qr.calm9.com Open in urlscan Pro
2606:4700:3037::ac43:82d8 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://s05.calm9.com/
Effective URL:
http://qr.calm9.com/en/
Submission: On May 03 via manual (May 3rd 2023, 8:28:53 am UTC) from IL — Scanned from DE

Summary HTTP 77 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 15 IPs in 5 countries across 18 domains to perform 77 HTTP transactions. The main IP is 2606:4700:3037::ac43:82d8, located in United States and belongs to CLOUDFLARENET, US. The main domain is qr.calm9.com.

This is the only time qr.calm9.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3030::6815:970	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 13	2606:4700:303... 2606:4700:3037::ac43:82d8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f17... 2a03:2880:f176:84:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:801::2001	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:811::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
1 1	35.186.193.173 35.186.193.173	15169 (GOOGLE) (GOOGLE)
8	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
1 1	18.158.78.2 18.158.78.2	16509 (AMAZON-02) (AMAZON-02)
1 1	85.114.159.93 85.114.159.93	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
1 1	2a05:d018:d29... 2a05:d018:d29:3602:c8cd:afe4:1960:d0d5	16509 (AMAZON-02) (AMAZON-02)
2 2	37.157.3.30 37.157.3.30	198622 (ADFORM) (ADFORM)
1 1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	185.80.39.216 185.80.39.216	27381 (CASALE-MEDIA) (CASALE-MEDIA)
77	15

1 2606:4700:3030::6815:970 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

s05.calm9.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2606:4700:3037::ac43:82d8 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

qr.calm9.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f176:84:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.193.173 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com

gcm.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.158.78.2 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-78-2.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.114.159.93 (Bad Durrheim, Germany) 1 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com

dsp.adfarm1.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d018:d29:3602:c8cd:afe4:1960:d0d5 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.3.30 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.80.39.216 (Canada) 2 redirects

ASN27381 (CASALE-MEDIA, CA)

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
26	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 129 tpc.googlesyndication.com — Cisco Umbrella Rank: 177	352 KB
17	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 67 cm.g.doubleclick.net — Cisco Umbrella Rank: 313	82 KB
14	calm9.com 2 redirects s05.calm9.com qr.calm9.com	88 KB
7	gstatic.com www.gstatic.com fonts.gstatic.com	74 KB
5	google.com 1 redirects adservice.google.com — Cisco Umbrella Rank: 130 www.google.com — Cisco Umbrella Rank: 16	2 KB
3	google.de adservice.google.de — Cisco Umbrella Rank: 5261	818 B
2	casalemedia.com 2 redirects ssum-sec.casalemedia.com — Cisco Umbrella Rank: 679	2 KB
2	adform.net 2 redirects c1.adform.net — Cisco Umbrella Rank: 908	1 KB
2	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 238	98 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 119	2 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 91	17 KB
1	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 447	504 B
1	yahoo.com 1 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 689	750 B
1	adition.com 1 redirects dsp.adfarm1.adition.com — Cisco Umbrella Rank: 2062	631 B
1	agkn.com 1 redirects d.agkn.com — Cisco Umbrella Rank: 1006	773 B
1	ctnsnet.com 1 redirects gcm.ctnsnet.com — Cisco Umbrella Rank: 50702	647 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1132	602 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	2 KB
77	18

	Domain	Requested by
15	pagead2.googlesyndication.com	qr.calm9.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com www.gstatic.com
13	qr.calm9.com	1 redirects qr.calm9.com
11	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
9	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
8	cm.g.doubleclick.net	googleads.g.doubleclick.net
6	www.gstatic.com	googleads.g.doubleclick.net
3	adservice.google.com	pagead2.googlesyndication.com
3	adservice.google.de	pagead2.googlesyndication.com
2	ssum-sec.casalemedia.com	2 redirects
2	c1.adform.net	2 redirects
2	www.google.com	1 redirects tpc.googlesyndication.com
2	www.googletagservices.com	googleads.g.doubleclick.net
2	fonts.googleapis.com	googleads.g.doubleclick.net
2	www.google-analytics.com	qr.calm9.com
1	pixel.rubiconproject.com	1 redirects
1	pr-bh.ybp.yahoo.com	1 redirects
1	dsp.adfarm1.adition.com	1 redirects
1	d.agkn.com	1 redirects
1	gcm.ctnsnet.com	1 redirects
1	fonts.gstatic.com	fonts.googleapis.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	www.facebook.com	qr.calm9.com
1	s05.calm9.com	1 redirects
77	23

This site contains links to these domains. Also see Links.

Domain
ip.calm9.com
www.linode.com
support.google.com

Subject Issuer	Validity	Valid
*.g.doubleclick.net GTS CA 1C3	`2023-04-17` - `2023-07-10`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-02-09` - `2023-05-10`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-04-17` - `2023-07-10`	3 months	crt.sh
*.google.de GTS CA 1C3	`2023-04-17` - `2023-07-10`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-04-17` - `2023-07-10`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-04-17` - `2023-07-10`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-04-17` - `2023-07-10`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-04-17` - `2023-07-10`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-04-17` - `2023-07-10`	3 months	crt.sh

This page contains 14 frames:

Primary Page: http://qr.calm9.com/en/
Frame ID: F798B06A78789191EC5DF2B54F690DEE
Requests: 25 HTTP requests in this frame

Frame: http://qr.calm9.com/qrcode/frame.htm
Frame ID: 226AEC166758511C0FB49F63F82DA506
Requests: 3 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fqr.calm9.com%2F&layout=standard&show_faces=true&width=450&action=like&font&colorscheme=light&height=80
Frame ID: 9B15D66C9BF65737D615AD14F07A9B5D
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1797051082820028&output=html&h=15&slotname=4015620116&adk=2307622340&adf=1850100242&pi=t.ma~as.4015620116&w=728&lmt=1683102529&url=http%3A%2F%2Fqr.calm9.com%2Fen%2F&wgl=1&dt=1683102529048&bpp=20&bdt=851&idt=204&shv=r20230501&mjsv=m202304270101&ptt=5&saldr=sa&abxe=1&correlator=68570723625&frm=20&pv=2&ga_vid=983160747.1683102529&ga_sid=1683102529&ga_hid=1393259841&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=624&ady=52&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44773809%2C44759842%2C44785293%2C44788442%2C44789762%2C44789924&oid=2&pvsid=1086273049722701&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Ce%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=1&uci=a!1&fsb=1&xpc=FODuNi3ECf&p=http%3A//qr.calm9.com&dtd=225
Frame ID: 2960B38960DA16EF9E99B16E6CCB0815
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1797051082820028&output=html&h=90&slotname=5492353314&adk=2697840534&adf=1101522062&pi=t.ma~as.5492353314&w=728&lmt=1683102529&url=http%3A%2F%2Fqr.calm9.com%2Fen%2F&wgl=1&dt=1683102529075&bpp=7&bdt=878&idt=206&shv=r20230501&mjsv=m202304270101&ptt=5&saldr=sa&abxe=1&prev_slotnames=4015620116&correlator=68570723625&frm=20&pv=1&ga_vid=983160747.1683102529&ga_sid=1683102529&ga_hid=1393259841&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=613&ady=670&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44773809%2C44759842%2C44785293%2C44788442%2C44789762%2C44789924&oid=2&pvsid=1086273049722701&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cpe%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=8hBUvgyDMS&p=http%3A//qr.calm9.com&dtd=211
Frame ID: 7F7E928BF5FEE82567E2CDD7C8104BBE
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 768C08D3725274225ECFD194D073FAAA
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/FHHDynUGsrfH4TjWcGmt-S1vebovfm5iFoLlE4fXdvI.js
Frame ID: 3D8A9B2A5B4611D3CD309F5CD5B95A56
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20190131/zrt_lookup.html
Frame ID: C139FD44CB0A919F3EEB9994D58B3FAB
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1797051082820028&output=html&adk=1812271804&adf=3025194257&lmt=1683102530&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=http%3A%2F%2Fqr.calm9.com%2Fen%2F&ea=0&pra=7&wgl=1&dt=1683102530705&bpp=3&bdt=2508&idt=3&shv=r20230501&mjsv=m202304270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D2f971656ec443856-22b5977abadd0072%3AT%3D1683102529%3ART%3D1683102529%3AS%3DALNI_MZlNzGUMEiraPPN4BeQ3A6qxc5omA&gpic=UID%3D00000bf5027851f8%3AT%3D1683102529%3ART%3D1683102529%3AS%3DALNI_MYKfyErIKey1HtLAtAsC1nttmwKRg&prev_slotnames=4015620116%2C5492353314&nras=1&correlator=68570723625&frm=20&pv=1&ga_vid=983160747.1683102529&ga_sid=1683102529&ga_hid=1393259841&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44773809%2C44759842%2C44785293%2C44788442%2C44789762%2C44789924&oid=2&psts=ABHeCvi4chnjE1ztjSD2JDhhS5eLNeQdL16X2qDdWQquLw5N0uETb7Jm9NaZeUbiqlsqGLslkDVsjAAZf7wKpTnxXPCNXcE4&pvsid=1086273049722701&tmod=891535300&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=3&uci=a!3&fsb=1&dtd=47
Frame ID: 58505C054CD4C5E8D9115E3BCEF96275
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 202CC5F2DF6CC963E751E16D9F0B15FC
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: BB44189AF81802BFFDA7D1A8C0E3566B
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1
Frame ID: 0E15710263BA70657342165CD6D9BCF5
Requests: 17 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 42C48EB4CFF07C0DE198E741B66F9068
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/FHHDynUGsrfH4TjWcGmt-S1vebovfm5iFoLlE4fXdvI.js
Frame ID: 0F40EB816E7BAE5957EE39B1183CF40A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

QR code generator | Calm9

Page URL History Show full URLs

http://s05.calm9.com/ HTTP 302
http://qr.calm9.com/en HTTP 301
http://qr.calm9.com/en/ Page URL

Detected technologies

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/pagead/show_ads\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui[.-]([\d.]*\d)[^/]*\.js
jquery-ui.*\.js

Page Statistics

77
Requests

73 %
HTTPS

68 %
IPv6

18
Domains

23
Subdomains

15
IPs

5
Countries

717 kB
Transfer

2029 kB
Size

20
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: http://ip.calm9.com/en
Title: My IP Address

Search URL Search Domain Scan URL

URL: https://www.linode.com/?r=453f5d3692f29b43ac4ff79370cd276960c98cf0
Title: Awesome Hosting - Linode VPS

Search URL Search Domain Scan URL

URL: https://support.google.com/maps/answer/18539?hl=en
Title: Find or enter Latitude & Longitude

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://s05.calm9.com/ HTTP 302
http://qr.calm9.com/en HTTP 301
http://qr.calm9.com/en/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

http://www.google-analytics.com/ga.js HTTP 307
https://www.google-analytics.com/ga.js

Request Chain 13

http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1070801219&utmhn=qr.calm9.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=QR%20code%20generator%20%7C%20Calm9&utmhid=1393259841&utmr=-&utmp=%2Fen%2F&utmht=1683102529118&utmac=UA-19980734-3&utmcc=__utma%3D134289713.983160747.1683102529.1683102529.1683102529.1%3B%2B__utmz%3D134289713.1683102529.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1292358219&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 307
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1070801219&utmhn=qr.calm9.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=QR%20code%20generator%20%7C%20Calm9&utmhid=1393259841&utmr=-&utmp=%2Fen%2F&utmht=1683102529118&utmac=UA-19980734-3&utmcc=__utma%3D134289713.983160747.1683102529.1683102529.1683102529.1%3B%2B__utmz%3D134289713.1683102529.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1292358219&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~

Request Chain 32

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 68

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESENi_zkGKCtTKaoGj5SrMxYQ&google_cver=1&google_push=ATf1kGP-PWS2HPKFAbC3Rzl4w2mU3Kit4H6S_yGVxN_Qf-ppJroMiys7cEEnwZK7eiFm3Az6_W5EzU7ax6d_CZIWZun9qoxBVrbhDLvo95SpsbVqS8yG4V__xvLHFbK60POqlUlcYo7QRmKVkQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ATf1kGP-PWS2HPKFAbC3Rzl4w2mU3Kit4H6S_yGVxN_Qf-ppJroMiys7cEEnwZK7eiFm3Az6_W5EzU7ax6d_CZIWZun9qoxBVrbhDLvo95SpsbVqS8yG4V__xvLHFbK60POqlUlcYo7QRmKVkQ&google_hm=At_Q47_NTz-99pDZ4SUUWgY

Request Chain 69

https://d.agkn.com/pixel/2175/?google_gid=CAESEHGniktZyL5KpZvDnFIQqZ0&google_cver=1&google_push=ATf1kGP8TPK2NjyA-GXWdX8gj1eP_Pb9570g0tMmC0LltfoSwVKtucYi8DLfTl5qrXMnQMmcllmoe3dxszOImmJgem_M9Lxka7tWzWjvxl45_b5hwT9B54s5OI9LSrAfeYKkBlvJRbjeCalcFA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ATf1kGP8TPK2NjyA-GXWdX8gj1eP_Pb9570g0tMmC0LltfoSwVKtucYi8DLfTl5qrXMnQMmcllmoe3dxszOImmJgem_M9Lxka7tWzWjvxl45_b5hwT9B54s5OI9LSrAfeYKkBlvJRbjeCalcFA&google_hm=Q0FFU0VIR25pa3RaeUw1S3BadkRuRklRcVow

Request Chain 70

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEDh_dTTFY__MijN-xzNlvE0&google_cver=1&google_push=ATf1kGPxuCMNrlkrofvtk5wYV3lqWiGxI75w1XfPHh9ai_xMD5gMhSVUqFMtGrtzxbVNK8UPObTYp-DLbjZhECablRNUSnR3QGQfbFdlABHw95STZIFXAsU0TfsIHuY25U7y-vfDfqB3X3yQKdg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzIyODg3MDMzMDc2MTU0MTc3MQ%3D%3D&google_push=ATf1kGPxuCMNrlkrofvtk5wYV3lqWiGxI75w1XfPHh9ai_xMD5gMhSVUqFMtGrtzxbVNK8UPObTYp-DLbjZhECablRNUSnR3QGQfbFdlABHw95STZIFXAsU0TfsIHuY25U7y-vfDfqB3X3yQKdg

Request Chain 71

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEHCMoEABs4BYOK4RfnFdLZo&google_cver=1&google_push=ATf1kGMfS2m66pfFsn_upE9skOoTlj3UXVa91HM2SSE57b6WkpgOWqrBRH2jAxx1LvMaTqlSUwT_lP27DEn6I3WVqYq6IQwSkd8xVZ455Q7QIo1iyuYNl1A0GMarzxlFUFzlrM416zLvMzwjLnM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGMfS2m66pfFsn_upE9skOoTlj3UXVa91HM2SSE57b6WkpgOWqrBRH2jAxx1LvMaTqlSUwT_lP27DEn6I3WVqYq6IQwSkd8xVZ455Q7QIo1iyuYNl1A0GMarzxlFUFzlrM416zLvMzwjLnM&google_hm=eS1KZllUVjZsRTJwRUh2NGpYNFdOeHgyN1dKQVdOS1IwbX5B

Request Chain 72

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESENlYigpjoifmVIcUPBnt1rE&google_cver=1&google_push=ATf1kGNxe-FIYjbK0G-Bar1TKqN6g7fqD9fD68IxWnebqJ0Z7YjkUAIHBeIf5aT5H0ttiP24H18tTsBjgbpFpNqV5uEjHeEBljnlywj_tYSRHidNHwsUtCRJT_vnFHWHc1WhAakfYWOR1YLIT48 HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESENlYigpjoifmVIcUPBnt1rE&google_cver=1&google_push=ATf1kGNxe-FIYjbK0G-Bar1TKqN6g7fqD9fD68IxWnebqJ0Z7YjkUAIHBeIf5aT5H0ttiP24H18tTsBjgbpFpNqV5uEjHeEBljnlywj_tYSRHidNHwsUtCRJT_vnFHWHc1WhAakfYWOR1YLIT48 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjU5NTQ5NzY1NDE5NTQ2NjcwNQ&google_push=ATf1kGNxe-FIYjbK0G-Bar1TKqN6g7fqD9fD68IxWnebqJ0Z7YjkUAIHBeIf5aT5H0ttiP24H18tTsBjgbpFpNqV5uEjHeEBljnlywj_tYSRHidNHwsUtCRJT_vnFHWHc1WhAakfYWOR1YLIT48

Request Chain 73

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEKQArmuk-cpcRgxe5CU_Up8&google_cver=1&google_push=ATf1kGNeEb0mMouNJQm37nL24Hp0EismACbRRYKp40sLbE2SjK35nFaBy3TgDCXnOsw7gmUC1iGRmhu6rcq_HeOMYkhq-rE8UnIbCCRnGucVgvp632lN5wYJGex6vgyWkkSglglLiy-IHKA5Gfo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEg3RlNISlgtWS1JTzhB&google_push=ATf1kGNeEb0mMouNJQm37nL24Hp0EismACbRRYKp40sLbE2SjK35nFaBy3TgDCXnOsw7gmUC1iGRmhu6rcq_HeOMYkhq-rE8UnIbCCRnGucVgvp632lN5wYJGex6vgyWkkSglglLiy-IHKA5Gfo

Request Chain 74

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIhAwmBj1Pl-HrW1gfdM_ZU&google_cver=1&google_push=ATf1kGOgnMzi5FkXBuoDn1NbH2Ovfv4YMdRiV4sqgH04gAa06WxfVoEiQqo3Y4rle3BV348nvUoCx6s5Y2QHItZyqdx8dZw04gTcvOjNN4cx1bPg6NEYNhsebpTcHtYuM4yZrxsuMTMyh7yyCEc HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEIhAwmBj1Pl-HrW1gfdM_ZU&google_push=ATf1kGOgnMzi5FkXBuoDn1NbH2Ovfv4YMdRiV4sqgH04gAa06WxfVoEiQqo3Y4rle3BV348nvUoCx6s5Y2QHItZyqdx8dZw04gTcvOjNN4cx1bPg6NEYNhsebpTcHtYuM4yZrxsuMTMyh7yyCEc&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIhAwmBj1Pl-HrW1gfdM_ZU&google_hm=ZFIbRIfhho8A_7JWZD7KIgAACIYAAAIB&google_nid=index&google_push=ATf1kGOgnMzi5FkXBuoDn1NbH2Ovfv4YMdRiV4sqgH04gAa06WxfVoEiQqo3Y4rle3BV348nvUoCx6s5Y2QHItZyqdx8dZw04gTcvOjNN4cx1bPg6NEYNhsebpTcHtYuM4yZrxsuMTMyh7yyCEc

77 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
qr.calm9.com/en/
Redirect Chain

http://s05.calm9.com/
http://qr.calm9.com/en
http://qr.calm9.com/en/

32 KB
7 KB

524ms
524ms

Document
text/html

2606:4700:3037::ac43:82d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://qr.calm9.com/en/

Protocol

HTTP/1.1

Server

2606:4700:3037::ac43:82d8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

822fcc64f8faa69304d97d943f3fe6391125bc264349857def3671a6492523fa

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

CF-Cache-Status: DYNAMIC
CF-RAY: 7c1721edfb01371f-FRA
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Wed, 03 May 2023 08:28:48 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KakoBG6JnXObbEAKMLWk%2B8OH32SeFwVnUfk6%2Ff5pBqg3qe3i1n2JA310EMaqXVAdvGyqNCc1D%2BJS07YmkmxIRScjleNhh5RPz7luVZn%2F1V1DJroPpj4WmQ8mvmLn8YOTM9DBjfsc%2FbzGOEw%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
X-Frame-Options: SAMEORIGIN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

CF-Cache-Status: DYNAMIC
CF-RAY: 7c1721e7cc3e371f-FRA
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Date: Wed, 03 May 2023 08:28:47 GMT
Location: http://qr.calm9.com/en/
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ln3DHbha3WlURd7J2TnzjSLnsuZfW2Bh2F%2BWajHnBCAuR66e0mviFiSAnqjExB5D%2Fi0JEF%2BqKb9lvy8%2FT3Cl5OwdZEckAk2KPCii%2FFZ3tp5kZPZHvtrbte6Ny5Z%2FeqCAqlQVC%2BUyLkWC%2F6I%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
X-Frame-Options: SAMEORIGIN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK jquery-1.3.2.min.js Show response
qr.calm9.com/extra/jquery/ 56 KB
20 KB 289ms
282ms Script
text/javascript 2606:4700:3037::ac43:82d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr.calm9.com/extra/jquery/jquery-1.3.2.min.js
Requested by: Host: qr.calm9.com
URL: http://qr.calm9.com/en/
Protocol: HTTP/1.1
Server: 2606:4700:3037::ac43:82d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c8370a2d050359e9d505acc411e6f457a49b21360a21e6cbc9229bad3a767899

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Wed, 03 May 2023 08:28:48 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Wed, 27 Apr 2011 07:32:06 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
ETag: W/"406022-dfa6-4a1e170060980"
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I3S6dWMXPphcSBYVNt69yX3I25CK03r4mDqJfm7KHYnot6QwnziOhfOba%2BgQVxGjJhJl3cwt2Y2xgc2ggEZmzzg6%2BCsJOXZBG2MbW%2F5rDmTIbeYFYL2KrdDnDBbGENqFaDAVuMtF7K2t3TM%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/javascript
Vary: Accept-Encoding
Cache-Control: max-age=14400
Connection: keep-alive
CF-RAY: 7c1721f1488637e4-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK jquery-ui-1.7.1.custom.min.js Show response
qr.calm9.com/extra/jquery-ui/1.7.1/js/ 188 KB
46 KB 769ms
763ms Script
text/javascript 2606:4700:3037::ac43:82d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr.calm9.com/extra/jquery-ui/1.7.1/js/jquery-ui-1.7.1.custom.min.js
Requested by: Host: qr.calm9.com
URL: http://qr.calm9.com/en/
Protocol: HTTP/1.1
Server: 2606:4700:3037::ac43:82d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c59d58df38a15957344f964dde211eab485b340df98eb60bdd17f90f84c6e226

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Wed, 03 May 2023 08:28:48 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Tue, 10 Jan 2012 05:39:55 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
ETag: W/"b4d08-2eea1-4b625f1e1e0c0"
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z4gO5iqL%2B4DFkGSHXvxR4YczBLYP6fnGTVSVTP7XLF6VrHLBW8hGny9yjrsoEtetdLSX52zbKXS44SIAwuiystzcuzHWI1f9Uuf4YQNd%2FCwrKl21RMH%2BK9i9k7JAYvcL%2BOXTyKGpddD5s2Y%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/javascript
Vary: Accept-Encoding
Cache-Control: max-age=14400
Connection: keep-alive
CF-RAY: 7c1721f14dce2c29-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK jquery-ui-1.7.1.custom.css
qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/ 27 KB
6 KB 287ms
281ms Stylesheet
text/css 2606:4700:3037::ac43:82d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/jquery-ui-1.7.1.custom.css
Requested by: Host: qr.calm9.com
URL: http://qr.calm9.com/en/
Protocol: HTTP/1.1
Server: 2606:4700:3037::ac43:82d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0cb37ebd0d0d5cd404f5cd9faf966d08eccade204f973256b0d045a82e7e78f1

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Wed, 03 May 2023 08:28:48 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Tue, 10 Jan 2012 05:39:49 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
ETag: W/"b4ddd-6aee-4b625f1865340"
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gcXy%2FrPSzZ7WIFm1Wm%2FNKukD5hRbR2I%2FDArhqi4fsXeHOrTjeBdAZ5agauiXMh6ej9RC0TMWBdBOcHN7bWg2Sg4f1xhVWKq%2BnGxURY0u0yCIBqDE2dYA5tXCWz6mmVO9Jl%2FyaWEPAA02XDQ%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
Vary: Accept-Encoding
Cache-Control: max-age=14400
Connection: keep-alive
CF-RAY: 7c1721f14e959bc4-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK common.js Show response
qr.calm9.com/extra/ 141 B
899 B 291ms
285ms Script
text/javascript 2606:4700:3037::ac43:82d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://qr.calm9.com/extra/common.js
Requested by: Host: qr.calm9.com
URL: http://qr.calm9.com/en/
Protocol: HTTP/1.1
Server: 2606:4700:3037::ac43:82d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b507f600b4059b7977b2b567c10927ce07636983b494a3e79a40376780448fe5

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/en/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Wed, 03 May 2023 08:28:48 GMT
Content-Encoding: gzip
CF-Cache-Status: REVALIDATED
Last-Modified: Sun, 02 Jun 2013 19:55:53 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
ETag: W/"80561-8d-4de313c48a440"
Transfer-Encoding: chunked
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TxGpG%2BEnz4EqsyNCWDia2SeRVultfguVksGrANClpeVgvHtp8KSdBr%2BvY8oyLXpUTa%2BpPX3jVcLvSHxub%2BPz4O3GD6hxMaVpc%2FUrILRpOtgsnwIki1243f0224Ad4twjuA73HITriaoXLWo%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/javascript
Vary: Accept-Encoding
Cache-Control: max-age=14400
Connection: keep-alive
CF-RAY: 7c1721f14dc539ee-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ 91 KB
32 KB 73ms
52ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: qr.calm9.com
URL: http://qr.calm9.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3581624d9baea9d63669cb837c7bbc06d6f897d32f4255f7aaee8d6caa0f9b70

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32212
x-xss-protection: 0
server: cafe
etag: 11828613224455776218
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 03 May 2023 08:28:48 GMT

GET
H2

200

ga.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/ga.js
https://www.google-analytics.com/ga.js

45 KB
17 KB

29ms
7ms

Script
text/javascript

2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/ga.js

Requested by

Host: qr.calm9.com
URL: http://qr.calm9.com/en/

Protocol

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 03 May 2023 07:09:33 GMT
last-modified: Mon, 17 Apr 2023 22:36:01 GMT
server: Golfe2
age: 4756
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17168
expires: Wed, 03 May 2023 09:09:33 GMT

Redirect headers

Location: https://www.google-analytics.com/ga.js
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202304270101/ 354 KB
119 KB 82ms
80ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202304270101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1797051082820028&plah=qr.calm9.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1c703b70af10365e3fceaac5077989c3b821221f92db74f53025dc1494e04fc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 122070
x-xss-protection: 0
server: cafe
etag: 12152628781070362040
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 03 May 2023 08:28:49 GMT

GET
H/1.1 200
OK frame.htm Show response
qr.calm9.com/qrcode/ Frame 226A 1 KB
1 KB 275ms
274ms Document
text/html 2606:4700:3037::ac43:82d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://qr.calm9.com/qrcode/frame.htm

Requested by

Host: qr.calm9.com
URL: http://qr.calm9.com/en/

Protocol

HTTP/1.1

Server

2606:4700:3037::ac43:82d8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc3280068df5ea79f67752267b2069add1fadb2c0b22ba26ae8617b651dbffba

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://qr.calm9.com/en/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

CF-Cache-Status: DYNAMIC
CF-RAY: 7c1721f6bc3c2c29-FRA
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Wed, 03 May 2023 08:28:49 GMT
Last-Modified: Fri, 06 Nov 2020 14:52:37 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6XxzA1Jb5wjrIvGVvbilA2LPb19Lp1xQSD29VdbWSphBemqwQI7iyuvsHleou6gI0h41aJgSN3lZUwfHG%2FU%2B%2Bth6MsaLFShSxpdsAcdjYAXHl8X%2FbndYu35ovvddZ8ln5PZI0VhuR9oATk8%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
X-Frame-Options: SAMEORIGIN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 like.php Show response
www.facebook.com/plugins/ Frame 9B15 0
2 KB 115ms
100ms Document
text/html 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fqr.calm9.com%2F&layout=standard&show_faces=true&width=450&action=like&font&colorscheme=light&height=80

Requested by

Host: qr.calm9.com
URL: http://qr.calm9.com/en/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://qr.calm9.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-length: 0
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html;charset=utf-8
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 03 May 2023 08:28:49 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
x-content-type-options: nosniff
x-fb-debug: RKkeCVwpqbSNJgOifqsHs3FdExu8Rcn+7TOxk1gPzPA3KmqmKIFsD49CVqogZFJdzQYMghQJOghw4qk89S0h/A==
x-xss-protection: 0

GET
H/1.1 200
OK ui-bg_flat_75_ffffff_40x100.png
qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/images/ 178 B
926 B 264ms
263ms Image
image/png 2606:4700:3037::ac43:82d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/images/ui-bg_flat_75_ffffff_40x100.png
Requested by: Host: qr.calm9.com
URL: http://qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/jquery-ui-1.7.1.custom.css
Protocol: HTTP/1.1
Server: 2606:4700:3037::ac43:82d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 39ab7ccd9f4e82579da78a9241265df288d8eb65dbbd7cf48aed2d0129887df5

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/jquery-ui-1.7.1.custom.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Wed, 03 May 2023 08:28:49 GMT
CF-Cache-Status: HIT
Last-Modified: Tue, 10 Jan 2012 05:39:49 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
ETag: "b4dd1-b2-4b625f1865340"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nVhScmxzizNQAJbipD0By5I6oay3McPD2CcGVWh%2FMCekFdyk8%2BTQkbXZbGYgH4LnJlhRkl%2BC4WwBd%2BHOHSqFwgzBfNW7%2BUpPFnx5vWyaN9Sj4lDGpwlaPPp7RdCsiTVJxPr6%2FQElRkVHQGE%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 7c1721f6dbfe39ee-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 178

GET
H/1.1 200
OK ui-bg_highlight-soft_75_cccccc_1x100.png
qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/images/ 101 B
851 B 257ms
256ms Image
image/png 2606:4700:3037::ac43:82d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/images/ui-bg_highlight-soft_75_cccccc_1x100.png
Requested by: Host: qr.calm9.com
URL: http://qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/jquery-ui-1.7.1.custom.css
Protocol: HTTP/1.1
Server: 2606:4700:3037::ac43:82d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 54270656df079c4da5182629a080fc633b6f84b87985eb016d25a560e2c38d4a

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/jquery-ui-1.7.1.custom.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Wed, 03 May 2023 08:28:49 GMT
CF-Cache-Status: HIT
Last-Modified: Tue, 10 Jan 2012 05:39:49 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
ETag: "b4dd7-65-4b625f1865340"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BGNfvXnxmzUPh%2F6WOHqYzTopXRGsoL9xNtEsH6DWyKchezHf%2FzHeLLRlVGFObqP%2FqdaG4hBvZjMAiEsovHrN%2BoGpB2yvtqsHO91t77g7DRJwQqYEt4%2FMmrYnhIGK5F5V%2BW8CRmFtTfQjhok%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 7c1721f6d91037e4-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 101

GET
H/1.1 200
OK ui-bg_glass_65_ffffff_1x400.png
qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/images/ 105 B
861 B 291ms
290ms Image
image/png 2606:4700:3037::ac43:82d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/images/ui-bg_glass_65_ffffff_1x400.png
Requested by: Host: qr.calm9.com
URL: http://qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/jquery-ui-1.7.1.custom.css
Protocol: HTTP/1.1
Server: 2606:4700:3037::ac43:82d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f0e6cd91b837d5c5644d026e5ffeccd907953317cd5c0f689901733afda260b2

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/jquery-ui-1.7.1.custom.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Wed, 03 May 2023 08:28:49 GMT
CF-Cache-Status: HIT
Last-Modified: Tue, 10 Jan 2012 05:39:49 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
ETag: "b4dd3-69-4b625f1865340"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qQvS%2BMhZeTcWSqvfxYHjYffeo%2BrpIm4RKG%2ByLlfK7b4G8fUWnCBg77gq%2Fnu4%2FNG0N61k%2BGoE7Z2BSclveagVc%2BN3raXBuT1%2FTSQNHJoHLH%2Br%2FGRn5MeK6bMja2cuB81ij8x2g6FRioIY1BE%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 7c1721f6de1b9bc4-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 105

GET
H/1.1 200
OK ui-bg_glass_75_e6e6e6_1x400.png
qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/images/ 110 B
856 B 266ms
266ms Image
image/png 2606:4700:3037::ac43:82d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/images/ui-bg_glass_75_e6e6e6_1x400.png
Requested by: Host: qr.calm9.com
URL: http://qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/jquery-ui-1.7.1.custom.css
Protocol: HTTP/1.1
Server: 2606:4700:3037::ac43:82d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ddf5dd4e0ef2b185e8bb0af7b6e90ebe74a84384cb4700658e76e754c8bfe550

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/extra/jquery-ui/1.7.1/css/smoothness/jquery-ui-1.7.1.custom.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Wed, 03 May 2023 08:28:49 GMT
CF-Cache-Status: HIT
Last-Modified: Tue, 10 Jan 2012 05:39:49 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
ETag: "b4dd5-6e-4b625f1865340"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=skQok3JLi83uxm%2ByGl3t8ei%2FwK5FHbSV4xaPLeXFXj1aVeiSyQDNRxZoXBTbAAcGrIhWZVown6R%2BHVxQgRRV7viATRuqhYmflxX%2Fg%2FXDplNtsmx3GJMnurZvxbUmjBnpSTI2yLL7ltJAd7c%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 7c1721f6dcfa371f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 110

GET
H2

200

__utm.gif
www.google-analytics.com/r/
Redirect Chain

http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1070801219&utmhn=qr.calm9.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=QR%20cod...
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1070801219&utmhn=qr.calm9.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=QR%20co...

35 B
197 B

15ms
14ms

Image
image/gif

2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1070801219&utmhn=qr.calm9.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=QR%20code%20generator%20%7C%20Calm9&utmhid=1393259841&utmr=-&utmp=%2Fen%2F&utmht=1683102529118&utmac=UA-19980734-3&utmcc=__utma%3D134289713.983160747.1683102529.1683102529.1683102529.1%3B%2B__utmz%3D134289713.1683102529.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1292358219&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~

Requested by

Host: qr.calm9.com
URL: http://qr.calm9.com/en/

Protocol

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 May 2023 08:28:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1070801219&utmhn=qr.calm9.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=QR%20code%20generator%20%7C%20Calm9&utmhid=1393259841&utmr=-&utmp=%2Fen%2F&utmht=1683102529118&utmac=UA-19980734-3&utmcc=__utma%3D134289713.983160747.1683102529.1683102529.1683102529.1%3B%2B__utmz%3D134289713.1683102529.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1292358219&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 385 B
602 B 36ms
14ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=qr.calm9.com&callback=_gfp_s_&client=ca-pub-1797051082820028

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202304270101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1797051082820028&plah=qr.calm9.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

adbe6828e1a9a96c0095a9203f661179c74d48cebc9c4107fb6f4ce64319dcb3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 251
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
531 B 40ms
17ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=qr.calm9.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 37ms
15ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=qr.calm9.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2960 603 B
534 B 51ms
30ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1797051082820028&output=html&h=15&slotname=4015620116&adk=2307622340&adf=1850100242&pi=t.ma~as.4015620116&w=728&lmt=1683102529&url=http%3A%2F%2Fqr.calm9.com%2Fen%2F&wgl=1&dt=1683102529048&bpp=20&bdt=851&idt=204&shv=r20230501&mjsv=m202304270101&ptt=5&saldr=sa&abxe=1&correlator=68570723625&frm=20&pv=2&ga_vid=983160747.1683102529&ga_sid=1683102529&ga_hid=1393259841&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=624&ady=52&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44773809%2C44759842%2C44785293%2C44788442%2C44789762%2C44789924&oid=2&pvsid=1086273049722701&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Ce%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=1&uci=a!1&fsb=1&xpc=FODuNi3ECf&p=http%3A//qr.calm9.com&dtd=225

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://qr.calm9.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 03 May 2023 08:28:49 GMT
expires: Wed, 03 May 2023 08:28:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7F7E 84 KB
31 KB 1024ms
1015ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1797051082820028&output=html&h=90&slotname=5492353314&adk=2697840534&adf=1101522062&pi=t.ma~as.5492353314&w=728&lmt=1683102529&url=http%3A%2F%2Fqr.calm9.com%2Fen%2F&wgl=1&dt=1683102529075&bpp=7&bdt=878&idt=206&shv=r20230501&mjsv=m202304270101&ptt=5&saldr=sa&abxe=1&prev_slotnames=4015620116&correlator=68570723625&frm=20&pv=1&ga_vid=983160747.1683102529&ga_sid=1683102529&ga_hid=1393259841&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=613&ady=670&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44773809%2C44759842%2C44785293%2C44788442%2C44789762%2C44789924&oid=2&pvsid=1086273049722701&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cpe%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=8hBUvgyDMS&p=http%3A//qr.calm9.com&dtd=211

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0729e79d82be38d6a4cac082903153ec6d23c513d4bf14c00826c7ba7951b367

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://qr.calm9.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 31944
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 03 May 2023 08:28:50 GMT
expires: Wed, 03 May 2023 08:28:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK Calm9-QRCode-Bookmark.png
qr.calm9.com/qrcode/ Frame 226A 714 B
1 KB 265ms
264ms Image
image/png 2606:4700:3037::ac43:82d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr.calm9.com/qrcode/Calm9-QRCode-Bookmark.png
Requested by: Host: qr.calm9.com
URL: http://qr.calm9.com/qrcode/frame.htm
Protocol: HTTP/1.1
Server: 2606:4700:3037::ac43:82d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe6fd7911f1285db42e21f1cfecc69b904d78819db2f1992a3004dfb4b7ee4ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/qrcode/frame.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Wed, 03 May 2023 08:28:49 GMT
CF-Cache-Status: HIT
Last-Modified: Sun, 02 Jun 2013 18:22:53 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
ETag: "80669-2ca-4de2fefb09940"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dv56BaFaB3Jh8z5X1yjYyfFoieaHrgYQEcZXp98lt2XOUrWiAjubYSyLp0TUzd9QMpMCCrHplgdyO95s9ZkD2Txx7yA7fEcYNxGzv3UNzuQoH177VjXuKng9KNpcL6x4qd6pldSs9pADYFk%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 7c1721f87b2237e4-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 714

GET
H/1.1 200
OK favicon.png
qr.calm9.com/ Frame 226A 809 B
2 KB 1069ms
1069ms Image
image/png 2606:4700:3037::ac43:82d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://qr.calm9.com/favicon.png
Requested by: Host: qr.calm9.com
URL: http://qr.calm9.com/qrcode/frame.htm
Protocol: HTTP/1.1
Server: 2606:4700:3037::ac43:82d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e9bedd3c5f2bbfb6a3472d300f4746e6b623177717e83cf41a518d067db64ed3

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/qrcode/frame.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Wed, 03 May 2023 08:28:50 GMT
CF-Cache-Status: HIT
Last-Modified: Thu, 06 Jun 2013 10:20:59 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
ETag: "80421-329-4de79aba578c0"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4uUT0xaoCBmqLG2VG5svUTHEzZextsBKwh4koRXvlk3EIGTMpnbprNAIDrAHQypytkw%2BT92XumvpXhCHFTOQU%2BfRMWJz2j8ciYVb4MBUyg7uamkoHYvBXgXvhIrP%2F0BU3pncTFyi8MPFT20%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 7c1721f87e7c2c29-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 809

GET
H2 200 css
fonts.googleapis.com/ Frame 7F7E 9 KB
1 KB 60ms
34ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1797051082820028&output=html&h=90&slotname=5492353314&adk=2697840534&adf=1101522062&pi=t.ma~as.5492353314&w=728&lmt=1683102529&url=http%3A%2F%2Fqr.calm9.com%2Fen%2F&wgl=1&dt=1683102529075&bpp=7&bdt=878&idt=206&shv=r20230501&mjsv=m202304270101&ptt=5&saldr=sa&abxe=1&prev_slotnames=4015620116&correlator=68570723625&frm=20&pv=1&ga_vid=983160747.1683102529&ga_sid=1683102529&ga_hid=1393259841&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=613&ady=670&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44773809%2C44759842%2C44785293%2C44788442%2C44789762%2C44789924&oid=2&pvsid=1086273049722701&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cpe%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=8hBUvgyDMS&p=http%3A//qr.calm9.com&dtd=211

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

400fabe35a47597142482001174f415493a18dc7e1d35f2f66385013b7dd1e02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 03 May 2023 08:28:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 03 May 2023 08:10:39 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 03 May 2023 08:28:50 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230501/r20110914/client/ Frame 7F7E 2 KB
847 B 40ms
12ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230501/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 17:36:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53537
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 738
x-xss-protection: 0
server: cafe
etag: 1394486882873449110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 16 May 2023 17:36:33 GMT

GET
H2 200 adview
googleads.g.doubleclick.net/pagead/ Frame 7F7E 0
0 52ms
51ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C3Sv5QRtSZLCqE9qJlgS2wp2gCK3216xuy7iataAO_ePmwLslEAEg0obuBmCV4pCCoAegAY3s5NkCyAEBqQJ5zaBGesaoPqgDAcgDywSqBMYBT9C3p_05PKQS5P8NT3CPAMDWLfJmObBKjmVhU-ly1XAj7d7xHDuZaeUXmiYO02TXYghP8lznWiKaD219Php2JgQwE5HUP5Ty0acklMwkDQc0t7ciSOlpNySiOixctW0tr9FeunjGq8F-p4ublMfKGznJqwXXBM-mgnfzqtSaKcyYnvAEir9q6us1jrYJlCEv_P8UYYjDVPRMFqGC4L2TMdF5W3lWRnjuok415nIIoH1AoNRfvBGyzMYQORXc0xmKW4jvABvtwATgwp3M5gOSBQQIBBgBkgUECAUYBIAH25ObpgGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBDRyQLSCBYIgOGAEBABGB8yAqoCOgKAQEi9_cE6gAoByAsB2BMNiBQK0BUBgBcBshccChoIABIUcHViLTE3OTcwNTEwODI4MjAwMjgYAA&sigh=QUVHlBqajrA&uach_m=[UACH]&cid=CAQSGwBygQiDXqt07L1SZsZt3IP6XGF9ER5cHIu7eBgB

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1797051082820028&output=html&h=90&slotname=5492353314&adk=2697840534&adf=1101522062&pi=t.ma~as.5492353314&w=728&lmt=1683102529&url=http%3A%2F%2Fqr.calm9.com%2Fen%2F&wgl=1&dt=1683102529075&bpp=7&bdt=878&idt=206&shv=r20230501&mjsv=m202304270101&ptt=5&saldr=sa&abxe=1&prev_slotnames=4015620116&correlator=68570723625&frm=20&pv=1&ga_vid=983160747.1683102529&ga_sid=1683102529&ga_hid=1393259841&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=613&ady=670&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44773809%2C44759842%2C44785293%2C44788442%2C44789762%2C44789924&oid=2&pvsid=1086273049722701&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cpe%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=8hBUvgyDMS&p=http%3A//qr.calm9.com&dtd=211
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 03 May 2023 08:28:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 03 May 2023 08:28:50 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230501/r20110914/ Frame 7F7E 22 KB
9 KB 33ms
8ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230501/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00d6272f8ba086bd63eed498e6a916b8d9eb0f51920af223b1596e0b72c9a4a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 17:35:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53583
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8743
x-xss-protection: 0
server: cafe
etag: 14489809188666054284
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 16 May 2023 17:35:47 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230501/r20110914/client/ Frame 7F7E 3 KB
1 KB 38ms
13ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230501/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 07:37:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3106
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 May 2023 07:37:04 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230501/r20110914/client/ Frame 7F7E 19 KB
8 KB 34ms
9ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230501/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7141471cf38c1e5f68499d03fc12899c1d4f91358d533881a7c5e8ddf10a5ad5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 17:34:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53669
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7957
x-xss-protection: 0
server: cafe
etag: 10936619172403307163
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 16 May 2023 17:34:21 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7F7E 160 KB
49 KB 64ms
21ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dcef0a2eb37a3d8e32ddf11f664b3375a06980cf33792aa7bfb798b15cb646d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50021
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1682940967289926"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 May 2023 08:28:50 GMT

GET
H2 200 dc885651c24f3a38cf2b2dda4c5c7197.js Show response
www.gstatic.com/mysidia/ Frame 7F7E 32 KB
14 KB 38ms
13ms Script
text/javascript 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/dc885651c24f3a38cf2b2dda4c5c7197.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14c77f954be37da1e7fba8efd1279e7ece7e384d33b8375d6e6a1ce013daaf47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 12:11:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73037
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13586
x-xss-protection: 0
last-modified: Thu, 27 Apr 2023 20:09:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 31 Jul 2023 12:11:33 GMT

GET
DATA 200
OK truncated
/ Frame 7F7E 161 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 29e4c24a2fa1b6c2218b217e252a8d838cb65819a3b959a73c1a3565067ec0d9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 768C 143 B
166 B 7ms
6ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1797051082820028&output=html&h=90&slotname=5492353314&adk=2697840534&adf=1101522062&pi=t.ma~as.5492353314&w=728&lmt=1683102529&url=http%3A%2F%2Fqr.calm9.com%2Fen%2F&wgl=1&dt=1683102529075&bpp=7&bdt=878&idt=206&shv=r20230501&mjsv=m202304270101&ptt=5&saldr=sa&abxe=1&prev_slotnames=4015620116&correlator=68570723625&frm=20&pv=1&ga_vid=983160747.1683102529&ga_sid=1683102529&ga_hid=1393259841&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=613&ady=670&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44773809%2C44759842%2C44785293%2C44788442%2C44789762%2C44789924&oid=2&pvsid=1086273049722701&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cpe%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=8hBUvgyDMS&p=http%3A//qr.calm9.com&dtd=211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1072
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 03 May 2023 08:10:58 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7F7E 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 32453fa389296dd8227b1e9abe4c3b37895ba4958d9aada00c277b9d82c46772

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 768C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

24ms
23ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 03 May 2023 08:28:50 GMT
expires: Wed, 03 May 2023 08:28:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 03 May 2023 08:28:50 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v46/ Frame 7F7E 29 KB
30 KB 32ms
6ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v46/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45a61a04904fc2115c440a349a65dc93d2965b0b24dc5a8172bd8b792bdbf103

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 05:16:02 GMT
x-content-type-options: nosniff
age: 357168
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29728
x-xss-protection: 0
last-modified: Mon, 03 Apr 2023 16:59:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 28 Apr 2024 05:16:02 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 135 KB
46 KB 108ms
108ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50b14a2d5fdb9675aebceb24c610cf491be21d5a8bbd8fce0f469f47d8c08fa0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:50 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47068
x-xss-protection: 0
server: cafe
etag: 10174568327460141942
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 03 May 2023 08:28:50 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 75ms
57ms XHR
application/json 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230501&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68604b008a8bbd8311fdddf214bd4aae0561776c8c004dcaa1d3b93623b138fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11194
x-xss-protection: 0

GET
H3 200 FHHDynUGsrfH4TjWcGmt-S1vebovfm5iFoLlE4fXdvI.js Show response
pagead2.googlesyndication.com/bg/ Frame 3D8A 37 KB
14 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/FHHDynUGsrfH4TjWcGmt-S1vebovfm5iFoLlE4fXdvI.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1471c3ca7506b2b7c7e138d67069adf92d6f79ba2f7e6e621682e51387d776f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 27 Apr 2023 12:55:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 502397
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14620
x-xss-protection: 0
last-modified: Tue, 25 Apr 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 26 Apr 2024 12:55:33 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 101ms
100ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 03 May 2023 08:28:50 GMT

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230501/r20190131/ Frame C139 10 KB
4 KB 8ms
7ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230501/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://qr.calm9.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 51537
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 02 May 2023 18:09:53 GMT
etag: 15057649708203361565
expires: Tue, 16 May 2023 18:09:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 18ms
16ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=qr.calm9.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 18ms
17ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=qr.calm9.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 5850 122 KB
39 KB 1256ms
1254ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1797051082820028&output=html&adk=1812271804&adf=3025194257&lmt=1683102530&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=http%3A%2F%2Fqr.calm9.com%2Fen%2F&ea=0&pra=7&wgl=1&dt=1683102530705&bpp=3&bdt=2508&idt=3&shv=r20230501&mjsv=m202304270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D2f971656ec443856-22b5977abadd0072%3AT%3D1683102529%3ART%3D1683102529%3AS%3DALNI_MZlNzGUMEiraPPN4BeQ3A6qxc5omA&gpic=UID%3D00000bf5027851f8%3AT%3D1683102529%3ART%3D1683102529%3AS%3DALNI_MYKfyErIKey1HtLAtAsC1nttmwKRg&prev_slotnames=4015620116%2C5492353314&nras=1&correlator=68570723625&frm=20&pv=1&ga_vid=983160747.1683102529&ga_sid=1683102529&ga_hid=1393259841&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44773809%2C44759842%2C44785293%2C44788442%2C44789762%2C44789924&oid=2&psts=ABHeCvi4chnjE1ztjSD2JDhhS5eLNeQdL16X2qDdWQquLw5N0uETb7Jm9NaZeUbiqlsqGLslkDVsjAAZf7wKpTnxXPCNXcE4&pvsid=1086273049722701&tmod=891535300&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=3&uci=a!3&fsb=1&dtd=47

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a7d49fe71fd62ced61d759922d244d0152bb20aeef8bf3213323dad9ad18d622

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://qr.calm9.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 40178
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 03 May 2023 08:28:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 202C 13 KB
5 KB 14ms
6ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://qr.calm9.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3093
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 03 May 2023 07:37:17 GMT
expires: Thu, 02 May 2024 07:37:17 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame BB44 783 B
968 B 18ms
16ms Document
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

2e5aeaca44f77c82173dff9e0f386d0495140483cf5f1db8bf64a904e68d88fa

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KGqAXWdlFF8c7StDoDdsCg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://qr.calm9.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-KGqAXWdlFF8c7StDoDdsCg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 03 May 2023 08:28:50 GMT
expires: Wed, 03 May 2023 08:28:50 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame BB44 0
0 43ms
42ms Image
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230501&jk=1086273049722701&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

GET
H3 200 FHHDynUGsrfH4TjWcGmt-S1vebovfm5iFoLlE4fXdvI.js Show response
pagead2.googlesyndication.com/bg/ Frame 202C 37 KB
14 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/FHHDynUGsrfH4TjWcGmt-S1vebovfm5iFoLlE4fXdvI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1471c3ca7506b2b7c7e138d67069adf92d6f79ba2f7e6e621682e51387d776f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 27 Apr 2023 12:55:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 502397
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14620
x-xss-protection: 0
last-modified: Tue, 25 Apr 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 26 Apr 2024 12:55:33 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 202C 0
10 B 8ms
7ms Image
text/plain 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?hFMpIw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:50 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 45ms
45ms Image
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230501&jk=1086273049722701&bg=!jI-lj9vNAAYcDqajPA47ADkAdvg8WtvyE3UVHyIAjlvNf6Nwf-y-gyqYr9AUXU1mTpRsXeQ4VjWIVNLIy5LlhwFtxmSCVr52nVcCAAAAeFIAAAACaAEHCgAFOH3VWiqZAt6A0SCmgw96XeNygJpLPr1iAO1kSg8T1zEqRz3rTbluRWl0N8Ww8NOfXbfXXA7imBjy_Fhktcv-Di9cO8eJuk_j6N4MdMtS-hywHFinsPBa_J2uFcvzaftqRYpIScYvfIWRRSEehLOC0HChwh1xjNT4YPYBdrbKM2r1oJkHo4YPo4fqOL27kqn79UrLSCA_WlMkafTLopzFDKKt4v5B74-RLY02S0CF0Z5stLzyBVKTXFIwBeSfN1Zjmn4JsPfA1JwkYk0mZOFK8Plmk8vrsgyDG4DIiFxexQPDS2fMNNiKna7Jj7xzb88hpqGbpfXoyiQ7CG6yGKXuSgQywXKjtM3KgiyB-F6CRtV755skFsHLfOHhXuT3NkraJHguVRSqjQR3zJ0DZL8JsFNECq-tAz-bDU7klMjzZsEh9AaPSBwQMvatiy713HyhhwqdVgT_7LUORpwxgXnVk5cQroKdMRPQ4XpyZczYv84bnVXtB9EmvxbPu1QaHJqj4xNiXi-ugJGKJsunsSwyZQE7sBfvOm6-jneIF08gXPnnRfMEwJTcayEFPyuCfDPRRtunhqs-aI2Nlo4t7BsQDDmTS0OLNy1wfh-ILoiC9yO0DhzAteT8kgP_SyoifoizoFBrT0Nq7a66Z1S6mtJHEUJAI3RpZERvuU-7ZyANIGLTeqFeKGSSLqRaaxNFn_TIHnd30S59qJkM_8RwTn7FQ_09xIiY06l3O03K6urZj6rQwnLUsklFlyeZgRsusodUfwwOPDCy9NIqHZgPET2-Ok_XObNZhctkuVJNMRjwFDoNDe8AXcJwONaHUwig9X2sy399Un2yxd6CIYCgZ1dSI3FyLq8S89NNG4ZfFq1-Xhm35HGWoErRblHeQB7Bl_WhbfoVd8zAUclgZADUVxdB-4QWVE6CjhyOSU-WurzTT_tMRtxQYdTNRaC35DoNetUX0Q-m2qDMrju5gUaMgVmN3g5xW0RlsA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7F7E 42 B
64 B 45ms
45ms Fetch
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuF1_JEl3Txvrqj8RKwsXsOKxR-k7lLjPLicamXU2oEJv6AgPRlFTAsch9MxKVoa2WDwLDoOeDUD3_HwOAwGbONkRkbi4LqSFaGZlptsEHogiQj9faOFFJfVd4zl1xpVkKRlzaejA&sai=AMfl-YRwixjkin2lFLrgUdfVkr4oH1Eg12aFq_V-rSxU65UsP_J3I2A0Aikn2ooYzzT0cZzZRG6d2kNEvrp_&sig=Cg0ArKJSzIA8IjFlS90REAE&cid=CAQSGwBygQiDXqt07L1SZsZt3IP6XGF9ER5cHIu7eBgB&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230501&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=2697840534&rs=2&la=0&cr=0&vs=4&r=v&rst=1683102529287&rpt=1273&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 May 2023 08:28:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202304270101/ 151 KB
51 KB 94ms
93ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202304270101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

87b402dab19d264bc7a29342c7386384f96e1612944345823dd12085e74ff66a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:52 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52298
x-xss-protection: 0
server: cafe
etag: 9325268568689635691
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 03 May 2023 08:28:52 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=qr.calm9.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
16ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=qr.calm9.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://qr.calm9.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/ Frame 0E15 10 KB
4 KB 8ms
7ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://qr.calm9.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 50702
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 02 May 2023 18:23:50 GMT
etag: 15057649708203361565
expires: Tue, 16 May 2023 18:23:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 e6ca7bffdb571b122f7e2a992921a2d5.js Show response
www.gstatic.com/mysidia/ Frame 0E15 8 KB
4 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/e6ca7bffdb571b122f7e2a992921a2d5.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

671485b0714fdbb8c1c7fd0d2e632f0b183e62577af1fc2dc38933cb8bfb46a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 12:11:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73042
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3681
x-xss-protection: 0
last-modified: Fri, 28 Apr 2023 17:44:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 31 Jul 2023 12:11:30 GMT

GET
H2 200 4c337f9a7ad795df07d5c5a50dffb0d5.js Show response
www.gstatic.com/mysidia/ Frame 0E15 9 KB
4 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/4c337f9a7ad795df07d5c5a50dffb0d5.js?tag=text/vanilla_highlight_ms

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a33fd1a1bd68e80e3e361791bd30eece467824d66669d1f78be8925d78d2baba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 12:11:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73039
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4065
x-xss-protection: 0
last-modified: Fri, 28 Apr 2023 17:44:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 31 Jul 2023 12:11:33 GMT

GET
H2 200 3f4d05c2ee4f6e8df89808e39016b993.js Show response
www.gstatic.com/mysidia/ Frame 0E15 18 KB
7 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/3f4d05c2ee4f6e8df89808e39016b993.js?tag=pingback

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

10bdc8e2d25f3464c817905c4905f33c69f3632f96645d04ff095a39daa040e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 00:42:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 114365
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7550
x-xss-protection: 0
last-modified: Fri, 28 Apr 2023 17:44:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 31 Jul 2023 00:42:47 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 0E15 9 KB
1017 B 18ms
17ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

400fabe35a47597142482001174f415493a18dc7e1d35f2f66385013b7dd1e02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 03 May 2023 08:28:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 03 May 2023 08:10:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 03 May 2023 08:28:52 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230501/r20110914/client/ Frame 0E15 2 KB
765 B 14ms
13ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230501/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 17:36:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53539
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 738
x-xss-protection: 0
server: cafe
etag: 1394486882873449110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 16 May 2023 17:36:33 GMT

GET
H2 200 136beb7e84d4b05a5b5bba85738ca9f6.js Show response
www.gstatic.com/mysidia/ Frame 0E15 6 KB
2 KB 12ms
10ms Script
text/javascript 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/136beb7e84d4b05a5b5bba85738ca9f6.js?tag=analytics_pingback_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

220049135e6c242896cea20cbd980419905e04e43cc5d1f9d23db3e00e25c6f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 00:43:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 114348
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2330
x-xss-protection: 0
last-modified: Fri, 28 Apr 2023 17:44:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 31 Jul 2023 00:43:04 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230501/r20110914/ Frame 0E15 22 KB
9 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230501/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00d6272f8ba086bd63eed498e6a916b8d9eb0f51920af223b1596e0b72c9a4a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 17:35:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53585
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8743
x-xss-protection: 0
server: cafe
etag: 14489809188666054284
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 16 May 2023 17:35:47 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230501/r20110914/client/ Frame 0E15 3 KB
1 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230501/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 07:37:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3108
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 May 2023 07:37:04 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230501/r20110914/client/ Frame 0E15 19 KB
8 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230501/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7141471cf38c1e5f68499d03fc12899c1d4f91358d533881a7c5e8ddf10a5ad5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 17:34:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53671
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7957
x-xss-protection: 0
server: cafe
etag: 10936619172403307163
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 16 May 2023 17:34:21 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0E15 160 KB
49 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dcef0a2eb37a3d8e32ddf11f664b3375a06980cf33792aa7bfb798b15cb646d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50021
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1682940967289926"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 May 2023 08:28:52 GMT

GET
H2 200 dc885651c24f3a38cf2b2dda4c5c7197.js Show response
www.gstatic.com/mysidia/ Frame 0E15 32 KB
13 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/dc885651c24f3a38cf2b2dda4c5c7197.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14c77f954be37da1e7fba8efd1279e7ece7e384d33b8375d6e6a1ce013daaf47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 12:11:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73039
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13586
x-xss-protection: 0
last-modified: Thu, 27 Apr 2023 20:09:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 31 Jul 2023 12:11:33 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0E15 0
20 B 41ms
40ms Ping
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=Cg4IByoKd2ViX2Jhbm5lcgoHCAgqA2x0cgoSCAEqDmJhbm5lci12YW5pbGxhCgoIAioGc2VydmVyChUIBCoRbXlzaWRpYV9hbmFseXRpY3MKDRArIQAAAAAAACRAMAQKDRArIQAAAAAAADJAMAEKDRADIQAAANDMjE9AMAQSGkNOUG4zc1BkMlA0Q0ZRYUVoUW9kclNvTDdnIhl0ZXh0L3ZhbmlsbGFfaGlnaGxpZ2h0X21zKBU=

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/3f4d05c2ee4f6e8df89808e39016b993.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 May 2023 08:28:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 0E15 0
0 51ms
51ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CEaeAQhtSZNO-L4aIlgSt1azwDrWrgKdwobis760Ry5fnkJIOEAEg0obuBmCV4pCCoAegAYHJr9QDyAEBqAMByAPLBKoExQFP0KbEIumBhr_h6koQMu2w-POhtWjzvcO_juLgdK99ECLlBoqqdNe9kOySDHsAFsHNnTHnpCOVcLuWnglmuHPpzPseY7RXG8YMizZZ20S4B23SI9TWIrVg7X_4QKYUaL_crjHKE-yEn9yywD6aHJugvZ8UcnMqFfwzLJ5TLG5nu9MVP1ktXgwN5HTm9npMh3QennPzgi1RjRMnUjRCpAED399a1VorffTMcRXz5wzKpHdbtxVienpmRGzib7yJYuBKrgf8qMAEiZzCjaMEkgUECAQYAZIFBAgFGASAB4zX_MwDqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQiowE0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAcgLAdgTC9AVAYAXAbIXHAoaCAASFHB1Yi0xNzk3MDUxMDgyODIwMDI4GAA&sigh=tUOg92rCfws&uach_m=[UACH]&cid=CAQSOwBygQiDA1S_iHi96Yv_t5GzJ97NYUlgVkfwCshjQiO9vekS9-0q9sPulL4WldVHAL9m4QU0HdlA5z41GAE

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 03 May 2023 08:28:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 42C4 1 KB
643 B 7ms
6ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 61864
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 02 May 2023 15:17:48 GMT
etag: 48472445140208031
expires: Wed, 03 May 2023 15:17:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 0E15 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9118e407c9924f0b02ccd3bda541675aa44d0d77445bbe4c34f7d65fbf50f291

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 42C4
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESENi_zkGKCtTKaoGj5SrMxYQ&google_cver=1&google_push=ATf1kGP-PWS2HPKFAbC3Rzl4w2mU3Kit4H6S_yGVxN_Qf-ppJroMiys7cEEnwZK7eiFm3Az6_W5EzU7ax6d...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ATf1kGP-PWS2HPKFAbC3Rzl4w2mU3Kit4H6S_yGVxN_Qf-ppJroMiys7cEEnwZK7eiFm3Az6_W5EzU7ax6d_CZIWZun9qoxBVrbhDLvo95SpsbVqS8yG4V__xvLHFbK60PO...

170 B
232 B

19ms
19ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ATf1kGP-PWS2HPKFAbC3Rzl4w2mU3Kit4H6S_yGVxN_Qf-ppJroMiys7cEEnwZK7eiFm3Az6_W5EzU7ax6d_CZIWZun9qoxBVrbhDLvo95SpsbVqS8yG4V__xvLHFbK60POqlUlcYo7QRmKVkQ&google_hm=At_Q47_NTz-99pDZ4SUUWgY

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 May 2023 08:28:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 03 May 2023 08:28:52 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ATf1kGP-PWS2HPKFAbC3Rzl4w2mU3Kit4H6S_yGVxN_Qf-ppJroMiys7cEEnwZK7eiFm3Az6_W5EzU7ax6d_CZIWZun9qoxBVrbhDLvo95SpsbVqS8yG4V__xvLHFbK60POqlUlcYo7QRmKVkQ&google_hm=At_Q47_NTz-99pDZ4SUUWgY
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 42C4
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEHGniktZyL5KpZvDnFIQqZ0&google_cver=1&google_push=ATf1kGP8TPK2NjyA-GXWdX8gj1eP_Pb9570g0tMmC0LltfoSwVKtucYi8DLfTl5qrXMnQMmcllmoe3dxszOImmJgem_M9Lxka7tWz...
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ATf1kGP8TPK2NjyA-GXWdX8gj1eP_Pb9570g0tMmC0LltfoSwVKtucYi8DLfTl5qrXMnQMmcllmoe3dxszOImmJgem_M9Lxka7tWzWjvxl45_b5hwT9B54s5OI9LSrAfeYKk...

170 B
232 B

21ms
19ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ATf1kGP8TPK2NjyA-GXWdX8gj1eP_Pb9570g0tMmC0LltfoSwVKtucYi8DLfTl5qrXMnQMmcllmoe3dxszOImmJgem_M9Lxka7tWzWjvxl45_b5hwT9B54s5OI9LSrAfeYKkBlvJRbjeCalcFA&google_hm=Q0FFU0VIR25pa3RaeUw1S3BadkRuRklRcVow

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 May 2023 08:28:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 03 May 2023 08:28:52 GMT
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ATf1kGP8TPK2NjyA-GXWdX8gj1eP_Pb9570g0tMmC0LltfoSwVKtucYi8DLfTl5qrXMnQMmcllmoe3dxszOImmJgem_M9Lxka7tWzWjvxl45_b5hwT9B54s5OI9LSrAfeYKkBlvJRbjeCalcFA&google_hm=Q0FFU0VIR25pa3RaeUw1S3BadkRuRklRcVow
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 42C4
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEDh_dTTFY__MijN-xzNlvE0&google_cver=1&google_push=ATf1kGPxuCMNrlkrofvtk5wYV3lqWiGxI75w1XfPHh9ai_xMD5gMhSVUqFMtGrtzxbVNK8UPObTYp-DLbjZhEC...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzIyODg3MDMzMDc2MTU0MTc3MQ%3D%3D&google_push=ATf1kGPxuCMNrlkrofvtk5wYV3lqWiGxI75w1XfPHh9ai_xMD5gMhSVUqFMtGrtzxbVNK8UPObTYp-DLbjZhECablR...

170 B
329 B

18ms
18ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzIyODg3MDMzMDc2MTU0MTc3MQ%3D%3D&google_push=ATf1kGPxuCMNrlkrofvtk5wYV3lqWiGxI75w1XfPHh9ai_xMD5gMhSVUqFMtGrtzxbVNK8UPObTYp-DLbjZhECablRNUSnR3QGQfbFdlABHw95STZIFXAsU0TfsIHuY25U7y-vfDfqB3X3yQKdg

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 May 2023 08:28:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzIyODg3MDMzMDc2MTU0MTc3MQ%3D%3D&google_push=ATf1kGPxuCMNrlkrofvtk5wYV3lqWiGxI75w1XfPHh9ai_xMD5gMhSVUqFMtGrtzxbVNK8UPObTYp-DLbjZhECablRNUSnR3QGQfbFdlABHw95STZIFXAsU0TfsIHuY25U7y-vfDfqB3X3yQKdg
Date: Wed, 03 May 2023 08:28:52 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 42C4
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEHCMoEABs4BYOK4RfnFdLZo&google_cver=1&google_push=ATf1kGMfS2m66pfFsn_upE9skOoTlj3UXVa91HM2SSE57b6WkpgOWqrBRH2jAxx1LvMaTqlSUwT_lP27DEn6I3WVqYq6IQw...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGMfS2m66pfFsn_upE9skOoTlj3UXVa91HM2SSE57b6WkpgOWqrBRH2jAxx1LvMaTqlSUwT_lP27DEn6I3WVqYq6IQwSkd8xVZ455Q7QIo1iyuYNl1A0GMarzxlFUFzlr...

170 B
232 B

17ms
17ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGMfS2m66pfFsn_upE9skOoTlj3UXVa91HM2SSE57b6WkpgOWqrBRH2jAxx1LvMaTqlSUwT_lP27DEn6I3WVqYq6IQwSkd8xVZ455Q7QIo1iyuYNl1A0GMarzxlFUFzlrM416zLvMzwjLnM&google_hm=eS1KZllUVjZsRTJwRUh2NGpYNFdOeHgyN1dKQVdOS1IwbX5B

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 May 2023 08:28:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 03 May 2023 08:28:52 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGMfS2m66pfFsn_upE9skOoTlj3UXVa91HM2SSE57b6WkpgOWqrBRH2jAxx1LvMaTqlSUwT_lP27DEn6I3WVqYq6IQwSkd8xVZ455Q7QIo1iyuYNl1A0GMarzxlFUFzlrM416zLvMzwjLnM&google_hm=eS1KZllUVjZsRTJwRUh2NGpYNFdOeHgyN1dKQVdOS1IwbX5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 42C4
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESENlYigpjoifmVIcUPBnt1rE&google_cver=1&google_push=ATf1kGNxe-FIYjbK0G-Bar1TKqN6g7fqD9fD68IxWnebqJ0Z7YjkUAIHBeIf5aT5H0ttiP24H18tTsBj...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESENlYigpjoifmVIcUPBnt1rE&google_cver=1&google_push=ATf1kGNxe-FIYjbK0G-Bar1TKqN6g7fqD9fD68IxWnebqJ0Z7YjkUAIHBeIf5aT5H0ttiP24H18...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjU5NTQ5NzY1NDE5NTQ2NjcwNQ&google_push=ATf1kGNxe-FIYjbK0G-Bar1TKqN6g7fqD9fD68IxWnebqJ0Z7YjkUAIHBeIf5aT5H0ttiP24H18tTs...

170 B
188 B

18ms
17ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjU5NTQ5NzY1NDE5NTQ2NjcwNQ&google_push=ATf1kGNxe-FIYjbK0G-Bar1TKqN6g7fqD9fD68IxWnebqJ0Z7YjkUAIHBeIf5aT5H0ttiP24H18tTsBjgbpFpNqV5uEjHeEBljnlywj_tYSRHidNHwsUtCRJT_vnFHWHc1WhAakfYWOR1YLIT48

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 May 2023 08:28:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 03 May 2023 08:28:52 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjU5NTQ5NzY1NDE5NTQ2NjcwNQ&google_push=ATf1kGNxe-FIYjbK0G-Bar1TKqN6g7fqD9fD68IxWnebqJ0Z7YjkUAIHBeIf5aT5H0ttiP24H18tTsBjgbpFpNqV5uEjHeEBljnlywj_tYSRHidNHwsUtCRJT_vnFHWHc1WhAakfYWOR1YLIT48
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 42C4
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEKQArmuk-cpcRgxe5CU_Up8&google_cver=1&google_push=ATf1kGNeEb0mMouNJQm37nL24Hp0EismACbRRYKp40sLbE2SjK35nFaBy3TgDCXnOsw7gmUC1iG...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEg3RlNISlgtWS1JTzhB&google_push=ATf1kGNeEb0mMouNJQm37nL24Hp0EismACbRRYKp40sLbE2SjK35nFaBy3TgDCXnOsw7gmUC1iGRmhu6rcq_HeOMYkhq-rE8UnIbCCRnG...

170 B
232 B

20ms
20ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEg3RlNISlgtWS1JTzhB&google_push=ATf1kGNeEb0mMouNJQm37nL24Hp0EismACbRRYKp40sLbE2SjK35nFaBy3TgDCXnOsw7gmUC1iGRmhu6rcq_HeOMYkhq-rE8UnIbCCRnGucVgvp632lN5wYJGex6vgyWkkSglglLiy-IHKA5Gfo

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 May 2023 08:28:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEg3RlNISlgtWS1JTzhB&google_push=ATf1kGNeEb0mMouNJQm37nL24Hp0EismACbRRYKp40sLbE2SjK35nFaBy3TgDCXnOsw7gmUC1iGRmhu6rcq_HeOMYkhq-rE8UnIbCCRnGucVgvp632lN5wYJGex6vgyWkkSglglLiy-IHKA5Gfo
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
Expires: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 42C4
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIhAwmBj1Pl-HrW1gfdM_ZU&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEIhAwmBj1Pl-HrW1gfdM_ZU&google_push=AT...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIhAwmBj1Pl-HrW1gfdM_ZU&google_hm=ZFIbRIfhho8A_7JWZD7KIgAACIYAAAIB&google_nid=index&google_push=ATf1kGOgnMzi5FkXBuoDn1NbH2Ovfv4YMdRiV...

170 B
232 B

18ms
18ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIhAwmBj1Pl-HrW1gfdM_ZU&google_hm=ZFIbRIfhho8A_7JWZD7KIgAACIYAAAIB&google_nid=index&google_push=ATf1kGOgnMzi5FkXBuoDn1NbH2Ovfv4YMdRiV4sqgH04gAa06WxfVoEiQqo3Y4rle3BV348nvUoCx6s5Y2QHItZyqdx8dZw04gTcvOjNN4cx1bPg6NEYNhsebpTcHtYuM4yZrxsuMTMyh7yyCEc

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 May 2023 08:28:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 03 May 2023 08:28:52 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIhAwmBj1Pl-HrW1gfdM_ZU&google_hm=ZFIbRIfhho8A_7JWZD7KIgAACIYAAAIB&google_nid=index&google_push=ATf1kGOgnMzi5FkXBuoDn1NbH2Ovfv4YMdRiV4sqgH04gAa06WxfVoEiQqo3Y4rle3BV348nvUoCx6s5Y2QHItZyqdx8dZw04gTcvOjNN4cx1bPg6NEYNhsebpTcHtYuM4yZrxsuMTMyh7yyCEc
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 0
Expires: 0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 42C4 0
130 B 79ms
15ms Image
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L6dpZwRKpSCr4szG2Dl4iNsKEsovHS7Pj8mTwWALGA8G-9g0J6_y-m1N5GQ0vjNRQ44DYk

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 03 May 2023 08:28:52 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 FHHDynUGsrfH4TjWcGmt-S1vebovfm5iFoLlE4fXdvI.js Show response
pagead2.googlesyndication.com/bg/ Frame 0F40 37 KB
14 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/FHHDynUGsrfH4TjWcGmt-S1vebovfm5iFoLlE4fXdvI.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230501/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1471c3ca7506b2b7c7e138d67069adf92d6f79ba2f7e6e621682e51387d776f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 27 Apr 2023 12:55:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 502399
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14620
x-xss-protection: 0
last-modified: Tue, 25 Apr 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 26 Apr 2024 12:55:33 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0E15 0
20 B 43ms
43ms Ping
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=Cg4IByoKd2ViX2Jhbm5lcgoHCAgqA2x0cgoSCAEqDmJhbm5lci12YW5pbGxhCgoIAioGc2VydmVyChUIBCoRbXlzaWRpYV9hbmFseXRpY3MKDRAKIQAAAAAzM_M_MAQKDRANIQAAAAAAAAAAMAQKDhAeKggxMDA1eDEyNDAECg4QGSoIMTAwNXgxMjQwBAoNEA4hAAAAAAAAAAAwBAoNEAQhAAAAaGbGUEAwBAoNEA8hAAAAAAAAAAAwBAoNECshAAAAAAAAOEAwBAoNEAUhAAAANDPTUEAwBAoNEBAhAAAAAADoskAwBAoNEBEhAAAAADAj8UAwBAoNEBIhAAAAAAAAIEAwBAoNEBMhAAAAAAAACEAwBAoNEBchAAAAmJn5WkAwBAoNEBQhAAAAACCn8UAwBAoNEBUhAAAAAAAAKEAwBAoNEBYhAAAAAAAAFEAwBAoNEBghAAAANDNzXkAwBAoNEDIhAAAAADQz0z8wBAoNEDMhAAAAADQz0z8wBAoNEDQhAAAAADQz0z8wBAoNEDUhAAAAADQz0z8wBAoNEDYhAAAAADQz0z8wBAoNEDchAAAAADQz0z8wBAoNEDghAAAAAJqZ8T8wBAoNEDkhAAAAAAAAIUAwBAoNEDohAAAAYGZmJUAwBAoNEDshAAAAAABAWkAwBAoNEDwhAAAAAABAWkAwBAoNED0hAAAAAAAAW0AwBAoNED4hAAAAAACgXEAwBAoNED8hAAAAAACgXEAwBAoNEEAhAAAAzMwMX0AwBBIaQ05QbjNzUGQyUDRDRlFhRWhRb2RyU29MN2ciGXRleHQvdmFuaWxsYV9oaWdobGlnaHRfbXMoFQ==

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/3f4d05c2ee4f6e8df89808e39016b993.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 May 2023 08:28:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 0E15 42 B
64 B 51ms
51ms Fetch
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstwHrif-3EGU4mLZSVIO-Io3EWXpv7YYt4ZcsxKfL-crv2E03jLdSXm3NPg2d7ASlPAPGCnbONsCjAws8vxY_wCAba-hg84bd0iNsav7KMcH_HB105fVzHVm5XOjmFaVk6iT-O0MQ&sai=AMfl-YSNtpGj8klXvkNM3WEC-A-aGenIT5BNYCQWVtdmaJ_Tbqd6Iz2uqp3W4j6bmOnZetpZWH_dPj3d6derxD715jjK9C3uRFBSaGFALRv1c0BjyWPCha2HgcWHddM&sig=Cg0ArKJSzCcEnEFZP1B9EAE&cid=CAQSOwBygQiDA1S_iHi96Yv_t5GzJ97NYUlgVkfwCshjQiO9vekS9-0q9sPulL4WldVHAL9m4QU0HdlA5z41GAE&id=lidar2&mcvt=1001&p=0,0,124,1005&mtos=83,767,1001,1117,1261&tos=83,684,234,116,144&v=20230501&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1812271801&rs=2&la=0&cr=0&vs=4&r=v&rst=1683102532156&rpt=122&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 May 2023 08:28:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

196 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

20 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.qr.calm9.com/	1970-01-20 21:07:42	Name: __utma Value: 134289713.983160747.1683102529.1683102529.1683102529.1
.qr.calm9.com/	1969-12-31 23:59:59	Name: __utmc Value: 134289713
.qr.calm9.com/	1970-01-20 15:54:30	Name: __utmz Value: 134289713.1683102529.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.qr.calm9.com/	1970-01-20 11:31:43	Name: __utmt Value: 1
.qr.calm9.com/	1970-01-20 11:31:44	Name: __utmb Value: 134289713.1.10.1683102529
.calm9.com/	1970-01-20 20:53:18	Name: __gads Value: ID=2f971656ec443856-22b5977abadd0072:T=1683102529:RT=1683102529:S=ALNI_MZlNzGUMEiraPPN4BeQ3A6qxc5omA
.calm9.com/	1970-01-20 20:53:18	Name: __gpi Value: UID=00000bf5027851f8:T=1683102529:RT=1683102529:S=ALNI_MYKfyErIKey1HtLAtAsC1nttmwKRg
.doubleclick.net/	1970-01-20 20:53:18	Name: IDE Value: AHWqTUkk9asZwsrCuYltl30bPD7AaTKm61Iv6n9XM-5SZSw5ky79ODXzr-eDNszjQug
.doubleclick.net/	1970-01-20 11:31:46	Name: DSID Value: NO_DATA
.agkn.com/	1970-01-20 20:17:18	Name: ab Value: 0001%3AxhQD543j8aCFDa2z379w1jDlsQzRVmDq
.agkn.com/	1970-01-20 20:17:18	Name: u Value: C\|0CEAr5NfEK-TXxAAAAAAAAQ13AQCAAQpAAAAAAA
.ctnsnet.com/	1970-01-20 20:17:18	Name: cid_02dfd0e3bfcd4f3fbdf690d9e125145a Value: 1
.ctnsnet.com/	1970-01-20 20:17:18	Name: gid_CAESENi_zkGKCtTKaoGj5SrMxYQ Value: 1
.adfarm1.adition.com/	1970-01-20 13:41:18	Name: UserID1 Value: 7228870330761541771
.casalemedia.com/	1970-01-20 20:17:18	Name: CMID Value: ZFIbRIfhho8A-7JWZD7KIgAA
.casalemedia.com/	1970-01-20 13:41:18	Name: CMPS Value: 2182
.casalemedia.com/	1970-01-20 13:41:18	Name: CMPRO Value: 2182
.adform.net/	1970-01-20 12:16:20	Name: C Value: 1
.yahoo.com/	1970-01-20 20:17:40	Name: A3 Value: d=AQABBEQbUmQCEEH19BuMQ29oEK17h_CUeAsFEgEBAQFsU2RbZAAAAAAA_eMAAA&S=AQAAAkjsva-T4DOPU_GTSRC4nLs
.adform.net/	1970-01-20 12:58:06	Name: uid Value: 6595497654195466705

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
c1.adform.net
cm.g.doubleclick.net
d.agkn.com
dsp.adfarm1.adition.com
fonts.googleapis.com
fonts.gstatic.com
gcm.ctnsnet.com
googleads.g.doubleclick.net
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.rubiconproject.com
pr-bh.ybp.yahoo.com
qr.calm9.com
s05.calm9.com
ssum-sec.casalemedia.com
tpc.googlesyndication.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagservices.com
www.gstatic.com
142.250.186.162
18.158.78.2
185.80.39.216
2606:4700:3030::6815:970
2606:4700:3037::ac43:82d8
2a00:1450:4001:800::200e
2a00:1450:4001:801::2001
2a00:1450:4001:806::2003
2a00:1450:4001:809::2002
2a00:1450:4001:810::2002
2a00:1450:4001:811::2004
2a00:1450:4001:812::200a
2a00:1450:4001:813::2003
2a00:1450:4001:828::2002
2a00:1450:4001:82f::2002
2a00:1450:4001:830::2002
2a03:2880:f176:84:face:b00c:0:25de
2a05:d018:d29:3602:c8cd:afe4:1960:d0d5
35.186.193.173
37.157.3.30
69.173.144.138
85.114.159.93
00d6272f8ba086bd63eed498e6a916b8d9eb0f51920af223b1596e0b72c9a4a3
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
0729e79d82be38d6a4cac082903153ec6d23c513d4bf14c00826c7ba7951b367
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0cb37ebd0d0d5cd404f5cd9faf966d08eccade204f973256b0d045a82e7e78f1
10bdc8e2d25f3464c817905c4905f33c69f3632f96645d04ff095a39daa040e9
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
1471c3ca7506b2b7c7e138d67069adf92d6f79ba2f7e6e621682e51387d776f2
14c77f954be37da1e7fba8efd1279e7ece7e384d33b8375d6e6a1ce013daaf47
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1c703b70af10365e3fceaac5077989c3b821221f92db74f53025dc1494e04fc6
220049135e6c242896cea20cbd980419905e04e43cc5d1f9d23db3e00e25c6f9
29e4c24a2fa1b6c2218b217e252a8d838cb65819a3b959a73c1a3565067ec0d9
2e5aeaca44f77c82173dff9e0f386d0495140483cf5f1db8bf64a904e68d88fa
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
32453fa389296dd8227b1e9abe4c3b37895ba4958d9aada00c277b9d82c46772
3581624d9baea9d63669cb837c7bbc06d6f897d32f4255f7aaee8d6caa0f9b70
39ab7ccd9f4e82579da78a9241265df288d8eb65dbbd7cf48aed2d0129887df5
400fabe35a47597142482001174f415493a18dc7e1d35f2f66385013b7dd1e02
45a61a04904fc2115c440a349a65dc93d2965b0b24dc5a8172bd8b792bdbf103
50b14a2d5fdb9675aebceb24c610cf491be21d5a8bbd8fce0f469f47d8c08fa0
54270656df079c4da5182629a080fc633b6f84b87985eb016d25a560e2c38d4a
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
671485b0714fdbb8c1c7fd0d2e632f0b183e62577af1fc2dc38933cb8bfb46a2
68604b008a8bbd8311fdddf214bd4aae0561776c8c004dcaa1d3b93623b138fc
7141471cf38c1e5f68499d03fc12899c1d4f91358d533881a7c5e8ddf10a5ad5
822fcc64f8faa69304d97d943f3fe6391125bc264349857def3671a6492523fa
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
87b402dab19d264bc7a29342c7386384f96e1612944345823dd12085e74ff66a
9118e407c9924f0b02ccd3bda541675aa44d0d77445bbe4c34f7d65fbf50f291
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
a33fd1a1bd68e80e3e361791bd30eece467824d66669d1f78be8925d78d2baba
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a7d49fe71fd62ced61d759922d244d0152bb20aeef8bf3213323dad9ad18d622
adbe6828e1a9a96c0095a9203f661179c74d48cebc9c4107fb6f4ce64319dcb3
b507f600b4059b7977b2b567c10927ce07636983b494a3e79a40376780448fe5
bc3280068df5ea79f67752267b2069add1fadb2c0b22ba26ae8617b651dbffba
c59d58df38a15957344f964dde211eab485b340df98eb60bdd17f90f84c6e226
c8370a2d050359e9d505acc411e6f457a49b21360a21e6cbc9229bad3a767899
dcef0a2eb37a3d8e32ddf11f664b3375a06980cf33792aa7bfb798b15cb646d1
ddf5dd4e0ef2b185e8bb0af7b6e90ebe74a84384cb4700658e76e754c8bfe550
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9bedd3c5f2bbfb6a3472d300f4746e6b623177717e83cf41a518d067db64ed3
eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0e6cd91b837d5c5644d026e5ffeccd907953317cd5c0f689901733afda260b2
f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f
fe6fd7911f1285db42e21f1cfecc69b904d78819db2f1992a3004dfb4b7ee4ae

qr.calm9.com Open in urlscan Pro 2606:4700:3037::ac43:82d8 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

77 Requests

73 %HTTPS

68 %IPv6

18 Domains

23 Subdomains

15 IPs

5 Countries

717 kBTransfer

2029 kBSize

20 Cookies

3 Outgoing links

Page URL History

Redirected requests

77 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

qr.calm9.com Open in urlscan Pro
2606:4700:3037::ac43:82d8 Public Scan

Screenshot
Live screenshot

Full Image

77
Requests

73 %
HTTPS

68 %
IPv6

18
Domains

23
Subdomains

15
IPs

5
Countries

717 kB
Transfer

2029 kB
Size

20
Cookies

77 HTTP transactions
3 data transactions