:fc2:b806:4edd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1574389&asId=f283cf6e-9587-5286-cd16-d433421d8b17&tv=%7Bc:jS57Rw,pingTime:-6,time:423,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:423,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:395,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B33~0%5D,as:%5B33~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tLvVAK7+11%7C12%7C13%7C14%7C15%7C161%7C162%7C163%7C164%7C171%7C1721%7C173%7C174%7C18*.1574389-72805536%7C181%7C1821%7C183%7C1911,idMap:18*,rmeas:1,rend:0,renddet:na,siq:396%7D&tpiLookup=ao:sharemods.com*&br=c
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:7da:fc2:b806:4edd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: nginx
x-server-name: dt10.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FC24 0
20 B 75ms
75ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BIMEX45jGZJvkAdub9u8P1I-NgAMAAAAAOAHgBAI&bg=!Z2SlZDDNAAZGOVy5Zjk7ADkAdvg8WtHfnq6SVA9ok9WZFk3qgEJGRDzpDGaWx2RG1qswSZCevNv-AO1-DATDW2lHaroVvYvxKWsCAAABBVIAAAAFaAEHmQLxakSTJVHS5R2hAKCD6WnOvsMUMhwytv2nHIG5dIJKEQADXvpO5SvzieVNxD1ufQf2V1E4jCiFDQaBSIqNXCYC0lc1oEkznPG9228ZOS1VnfeYhID0I0QZtvGTjoJNmppf_W_6gsuYoQ9OwOFdIXIBaj-7YNDfZeCVphtn5LqEAH0j12XwSei19cS4MjfP5cSUXHB7Zl8w7_Ex4giJCHKorIEnbiPeqgLoMzFCuMaZ5bVRfryXAQ4AQ-noJv0f1dC7GuNlcxZc6NuCODxEge0EZFusezC_5prGubxUmERoi2dECiWg2XPTG7Z5WuGvfPSAVl090YL17hSBbTUNHIs1npa-z5N-pGmNZBuyrQAMGYFTZgSKiX4HqbcZhCPjmdELhOavT_uWwNV-y0LmduQEqmPOa7g-B6bMytBMha67Em3dK1M6gDixJmnSZOQI9bRExs2EErbEonBFoBTUJrAXAEtF35fTGoquqnmhSI7xeGSAOaEMPYSy2HhnUO09Uny73ChCeTXlw7bLofUR1vapNV4GI67RBtpFCyumuy5784IBSFBPqd3wmA38hn8W8YYFtvtcQDm7UNz0p5hTUcxJ-qAS2pEPlehPVsgYtUJ9EXUKXOBK-nvY_xH9J3YZCYUUKT3XYd5fE9jmvpf45HeeB_nKolzqW2IxXUbiUdtNXyKVsuUYzHzXxTN6IsWQjYMlPTWfBX5fctUNiQugKuLNckkFqVG0IlzGbakULY_2fZhVM3z4GU5LA9p1UCVy4h0rXc51rowZVuuNJIONgxXbuv-WD6ojO6j-oKbuu8obu-fThF6rMP-msfK26s6ryznYL12AwhEr3nawq8JvAmGi6KocYKtAKYahgRbQ_fKxJRNc8FmfTDL-F-psOWjPCMFymKX1cTv6NJalcfnPyl6r8VWF9pnJ9aMVGlBAvBEX_nL92B1MRy-kZXcyQS7wMbTUN9eoX5YgdsaNkSzxchYM4GKmo8ZMmPC2ZYodrlt9jldW

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cta1.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 36BE 1 KB
1 KB 42ms
41ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/cta1.png

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d806dcaf1e89bb001644bf7162339c90aff397aa91c6bc1291d7459eca603951

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 11:42:20 GMT
x-content-type-options: nosniff
age: 105927
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1369
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 28 Jul 2024 11:42:20 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 36BE 1 KB
1 KB 48ms
46ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/cta.png

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

60b1adf9dddc31c4bd262ae18eee19349d1010faad6154453824d4c920e714d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:36:40 GMT
x-content-type-options: nosniff
age: 178267
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1265
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 27 Jul 2024 15:36:40 GMT

GET
H3 200 Price.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 36BE 6 KB
6 KB 58ms
56ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/Price.png

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5817e6e47f82803838a7515614e2da2c7980c3a23dbc94fc9c3ba1136ccb55a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 04:13:07 GMT
x-content-type-options: nosniff
age: 219280
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5700
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 27 Jul 2024 04:13:07 GMT

GET
H3 200 Prod.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 36BE 16 KB
16 KB 51ms
48ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/Prod.png

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f6b51bc4697ce07a62090761e4c04bf7b7c1d6ed8944b3fde69824fcec3d392

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 09:03:07 GMT
x-content-type-options: nosniff
age: 201880
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16160
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 27 Jul 2024 09:03:07 GMT

GET
H3 200 Date.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 36BE 2 KB
2 KB 55ms
53ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/Date.png

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b0a314f90228259924bcecdfcd26c4d9e320470f783de5cb6b7f94e82b0e45e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 21:28:31 GMT
x-content-type-options: nosniff
age: 243556
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1717
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jul 2024 21:28:31 GMT

GET
H3 200 HL.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 36BE 3 KB
3 KB 55ms
53ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/HL.png

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c413612cb15ad9d96ed9a55afb4c2a953b97301322dd908281d5a09a1425d47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 05:39:02 GMT
x-content-type-options: nosniff
age: 214125
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3246
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 27 Jul 2024 05:39:02 GMT

GET
H3 200 Visual.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 36BE 7 KB
7 KB 49ms
47ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/Visual.png

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

df4a8d6a9c3e1ec8ae8f5aba56d3afd69faaf5e9f71308746d60b492356494ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 07:00:20 GMT
x-content-type-options: nosniff
age: 122847
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7142
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 28 Jul 2024 07:00:20 GMT

GET
H3 200 BG3.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 36BE 19 KB
19 KB 91ms
89ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/BG3.png

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b5e6b25f2add646c0844f07a435fb9c670c15483419ac4a62924f003b5f83440

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 07:00:20 GMT
x-content-type-options: nosniff
age: 122847
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19565
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 28 Jul 2024 07:00:20 GMT

GET
H3 200 BG1.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 36BE 27 KB
27 KB 67ms
65ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/BG1.png

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

464314e351596dfa30b39e7d5b45233640e87f6b3901d41081d60b141cf9a633

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 07:00:20 GMT
x-content-type-options: nosniff
age: 122847
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27966
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 28 Jul 2024 07:00:20 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 36BE 13 KB
13 KB 79ms
77ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/logo.png

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c1a27fc22ddf3d27e1298f4d518780003cf2c1fdc24fbcc5af0439f49a9b6434

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 07:00:20 GMT
x-content-type-options: nosniff
age: 122847
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13119
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 28 Jul 2024 07:00:20 GMT

GET
H3 200 cta1.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 9DB2 1 KB
1 KB 47ms
45ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/cta1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d806dcaf1e89bb001644bf7162339c90aff397aa91c6bc1291d7459eca603951

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 11:42:20 GMT
x-content-type-options: nosniff
age: 105927
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1369
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 28 Jul 2024 11:42:20 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 9DB2 1 KB
1 KB 48ms
46ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

60b1adf9dddc31c4bd262ae18eee19349d1010faad6154453824d4c920e714d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 15:36:40 GMT
x-content-type-options: nosniff
age: 178267
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1265
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 27 Jul 2024 15:36:40 GMT

GET
H3 200 Price.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 9DB2 6 KB
6 KB 65ms
63ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/Price.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5817e6e47f82803838a7515614e2da2c7980c3a23dbc94fc9c3ba1136ccb55a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 04:13:07 GMT
x-content-type-options: nosniff
age: 219280
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5700
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 27 Jul 2024 04:13:07 GMT

GET
H3 200 Prod.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 9DB2 16 KB
16 KB 60ms
58ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/Prod.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f6b51bc4697ce07a62090761e4c04bf7b7c1d6ed8944b3fde69824fcec3d392

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 09:03:07 GMT
x-content-type-options: nosniff
age: 201880
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16160
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 27 Jul 2024 09:03:07 GMT

GET
H3 200 Date.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 9DB2 2 KB
2 KB 65ms
63ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/Date.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b0a314f90228259924bcecdfcd26c4d9e320470f783de5cb6b7f94e82b0e45e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 27 Jul 2023 21:28:31 GMT
x-content-type-options: nosniff
age: 243556
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1717
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 26 Jul 2024 21:28:31 GMT

GET
H3 200 HL.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 9DB2 3 KB
3 KB 64ms
62ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/HL.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c413612cb15ad9d96ed9a55afb4c2a953b97301322dd908281d5a09a1425d47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 05:39:02 GMT
x-content-type-options: nosniff
age: 214125
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3246
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 27 Jul 2024 05:39:02 GMT

GET
H3 200 Visual.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 9DB2 7 KB
7 KB 57ms
55ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/Visual.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

df4a8d6a9c3e1ec8ae8f5aba56d3afd69faaf5e9f71308746d60b492356494ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 07:00:20 GMT
x-content-type-options: nosniff
age: 122847
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7142
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 28 Jul 2024 07:00:20 GMT

GET
H3 200 BG3.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 9DB2 19 KB
19 KB 105ms
103ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/BG3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b5e6b25f2add646c0844f07a435fb9c670c15483419ac4a62924f003b5f83440

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 07:00:20 GMT
x-content-type-options: nosniff
age: 122847
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19565
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 28 Jul 2024 07:00:20 GMT

GET
H3 200 BG1.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 9DB2 27 KB
27 KB 96ms
94ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/BG1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

464314e351596dfa30b39e7d5b45233640e87f6b3901d41081d60b141cf9a633

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 07:00:20 GMT
x-content-type-options: nosniff
age: 122847
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27966
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 28 Jul 2024 07:00:20 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/ Frame 9DB2 13 KB
13 KB 101ms
99ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c1a27fc22ddf3d27e1298f4d518780003cf2c1fdc24fbcc5af0439f49a9b6434

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728579573010158645/Billboard/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 07:00:20 GMT
x-content-type-options: nosniff
age: 122847
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13119
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 11:17:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 28 Jul 2024 07:00:20 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C14 43 B
216 B 365ms
236ms Image
image/gif 2600:1f18:1aca:4281:7da:fc2:b806:4edd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1574389&asId=f283cf6e-9587-5286-cd16-d433421d8b17&tv=%7Bc:jS57RN,pingTime:-2,time:440,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:567,beZ:568,mfA:957,cmA:957,inA:957,inZ:958,prA:958,prZ:960,si:962,poA:963,poZ:969,cmZ:969,mfZ:969,loA:990,loZ:991,ltA:1007,ltZ:1007,mdA:568,mdZ:820%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:970.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:970,h:250,t:395%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:440,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:395,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B50~0%5D,as:%5B50~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tLvVAJY+11%7C12%7C13%7C14%7C15%7C16.1574389-72805578%7C161%7C162%7C163%7C164%7C17.1574389-72805578%7C171%7C1721%7C173%7C174%7C18*.1574389-72805536%7C181%7C1821%7C183%7C1911,idMap:18*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:na,siq:396,sinceFw:44,readyFired:true%7D&br=c
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:7da:fc2:b806:4edd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: nginx
x-server-name: dt25.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 IAS_PassbackAds_970x250.png
static.adsafeprotected.com/ Frame 2C94 28 KB
29 KB 45ms
42ms Image
image/png 2600:9000:223f:3e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/IAS_PassbackAds_970x250.png
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:3e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7be9364f21808a881f4530002ab0363deabf7de3321a1356984e88fb316ac165

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 24 Jul 2023 00:56:34 GMT
x-amz-version-id: pdWOnfKbVAXycyDHbhFI_OqkWBFerFwW
via: 1.1 07a6f7d6fd9710cbcfc60fa67d44f04e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 576674
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 28949
last-modified: Fri, 18 Feb 2022 23:29:18 GMT
server: AmazonS3
etag: "9d3f43da9d0d0679ec0dfea58b2f1d45"
content-type: image/png
cache-control: max-age=604800
accept-ranges: bytes
x-amz-cf-id: _QvSUFeeT07rmLTkb6UUP8t6b-DOtUdUYh-ziRxckQatWM2Jmrteiw==

GET
H2 200 IAS_PassbackAds_970x250.png
static.adsafeprotected.com/ Frame F407 28 KB
29 KB 41ms
41ms Image
image/png 2600:9000:223f:3e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/IAS_PassbackAds_970x250.png
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/st/1574389/72805578/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1013543513&ias_pubId=pub-7383171830614216&ias_chanId=1&ias_placementId=20390324281&bidurl=https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0i62-VRZTlYG4W7AdVITpeh&adsafe_url=https%3A%2F%2Fsharemods.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fsharemods.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:a9dfcc90-f508-5502-ebd1-e78a6528ce77,c:jS57Q4,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-7bdf49c444-qzxbj,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:329,mot:0,app:0,maw:0,fm:tLvVAK5+11%7C12%7C13%7C14%7C15%7C161%7C1621%7C163%7C164%7C17*.1574389-72805578%7C171%7C1721%7C173%7C181%7C1821%7C183%7C1911,idMap:17*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:na,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:336,oid:9b559483-2efb-11ee-b6be-6eb9aae7ee24,v:19.8.434,sp:1,st:0,fwm:1,wr:1600.1200,sr:1600.1200,ov:0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:3e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7be9364f21808a881f4530002ab0363deabf7de3321a1356984e88fb316ac165

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 24 Jul 2023 00:56:34 GMT
x-amz-version-id: pdWOnfKbVAXycyDHbhFI_OqkWBFerFwW
via: 1.1 07a6f7d6fd9710cbcfc60fa67d44f04e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 576674
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 28949
last-modified: Fri, 18 Feb 2022 23:29:18 GMT
server: AmazonS3
etag: "9d3f43da9d0d0679ec0dfea58b2f1d45"
content-type: image/png
cache-control: max-age=604800
accept-ranges: bytes
x-amz-cf-id: _kpAdlR7GXNg0pO7p6DrtyDUo9XY4eqPI-KY1iDtaTuzkAnbK7j3mA==

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D731 0
20 B 75ms
75ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B983l45jGZO72BYuq9u8Pm5O7gA8AAAAAOAHgBAI&bg=!19Sl1IDNAAZGOVy5Zjk7ADkAdvg8WjwSOt5dsD-yaXMH-8H50Zx_JruZgQMqdoX_Q6vBxe5hmxco1RglhEpYQvvCjhvbtAw8MlECAAABKlIAAAAFaAEHmQLofiuIzDZaX_UXpwGimaAiScElzaeSwt9ZiafQ6aul_k6AMJNR00qLUSRHfOZODIm4SXTJAIhj3lBq2ZVhGNUbnTE7lcJJN5GScql8t6l8V2wCP0taliVP4TBsnC4ynkMQJ8j_ETOd8gQyThcWt3xGN4w355kOdONpe0rjLWrXmH-U0beB2XzxVFsem-_deuHpiu1OuxdwqYrLticlOnMhxw-Jx5pH7b3Ej7J5LlzGWtTzJqHMjaC91bNklvjOCfBAbVF_1tmTruFQ-YUspmnOZJsmZRu0TDo0-E6QmioWxggjm-wE22RIQmv9j9__HseIw-Ew93J7dBO2LaYSkT-nXjIkcgoMJpAyRVABopiT91wJGpsNhqlTr9-QUxyFKm0iv6v6-BXaporGFzS5S5FBtz44tUH8QJ_SNO22oq9q4XPWBEiM0BpRC0sjVtGiJS6h0rn7UDhO3lvoavymmFp8XxhDjN7p8_MxRcXTECDMOizKgScefq4l6rnNBvzuMVm3n8qXhrbkFjs3PbACOB2cjzLRlND7nbuP5bUg_V2NYmvws3m_rY6ClHfIgkY_OPv1wQv73l9Oz2Yw9OC4ZzmA3MLNsap0IFAgK9IZo_dCeQBWmAasXBwQVXu7QZTM2irKeb3fIkOp0HHbqjqkkM9cfVa8i7CD0-tcFa-_bxFqOrWdO1CHEQouOz7-gamMtC5iJUQ4l_oe2MCgDK_cwpEZPK9_K1CP8FRtHJyUbR9owU2ueTNErAwNA6OMT6n01GmOYIFrIUwz5_giBfCtbqqwIrK4tKSgtHQWkOQ-8w6lLorXV7gwUF8T370-W10JtDbyePvOZDVRy5IW_MBs4_OWCOtLwKLmE5fbrqBhOFmbeIkRF8fQxWJGH9ZtPFRDfHcAAl3vnT6AoU5pz2c790DyLCorvog_gCZU4pB9a09ng5admGTOF8narpZVtAQ3mkmqpCdlh8UW9BvGH_XR24ZQaX4GO1ELfuNW

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 996C 0
20 B 76ms
76ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BdTj445jGZJ6XBoSS9u8Pxd-YmAIAAAAAOAHgBAI&bg=!aGulaz_NAAZGOVy5Zjk7ADkAdvg8WhHYVFM5dzqm8L9Y9GGHzQoJmsW3gMsNhuzzn5r2LMvuwOf41jhtbG4I47Wo2WZ51-aStxoCAAABIVIAAAAGaAEHmQL-Jwl-JHwxz6bUboACsO8jyugojB7nPBHIR4dXsSbNr0KrGrJn0Feos2rCsCyDxIdN37YlbZrgUURipAmx9vfKzUn0ZVn24M9t0plhIynSrsQOnWO8Vn5yB7Pac024EZA9_zZ-4MGHPxEp_ZFpd7tRzwsce5b-Ntwd0t7onWyoWf0zTWZAwhLOP-wqFhvgUpo8fqIwH1Yxd9nH9F-e7KHGAlZIVNJORBDs3NEH82_a80-27xAZ9ab1JxrLfpfXpQCSdz5CgICUqtdXFBmptLrI_ufy73cdIAxGgGRIk_Ba30KcBlypR6Ve2YYbYC0LERMbG0dunqaUnWkFA1L3fnVkja3en0oZATJbD17qE1HjswXAJaP6H2mCmpxyGZgUFy5Y6NOnQ9AbCIc6FKo9EeB3eoPfDrWp1d9jA2AYEFBN_fXkCNCV61jazzaGK2ukeO55yURKIihx88qCtk_3Z3zp8KfABOJJWCeDIwrWsTuID94iM0i-bS7tS8S8ffOp9hQdjHs98u37GL3X4pPXudaD73MaU0x0U2kSwK17goOYPHfSzEDv4FTTh9wyP6q7f009YFHKK6VJhxhxLk7ya4_WUvnsm_MoPpcS8jXlzlnNiWRnETBBvllcxqBCFyx4TWocjVBDpEEn2czHuq7HoyuZd3hcusXHBJ0a28vkc10qgDcClya-BCDqaTRMJTBhoZXcoPXM3naZYBrYUomSi02jwmlAzPNb1RsgYcgQuU7u7uUGq7dmNzu-ogMspp0Xct8sKt0wY0mriK_Yiis_TlpMQsdB2-gzUe6LwwxgmuD25dLBZklSbXxynq9VQsQiNXtRQZRVfTFa6ykvdYzMl7rxwUxWhqjIxq-6EsNAMp9TutjrW-7CV3ZDEYDtn9Klp2aFK9dF3YRYLSbwDDOC4SALJamgWf8dzmvshK7wmZz3K4_do6QuzOBTFzwVw9Epmc4M7LKhcJf9c-e62QXigCC1gE0AbqpehChLXNAZ2QUcWclN37bHKn9VrQPYiiD1wA

Requested by

Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 IAS_PassbackAds_970x250.png
static.adsafeprotected.com/ Frame 1C14 28 KB
29 KB 41ms
41ms Image
image/png 2600:9000:223f:3e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/IAS_PassbackAds_970x250.png
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/st/1574389/72805536/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1013543513&ias_pubId=pub-7383171830614216&ias_chanId=1&ias_placementId=20390324281&bidurl=https://sharemods.com/gg9zios3hjxy/WeMod_Premium.zip.html&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0jLVf7c2xAheHkd9zhLv0dA&adsafe_url=https%3A%2F%2Fsharemods.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fsharemods.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:f283cf6e-9587-5286-cd16-d433421d8b17,c:jS57R4,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-7bdf49c444-8xx76,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:390,mot:0,app:0,maw:0,fm:tLvVAK7+11%7C12%7C13%7C14%7C15%7C161%7C162%7C163%7C164%7C171%7C1721%7C173%7C174%7C18*.1574389-72805536%7C181%7C1821%7C183%7C1911,idMap:18*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:na,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:395,oid:9b559474-2efb-11ee-9b05-7675a4fa1a88,v:19.8.434,sp:1,st:0,fwm:1,wr:1600.1200,sr:1600.1200,ov:0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:3e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7be9364f21808a881f4530002ab0363deabf7de3321a1356984e88fb316ac165

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Mon, 24 Jul 2023 00:56:34 GMT
x-amz-version-id: pdWOnfKbVAXycyDHbhFI_OqkWBFerFwW
via: 1.1 07a6f7d6fd9710cbcfc60fa67d44f04e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 576674
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 28949
last-modified: Fri, 18 Feb 2022 23:29:18 GMT
server: AmazonS3
etag: "9d3f43da9d0d0679ec0dfea58b2f1d45"
content-type: image/png
cache-control: max-age=604800
accept-ranges: bytes
x-amz-cf-id: YFFNr34faqXXjVXOdSujFd_SVL8V5w3QXkEHNzidNZpv8kVKoTWrBA==

POST
H2 200 node.php Show response
node.setupad.com/node/ 0
210 B 140ms
40ms XHR
text/html 159.89.25.223
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://node.setupad.com/node/node.php
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.89.25.223 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Sun, 30 Jul 2023 17:07:48 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET, POST
content-type: text/html; charset=UTF-8

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 2C94 43 B
216 B 118ms
118ms Image
image/gif 2600:1f18:1aca:4281:7da:fc2:b806:4edd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1574389&asId=510896fe-5ea6-51d3-6468-96f2afa8c103&tv=%7Bc:jS57Wh,pingTime:-10,time:727,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE1LjAuNTc5MC4xMTAgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1690736868113%7C%7Cf7885bc863c6b6fc81cd156a0940ccf3%7C%7Cd0bbb78e6e470472c335369488825264%7C%7Cb57ec7afd7f380c3cbd09f5ef5ece9e1%7C%7Cae6a33986491bdf899ddcddddeb79cb4%7C%7Cfb3ee50cfdbb333c11d1c98c1b043e31%7C%7Ce5555969d010ccaf8e95eda1a5e887c6%7C%7C18cadf80432d80a1ac3a160afcdc0bbf%7C%7C1663701684%7D
Requested by: Host: 9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com
URL: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:7da:fc2:b806:4edd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: nginx
x-server-name: dt06.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F407 43 B
216 B 119ms
118ms Image
image/gif 2600:1f18:1aca:4281:7da:fc2:b806:4edd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1574389&asId=a9dfcc90-f508-5502-ebd1-e78a6528ce77&tv=%7Bc:jS57WK,time:749,type:e,im:%7Bpci:%7Btdr:375%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:749,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:335,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B419~0%5D,as:%5B419~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:335,fm:tLvVAJY+11%7C12%7C13%7C14%7C15%7C16.1574389-72805578%7C161%7C1621%7C163%7C164%7C17*.1574389-72805578%7C171%7C1721%7C173%7C18.1574389-72805536%7C181%7C1821%7C183%7C1911,idMap:17*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr,siq:336,sis:481%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:7da:fc2:b806:4edd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: nginx
x-server-name: dt24.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H2 200 node.php Show response
node.setupad.com/node/ 0
209 B 42ms
41ms XHR
text/html 159.89.25.223
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://node.setupad.com/node/node.php
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.89.25.223 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Sun, 30 Jul 2023 17:07:48 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET, POST
content-type: text/html; charset=UTF-8

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2C94 42 B
175 B 83ms
81ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssWbxNmZ6TgtXxfd0w5Y5OiFbuJRBlx2i6sG9WHWzS8ilcFij9nu9xSxwQPHn6LESH4t9-8CNmZWvOZBRWHptdRfbd4FcjjlTeYIYndmc2WrgBy7EZMb82GalJxTzQGt93GAQsU6ZkVpf19&sai=AMfl-YRMt7A3ZPgsW0cYaINXxvytyR6FEr4gQjYbXa22LQfy3CneREsTS3gf5H52DUCq5ctJ5Wr_3Uc91G8b-0XAYzcEkVPgOSurdUynPGQfGERyzVPZJzCH9YfvSrK7ryjozsspSsSZlANYQWAN&sig=Cg0ArKJSzGFRSlIy-ZOpEAE&cid=CAQSSwBpAlJWIA3oPO780tOTM3SzL4bf69lJGNK7gC8SSKBNGHbdUnjOmTdlnzKq0lYx1cfXjtAColwpPYveH_NC9Fr_rrhMzap4O8CFmRgB&id=lidar2&mcvt=1002&p=887,315,1137,1285&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20230726&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=605329121&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1690736866771&rpt=406&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 node.php Show response
node.setupad.com/node/ 0
209 B 40ms
40ms XHR
text/html 159.89.25.223
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://node.setupad.com/node/node.php
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.89.25.223 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Sun, 30 Jul 2023 17:07:48 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET, POST
content-type: text/html; charset=UTF-8

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C14 43 B
216 B 119ms
119ms Image
image/gif 2600:1f18:1aca:4281:7da:fc2:b806:4edd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1574389&asId=f283cf6e-9587-5286-cd16-d433421d8b17&tv=%7Bc:jS57Yy,time:859,type:e,im:%7Bpci:%7Btdr:418%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:859,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:395,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B470~0%5D,as:%5B470~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:368,fm:tLvVAJY+11%7C12%7C13%7C14%7C15%7C16.1574389-72805578%7C161%7C162%7C163%7C164%7C17.1574389-72805578%7C171%7C1721%7C173%7C174%7C18*.1574389-72805536%7C181%7C1821%7C183%7C1911,idMap:18*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr,siq:396,sis:518%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:7da:fc2:b806:4edd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: nginx
x-server-name: dt04.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F407 42 B
109 B 76ms
76ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvD4KfFzLu8thO6gIyby37-G8UzjZNhVUEkgZhdTJjER8wyBCb86E-wvXQ82ew2PqpnTc0pzs3GIdSFt1L4hXrLJZqFfLfDBTtz8IvOoE-Hrfkf8HqljeSStkp6zm2I6beYSo9vPzElBFLa&sai=AMfl-YQTzbNdjMOnnL29-34L-N7WxQxE4m4AEj6xBjZmtfq_rhj5pk4qp_q9Z97VczPE6Q3c_uq1q6z1N92zvKYMJzBOjncZr78yXALUJLa-Pjcm4Zo-H--Vf7__kNtaab2oxeH__34wD4fTOObP&sig=Cg0ArKJSzNre_6HWZ2A7EAE&cid=CAQSSwBpAlJWIA3oPO780tOTM3SzL4bf69lJGNK7gC8SSKBNGHbdUnjOmTdlnzKq0lYx1cfXjtAColwpPYveH_NC9Fr_rrhMzap4O8CFmRgB&id=lidar2&mcvt=1000&p=339,315,589,1285&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230726&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3771485005&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1690736866819&rpt=475&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

visitormatch Show response
bh.contextweb.com/ Frame C83B
Redirect Chain

https://bh.contextweb.com/visitormatch
https://bh.contextweb.com/visitormatch?reat=1

27 B
464 B

43ms
43ms

Document
text/html

208.93.169.131
WEBMD-IDC1-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://bh.contextweb.com/visitormatch?reat=1

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/3928

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

208.93.169.131 , United States, ASN46244 (WEBMD-IDC1-AS, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

ec2f44e7dbd2ebb1268ac7e7a0602ec2106bc7fd9da17b9012db81be55cbd485

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control: private, max-age=0, no-cache, no-store
content-language: de-DE
content-type: text/html;charset=iso-8859-1
cw-server: bh-deployment-848647674d-jtjl4
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server: Jetty(10.0.14)
strict-transport-security: max-age=15768000

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control: private, max-age=0, no-cache, no-store
content-language: de-DE
cw-server: bh-deployment-848647674d-jtjl4
expires: -1
location: /visitormatch?reat=1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server: Jetty(10.0.14)
strict-transport-security: max-age=15768000

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 3206 281 B
554 B 202ms
40ms Document
text/html 95.101.149.233
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.149.233 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-149-233.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sun, 30 Jul 2023 17:07:48 GMT
ETag: "40010-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 4849 15 KB
6 KB 200ms
41ms Document
text/html 23.218.208.200
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.218.208.200 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-208-200.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 94061a925c5d84bf776554ac894020c407a9a4c89b979d538de3cf45591fe423

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=59853
content-encoding: gzip
content-length: 5606
content-type: text/html
date: Sun, 30 Jul 2023 17:07:48 GMT
expires: Mon, 31 Jul 2023 09:45:21 GMT
last-modified: Tue, 11 Jul 2023 09:39:35 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 204 /
onetag-sys.com/usync/ Frame CA2A 0
0 41ms
40ms Document
text/plain 51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1690736865057

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/3928

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip251.ip-51-89-9.eu

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store
strict-transport-security: max-age=15552000

GET
H2 200 sync-all.html Show response
adxbid.info/ Frame 8520 7 KB
3 KB 218ms
62ms Document
text/html 2606:4700:e4::ac40:a713
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a713 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cccba065a0e962f62ca114793d18ada30e87cf7a48900c1e7486e8e4c57a05b9

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7eef3334ba21bc04-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Sun, 30 Jul 2023 17:07:48 GMT
last-modified: Thu, 26 Jan 2023 09:50:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v6SwkmDuszfGWLrcUMjMCYjco8GUtIkHa7%2FERgCpDxeEfpiqFSqduoRmkZPUlPvfhYf5l%2Bm4awNk458K154Nj4QHHVozb4UNsuB7BUamLlA2Wmgf62BaPFJMGXfGd5ThCG%2BFBUv4B4DE6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame CCED 52 KB
17 KB 196ms
43ms Document
text/html 23.218.208.187
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.218.208.187 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-208-187.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Sun, 30 Jul 2023 17:07:48 GMT
ETag: "623de86a-cf34"
Expires: Mon, 31 Jul 2023 17:07:50 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 3206 34 KB
10 KB 41ms
41ms Script
text/html 95.101.149.233
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.149.233 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-149-233.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 09a2f12ea6bc6bf8145bbc7091f4527fd38a2f7a3e363c4afa5dd57dca6388ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Sun, 30 Jul 2023 17:07:48 GMT
Content-Encoding: gzip
Last-Modified: Sat, 29 Jul 2023 19:36:56 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=8865
Connection: keep-alive
Content-Length: 10115
Expires: Sun, 30 Jul 2023 19:35:33 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 4849 5 KB
6 KB 142ms
42ms Script
text/html 198.47.127.19
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=32856242&p=156191&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.19 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 36392f09d33868022515cf0bbc8f82888e98f224c46b8c54b29434c60f5f8c18

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Sun, 30 Jul 2023 17:07:48 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame CCED 0
594 B 78ms
78ms Script
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
an-x-request-uuid: 0277ccf2-1a62-4a01-b199-9011f0453049
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.7.108; 80.255.7.108; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 getuid
eb2.3lift.com/ Frame 8520 37 B
141 B 118ms
41ms Image
image/gif 13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/getuid?limit=50&redir=https%3A%2F%2Frtb.adxpremium.services%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID
Requested by: Host: adxbid.info
URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adxbid.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 2C94 43 B
216 B 118ms
117ms Image
image/gif 2600:1f18:1aca:4281:7da:fc2:b806:4edd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1574389&asId=510896fe-5ea6-51d3-6468-96f2afa8c103&tv=%7Bc:jS586M,pingTime:1,time:1378,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:970,h:250,t:272%7D,%7Bpiv:100,vs:i,r:,t:377%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1001,o:377,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:272,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B118~0%5D,as:%5B118~970.250%5D%7D%7D,%7Bsl:i,t:377,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.504,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~970.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:124,fm:tLvVAJY+11%7C12%7C13%7C14%7C15%7C16*.1574389-72805578%7C161%7C1621%7C163%7C17.1574389-72805578%7C171%7C1721%7C173%7C18.1574389-72805536%7C181%7C1821%7C183%7C1911,idMap:16*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:273,sis:477%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:7da:fc2:b806:4edd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: nginx
x-server-name: dt05.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 2C94 43 B
216 B 117ms
117ms Image
image/gif 2600:1f18:1aca:4281:7da:fc2:b806:4edd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1574389&asId=510896fe-5ea6-51d3-6468-96f2afa8c103&tv=%7Bc:jS586M,pingTime:1,time:1378,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:970,h:250,t:272%7D,%7Bpiv:100,vs:i,r:,t:377%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1001,o:377,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:272,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B118~0%5D,as:%5B118~970.250%5D%7D%7D,%7Bsl:i,t:377,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.504,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~970.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:124,fm:tLvVAJY+11%7C12%7C13%7C14%7C15%7C16*.1574389-72805578%7C161%7C1621%7C163%7C17.1574389-72805578%7C171%7C1721%7C173%7C18.1574389-72805536%7C181%7C1821%7C183%7C1911,idMap:16*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:273,sis:477%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:7da:fc2:b806:4edd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: nginx
x-server-name: dt08.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 3206
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=_JOPCK62SymcmS7LsEPRoA&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=_JOPCK62SymcmS7LsEPRoA

43 B
479 B

135ms
135ms

Image
image/gif

209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=_JOPCK62SymcmS7LsEPRoA

Protocol

HTTP/1.1

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 30 Jul 2023 17:07:49 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 8RRQ1KJZP6SZF484CKGM
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=_JOPCK62SymcmS7LsEPRoA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: e06182bf224d96e6550f4595601cdb0b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 3206
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LKPP2QDO-22-5WYA

0
650 B

314ms
214ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LKPP2QDO-22-5WYA
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:48 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 196F1DDEEDE14B6C984B9E1A1002D119 Ref B: FRAEDGE1216 Ref C: 2023-07-30T17:07:49Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYBt1p+zWTQQGwbtXITdw==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LKPP2QDO-22-5WYA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 3206
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/vZ1VSZdizb5SEF3qpBUzUsn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-zqykKWFE2oLKzUXIUsFMQvyYB9Ib1VAws0Pfzg--~A

0
239 B

75ms
41ms

Image
image/gif

69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-zqykKWFE2oLKzUXIUsFMQvyYB9Ib1VAws0Pfzg--~A
Protocol: HTTP/1.1
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: e06182bf224d96e6550f4595601cdb0b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Sun, 30 Jul 2023 17:07:48 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-zqykKWFE2oLKzUXIUsFMQvyYB9Ib1VAws0Pfzg--~A
content-length: 0

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame 3206
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=vd35Sc09RjSgJopb9iJrAg&rk=usync-other
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=vd35Sc09RjSgJopb9iJrAg

43 B
720 B

215ms
214ms

Image
image/gif

52.94.223.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=vd35Sc09RjSgJopb9iJrAg

Protocol

HTTP/1.1

Server

52.94.223.37 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 30 Jul 2023 17:07:49 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: B8XZJN9AT9N8MPEFFF0T
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=vd35Sc09RjSgJopb9iJrAg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: e06182bf224d96e6550f4595601cdb0b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3206
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MDMyOWE2NTE4NTljNjExNGJiMzMzMjEyM2QwZmM3MjA2N2IxOWYwYQ

170 B
188 B

51ms
51ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MDMyOWE2NTE4NTljNjExNGJiMzMzMjEyM2QwZmM3MjA2N2IxOWYwYQ

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MDMyOWE2NTE4NTljNjExNGJiMzMzMjEyM2QwZmM3MjA2N2IxOWYwYQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: e06182bf224d96e6550f4595601cdb0b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 3206
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELyVi3I37TMbzdZgw_0t-N4&google_cver=1

0
239 B

164ms
40ms

Image
image/gif

69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELyVi3I37TMbzdZgw_0t-N4&google_cver=1
Protocol: HTTP/1.1
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: e06182bf224d96e6550f4595601cdb0b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELyVi3I37TMbzdZgw_0t-N4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame 3206 70 B
266 B 180ms
58ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3206
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEtQUDJRRE8tMjItNVdZQQ==
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEOFomJJmJAnEvGwcB730ZdQ&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEtQUDJRRE8tMjItNVdZQQ==&google_push=

170 B
188 B

49ms
49ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEtQUDJRRE8tMjItNVdZQQ==&google_push=

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

186.62.91.34.bc.googleusercontent.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEtQUDJRRE8tMjItNVdZQQ==&google_push=
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: e06182bf224d96e6550f4595601cdb0b
Expires: 0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 98B6
Redirect Chain

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=1609431484924225651

42 B
196 B

47ms
47ms

Document
image/gif

185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=1609431484924225651
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sun, 30 Jul 2023 17:07:47 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=1609431484924225651
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 93F3
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5140084926413751205

42 B
275 B

47ms
47ms

Document
image/gif

185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5140084926413751205
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sun, 30 Jul 2023 17:07:48 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Sun, 30 Jul 2023 17:07:48 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5140084926413751205
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 8B66
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=

42 B
96 B

42ms
42ms

Document
image/gif

198.47.127.205
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.205 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sun, 30 Jul 2023 17:07:47 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache
content-length: 0
cross-origin-resource-policy: cross-origin
date: Sun, 30 Jul 2023 17:07:48 GMT
expires: Sun, 30 Jul 2023 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 5803632
strict-transport-security: max-age=31536000; preload;
x-errorlevel: 0

GET
H/1.1

200
OK

dcm Show response
aax-eu.amazon-adsystem.com/s/ Frame 0AED
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=ED07E5AF-2C92-47FA-8DF2-B5532E96148A&redir=true&gdpr=0&gdpr_consent=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=ED07E5AF-2C92-47FA-8DF2-B5532E96148A&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

212ms
212ms

Document
image/gif

52.94.223.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=ED07E5AF-2C92-47FA-8DF2-B5532E96148A&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.94.223.37 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Sun, 30 Jul 2023 17:07:49 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 4H5N46PS5KKB4RGCRRNE

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Sun, 30 Jul 2023 17:07:48 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=ED07E5AF-2C92-47FA-8DF2-B5532E96148A&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 9T0K23W02Z9E4TWXHZKC

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame E0D8
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=bzE8CWA9Ogt0YT1dbmdyB2kwbV10MmxcbmS27W9D

42 B
417 B

76ms
47ms

Document
image/gif

185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=bzE8CWA9Ogt0YT1dbmdyB2kwbV10MmxcbmS27W9D
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sun, 30 Jul 2023 17:07:46 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
date: Sun, 30 Jul 2023 17:07:48 GMT
expires: Fri, 04 Aug 1978 12:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=bzE8CWA9Ogt0YT1dbmdyB2kwbV10MmxcbmS27W9D
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma: no-cache
strict-transport-security: max-age=86400

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 1F6F
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8633280776584377338&gdpr=0&gdpr_consent=

42 B
450 B

133ms
43ms

Document
image/gif

198.47.127.205
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8633280776584377338&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.205 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sun, 30 Jul 2023 17:07:48 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: a3618cf3-f57a-442b-b0d6-524bdb7ea9eb
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Sun, 30 Jul 2023 17:07:48 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8633280776584377338&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.21.3
x-proxy-origin: 80.255.7.108; 80.255.7.108; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 0D02
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=9&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA%3D&piggybackCookie=7261659554230761622&gdpr=0&gdpr_consent=

42 B
220 B

42ms
42ms

Document
image/gif

198.47.127.205
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA%3D&piggybackCookie=7261659554230761622&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.205 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sun, 30 Jul 2023 17:07:48 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Date: Sun, 30 Jul 2023 17:07:48 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA%3D&piggybackCookie=7261659554230761622&gdpr=0&gdpr_consent=
Server: nginx
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame C002
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=82NyhbR3XSNH7Pjg59tfMFD_B2w&gdpr=0&gdpr_consent=

42 B
300 B

42ms
42ms

Document
image/gif

198.47.127.205
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=82NyhbR3XSNH7Pjg59tfMFD_B2w&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.205 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sun, 30 Jul 2023 17:07:48 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 188
Content-Type: text/html; charset=utf-8
Date: Sun, 30 Jul 2023 17:07:49 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=82NyhbR3XSNH7Pjg59tfMFD_B2w&gdpr=0&gdpr_consent=

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame C5B0
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_...

85 B
260 B

128ms
128ms

Document
image/png

151.101.2.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZMaY5AAAAbTTewA_
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 85
content-type: image/png
date: Sun, 30 Jul 2023 17:07:49 GMT
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-fra-etou8220020-FRA
x-timer: S1690736869.019861,VS0,VE89

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Sun, 30 Jul 2023 17:07:48 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZMaY5AAAAbTTewA_
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-fra-etou8220020-FRA
x-timer: S1690736869.887796,VS0,VE92

GET sync
t.adx.opera.com/pub/ Frame B474 0
0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame EF32
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFFUW5VN0pqVElBQUNVT3ZGdGlXdw&gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_syn...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEQnU7JjTIAACUOvFtiWw&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cpm%26bee...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=6258998906856031155&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AAEQnU7JjTIAACUOvFtiWw&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D6258998906856031155%26gdpr%3D0%26gdpr_consen...
https://match.prod.bidr.io/cookie-sync?gdpr=0&userid=6258998906856031155&gdpr=0&gdpr_consent=&bee_sync_partners=pm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=3&ev=AAEQnU7...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAEQnU7JjTIAACUOvFtiWw&gdpr=0&gdpr_consent=

42 B
201 B

48ms
48ms

Document
image/gif

185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAEQnU7JjTIAACUOvFtiWw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sun, 30 Jul 2023 17:07:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Sun, 30 Jul 2023 17:07:49 GMT
Server: gunicorn
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAEQnU7JjTIAACUOvFtiWw&gdpr=0&gdpr_consent=
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame A540
Redirect Chain

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}

0
94 B

41ms
41ms

Document
text/html

198.47.127.205
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.205 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sun, 30 Jul 2023 17:07:47 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Sun, 30 Jul 2023 17:07:48 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
server: _

GET
H2 200 bridge Show response
cm.adgrx.com/ Frame 8B47 43 B
284 B 196ms
49ms Document
image/gif 72.251.241.204
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 72.251.241.204 Amsterdam, Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: Cowboy /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, proxy-revalidate
content-length: 43
content-type: image/gif
date: Sun, 30 Jul 2023 17:07:48 GMT
expires: Thu, 23 Sep 2004 17:42:04 GMT
p3p: CP="NOI OTC OTP OUR NOR"
pragma: no-cache
server: Cowboy
x-realserver-nx: ams-delivery-6

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 3A15
Redirect Chain

https://cm-supply-web.gammaplatform.com/adx/usersyncsupply?pid=7&t=pixel
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTkmdGw9NDMyMDA=&piggybackCookie=oltpqaw0fqiy

42 B
311 B

47ms
47ms

Document
image/gif

185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTkmdGw9NDMyMDA=&piggybackCookie=oltpqaw0fqiy
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sun, 30 Jul 2023 17:07:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-encoding: utf-8
cache-control: no-cache, no-store
content-length: 0
date: Sun, 30 Jul 2023 17:07:49 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTkmdGw9NDMyMDA=&piggybackCookie=oltpqaw0fqiy
lws: 222
strict-transport-security: max-age=31536000; includeSubDomains
time-ms: 0

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame 6EBF 43 B
279 B 243ms
76ms Document
image/gif 195.5.165.20
IPROM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Sun, 30 Jul 2023 17:07:48 GMT
Vary: Accept-Encoding
X-adserver-worker: erebus-6d79b7dcb6ac@version_1.564v2
X-core-time: 0ms
X-server-arch: v2

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame F5AE 43 B
370 B 141ms
48ms Document
image/gif 35.186.193.173
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 173.193.186.35.bc.googleusercontent.com
Software: Apache-Coyote/1.1 /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Sun, 30 Jul 2023 17:07:48 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
server: Apache-Coyote/1.1
via: 1.1 google

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 2525
Redirect Chain

https://ad.mrtnsvr.com/sync/pubmatic?gdpr=0&gdpr_consent=
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw%26piggybackCookie%3D%23PM_USER_ID%26gdpr...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=ED07E5AF-2C92-47FA-8DF2-B5532E96148A&gdpr=0&gdpr_consent=

42 B
324 B

42ms
42ms

Document
image/gif

198.47.127.205
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=ED07E5AF-2C92-47FA-8DF2-B5532E96148A&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.205 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sun, 30 Jul 2023 17:07:48 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 30 Jul 2023 17:07:48 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=ED07E5AF-2C92-47FA-8DF2-B5532E96148A&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame 54FB
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
428 B

207ms
198ms

Document
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 7eef3337e9a3368a-FRA
content-length: 43
content-type: image/gif; charset=utf-8
date: Sun, 30 Jul 2023 17:07:49 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 7eef33369f69368a-FRA
content-type: text/html
date: Sun, 30 Jul 2023 17:07:49 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 206
x-reuse-index: 164

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 4849
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=7QflryySR_qN8rVTLpYUig%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

15 KB
15 KB

56ms
56ms

Image
text/html

23.218.208.200
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 23.218.208.200 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-208-200.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:48 GMT
content-encoding: gzip
last-modified: Tue, 11 Jul 2023 09:39:35 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=59853
accept-ranges: bytes
content-length: 5606
expires: Mon, 31 Jul 2023 09:45:21 GMT

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 404 qmap
sync.crwdcntrl.net/ Frame 4849 49 B
267 B 175ms
54ms Image
image/gif 54.247.118.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=ED07E5AF-2C92-47FA-8DF2-B5532E96148A&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.247.118.8 , Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-247-118-8.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.31.100
content-length: 49
expires: 0

GET
H2

204

ids
idsync.frontend.weborama.fr/ Frame 4849
Redirect Chain

https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent=
https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent=&bounce=1&random=3504996823
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fidsync.frontend.weborama.fr%2Fids%3Fkey%3Dpubmatic%26value%3D%23PM_USER_ID&gdpr=0
https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=ED07E5AF-2C92-47FA-8DF2-B5532E96148A

0
286 B

150ms
50ms

Image
text/plain

34.111.131.239
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=ED07E5AF-2C92-47FA-8DF2-B5532E96148A
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 34.111.131.239 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 239.131.111.34.bc.googleusercontent.com
Software: Weborama Collect Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
via: 1.1 google
last-modified: Sun, 30 Jul 2023 17:07:49 GMT
server: Weborama Collect Frontend
vary: Origin
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 03 Jul 2001 06:00:00 GMT

Redirect headers

location: https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=ED07E5AF-2C92-47FA-8DF2-B5532E96148A
date: Sun, 30 Jul 2023 17:07:48 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H/1.1

200

p
a.audrte.com/ Frame 4849
Redirect Chain

https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=ED07E5AF-2C92-47FA-8DF2-B5532E96148A
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=ZG1kTlBUNXVEd25UeS11MDlTd1VFTWw4QQ==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL...
https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%3D%3D&gdpr=0&gdpr_consent=
https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent=
https://a.audrte.com/a?adform_uid=2465630475714310977&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D
https://a.audrte.com/p

68 B
424 B

118ms
118ms

Image
image/png

34.237.225.4
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: HTTP/1.1
Server: 34.237.225.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-237-225-4.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Sun, 30 Jul 2023 17:07:49 GMT
Server: nginx/1.22.1
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Sun, 30 Jul 2023 17:07:49 GMT
Server: nginx/1.22.1
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Origin: *
Location: https://a.audrte.com:443/p
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 4849
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RUQwN0U1QUYtMkM5Mi00N0ZBLThERjItQjU1MzJFOTYxNDhB&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
96 B

166ms
48ms

Image
image/gif

185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Sun, 30 Jul 2023 17:07:48 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 4849
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEPz_FywlECQ8BxCXYxwrjV8&google_cver=1

42 B
534 B

160ms
47ms

Image
image/gif

185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEPz_FywlECQ8BxCXYxwrjV8&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Sun, 30 Jul 2023 17:07:47 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEPz_FywlECQ8BxCXYxwrjV8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubmatic
um.simpli.fi/ Frame 4849 43 B
613 B 148ms
47ms Image
image/gif 34.91.62.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.91.62.186 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:48 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Sat, 29 Jul 2023 17:07:48 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 4849
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=2465630475714310977

42 B
244 B

49ms
43ms

Image
image/gif

198.47.127.205
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=2465630475714310977
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 198.47.127.205 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Sun, 30 Jul 2023 17:07:48 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=2465630475714310977
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 4849 70 B
265 B 165ms
58ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 ED07E5AF-2C92-47FA-8DF2-B5532E96148A
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 4849 43 B
427 B 175ms
57ms Image
image/gif 2a05:d018:d29:3601:de66:34eb:ab9d:5d4c
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/ED07E5AF-2C92-47FA-8DF2-B5532E96148A?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3601:de66:34eb:ab9d:5d4c Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:48 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58292/ Frame 4849 0
126 B 155ms
44ms Image
text/plain 3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=ED07E5AF-2C92-47FA-8DF2-B5532E96148A&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.64 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:48 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.64
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 4849
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=b0d5cdfe-0b27-48e1-b790-809032234d50&gdpr=0&gdpr_consent=&gdpr_pd=

1 B
246 B

42ms
42ms

Image
text/html

198.47.127.205
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=b0d5cdfe-0b27-48e1-b790-809032234d50&gdpr=0&gdpr_consent=&gdpr_pd=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 198.47.127.205 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Sun, 30 Jul 2023 17:07:47 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=b0d5cdfe-0b27-48e1-b790-809032234d50&gdpr=0&gdpr_consent=&gdpr_pd=
date: Sun, 30 Jul 2023 17:07:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2 204 current
pubmatic-match.dotomi.com/match/bounce/ Frame 4849 0
105 B 225ms
81ms Image
text/plain 2a02:fa8:8806:13::1370
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=ED07E5AF-2C92-47FA-8DF2-B5532E96148A&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:13::1370 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 4849
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8157739139790813553&gdpr=0&gdpr_consent=&us_privacy=

1 B
177 B

42ms
42ms

Image
text/html

198.47.127.205
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8157739139790813553&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 198.47.127.205 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Sun, 30 Jul 2023 17:07:48 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8157739139790813553&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 4849 0
187 B 152ms
42ms Image
text/plain 98.98.134.242
ZEN-ECN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 98.98.134.242 , United States, ASN21859 (ZEN-ECN, US),
Reverse DNS
Software: A /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Sun, 30 Jul 2023 17:07:48 GMT
cache-control: max-age=0,no-cache,no-store
server: A
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 4849
Redirect Chain

https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:331242e4-362d-4696-93f4-7f5411f32965&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

42 B
96 B

42ms
42ms

Image
image/gif

198.47.127.205
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:331242e4-362d-4696-93f4-7f5411f32965&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 198.47.127.205 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Sun, 30 Jul 2023 17:07:48 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:331242e4-362d-4696-93f4-7f5411f32965&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date: Sun, 30 Jul 2023 17:07:49 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H/1.1

200
OK

setuid
user-sync.adxpremium.services/ Frame 8520
Redirect Chain

https://as.ck-ie.com/prebid.gif?limit=50&redir=https%3A%2F%2Fuser-sync.adxpremium.services%2Fsetuid%3Fbidder%3Dsmartyads%26uid%3D%5BUID%5D
https://user-sync.adxpremium.services/setuid?bidder=smartyads&uid=277e93d456c19b933cab211609ac3880d2fca623cda996fa2448985973b87c36

86 B
564 B

581ms
266ms

Image
image/png

209.192.201.180

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://user-sync.adxpremium.services/setuid?bidder=smartyads&uid=277e93d456c19b933cab211609ac3880d2fca623cda996fa2448985973b87c36
Requested by: Host: adxbid.info
URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Protocol: HTTP/1.1
Server: 209.192.201.180 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adxbid.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sun, 30 Jul 2023 17:07:52 GMT
content-length: 86
content-type: image/png

Redirect headers

Location: https://user-sync.adxpremium.services/setuid?bidder=smartyads&uid=277e93d456c19b933cab211609ac3880d2fca623cda996fa2448985973b87c36
Pragma: no-cache
Date: Sun, 30 Jul 2023 17:07:49 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Transfer-Encoding: chunked
Expires: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F407 43 B
216 B 120ms
119ms Image
image/gif 2600:1f18:1aca:4281:7da:fc2:b806:4edd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1574389&asId=a9dfcc90-f508-5502-ebd1-e78a6528ce77&tv=%7Bc:jS58aK,pingTime:-10,time:1617,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE1LjAuNTc5MC4xMTAgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1690736868113%7C%7Cf7885bc863c6b6fc81cd156a0940ccf3%7C%7Cd0bbb78e6e470472c335369488825264%7C%7Cb57ec7afd7f380c3cbd09f5ef5ece9e1%7C%7Cae6a33986491bdf899ddcddddeb79cb4%7C%7Cfb3ee50cfdbb333c11d1c98c1b043e31%7C%7Ce5555969d010ccaf8e95eda1a5e887c6%7C%7C18cadf80432d80a1ac3a160afcdc0bbf%7C%7C1663701684,sca:%7Bspg:510896fe-5ea6-51d3-6468-96f2afa8c103%7D%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:7da:fc2:b806:4edd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:49 GMT
server: nginx
x-server-name: dt17.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1C14 43 B
216 B 119ms
119ms Image
image/gif 2600:1f18:1aca:4281:7da:fc2:b806:4edd
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1574389&asId=f283cf6e-9587-5286-cd16-d433421d8b17&tv=%7Bc:jS58b0,pingTime:-10,time:1631,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE1LjAuNTc5MC4xMTAgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1690736868113%7C%7Cf7885bc863c6b6fc81cd156a0940ccf3%7C%7Cd0bbb78e6e470472c335369488825264%7C%7Cb57ec7afd7f380c3cbd09f5ef5ece9e1%7C%7Cae6a33986491bdf899ddcddddeb79cb4%7C%7Cfb3ee50cfdbb333c11d1c98c1b043e31%7C%7Ce5555969d010ccaf8e95eda1a5e887c6%7C%7C18cadf80432d80a1ac3a160afcdc0bbf%7C%7C1663701684,sca:%7Bspg:510896fe-5ea6-51d3-6468-96f2afa8c103%7D%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:7da:fc2:b806:4edd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:49 GMT
server: nginx
x-server-name: dt16.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F407 0
20 B 73ms
73ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=4012314549952&version=m202306200101&ct=76&x=1&cor=7862646770765940000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1C14 0
20 B 74ms
73ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=7121173728655&version=m202306200101&ct=76&x=1&cor=6171422387587972000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C94 0
20 B 72ms
71ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=5223638906202&version=m202306200101&ct=76&x=1&cor=6721952850924367000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9d844cb717aec7ca9c6a4440ccb0953d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 17:07:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame CCED 0
595 B 39ms
39ms Script
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS