www.profinance.ru Open in urlscan Pro
81.177.34.158 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://forexpf.ru/
Effective URL:
https://www.profinance.ru/
Submission Tags: tranco_l324
Submission: On November 21 via api (November 21st 2021, 8:17:29 am UTC) from DE — Scanned from DE

Summary HTTP 243 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 56 IPs in 10 countries across 52 domains to perform 243 HTTP transactions. The main IP is 81.177.34.158, located in Moscow, Russian Federation and belongs to RTCOMM-AS, RU. The main domain is www.profinance.ru.
TLS certificate: Issued by GoGetSSL RSA DV CA on October 13th 2021. Valid for: a year.

This is the only time www.profinance.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 43	81.177.34.158 81.177.34.158	8342 (RTCOMM-AS) (RTCOMM-AS)
3	2a02:6b8:a::a 2a02:6b8:a::a	208722 (YNDX) (YNDX)
1	81.177.34.136 81.177.34.136	8342 (RTCOMM-AS) (RTCOMM-AS)
1 5	217.69.133.145 217.69.133.145	47764 (MAILRU-AS...) (MAILRU-AS Mail.Ru)
18	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
3 13	2a02:6b8::1:119 2a02:6b8::1:119	208722 (YNDX) (YNDX)
2 9	96.46.186.57 96.46.186.57	7979 (SERVERS-COM) (SERVERS-COM)
1	2a00:1450:400... 2a00:1450:4001:813::2008	15169 (GOOGLE) (GOOGLE)
2 3	88.212.201.204 88.212.201.204	39134 (UNITEDNET) (UNITEDNET)
2 22	2a02:6b8::90 2a02:6b8::90	208722 (YNDX) (YNDX)
2 15	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
4	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
6	2a02:6b8:20::215 2a02:6b8:20::215	208722 (YNDX) (YNDX)
1	2a02:6b8::16b 2a02:6b8::16b	208722 (YNDX) (YNDX)
3	2a02:2638:1::3 2a02:2638:1::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	185.184.8.65 185.184.8.65	204995 (RTB-HOUSE...) (RTB-HOUSE-AMS)
3 4	193.232.150.45 193.232.150.45	48061 (UMA-TECH-AS) (UMA-TECH-AS)
1	2a00:1148:db0... 2a00:1148:db00::17	47764 (MAILRU-AS...) (MAILRU-AS Mail.Ru)
1	195.201.152.110 195.201.152.110	24940 (HETZNER-AS) (HETZNER-AS)
1 2	116.202.236.172 116.202.236.172	24940 (HETZNER-AS) (HETZNER-AS)
1	195.209.111.20 195.209.111.20	52007 (ADRIVER-AS) (ADRIVER-AS)
1	151.236.118.210 151.236.118.210	204720 (CDNETWORKS) (CDNETWORKS)
6 6	3.124.225.84 3.124.225.84	16509 (AMAZON-02) (AMAZON-02)
2 2	35.210.53.219 35.210.53.219	15169 (GOOGLE) (GOOGLE)
2 2	63.251.14.3 63.251.14.3	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
5 5	31.172.81.158 31.172.81.158	44066 (DE-FIRSTC...) (DE-FIRSTCOLO www.first-colo.net)
2 3	31.172.81.160 31.172.81.160	44066 (DE-FIRSTC...) (DE-FIRSTCOLO www.first-colo.net)
2	178.250.2.131 178.250.2.131	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 1	157.90.167.185 157.90.167.185	24940 (HETZNER-AS) (HETZNER-AS)
3	2a02:6b8::184 2a02:6b8::184	208722 (YNDX) (YNDX)
3 3	89.108.120.76 89.108.120.76	197695 (AS-REG) (AS-REG)
2 2	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
34	2a00:1450:400... 2a00:1450:4001:80f::2001	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
1	2a02:6b8::5:114 2a02:6b8::5:114	208722 (YNDX) (YNDX)
1 1	212.11.155.167 212.11.155.167	8901 (Moscow Ma...) (Moscow Mayors Office)
4 5	95.217.109.66 95.217.109.66	24940 (HETZNER-AS) (HETZNER-AS)
3 3	35.190.16.14 35.190.16.14	15169 (GOOGLE) (GOOGLE)
1	81.222.128.213 81.222.128.213	20597 (ELTEL-AS) (ELTEL-AS)
2 2	185.15.175.158 185.15.175.158	43226 (SAFEDATA ...) (SAFEDATA Uplinks)
1 1	80.64.106.147 80.64.106.147	20764 (RASCOM-AS...) (RASCOM-AS CJSC RASCOM ISP)
1 1	80.64.106.149 80.64.106.149	20764 (RASCOM-AS...) (RASCOM-AS CJSC RASCOM ISP)
2 2	78.46.100.125 78.46.100.125	24940 (HETZNER-AS) (HETZNER-AS)
1 1	91.192.150.14 91.192.150.14	42481 (BEGUN-AS) (BEGUN-AS)
1 2	52.208.121.178 52.208.121.178	16509 (AMAZON-02) (AMAZON-02)
1	37.18.16.23 37.18.16.23	205675 (HYBRID-AS) (HYBRID-AS)
1 2	2001:6d0:4001... 2001:6d0:4001::226	52016 (TNSMSK-) (TNSMSK-)
2 2	148.251.236.115 148.251.236.115	24940 (HETZNER-AS) (HETZNER-AS)
1 1	148.251.236.118 148.251.236.118	24940 (HETZNER-AS) (HETZNER-AS)
3 10	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
5	77.88.21.179 77.88.21.179	13238 (YANDEX) (YANDEX)
2	2a00:1450:400... 2a00:1450:4001:811::200a	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
1 1	23.37.42.132 23.37.42.132	16625 (AKAMAI-AS) (AKAMAI-AS)
2	23.79.143.124 23.79.143.124	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a00:1450:400... 2a00:1450:4001:82a::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	99.81.7.40 99.81.7.40	16509 (AMAZON-02) (AMAZON-02)
1 2	2a02:2638:1::13 2a02:2638:1::13	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	178.250.0.157 178.250.0.157	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	51.89.9.253 51.89.9.253	16276 (OVH) (OVH)
1 2	142.250.186.70 142.250.186.70	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:801::2006	15169 (GOOGLE) (GOOGLE)
1	82.145.213.8 82.145.213.8	39832 (NO-OPERA) (NO-OPERA)
2 3	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
243	56

43 81.177.34.158 (Moscow, Russian Federation) 2 redirects

ASN8342 (RTCOMM-AS, RU)

forexpf.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.profinance.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:6b8:a::a (Moscow, Russian Federation)

ASN208722 (YNDX, FI)

yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 81.177.34.136 (Moscow, Russian Federation)

ASN8342 (RTCOMM-AS, RU)

informers.forexpf.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 217.69.133.145 (Russian Federation) 1 redirects

ASN47764 (MAILRU-AS Mail.Ru, RU)
PTR: top-fwz1.mail.ru

top-fwz1.mail.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a02:6b8::1:119 (Moscow, Russian Federation) 3 redirects

ASN208722 (YNDX, FI)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 96.46.186.57 (United States) 2 redirects

ASN7979 (SERVERS-COM, US)

ads.betweendigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 88.212.201.204 (Russian Federation) 2 redirects

ASN39134 (UNITEDNET, RU)

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2a02:6b8::90 (Moscow, Russian Federation) 2 redirects

ASN208722 (YNDX, FI)

an.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:6b8:20::215 (Moscow, Russian Federation)

ASN208722 (YNDX, FI)

yastatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6b8::16b (Moscow, Russian Federation)

ASN208722 (YNDX, FI)

matchid.adfox.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:2638:1::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.184.8.65 (Amsterdam, Netherlands)

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-65.rtbhouse.net

adfox-c2s-ams.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 193.232.150.45 (Russian Federation) 3 redirects

ASN48061 (UMA-TECH-AS, RU)
PTR: smtp18.sender.ltmse.com

px.adhigh.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1148:db00::17 (Russian Federation)

ASN47764 (MAILRU-AS Mail.Ru, RU)

ad.mail.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 195.201.152.110 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.110.152.201.195.clients.your-server.de

yhb.p.otm-r.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 116.202.236.172 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.172.236.202.116.clients.your-server.de

exchange.buzzoola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 195.209.111.20 (Russian Federation)

ASN52007 (ADRIVER-AS, RU)

pb.adriver.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.236.118.210 (Moscow, Russian Federation)

ASN204720 (CDNETWORKS, RU)

cache.betweendigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.124.225.84 (Frankfurt am Main, Germany) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-225-84.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.210.53.219 (Brussels, Belgium) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 219.53.210.35.bc.googleusercontent.com

pool.admedo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.251.14.3 (United States) 2 redirects

ASN32475 (SINGLEHOP-LLC, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 31.172.81.158 (Muehlheim am Main, Germany) 5 redirects

ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE)

sync.bumlam.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 31.172.81.160 (Muehlheim am Main, Germany) 2 redirects

ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE)

sync3.adsniper.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync3.sniperlog.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.2.131 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: bidder.am5.vip.prod.criteo.com

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.90.167.185 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.185.167.90.157.clients.your-server.de

bidswitch-eu.splicky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:6b8::184 (Moscow, Russian Federation)

ASN208722 (YNDX, FI)

avatars.mds.yandex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 89.108.120.76 (Russian Federation) 3 redirects

ASN197695 (AS-REG, RU)
PTR: d51804.reg.regrucolo.ru

x01.aidata.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.162 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 2a00:1450:4001:80f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6b8::5:114 (Moscow, Russian Federation)

ASN208722 (YNDX, FI)

ysa-static.passport.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.11.155.167 (Moscow, Russian Federation) 1 redirects

ASN8901 (Moscow Mayors Office, RU)

stats.mos.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 95.217.109.66 (Helsinki, Finland) 4 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.66.109.217.95.clients.your-server.de

sonar.semantiqo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn3.caltat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.magnitent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.190.16.14 (Kansas City, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 14.16.190.35.bc.googleusercontent.com

redirect.frontend.weborama.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 81.222.128.213 (Russian Federation)

ASN20597 (ELTEL-AS, RU)
PTR: ad13.adriver.ru

ssp.adriver.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.15.175.158 (Russian Federation) 2 redirects

ASN43226 (SAFEDATA Uplinks, RU)

dmg.digitaltarget.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 80.64.106.147 (Russian Federation) 1 redirects

ASN20764 (RASCOM-AS CJSC RASCOM ISP, RU)
PTR: s-fr2.rutarget.ru

yandex-dmp-sync.rutarget.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 80.64.106.149 (Russian Federation) 1 redirects

ASN20764 (RASCOM-AS CJSC RASCOM ISP, RU)
PTR: s-fr4.rutarget.ru

yandex-sync.rutarget.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 78.46.100.125 (Germany) 2 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.125.100.46.78.clients.your-server.de

sync.1dmp.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.192.150.14 (Russian Federation) 1 redirects

ASN42481 (BEGUN-AS, RU)
PTR: zvezda.ssp.rambler.ru

profile.ssp.rambler.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.208.121.178 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-208-121-178.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.18.16.23 (Netherlands)

ASN205675 (HYBRID-AS, RU)

dm.hybrid.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:6d0:4001::226 (Russian Federation) 1 redirects

ASN52016 (TNSMSK-, RU)

cm.tns-counter.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.tns-counter.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 148.251.236.115 (Germany) 2 redirects

ASN24940 (HETZNER-AS, DE)
PTR: prod-hzeu-bidder-5.community.moscow

sync.upravel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 148.251.236.118 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: prod-hzeu-bidder-4.community.moscow

4868825d-76cb-4b65-a19c-5246f372c51c.sync.upravel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 77.88.21.179 (Moscow, Russian Federation)

ASN13238 (YANDEX, RU)
PTR: adfox-external-l3-engine.stable.qloud-b.yandex.net

ads.adfox.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.37.42.132 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-42-132.deploy.static.akamaitechnologies.com

secure-assets.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.79.143.124 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-79-143-124.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

encrypted-tbn2.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

encrypted-tbn0.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

encrypted-tbn3.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.81.7.40 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-99-81-7-40.eu-west-1.compute.amazonaws.com

ad.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:1::13 (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.0.157 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.89.9.253 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ip253.ip-51-89-9.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.70 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 82.145.213.8 (Norway)

ASN39832 (NO-OPERA, NO)
PTR: n-sysadmin-jumpbox-03.feednews.opera.technology

t.adx.opera.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.34 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
54	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com 7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com	576 KB
42	profinance.ru 1 redirects www.profinance.ru	88 KB
30	yandex.ru 3 redirects yandex.ru mc.yandex.ru an.yandex.ru matchid.adfox.yandex.ru ysa-static.passport.yandex.ru	342 KB
21	doubleclick.net 5 redirects googleads.g.doubleclick.net cm.g.doubleclick.net securepubads.g.doubleclick.net ad.doubleclick.net	238 KB
15	gstatic.com www.gstatic.com fonts.gstatic.com encrypted-tbn2.gstatic.com encrypted-tbn0.gstatic.com encrypted-tbn3.gstatic.com	210 KB
12	google.com 3 redirects adservice.google.com www.google.com	2 KB
10	yandex.com 2 redirects mc.yandex.com	3 KB
10	betweendigital.com 2 redirects ads.betweendigital.com cache.betweendigital.com	7 KB
8	google.de adservice.google.de www.google.de	2 KB
6	bidswitch.net 6 redirects x.bidswitch.net	3 KB
6	yastatic.net yastatic.net	202 KB
6	mail.ru 1 redirects top-fwz1.mail.ru ad.mail.ru	17 KB
5	adfox.ru ads.adfox.ru	446 B
5	criteo.com 1 redirects bidder.criteo.com gum.criteo.com mug.criteo.com	7 KB
5	bumlam.com 5 redirects sync.bumlam.com	3 KB
4	rubiconproject.com 1 redirects secure-assets.rubiconproject.com eus.rubiconproject.com token.rubiconproject.com	11 KB
4	googletagservices.com www.googletagservices.com	136 KB
4	adhigh.net 3 redirects px.adhigh.net	2 KB
4	googleadservices.com 2 redirects partner.googleadservices.com www.googleadservices.com	16 KB
3	upravel.com 3 redirects sync.upravel.com 4868825d-76cb-4b65-a19c-5246f372c51c.sync.upravel.com	2 KB
3	weborama.fr 3 redirects redirect.frontend.weborama.fr	514 B
3	semantiqo.com 2 redirects sonar.semantiqo.com	1 KB
3	aidata.io 3 redirects x01.aidata.io	2 KB
3	yandex.net avatars.mds.yandex.net	36 KB
3	criteo.net static.criteo.net	39 KB
3	yadro.ru 2 redirects counter.yadro.ru	2 KB
2	360yield.com 1 redirects ad.360yield.com	846 B
2	googleapis.com fonts.googleapis.com	2 KB
2	tns-counter.ru 1 redirects cm.tns-counter.ru www.tns-counter.ru	801 B
2	demdex.net 1 redirects dpm.demdex.net	2 KB
2	1dmp.io 2 redirects sync.1dmp.io	1022 B
2	rutarget.ru 2 redirects yandex-dmp-sync.rutarget.ru yandex-sync.rutarget.ru	847 B
2	digitaltarget.ru 2 redirects dmg.digitaltarget.ru	1 KB
2	adsniper.ru 2 redirects sync3.adsniper.ru	1 KB
2	lijit.com 2 redirects ap.lijit.com	1 KB
2	admedo.com 2 redirects pool.admedo.com	718 B
2	adriver.ru pb.adriver.ru ssp.adriver.ru	506 B
2	buzzoola.com 1 redirects exchange.buzzoola.com	863 B
2	forexpf.ru 1 redirects forexpf.ru informers.forexpf.ru	854 B
1	opera.com t.adx.opera.com	410 B
1	2mdn.net s0.2mdn.net	63 KB
1	onetag-sys.com onetag-sys.com	823 B
1	hybrid.ai dm.hybrid.ai	238 B
1	rambler.ru 1 redirects profile.ssp.rambler.ru	244 B
1	magnitent.com 1 redirects sync.magnitent.com	778 B
1	caltat.com 1 redirects cdn3.caltat.com	334 B
1	mos.ru 1 redirects stats.mos.ru	182 B
1	sniperlog.ru sync3.sniperlog.ru	516 B
1	splicky.com 1 redirects bidswitch-eu.splicky.com	221 B
1	otm-r.com yhb.p.otm-r.com	255 B
1	creativecdn.com adfox-c2s-ams.creativecdn.com	211 B
1	google-analytics.com ssl.google-analytics.com	17 KB
243	52

	Domain	Requested by
42	www.profinance.ru	1 redirects www.profinance.ru
34	tpc.googlesyndication.com	www.profinance.ru googleads.g.doubleclick.net tpc.googlesyndication.com securepubads.g.doubleclick.net pagead2.googlesyndication.com 7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com
22	an.yandex.ru	2 redirects www.profinance.ru yandex.ru
18	pagead2.googlesyndication.com	www.profinance.ru pagead2.googlesyndication.com securepubads.g.doubleclick.net www.gstatic.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
14	googleads.g.doubleclick.net	2 redirects pagead2.googlesyndication.com www.profinance.ru googleads.g.doubleclick.net www.googleadservices.com
10	www.google.com	3 redirects tpc.googlesyndication.com 7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com
10	mc.yandex.com	2 redirects www.profinance.ru mc.yandex.ru
9	ads.betweendigital.com	2 redirects www.profinance.ru yandex.ru
7	fonts.gstatic.com	fonts.googleapis.com
6	www.google.de
6	x.bidswitch.net	6 redirects
6	yastatic.net	yandex.ru yastatic.net www.profinance.ru
5	ads.adfox.ru	www.profinance.ru
5	sync.bumlam.com	5 redirects
5	top-fwz1.mail.ru	1 redirects www.profinance.ru top-fwz1.mail.ru
4	www.gstatic.com	googleads.g.doubleclick.net
4	www.googletagservices.com	googleads.g.doubleclick.net yandex.ru 7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com
4	px.adhigh.net	3 redirects www.profinance.ru
3	www.googleadservices.com	2 redirects yastatic.net
3	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net www.profinance.ru
3	redirect.frontend.weborama.fr	3 redirects
3	sonar.semantiqo.com	2 redirects
3	x01.aidata.io	3 redirects
3	avatars.mds.yandex.net	www.profinance.ru
3	static.criteo.net	yandex.ru www.profinance.ru
3	counter.yadro.ru	2 redirects www.profinance.ru
3	mc.yandex.ru	1 redirects www.profinance.ru yastatic.net
3	yandex.ru	www.profinance.ru yastatic.net
2	ad.doubleclick.net	1 redirects 7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com
2	gum.criteo.com	1 redirects static.criteo.net
2	ad.360yield.com	1 redirects
2	encrypted-tbn0.gstatic.com	www.profinance.ru
2	7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	eus.rubiconproject.com	cache.betweendigital.com eus.rubiconproject.com
2	fonts.googleapis.com	tpc.googlesyndication.com googleads.g.doubleclick.net
2	sync.upravel.com	2 redirects
2	dpm.demdex.net	1 redirects www.profinance.ru
2	sync.1dmp.io	2 redirects
2	dmg.digitaltarget.ru	2 redirects
2	cm.g.doubleclick.net	2 redirects
2	bidder.criteo.com	static.criteo.net
2	sync3.adsniper.ru	2 redirects
2	ap.lijit.com	2 redirects
2	pool.admedo.com	2 redirects
2	exchange.buzzoola.com	1 redirects www.profinance.ru
2	adservice.google.com	pagead2.googlesyndication.com securepubads.g.doubleclick.net
2	adservice.google.de	pagead2.googlesyndication.com securepubads.g.doubleclick.net
1	t.adx.opera.com
1	s0.2mdn.net	tpc.googlesyndication.com
1	onetag-sys.com	cache.betweendigital.com
1	mug.criteo.com
1	www.tns-counter.ru	www.profinance.ru
1	token.rubiconproject.com	eus.rubiconproject.com
1	encrypted-tbn3.gstatic.com	www.profinance.ru
1	encrypted-tbn2.gstatic.com	www.profinance.ru
1	secure-assets.rubiconproject.com	1 redirects
1	4868825d-76cb-4b65-a19c-5246f372c51c.sync.upravel.com	1 redirects
1	cm.tns-counter.ru	1 redirects
1	dm.hybrid.ai	www.profinance.ru
1	profile.ssp.rambler.ru	1 redirects
1	yandex-sync.rutarget.ru	1 redirects
1	yandex-dmp-sync.rutarget.ru	1 redirects
1	ssp.adriver.ru	www.profinance.ru
1	sync.magnitent.com	1 redirects
1	cdn3.caltat.com	1 redirects
1	stats.mos.ru	1 redirects
1	ysa-static.passport.yandex.ru	www.profinance.ru
1	sync3.sniperlog.ru	www.profinance.ru
1	bidswitch-eu.splicky.com	1 redirects
1	cache.betweendigital.com	ads.betweendigital.com
1	pb.adriver.ru	yandex.ru
1	yhb.p.otm-r.com	yandex.ru
1	ad.mail.ru	yandex.ru
1	adfox-c2s-ams.creativecdn.com	yandex.ru
1	matchid.adfox.yandex.ru	yandex.ru
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	ssl.google-analytics.com	www.profinance.ru
1	informers.forexpf.ru	www.profinance.ru
1	forexpf.ru	1 redirects
243	79

This site contains links to these domains. Also see Links.

Domain
cabinet.profinanceservice.com
t.me
top.mail.ru
www.liveinternet.ru

Subject Issuer	Validity	Valid
*.profinance.ru GoGetSSL RSA DV CA	`2021-10-13` - `2022-11-13`	a year	crt.sh
yandex.ru Yandex CA	`2021-08-30` - `2022-02-28`	6 months	crt.sh
informers.forexpf.ru R3	`2021-10-12` - `2022-01-10`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
mc.yandex.ru Yandex CA	`2021-07-28` - `2022-01-07`	5 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.mail.ru GeoTrust ECC CA 2018	`2021-10-15` - `2022-11-15`	a year	crt.sh
bs.yandex.ru Yandex CA	`2021-11-17` - `2022-05-18`	6 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.yastatic.net Yandex CA	`2021-08-18` - `2022-02-16`	6 months	crt.sh
matchid.adfox.yandex.ru Yandex CA	`2021-08-26` - `2022-02-18`	6 months	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-09-09` - `2021-12-07`	3 months	crt.sh
*.creativecdn.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2021-03-30` - `2022-04-12`	a year	crt.sh
ads.betweendigital.com Sectigo RSA Domain Validation Secure Server CA	`2020-11-19` - `2021-12-20`	a year	crt.sh
*.p.otm-r.com Sectigo RSA Domain Validation Secure Server CA	`2020-01-27` - `2022-02-06`	2 years	crt.sh
*.adriver.ru RapidSSL RSA CA 2018	`2020-04-03` - `2022-04-24`	2 years	crt.sh
cache.betweendigital.com Sectigo RSA Domain Validation Secure Server CA	`2019-11-08` - `2022-02-05`	2 years	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-09-09` - `2021-12-07`	3 months	crt.sh
avatars.mds.yandex.net Yandex CA	`2021-08-31` - `2022-03-01`	6 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
ysa-static.passport.yandex.net Yandex CA	`2021-08-21` - `2022-02-19`	6 months	crt.sh
*.hybrid.ai Sectigo RSA Domain Validation Secure Server CA	`2020-07-07` - `2022-10-05`	2 years	crt.sh
*.adfox.ru Yandex CA	`2021-07-27` - `2022-01-06`	5 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-04-01` - `2022-04-04`	a year	crt.sh
*.tns-counter.ru GlobalSign ECC OV SSL CA 2018	`2020-11-10` - `2021-12-12`	a year	crt.sh
onetag-sys.com R3	`2021-11-02` - `2022-01-31`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.adx.opera.com DigiCert TLS RSA SHA256 2020 CA1	`2021-05-14` - `2022-06-10`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh

This page contains 22 frames:

Primary Page: https://www.profinance.ru/
Frame ID: 7DB8A9BB16FFA0892C9057540F3221FD
Requests: 102 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/zrt_lookup.html
Frame ID: 8D73EE0DC52A8D722C394D0F14297967
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1637482624&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643028&bpp=3&bdt=267&idt=78&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=4749937713146&frm=20&pv=2&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=439&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3QXWafL7QZ&p=https%3A//www.profinance.ru&dtd=90
Frame ID: EA8BD9FAB61E2FE38294F33B4019B846
Requests: 20 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9865432956&adk=870026366&adf=2297262845&pi=t.ma~as.9865432956&w=240&lmt=1637482624&psa=0&format=240x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643031&bpp=1&bdt=269&idt=94&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=580x400&correlator=4749937713146&frm=20&pv=1&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1345&ady=67&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=L1WxLcXsQE&p=https%3A//www.profinance.ru&dtd=97
Frame ID: BFCBCFC38ED1BC34F415E64343FB737D
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&adk=1812271804&adf=3025194257&lmt=1637482624&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.profinance.ru%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643041&bpp=1&bdt=280&idt=89&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=580x400%2C240x400&nras=1&correlator=4749937713146&frm=20&pv=1&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=96
Frame ID: CC6EE210C7AFC4362F464D128F866BFB
Requests: 1 HTTP requests in this frame

Frame: https://cache.betweendigital.com/code/bidder_18.html?USER_ID=f9781672-40fe-5345-9b2f-3aa1fab53a32&CACHEBUSTER=821503
Frame ID: 5D9FC81242541926E7FCA7A928B087B5
Requests: 7 HTTP requests in this frame

Frame: https://yastatic.net/safeframe-bundles/0.83/1-1-0/render.html
Frame ID: BE5394D4410E3CCBE6C0BBA42346D849
Requests: 38 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html
Frame ID: ADB8C36ADA9383B1B265FE59BB8264E5
Requests: 21 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=CPh1vkwCaYbmnCca17gO_rajIBp7jxvVllKfK6voNnf2F8NQIEAEg5pyMaWCV-vCBjAegAb6Dh6MDyAEJqAMByANIqgTOAU_QccDqmT_1FywS1r5SLxaUegNt7sNrbI8rUgoIjv3t_SivoLWDEZsZcJUYCaF65yC5NW_-mUzhBzrpH20SeCPtgqJev9CaINWRgQczIl_7o_EfS5E0Xp6AM2apnS7J94MkmxRxwjdy-8Nffm2pmORDqHMcF1XlNc7tvSp97IK4JuZe2ruqyDbRnaTMmifHCwBKRRVdVmcR_OUr2cOygKcnD0De6m0h0v1H8Uw3_TQRgsbQqsx_QqL5hDQVtOukfyv6MM-gBuy8gejnzytmwASa0trc3AOSBQQIBBgBkgUECAUYBKAGLoAHqvz4XKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcEEOfjbtIICQiA4YAQEAEYX4AKAcgLAdgTDYgUAtAVAYAXAbIXHAoaCAASFHB1Yi0yMjE1OTY3Mzg5OTUxMDYwGAA&sigh=JM2ptpez5N8&uach_m=[UACH]&template_id=419
Frame ID: 37203411727C089F5BCA60D7E58AEBBD
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 9977415A13F0A9FAF01589520BA4A477
Requests: 2 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: 2A395A7F062369A450DB38D90BFA38AD
Requests: 8 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=btwnex&endpoint=eu
Frame ID: 372EBA14D32707AEAB033338A55EFE0E
Requests: 3 HTTP requests in this frame

Frame: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Frame ID: 89BB01A65B476AF7FB9BE04DE3139C2A
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Ydwwnsiz0RrvfpNl89rQqoBRiFg6eVxNIdbgsmjvwYM.js
Frame ID: 5E6C2A38E9422892D8D85B1C42371ACD
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: F0BC373C5F3E104BAFF3067AEF583637
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 0361DFF953766E0DDCA0446617E07E5B
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.profinance.ru
Frame ID: 03933B67F198C07B6C162C1F9799F494
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 762CAB99C98ADC5EB8D4091772EFDB07
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 3FE4B1C41BD5E4C86FF1F95A453481D1
Requests: 2 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=5d1628750185ace
Frame ID: 995EB546E89704AFE1E9B5A08BEC5B8D
Requests: 1 HTTP requests in this frame

Frame: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Frame ID: 6A675FEC20AF23A32D96EC38A9D1C3C1
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/index.html
Frame ID: A3A1F01833F64A3AB75BEE8FC5780069
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Форекс на ProFinance.Ru. Курсы валют. Прогнозы валютного рынка.

Page URL History Show full URLs

http://forexpf.ru/ HTTP 301
http://www.profinance.ru/ HTTP 301
https://www.profinance.ru/ Page URL

Page Statistics

243
Requests

86 %
HTTPS

39 %
IPv6

52
Domains

79
Subdomains

56
IPs

10
Countries

2014 kB
Transfer

5701 kB
Size

75
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://cabinet.profinanceservice.com/real/
Title: Кабинет

Search URL Search Domain Scan URL

URL: https://t.me/marketsnapshot
Title: Telegram

Search URL Search Domain Scan URL

URL: https://top.mail.ru/jump?from=74564

Search URL Search Domain Scan URL

URL: http://www.liveinternet.ru/click

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://forexpf.ru/ HTTP 301
http://www.profinance.ru/ HTTP 301
https://www.profinance.ru/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 17

https://top-fwz1.mail.ru/counter?id=74564;t=556;l=1 HTTP 302
https://top-fwz1.mail.ru/counter2?id=74564;t=556;l=1

Request Chain 37

https://ads.betweendigital.com/sspmatch-js?p=43185&randsalt=4020879901 HTTP 302
https://ads.betweendigital.com/sspmatch-js?p=43185&randsalt=4020879901&crf=1

Request Chain 44

https://counter.yadro.ru/hit?t29.3;r;s1600*1200*24;uhttps%3A//www.profinance.ru/;0.8060801917267113 HTTP 302
https://counter.yadro.ru/hit?q;t29.3;r;s1600*1200*24;uhttps%3A//www.profinance.ru/;0.8060801917267113

Request Chain 59

https://mc.yandex.com/sync_cookie_image_check?t=ti(4) HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9464.shbhbDuYWuoDU9JC_z7MUZuridBLooyMh949s3JdXDzGdbImYrmX4dtL7Y-T-1VH.jekgNcwv27ueY19QVOqjluOFXMk%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=9464.zkQUjmd8nFei5ui3qX57jiBXz6GiqsUKHTuZpBdVwXaZcOtmbA4RbMVTsontAw44T_MVBiVStEgXXuGXvNaO6w%2C%2C.qIf4XEmzsLLIVIsRibSt3ewos2o%2C

Request Chain 70

https://px.adhigh.net/rtb/yandex_hb HTTP 307
https://px.adhigh.net/rtb/yandex_hb?bounced=1

Request Chain 74

https://exchange.buzzoola.com/ssp/adfox HTTP 307
https://exchange.buzzoola.com/ssp/adfox?set_buzzoola_cookie=t

Request Chain 78

https://x.bidswitch.net/sync?ssp=between HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=between HTTP 302
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=between&bsw_custom_parameter=a6afb578-f865-4b6c-8844-06e685d836eb HTTP 302
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=between&bsw_custom_parameter=a6afb578-f865-4b6c-8844-06e685d836eb HTTP 302
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=6aae418f-4438-4f79-94d1-f36ccbbd20b9&user_group=1&ssp=between&bsw_param=a6afb578-f865-4b6c-8844-06e685d836eb HTTP 302
https://ads.betweendigital.com/match?bidder_id=22&external_user_id=a6afb578-f865-4b6c-8844-06e685d836eb

Request Chain 79

https://px.adhigh.net/p/cm/btw HTTP 302
https://px.adhigh.net/p/cm/btw?bounced=1 HTTP 302
https://ads.betweendigital.com/match?bidder_id=37&external_user_id=757XPJUJirc.AikABlF9QZJAEw

Request Chain 80

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fads.betweendigital.com%2Fmatch%3Fbidder_id%3D114%26external_user_id%3D%24UID HTTP 307
https://ap.lijit.com/pixel?redir=https%3A%2F%2Fads.betweendigital.com%2Fmatch%3Fbidder_id%3D114%26external_user_id%3D%24UID&sovrn_retry=true HTTP 307
https://ads.betweendigital.com/match?bidder_id=114&external_user_id=bdd357d828d3283218fa44ff

Request Chain 81

https://sync.bumlam.com/?src=bw1&uid=f9781672-40fe-5345-9b2f-3aa1fab53a32 HTTP 302
https://sync3.adsniper.ru/?src=ss1&s_data=CAEQABiTgeiMBlIFvp7KygpiJGY5NzgxNjcyLTQwZmUtNTM0NS05YjJmLTNhYTFmYWI1M2EzMg** HTTP 302
https://sync3.adsniper.ru/?src=ss1&s_data=CAIQARiTgeiMBlIFvp7KygpiJGY5NzgxNjcyLTQwZmUtNTM0NS05YjJmLTNhYTFmYWI1M2EzMqIBEHRcLCJKoxHspukAJZDIJDc* HTTP 302
https://sync.bumlam.com/?src=bw1&s_data=CAIQABiTgeiMBmIkZjk3ODE2NzItNDBmZS01MzQ1LTliMmYtM2FhMWZhYjUzYTMyogEQdFwsIkqjEeym6QAlkMgkNw** HTTP 302
https://sync.bumlam.com/?src=bw1&s_data=CAIQARiTgeiMBmIkZjk3ODE2NzItNDBmZS01MzQ1LTliMmYtM2FhMWZhYjUzYTMyogEQdFwsIkqjEeym6QAlkMgkNw** HTTP 302
https://ads.betweendigital.com/match?bidder_id=18&external_user_id=745c2c22-4aa3-11ec-a6e9-002590c82437

Request Chain 82

https://mc.yandex.com/watch/9524?wmode=7&page-url=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&cnt-class=1&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmizds872r%3Afp%3A742%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A700%3Acn%3A1%3Adp%3A0%3Als%3A758213256447%3Ahid%3A986956526%3Az%3A0%3Ai%3A20211121081723%3Aet%3A1637482643%3Ac%3A1%3Arn%3A760018196%3Arqn%3A1%3Au%3A1637482643647252450%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1637482642181%3Ads%3A0%2C116%2C103%2C1%2C346%2C0%2C%2C249%2C2%2C%2C%2C%2C873%3Adsn%3A0%2C116%2C103%2C1%2C345%2C0%2C%2C263%2C1%2C%2C%2C%2C873%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1637482643%3At%3A%D0%A4%D0%BE%D1%80%D0%B5%D0%BA%D1%81%20%D0%BD%D0%B0%20ProFinance.Ru.%20%D0%9A%D1%83%D1%80%D1%81%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82.%20%D0%9F%D1%80%D0%BE%D0%B3%D0%BD%D0%BE%D0%B7%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D1%8B%D0%BD%D0%BA%D0%B0.&t=gdpr(14)ti(2) HTTP 302
https://mc.yandex.com/watch/9524/1?wmode=7&page-url=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&cnt-class=1&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmizds872r%3Afp%3A742%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A700%3Acn%3A1%3Adp%3A0%3Als%3A758213256447%3Ahid%3A986956526%3Az%3A0%3Ai%3A20211121081723%3Aet%3A1637482643%3Ac%3A1%3Arn%3A760018196%3Arqn%3A1%3Au%3A1637482643647252450%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1637482642181%3Ads%3A0%2C116%2C103%2C1%2C346%2C0%2C%2C249%2C2%2C%2C%2C%2C873%3Adsn%3A0%2C116%2C103%2C1%2C345%2C0%2C%2C263%2C1%2C%2C%2C%2C873%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1637482643%3At%3A%D0%A4%D0%BE%D1%80%D0%B5%D0%BA%D1%81%20%D0%BD%D0%B0%20ProFinance.Ru.%20%D0%9A%D1%83%D1%80%D1%81%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82.%20%D0%9F%D1%80%D0%BE%D0%B3%D0%BD%D0%BE%D0%B7%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D1%8B%D0%BD%D0%BA%D0%B0.&t=gdpr%2814%29ti%282%29

Request Chain 88

https://x.bidswitch.net/sync?ssp=between HTTP 302
https://bidswitch-eu.splicky.com/cm?bidswitch_ssp_id=between&bsw_custom_parameter=a6afb578-f865-4b6c-8844-06e685d836eb HTTP 302
https://x.bidswitch.net/sync?dsp_id=311&user_id=&user_group=2&ssp=between&expires=10&bsw_param=a6afb578-f865-4b6c-8844-06e685d836eb HTTP 302
https://ads.betweendigital.com/match?bidder_id=22&external_user_id=a6afb578-f865-4b6c-8844-06e685d836eb

Request Chain 97

https://sync.bumlam.com/?src=aid0 HTTP 302
https://x01.aidata.io/0.gif?pid=ADSNIPER&id=745c2c22-4aa3-11ec-a6e9-002590c82437 HTTP 302
https://x01.aidata.io/0.gif?pid=ADSNIPER&id=745c2c22-4aa3-11ec-a6e9-002590c82437&bounce=1 HTTP 302
https://sync.bumlam.com/?src=aid1&uid=AGOQCT5D0W8OlHuu3aFRAg& HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_cm&extra1=AGOQCT5D0W8OlHuu3aFRAg&extra2=aidata HTTP 302
https://sync3.sniperlog.ru/?src=ggl&extra1=AGOQCT5D0W8OlHuu3aFRAg&extra2=aidata&google_gid=CAESEID2CBUsYdoSHxOowkuTFgc&google_cver=1

Request Chain 107

https://stats.mos.ru/gc/ynd/ HTTP 302
https://an.yandex.ru/mapuid/ditmsk/?time=1637482643.927

Request Chain 108

https://sonar.semantiqo.com/dmp/scr.php HTTP 302
https://counter.yadro.ru/id127/reff-id.gif?sid=200a2a5733e24da09c51d742c90219b2 HTTP 302
https://sonar.semantiqo.com/fbfli/data_sess_sync.php?spid=85EDB671FCCA0060&sid=200a2a5733e24da09c51d742c90219b2 HTTP 302
https://cdn3.caltat.com/fbfc504c-89b0-4a80-bef4-c8e39daeee6f/sess.php?sid=200a2a5733e24da09c51d742c90219b2&spid=85EDB671FCCA0060&v= HTTP 302
https://sync.magnitent.com/fbfli/ct_sync.php?ct=db23968d0c9244889ae670108adf59a5&sonar=200a2a5733e24da09c51d742c90219b2&spid=85EDB671FCCA0060&v= HTTP 302
https://redirect.frontend.weborama.fr/rd?url=https%3A%2F%2Fsonar.semantiqo.com%2F983we%2Fspixel.php%3Fsid%3D200a2a5733e24da09c51d742c90219b2%26c%3Ddb23968d0c9244889ae670108adf59a5%26w%3D={WEBO_CID} HTTP 302
https://sonar.semantiqo.com/983we/spixel.php?sid=200a2a5733e24da09c51d742c90219b2&c=db23968d0c9244889ae670108adf59a5&w==Kua8/7Y6CNyeZBfyg77upO

Request Chain 110

https://an.yandex.ru/mapuid/google/ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yandexru&google_hm=9039DC576DC58715&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif HTTP 302
https://an.yandex.ru/resource/spacer.gif

Request Chain 111

https://dmg.digitaltarget.ru/1/119/i/i?i=1637482643 HTTP 307
https://dmg.digitaltarget.ru/awg/custom/119/i/i?call_source=awg&i=1637482643 HTTP 307
https://an.yandex.ru/mapuid/dmpamberdata/5LCg54p-4KQ196F7-rfK

Request Chain 112

https://yandex-dmp-sync.rutarget.ru/sync HTTP 302
https://an.yandex.ru/mapuid/dmpsegmento/-mq_4tg-4Elf?sign=2039831926

Request Chain 113

https://yandex-sync.rutarget.ru/sync HTTP 302
https://an.yandex.ru/mapuid/rutargetis/LvuCPyUdHkde

Request Chain 114

https://x01.aidata.io/0.gif?pid=YANDEX HTTP 302
https://an.yandex.ru/mapuid/dmpaidatame/AGOQCT5D0W8OlHuu3aFRAg?sign=1054776853

Request Chain 115

https://sync.1dmp.io/pixel.gif?cid=3cbc2ec8-1421-4677-89fe-2ac6fc52a09a&pid=w&o=au HTTP 302
https://sync.1dmp.io/pixel.gif?cid=3cbc2ec8-1421-4677-89fe-2ac6fc52a09a&pid=w&o=au&cs=1 HTTP 302
https://an.yandex.ru/mapuid/dmpcleverdata/74999670-4aa3-11ec-8677-901b0e934d81?sign=691522040

Request Chain 116

https://redirect.frontend.weborama.fr/redirect/standard?url=https://an.yandex.ru/mapuid/dmpweborama/{WEBO_CID} HTTP 302
https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fdmpweborama%2F%7BWEBO_CID%7D&bounce=1&random=4098449766 HTTP 302
https://an.yandex.ru/mapuid/dmpweborama/Kua8/7Y6CNyeZBfyg77upO

Request Chain 117

https://profile.ssp.rambler.ru/sync3.302?pid=188 HTTP 302
https://an.yandex.ru/mapuid/ramblerssp/

Request Chain 118

https://an.yandex.ru/mapuid/adobedmp/ HTTP 302
https://dpm.demdex.net/ibs:dpid=423652&dpuuid=4448C936A772D434 HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=423652&dpuuid=4448C936A772D434

Request Chain 120

https://cm.tns-counter.ru/yacm HTTP 302
https://an.yandex.ru/mapuid/mediascope/a378063c59ff0390bfb04bb09492a88fd18729db0569565ff416cb007d11284a

Request Chain 121

https://sync.upravel.com/yandex/sync HTTP 302
https://sync.upravel.com/yandex/sync?session_tpt=eyJoZWFkZXJzIjp7InJlZmVyZXIiOlsiaHR0cHM6Ly95YXN0YXRpYy5uZXQvIl19fQ HTTP 302
https://4868825d-76cb-4b65-a19c-5246f372c51c.sync.upravel.com/yandex/sync?ud_tpt=eyJoZWFkZXJzIjp7InJlZmVyZXIiOlsiaHR0cHM6Ly95YXN0YXRpYy5uZXQvIiwiaHR0cHM6Ly95YXN0YXRpYy5uZXQvIl19fQ HTTP 302
https://an.yandex.ru/mapuid/upravelis/4868825d-76cb-4b65-a19c-5246f372c51c

Request Chain 126

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 159

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=btwnex&endpoint=eu HTTP 301
https://eus.rubiconproject.com/usync.html?p=btwnex&endpoint=eu

Request Chain 180

https://x.bidswitch.net/sync?dsp_id=429&user_id=f9781672-40fe-5345-9b2f-3aa1fab53a32&expires=60 HTTP 302
https://ad.360yield.com/match?publisher_dsp_id=191&external_user_id=a6afb578-f865-4b6c-8844-06e685d836eb HTTP 302
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=191&external_user_id=a6afb578-f865-4b6c-8844-06e685d836eb

Request Chain 189

https://gum.criteo.com/sid/json?origin=publishertag&domain=profinance.ru&sn=ChromeSyncframe&so=0&topUrl=www.profinance.ru&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=PXjxtXw5bExVVFl2aStTajk5UFp5Y3d6RTZudXNsQlNSeEJHQkZ3ZXlLSXhvdHZGSlh0YUY5ZnJaS1NrakFBbE9MQ2swZkVXcGhqTG4raklmMHB5Q3dobThIMmlJajRZREJuQU5SZHpWT1VNSVNQbVN2SHRpWWI5V2RzMkdtSHFGOEdKNjNpYUZERFhqV2M1Zm9zMHhsL21Yb2RzeG9QQnF5VHF6MmtUbCtMV2V6N3NldklKQlpQdDAwRG5XSWFtQW5tcXVDWFJvM01SWTRBbytLNUwxSG5YVjdpM3BMN0o4NTE2Z1NLcllnS0NiV3ZaQ1ZSNjQwMnlyMGV2bFhSRlFRQTF0YWVKMVhMTEw1L2hxenRsN3ROY1lLQT09fA&cppv=2

Request Chain 195

https://ads.betweendigital.com/match?bidder_id=43554&callback_url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fbetweendigitalis%2Ff9781672-40fe-5345-9b2f-3aa1fab53a32 HTTP 302
https://an.yandex.ru/mapuid/betweendigitalis/f9781672-40fe-5345-9b2f-3aa1fab53a32

Request Chain 197

https://ad.doubleclick.net/ddm/trackimp/N393201.3392460GDNPROGRAMMATIC/B26136620.308725970;dc_trk_aid=501600486;dc_trk_cid=123773641;ord=2043734709;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N393201.3392460GDNPROGRAMMATIC/B26136620.308725970;dc_pre=CMWOgJuCqfQCFYm8dwodMBQGWQ;dc_trk_aid=501600486;dc_trk_cid=123773641;ord=2043734709;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=

Request Chain 220

https://www.googleadservices.com/pagead/conversion/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=lQCaYdKzMOK9x_AP2rOk0As&random=854152467&sscte=1&crd= HTTP 302
https://www.google.com/pagead/1p-user-list/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=854152467&crd=&is_vtc=1&random=230247769 HTTP 302
https://www.google.de/pagead/1p-user-list/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=854152467&crd=&is_vtc=1&random=230247769&ipr=y

Request Chain 221

https://www.googleadservices.com/pagead/conversion/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=lQCaYeiyMP7Mx_APpZe-6As&random=1534136822&sscte=1&crd= HTTP 302
https://www.google.com/pagead/1p-user-list/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1534136822&crd=&is_vtc=1&random=1769873107 HTTP 302
https://www.google.de/pagead/1p-user-list/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1534136822&crd=&is_vtc=1&random=1769873107&ipr=y

243 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.profinance.ru/
Redirect Chain

http://forexpf.ru/
http://www.profinance.ru/
https://www.profinance.ru/

63 KB
14 KB

219ms
103ms

Document
text/html

81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: cf8bd56da9c27a9f162ddaa7ac04e6f3217f55621fa538160b558409a306c90f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
server: nginx
last-modified: Sun, 21 Nov 2021 08:17:04 GMT
etag: W/"619a0080-fa89"
x-conf: news1-www www-to-news1
content-encoding: gzip

Redirect headers

Server: nginx
Date: Sun, 21 Nov 2021 08:17:22 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Keep-Alive: timeout=45
Location: https://www.profinance.ru/
x-conf: www-profinance

GET
H2 200 pro.css
www.profinance.ru/css/ 21 KB
3 KB 58ms
57ms Stylesheet
text/css 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/css/pro.css?181210
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 67d966655f66192caeabb47ca4d7ea5271a9a3083e906a44850a6932d5a0e2be

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
content-encoding: gzip
last-modified: Thu, 10 Dec 2020 20:28:41 GMT
server: nginx
etag: W/"5fd284f9-548a"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 pro-bal-new.css
www.profinance.ru/css/ 658 B
589 B 112ms
110ms Stylesheet
text/css 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/css/pro-bal-new.css?18112103
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 1484b97dfb6d3aeaf32de990df919f0c59458097e85e61c57ec0cd3863a2aa17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
content-encoding: gzip
last-modified: Wed, 21 Nov 2018 17:17:43 GMT
server: nginx
etag: W/"5bf59337-292"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 bors-forexpf.css
www.profinance.ru/css/ 6 KB
2 KB 112ms
111ms Stylesheet
text/css 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/css/bors-forexpf.css?
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 7e1e066fbf2de0d0703956d8e95b15e51a7a444289ca1bffae0d841f5c53c9b8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
content-encoding: gzip
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: W/"5ad47f6f-188f"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 ads.js Show response
www.profinance.ru/adv/ 85 B
350 B 58ms
57ms Script
application/javascript 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/adv/ads.js
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 88e5dc8f8a7799f095f0f957096776105f22b3c74a13a138431ae5e2487efa2f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
content-encoding: gzip
last-modified: Sun, 09 Dec 2018 22:16:30 GMT
server: nginx
etag: W/"5c0d943e-55"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 jquery-1.12.0.min.js Show response
www.profinance.ru/js/ 95 KB
33 KB 57ms
56ms Script
application/javascript 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/js/jquery-1.12.0.min.js
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 5f1ab65fe2ad6b381a1ae036716475bf78c9b2e309528cf22170c1ddeefddcbf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
content-encoding: gzip
last-modified: Fri, 08 Jan 2016 19:57:42 GMT
server: nginx
etag: W/"569014b6-17c52"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 forex.js Show response
www.profinance.ru/ 367 B
499 B 56ms
56ms Script
application/javascript 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/forex.js
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: e1574f8d5343d7b6218010a1e4a78b5a6f896a45eeab77317b6c29b28bc4509b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
content-encoding: gzip
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: W/"5ad47f6f-16f"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 custom.js Show response
www.profinance.ru/js/ 704 B
554 B 139ms
135ms Script
text/javascript 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/js/custom.js
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 5c45c312dc1ba44ddeecb86f06d442b85f7816d393b81d3d8197971f80dae7da

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-language: ru
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-type: text/javascript; charset=utf-8
x-conf: www-to-site2
expires: 0

GET
H2 200 header-bidding.js Show response
yandex.ru/ads/system/ 166 KB
44 KB 263ms
159ms Script
text/javascript 2a02:6b8:a::a
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/system/header-bidding.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

62be3464b67e788249ff9ce386d13ce5bdd3185f4d2fad8ec562c5bab46171c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-encoding: br
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 86400, "success_fraction": 0.001, "failure_fraction": 0.1}
etag: 359067584
x-yandex-req-id: 1637482643033131-11557543257790399546-man2-5393-1be-man-l7-balancer-8080-BAL-147
report-to: { "group": "network-errors", "max_age": 86400, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=3600
x-robots-tag: noindex, noarchive, nofollow
expires: Sun, 21 Nov 2021 09:17:23 GMT

GET
H2 200 pf_hb.js Show response
www.profinance.ru/js/ 18 KB
1 KB 58ms
57ms Script
application/javascript 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/js/pf_hb.js?2021040101
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 2c967cac40158b4a25c3f77d4123e5d9c203f5527322e6d51b6469df29abe2ae

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
content-encoding: gzip
last-modified: Thu, 01 Apr 2021 09:00:13 GMT
server: nginx
etag: W/"60658b9d-48d0"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 context.js Show response
yandex.ru/ads/system/ 303 KB
82 KB 160ms
55ms Script
text/javascript 2a02:6b8:a::a
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/system/context.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

7040b31ac3f3ba32dfd38d23a4f4972a093f0930faa8526ac5a78c49998c5ddc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-encoding: br
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 86400, "success_fraction": 0.001, "failure_fraction": 0.1}
etag: 2645802912
x-yandex-req-id: 1637482643033466-13757237681579433886-man2-5393-1be-man-l7-balancer-8080-BAL-7042
report-to: { "group": "network-errors", "max_age": 86400, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=3600
x-robots-tag: noindex, noarchive, nofollow
expires: Sun, 21 Nov 2021 09:17:23 GMT

GET
H2 200 tgbnr.js Show response
www.profinance.ru/js/ 2 KB
1 KB 107ms
106ms Script
application/javascript 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/js/tgbnr.js?2020120603
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: d7b6ed9e8166c815f86b056bb3caa013f5ac25dd030cc17ebe1b3fc2ebf06bbb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
content-encoding: gzip
last-modified: Sun, 06 Dec 2020 21:34:14 GMT
server: nginx
etag: W/"5fcd4e56-670"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 top01.gif
www.profinance.ru/img/ 7 KB
8 KB 62ms
57ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/top01.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 07878131250c810ce67539c1e45c5930389a0609a97edd176ae3806f9276f293

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-1dd8"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 7640
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 top03.gif
www.profinance.ru/img/ 1 KB
1 KB 61ms
56ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/top03.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 9b64a3adaddf9e73cc1ba8465732e00807a306d0ab4c2fe3d49a207b27e7d890

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-475"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1141
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 ftl.js Show response
informers.forexpf.ru/internal/ 2 KB
637 B 315ms
74ms Script
text/javascript 81.177.34.136
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://informers.forexpf.ru/internal/ftl.js
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server: 81.177.34.136 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 7badd5384528f2966a3161f7986ed2537f58dbdcd47480069bb89c409c7ea486

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
server: nginx/1.20.1
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
content-language: ru

GET
H2 200 ulang.gif
www.profinance.ru/img/ 68 B
287 B 64ms
60ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/ulang.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 273ba0c52e57a5c00ec7e68d64c13805cf735edee215ae624b0df5c01979de4a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-44"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 68
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 ugolt.gif
www.profinance.ru/img/ 77 B
296 B 66ms
61ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/ugolt.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 09cb736cb51c04a9c25e66bc769097be3b6aee29e7a8a9b2250344cca527c210

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-4d"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 77
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 sp.gif
www.profinance.ru/img/ 43 B
262 B 60ms
55ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/sp.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-2b"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 43
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2

200

counter2
top-fwz1.mail.ru/
Redirect Chain

https://top-fwz1.mail.ru/counter?id=74564;t=556;l=1
https://top-fwz1.mail.ru/counter2?id=74564;t=556;l=1

2 KB
3 KB

59ms
57ms

Image
image/gif

217.69.133.145
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://top-fwz1.mail.ru/counter2?id=74564;t=556;l=1

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Server

217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),

Reverse DNS

top-fwz1.mail.ru

Software

nginx /

Resource Hash

2d77dbc1c9f7a53c580fdd0c2c312d2afbaff938e7b0ee2383b10975533572ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
x-content-type-options: nosniff
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length: 2458
pragma: no-cache
amp-access-control-allow-source-origin: *
server: nginx
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: private, no-cache, no-store, max-age=0
access-control-allow-credentials: true
accept-ch-lifetime: 86400
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
timing-allow-origin: *
access-control-allow-headers: *

Redirect headers

date: Sun, 21 Nov 2021 08:17:23 GMT
x-content-type-options: nosniff
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length: 0
pragma: no-cache
amp-access-control-allow-source-origin: *
server: nginx
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
location: https://top-fwz1.mail.ru/counter2?id=74564;t=556;l=1
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: private, no-cache, no-store, max-age=0
access-control-allow-credentials: true
accept-ch-lifetime: 86400
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 dotv.gif
www.profinance.ru/img/ 43 B
262 B 64ms
60ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/dotv.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: e56916a41fd9c332af2b9eeaf98126db892a2be83d85b3bbaffdf828be2f2fc2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-2b"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 43
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 dotg.gif
www.profinance.ru/img/ 43 B
262 B 67ms
62ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/dotg.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 8ed705aab168de2a691e736e320622de21c10361048111100d539a75e3a8101e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-2b"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 43
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 dotgrey.gif
www.profinance.ru/img/ 43 B
262 B 65ms
60ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/dotgrey.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: bfd21dab62097e79d0a8736b29a340243e73d1472d427742117cd299f64461ee

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-2b"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 43
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 143 KB
51 KB 74ms
44ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57599ac6bcd9086c0d269b788fdf7ae81ede1f8f2a9476bf75e03b95650dadbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51228
x-xss-protection: 0
server: cafe
etag: 9825464397516981511
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 21 Nov 2021 08:17:22 GMT

GET
H2 200 profinance.js Show response
www.profinance.ru/js/ 5 KB
745 B 57ms
56ms Script
application/javascript 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/js/profinance.js?6
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 21be95910910148502d7064d8f8028d0424b88cc34a07858a433e48ed64c4bbf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
content-encoding: gzip
last-modified: Fri, 22 Jan 2021 12:41:42 GMT
server: nginx
etag: W/"600ac806-12df"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 EURUSD_A.gif
www.profinance.ru/img/ 140 B
360 B 66ms
61ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/EURUSD_A.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 7b82d70c7d4367a40c2ce524867410716831c036c90d5614561b513a7c4e4775

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Wed, 01 Apr 2020 13:45:08 GMT
server: nginx
etag: "5e849ae4-8c"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 140
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 kot2razd.gif
www.profinance.ru/img/ 45 B
264 B 61ms
56ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/kot2razd.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 99297d3ca7b65b05d85e5a1f33e9685962430730b2736d628ad8cf01323266b2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-2d"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 45
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 GBPUSD.gif
www.profinance.ru/img/ 139 B
359 B 62ms
57ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/GBPUSD.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: a41a08961f5d7e2efc5048aaaa95fccf73212484b5eb95880edcdcf5aab6dc86

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-8b"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 139
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 USDCHF.gif
www.profinance.ru/img/ 135 B
355 B 62ms
58ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/USDCHF.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 183732f738678d361ae726869c4464577519acbbb8f1d73dea5acbf3cd7c09d8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-87"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 135
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 USDJPY.gif
www.profinance.ru/img/ 136 B
356 B 63ms
58ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/USDJPY.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: dfdac8d559ad6777c9d1cfab6038b05e4b5a8f38e15963e8708c5545f0f40866

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-88"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 136
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 kotfix.gif
www.profinance.ru/img/ 54 B
273 B 66ms
62ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/kotfix.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 4428fa8a11efdc34826dd51d4e75030b868039b258d3854f45b1222e1794bb1b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-36"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 54
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 graphgen-01.gif
www.profinance.ru/ic/ 1 KB
2 KB 66ms
62ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/ic/graphgen-01.gif?rnd=1377750352
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 65d6a6ab5690cd0dde5027a379df67242ce89be2a12d6caf5fc9272bc03b9a97

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Sun, 21 Nov 2021 08:17:21 GMT
server: nginx
etag: "619a0091-5a6"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1446
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 USDRUB.gif
www.profinance.ru/img/ 139 B
359 B 66ms
63ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/USDRUB.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: dae6ffaec90ebdf8d644e69c53b5773def35e0f2ffba2b55492ff35ce37ee48a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Wed, 01 Apr 2020 14:35:51 GMT
server: nginx
etag: "5e84a6c7-8b"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 139
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 EURRUB.gif
www.profinance.ru/img/ 140 B
360 B 66ms
63ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/EURRUB.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 46f16a08e79604e878917477b6d17e0a00d3bc2b07a5f3bb9d4c5274f3fbe6d2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Wed, 01 Apr 2020 14:37:04 GMT
server: nginx
etag: "5e84a710-8c"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 140
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 BRENT.gif
www.profinance.ru/img/ 121 B
341 B 66ms
63ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/BRENT.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 4688af76f0aa4851953c45d5f4472b4328d046c0e5214de1502c79c6409948d9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Wed, 01 Apr 2020 14:20:29 GMT
server: nginx
etag: "5e84a32d-79"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 121
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 GOLD.gif
www.profinance.ru/img/ 112 B
332 B 67ms
63ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/GOLD.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: c0489ecb12247fa7c6305949de4d92dba7e183559f236f28a3c449fddca5f52c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Fri, 10 Apr 2020 11:07:36 GMT
server: nginx
etag: "5e905378-70"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 112
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 lmenu4.gif
www.profinance.ru/img/ 131 B
351 B 67ms
64ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/lmenu4.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: b72dce7fd4e527c1ce955795e14a8fc87395f8460eeb4790eb36e656d199edc9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-83"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 131
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 on-ready.js Show response
www.profinance.ru/js/ 567 B
601 B 67ms
64ms Script
application/javascript 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/js/on-ready.js
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 5f8a6e6ed3d25c671cff494344b9b30fdad846dfe411fd22de4588640a31ff0c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
content-encoding: gzip
last-modified: Thu, 20 Dec 2018 05:59:36 GMT
server: nginx
etag: W/"5c1b2fc8-237"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 watch.js Show response
mc.yandex.ru/metrika/ 130 KB
46 KB 185ms
85ms Script
application/javascript 2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/watch.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

2d8618e3d2de4948e82bbce7cd6e1cefb6d720a09adb2cae9ea3886785493a0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: br
last-modified: Wed, 17 Nov 2021 12:17:49 GMT
etag: "6194c8bd-b7ad"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
content-length: 47021
expires: Sun, 21 Nov 2021 09:17:23 GMT

GET
H2

200

sspmatch-js Show response
ads.betweendigital.com/
Redirect Chain

https://ads.betweendigital.com/sspmatch-js?p=43185&randsalt=4020879901
https://ads.betweendigital.com/sspmatch-js?p=43185&randsalt=4020879901&crf=1

882 B
980 B

97ms
97ms

Script
text/javascript

96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.betweendigital.com/sspmatch-js?p=43185&randsalt=4020879901&crf=1
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 8074284dcb2a2e278ea8c7cd4c88d2a685027616b1bb9807dfda25144086b877

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 882
content-type: text/javascript

Redirect headers

location: /sspmatch-js?p=43185&randsalt=4020879901&crf=1
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H2 200 top01bg.gif
www.profinance.ru/img/ 572 B
793 B 133ms
131ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/top01bg.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 92b73c1401907b7e391360b9e7bb79de1d2f25896649434a0eb36d72cbb43210

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-23c"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 572
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 top02bg.gif
www.profinance.ru/img/ 10 KB
11 KB 64ms
63ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/top02bg.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: b0866549b1f1e9ba2859efe300f0ff9754b30146182f7fe4e169d696bfb02851

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-29a5"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 10661
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 top03bg.gif
www.profinance.ru/img/ 1 KB
1 KB 64ms
64ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/top03bg.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 65c1eec846990c5831250ac37e698c949675bbdce85f99a0f8be29193f022892

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-512"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1298
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 langbg3.gif
www.profinance.ru/img/ 43 B
262 B 132ms
132ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/langbg3.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 8d95bff25156e15e179589e93e70867ffcb65e4ff16834088bfb995f69b2f9f8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:22 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-2b"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 43
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:22 GMT

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 29ms
7ms Script
text/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 4162
date: Sun, 21 Nov 2021 07:08:00 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Sun, 21 Nov 2021 09:08:00 GMT

GET
H2 200 code.js Show response
top-fwz1.mail.ru/js/ 25 KB
11 KB 223ms
108ms Script
application/javascript 217.69.133.145
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to

Full URL

https://top-fwz1.mail.ru/js/code.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),

Reverse DNS

top-fwz1.mail.ru

Software

nginx /

Resource Hash

536cd983c5ac840349770984405fe9eb9e67b9d7e35e0c45673a653b003173b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
amp-access-control-allow-source-origin: *
last-modified: Thu, 15 Jul 2021 18:35:46 GMT
server: nginx
etag: W/"60f08002-64db"
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: max-age=3600, private
access-control-allow-credentials: true
accept-ch-lifetime: 86400
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
timing-allow-origin: *
access-control-allow-headers: *
expires: Sun, 21 Nov 2021 09:17:23 GMT

GET
H/1.1

200
OK

hit
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit?t29.3;r;s1600*1200*24;uhttps%3A//www.profinance.ru/;0.8060801917267113
https://counter.yadro.ru/hit?q;t29.3;r;s1600*1200*24;uhttps%3A//www.profinance.ru/;0.8060801917267113

757 B
1 KB

69ms
69ms

Image
image/gif

88.212.201.204
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit?q;t29.3;r;s1600*1200*24;uhttps%3A//www.profinance.ru/;0.8060801917267113

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

HTTP/1.1

Server

88.212.201.204 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

f5a6c07e4ea32d17c0a919fb3d067b69261842c99c94a58b53e497c125082f04

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 21 Nov 2021 08:17:35 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin: *
Cache-control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 757
Expires: Fri, 20 Nov 2020 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 21 Nov 2021 08:17:35 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Location: https://counter.yadro.ru/hit?q;t29.3;r;s1600*1200*24;uhttps%3A//www.profinance.ru/;0.8060801917267113
Cache-control: no-cache
Connection: keep-alive
Content-Type: text/html
Content-Length: 32
Expires: Fri, 20 Nov 2020 21:00:00 GMT

GET
H2 200 context.js Show response
an.yandex.ru/system/ 302 KB
81 KB 170ms
78ms Script
text/javascript 2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/system/context.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

61d1757c075921df8d4a5aa73c80b1a516506e6edf14d9786dccb3968e6b9a29

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
strict-transport-security: max-age=31536000
content-encoding: br
etag: 3576045659
x-yandex-req-id: 1637482643119570-82746453415132490800317-production-app-host-sas-pcode-124
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=3600
x-robots-tag: noindex, noarchive, nofollow
expires: Sun, 21 Nov 2021 09:17:23 GMT

GET
H2 200 bgkot2.gif
www.profinance.ru/img/ 49 B
268 B 99ms
98ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/bgkot2.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: e0371710b9ebdb4886d7e854b54fa3cbf606b7b9cefff78a01c9175a0174baca

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-31"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 49
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:23 GMT

GET
H2 200 bgwhite.gif
www.profinance.ru/img/ 49 B
268 B 99ms
99ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/bgwhite.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 7df5774ffcccb6de91ea0c3e95ea530c054c80d1150c517bd2b9920e9b3c3ace

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-31"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 49
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:23 GMT

GET
H2 200 bgkot1.gif
www.profinance.ru/img/ 49 B
268 B 98ms
98ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/bgkot1.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 1424ef028f97cd5d48afe88370d0a83d59d96f69f8181bc3c48dbcfba0a228c4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-31"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 49
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:23 GMT

GET
H2 200 bgbej.gif
www.profinance.ru/img/ 49 B
268 B 97ms
97ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/bgbej.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: ecc05c55d6e7c828b235348fb0780e48361aaee003dfc79f9fd51f9879a5347f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-31"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 49
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:23 GMT

GET
H2 200 bgdown.gif
www.profinance.ru/img/ 49 B
268 B 97ms
97ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/bgdown.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: ea418f0311393888cfee5111296147ec5be28a407f6a213d192d400cbb2f8250

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-31"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 49
x-conf: www-to-news1
x-location: static
expires: Tue, 21 Dec 2021 08:17:23 GMT

GET
H2 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111110101/ 270 KB
97 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111110101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2215967389951060&plah=www.profinance.ru

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ae9c30c2bb4f823d269a0a54b0dd8d4de924461520b2d15183c4420aa382d55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 99573
x-xss-protection: 0
server: cafe
etag: 10821776964849967579
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sun, 21 Nov 2021 08:17:23 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/ Frame 8D73 11 KB
5 KB 30ms
7ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5cedd5abd94d64b07e3779451d057665572b89caa8b445a5e9efa42bad9c4274

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 21 Nov 2021 06:55:30 GMT
expires: Sun, 05 Dec 2021 06:55:30 GMT
content-type: text/html; charset=UTF-8
etag: 16478831307880631077
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4883
x-xss-protection: 0
age: 4913
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 203 B
639 B 45ms
19ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.profinance.ru&callback=_gfp_s_&client=ca-pub-2215967389951060

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111110101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2215967389951060&plah=www.profinance.ru

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

1d8e062d702af857fd52b30f1795176ce35eac925bdd5fbeee1e2bed69171556

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 194
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 64ms
16ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.profinance.ru

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 41ms
17ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.profinance.ru

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame EA8B 103 KB
33 KB 722ms
706ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1637482624&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643028&bpp=3&bdt=267&idt=78&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=4749937713146&frm=20&pv=2&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=439&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3QXWafL7QZ&p=https%3A//www.profinance.ru&dtd=90

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

79b7e258aaf300b72a9bee5527f8dc12ac369833c502f35641aecdab816a8142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 21 Nov 2021 08:17:23 GMT
server: cafe
content-length: 34249
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 21 Nov 2021 08:17:23 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame BFCB 126 KB
41 KB 571ms
565ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9865432956&adk=870026366&adf=2297262845&pi=t.ma~as.9865432956&w=240&lmt=1637482624&psa=0&format=240x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643031&bpp=1&bdt=269&idt=94&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=580x400&correlator=4749937713146&frm=20&pv=1&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1345&ady=67&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=L1WxLcXsQE&p=https%3A//www.profinance.ru&dtd=97

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d144b8737d7b53227cc0b6bb9920de9091f3db8bc68522a78a0ba6647a0e150

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPm8lZqCqfQCFcaaewodvxYKaQ&gqi=kwCaYbveCJqS3gPoz7XwBw&layout=/sadbundle/%24csp%253Der3%24/1591624239863002377/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPm8lZqCqfQCFcaaewodvxYKaQ&gqi=kwCaYbveCJqS3gPoz7XwBw&layout=/sadbundle/%24csp%253Der3%24/1591624239863002377/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 21 Nov 2021 08:17:23 GMT
server: cafe
content-length: 41466
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 21 Nov 2021 08:17:23 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame CC6E 6 KB
722 B 60ms
59ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&adk=1812271804&adf=3025194257&lmt=1637482624&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.profinance.ru%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643041&bpp=1&bdt=280&idt=89&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=580x400%2C240x400&nras=1&correlator=4749937713146&frm=20&pv=1&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=96

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cee961b83115cc0c2d2dacebf3744eb2307d32d8cd753350ed61600e262017c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 21 Nov 2021 08:17:23 GMT
server: cafe
content-length: 699
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 21 Nov 2021 08:17:23 GMT
cache-control: private

GET
H2

400

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check?t=ti(4)
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9464.shbhbDuYWuoDU9JC_z7MUZuridBLooyMh949s3JdXDzGdbImYrmX4dtL7Y-T-1VH.jekgNcwv27ueY19QVOqjluOFXMk%2C
https://mc.yandex.com/sync_cookie_image_decide?token=9464.zkQUjmd8nFei5ui3qX57jiBXz6GiqsUKHTuZpBdVwXaZcOtmbA4RbMVTsontAw44T_MVBiVStEgXXuGXvNaO6w%2C%2C.qIf4XEmzsLLIVIsRibSt3ewos2o%2C

75 B
75 B

48ms
48ms

Image
text/html

2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=9464.zkQUjmd8nFei5ui3qX57jiBXz6GiqsUKHTuZpBdVwXaZcOtmbA4RbMVTsontAw44T_MVBiVStEgXXuGXvNaO6w%2C%2C.qIf4XEmzsLLIVIsRibSt3ewos2o%2C

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
strict-transport-security: max-age=31536000
content-length: 75
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=9464.zkQUjmd8nFei5ui3qX57jiBXz6GiqsUKHTuZpBdVwXaZcOtmbA4RbMVTsontAw44T_MVBiVStEgXXuGXvNaO6w%2C%2C.qIf4XEmzsLLIVIsRibSt3ewos2o%2C
date: Sun, 21 Nov 2021 08:17:23 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
112 B 46ms
46ms Image
image/gif 2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif?t=ti(4)

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
last-modified: Wed, 17 Nov 2021 12:17:49 GMT
etag: "6194c8bd-2b"
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Sun, 21 Nov 2021 09:17:23 GMT

GET
H2 200 ac80f4be29c083e31de3.js Show response
yastatic.net/partner-code-bundles/49004/ 13 KB
5 KB 147ms
49ms Script
text/javascript 2a02:6b8:20::215
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/49004/ac80f4be29c083e31de3.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

a31a1fd9bd52ee5ebad50ba28eb8a6ef873cc1be5e8d712761c42ae7d7cf47a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.profinance.ru/
Origin: https://www.profinance.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: br
vary: Accept-Encoding
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 4466
last-modified: Thu, 18 Nov 2021 15:15:58 GMT
server: nginx/1.17.9
etag: "8d9d5370496a982b7204fec8efd8ec39"
x-robots-tag: noindex, noarchive, nofollow
strict-transport-security: max-age=43200000; includeSubDomains;
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2051 14:50:11 GMT

GET
H2 200 870c6077c3e7247e65a0.js Show response
yastatic.net/partner-code-bundles/49004/ 80 KB
17 KB 184ms
87ms Script
text/javascript 2a02:6b8:20::215
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/49004/870c6077c3e7247e65a0.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

3f2ddfa3bbb632bc1bd8b7725d83b552a7589a1978dc1f326ce3fd1aa73e0c53

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.profinance.ru/
Origin: https://www.profinance.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: br
vary: Accept-Encoding
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 17057
last-modified: Thu, 18 Nov 2021 15:15:58 GMT
server: nginx/1.17.9
etag: "3060b0889daa9d92cf91f451d2604d62"
x-robots-tag: noindex, noarchive, nofollow
strict-transport-security: max-age=43200000; includeSubDomains;
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2051 14:50:11 GMT

GET
H2 200 host.js Show response
yastatic.net/safeframe-bundles/0.83/ 33 KB
9 KB 243ms
147ms Script
text/javascript 2a02:6b8:20::215
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/safeframe-bundles/0.83/host.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.profinance.ru/
Origin: https://www.profinance.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: br
vary: Accept-Encoding
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 8878
last-modified: Wed, 03 Nov 2021 13:42:58 GMT
server: nginx/1.17.9
etag: "f80882bf67cf261aa08d636da095149a"
x-robots-tag: noindex, noarchive, nofollow
strict-transport-security: max-age=43200000; includeSubDomains;
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2051 14:50:23 GMT

GET
H2 200 9524 Show response
an.yandex.ru/meta/ 134 KB
35 KB 304ms
303ms XHR
application/json 2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/meta/9524?target-ref=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&pcode-test-ids=458424%2C0%2C95%3B456656%2C0%2C68%3B426972%2C0%2C73%3B452125%2C0%2C30%3B456562%2C0%2C31%3B452578%2C0%2C74%3B456227%2C0%2C38%3B457740%2C0%2C36%3B456244%2C0%2C91%3B457474%2C0%2C64%3B456345%2C0%2C65%3B451371%2C0%2C15%3B456500%2C0%2C68%3B458066%2C0%2C51%3B440126%2C0%2C-1%3B457847%2C0%2C-1&pcode-flags-map=%7B%22ENABLE_CODECS_WHITELIST%22%3A%5B%7B%22value%22%3A%22TRUE%22%2C%22testId%22%3A%22429059%22%7D%5D%2C%22DISABLE_DEFAULT_THEME_EMPTY_DURATION%22%3A%5B%7B%22value%22%3A%22TRUE%22%2C%22testId%22%3A%22429073%22%7D%5D%2C%22MEDIA_FILE_BITRATE_PRIORITY_FACTOR%22%3A%5B%7B%22value%22%3A%220.000001%22%2C%22testId%22%3A%22429074%22%7D%5D%2C%22VOLUME_BUTTON_ANIMATION%22%3A%5B%7B%22value%22%3A%22ENABLE%22%2C%22testId%22%3A%22429077%22%7D%5D%2C%22UNIFORMAT%22%3A%5B%7B%22value%22%3A%22ENABLE%22%2C%22testId%22%3A%22429079%22%7D%5D%2C%22CHANGE_CLICK_THROUGH_LOGIC%22%3A%5B%7B%22value%22%3A%22ACTION_BUTTON_PRIORITY%22%2C%22testId%22%3A%22432722%22%7D%5D%2C%22ENABLE_SKIN_THEME_EMPTY%22%3A%5B%7B%22value%22%3A%22TRUE%22%2C%22testId%22%3A%22441341%22%7D%5D%2C%22ENABLE_VP9_CODECS%22%3A%5B%7B%22value%22%3A%22TRUE%22%2C%22testId%22%3A%22441791%22%7D%5D%2C%22ENABLE_MEDIA_FILES_WITH_MSE_FILTER_UNDER_ABD_ONLY%22%3A%5B%7B%22value%22%3A%22TRUE%22%2C%22testId%22%3A%22445424%22%7D%5D%2C%22VAS_STABLE_VERSION%22%3A%5B%7B%22value%22%3A%22456068%22%2C%22testId%22%3A%22458411%22%7D%5D%2C%22ADFOX_MRC_VISIBILITY_ON_CLICK%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22427330%22%7D%5D%2C%22UNILOADER_FOR_AMP%22%3A%5B%7B%22value%22%3Atrue%2C%22testId%22%3A%22428390%22%7D%5D%2C%22USE_SSR_IN_AMP%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22428390%22%7D%5D%2C%22FULL_SSR_PERCENT_LOG_META%22%3A%5B%7B%22value%22%3A0.0001%2C%22testId%22%3A%22445452%22%7D%5D%2C%22DEFAULT_SSR_FORMATS%22%3A%5B%7B%22value%22%3A%5B%22zen%22%2C%22zen2%22%2C%22zen2-gallery%22%2C%22billboard%22%2C%22horizontal%22%2C%22horizontal0318%22%2C%22adaptiveConstructor%22%2C%22modernAdaptive%22%2C%22posterCarousel%22%2C%22adaptiveCarousel%22%2C%22smart_tile%22%5D%2C%22testId%22%3A%22445452%22%7D%5D%2C%22RTB_BANNER_FLAGS%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22445452%22%7D%5D%2C%22HBVER%22%3A%5B%7B%22value%22%3A42153%2C%22testId%22%3A%22445452%22%7D%5D%2C%22RMP_SEND_BEACON%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22433605%22%7D%5D%2C%22ADFOX_MRC_VISIBILITY_BY_OWNER%22%3A%5B%7B%22value%22%3A%5B168627%2C259055%2C258881%2C354188%2C239538%2C235076%2C264443%2C202100%2C354188%2C309667%2C270901%5D%2C%22testId%22%3A%22443574%22%7D%5D%2C%22AD_SEEN_OBSERVER%22%3A%5B%7B%22value%22%3A%22enable%22%2C%22testId%22%3A%22436297%22%7D%5D%2C%22FIXED_FORMAT_RENDER%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22436894%22%7D%5D%2C%22COMPRESS_FLAGS_MAP%22%3A%5B%7B%22value%22%3A1%2C%22testId%22%3A%22438661%22%7D%5D%2C%22FIX_IMAGES_PROTOCOL%22%3A%5B%7B%22value%22%3A1%2C%22testId%22%3A%22440194%22%7D%5D%2C%22SSR_HEADER_FORCE_ANSWER%22%3A%5B%7B%22value%22%3A1%2C%22testId%22%3A%22441777%22%7D%5D%2C%22FIX_MIN_HEIGHT_NTP%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22445391%22%7D%5D%2C%22FIX_SDK_LAYOUT_CONFIG%22%3A%5B%7B%22value%22%3A1%2C%22testId%22%3A%22445453%22%7D%5D%2C%22POSTER_PRICE%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22448272%22%7D%5D%2C%22PRICE_DISABLED_FORMATS%22%3A%5B%7B%22value%22%3A%5B%22posterVertical%22%2C%22posterHorizontal%22%2C%22posterCarousel%22%5D%2C%22testId%22%3A%22448272%22%7D%5D%2C%22ZEN2_REDESIGN_21_Q3_STEP_3%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22452293%22%7D%5D%2C%22VAS_ENABLE_AD_LABEL_OF_YANDEX_DIRECT%22%3A%5B%7B%22value%22%3A%22TRUE%22%2C%22testId%22%3A%22458424%22%7D%5D%2C%22ADSDKVER%22%3A%5B%7B%22value%22%3A%22456656%22%2C%22testId%22%3A%22456656%22%7D%5D%2C%22SMART_BANNER_PALETTE%22%3A%5B%7B%22value%22%3A%5B%5D%2C%22testId%22%3A%22426972%22%7D%5D%2C%22MULTIBANNER%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22452125%22%7D%5D%2C%22LOAD_NEW_MEDIA%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22456562%22%7D%5D%2C%22LEADERBOARD_HORIZONTAL_SD%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22452578%22%7D%5D%2C%22REMOVE_HORIZONTAL_ALIGN%22%3A%5B%7B%22value%22%3A%22ctl%22%2C%22testId%22%3A%22456227%22%7D%5D%2C%22SMART_BANNER_DISABLE_BOTTOM_PADDING%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22457740%22%7D%5D%2C%22ADAPTIVE_NEW_FULLSCREEN%22%3A%5B%7B%22value%22%3A%22ctl%22%2C%22testId%22%3A%22456244%22%7D%5D%2C%22ADAPTIVE_0418_NEW_FULLSCREEN%22%3A%5B%7B%22value%22%3A%22ctl%22%2C%22testId%22%3A%22456244%22%7D%5D%2C%22MOTION_NEW_FULLSCREEN%22%3A%5B%7B%22value%22%3A%22clt%22%2C%22testId%22%3A%22456244%22%7D%5D%2C%22WIDGET_LOAD_VAS_MODULE%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22457474%22%7D%5D%2C%22KEBAB_CLICKABLE_AREA%22%3A%5B%7B%22value%22%3A%22ctl%22%2C%22testId%22%3A%22456345%22%7D%5D%2C%22PREACT_RTB_INLINE%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22451371%22%7D%5D%2C%22ADFOX_MRC_VISIBILITY%22%3A%5B%7B%22value%22%3Atrue%2C%22testId%22%3A%22456500%22%7D%5D%2C%22ADFOX_RELOAD_IF_AD_WAS_SEEN%22%3A%5B%7B%22value%22%3A%22ctl%22%2C%22testId%22%3A%22456500%22%7D%5D%2C%22PCODEVER%22%3A%5B%7B%22value%22%3A%2249004%22%2C%22testId%22%3A%22458066%22%7D%5D%2C%22SMART_BANNER_HIDEABLE_BUTTONS%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22440126%22%7D%5D%2C%22SMART_QUEUE%22%3A%5B%7B%22value%22%3A%22queue_full%22%2C%22testId%22%3A%22457847%22%7D%5D%7D&server-side-rendering-enabled-formats=zen%0Azen2%0Azen2-gallery%0Abillboard%0Ahorizontal%0Ahorizontal0318%0AadaptiveConstructor%0AmodernAdaptive%0AposterCarousel%0AadaptiveCarousel%0Asmart_tile&price-disabled-formats=adaptive0418%0Aadaptive%0AmodernAdaptive%0Ahorizontal%0Ahorizontal0318%0Agrid%0A160x600%0A240x400%0A200x300%0A300x300%0A300x250%0A250x250%0A728x90%0A1000x120%0A320x50%0A320x100%0A400x240%0A320x480%0A480x320%0A336x280%0A300x600%0A300x500%0A970x250%0A970x90%0AposterVertical%0AposterHorizontal%0AposterCarousel%0AposterVertical%0AposterHorizontal%0AposterCarousel&raw-smart-content=1&smart-format-names=smart-banner-adaptive_v1%0Asmart-banner-mosaic_v1&pcode-icookie=9ZnCuKhqaHflVazmG5IiIJ8WjY7h%2BM92qtSigr60ONrsLdKazRyABdbuNLRkoBqa1iqQnrdthj6J0Q%2FW0wle4usyJro%3D&duid=MTYzNzQ4MjY0MzY0NzI1MjQ1MA%3D%3D&imp-id=70&enable-flat-highlight=1&comboblock-unencoded-vast=1&test-tag=481637632573442&ad-session-id=6873661637482643189&target-id=96539691&tga-with-creatives=1&pcode-version=49004&pcodever=49004&flash-ver=0&available-width=240&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A9.3%2C%22quirks%22%3Atrue%2C%22w%22%3A240%2C%22h%22%3A0%2C%22width%22%3A240%2C%22height%22%3A0%2C%22visible%22%3A1%2C%22left%22%3A1345%2C%22top%22%3A860%2C%22fontFamily%22%3A%22roboto%22%2C%22ad_no%22%3A0%2C%22req_no%22%3A0%7D&grab-orig-len=1028&grab=dNCk0L7RgNC10LrRgSDQvdCwIFByb0ZpbmFuY2UuUnUuINCa0YPRgNGB0Ysg0LLQsNC70Y7Rgi4g0J_RgNC-0LPQvdC-0LfRiyDQstCw0LvRjtGC0L3QvtCz0L4g0YDRi9C90LrQsC4KMiDQoNC10LTQsNC60YbQuNGPIMK3INCg0LXQutC70LDQvNCwIMK3INCa0L7QvdGC0LDQutGC0YsgCjIg0JrQvtGC0LjRgNC-0LLQutC4IMK3INCa0L7RgtC40YDQvtCy0LrQuCDQvtC90LvQsNC50L0gwrcg0JPRgNCw0YTQuNC60Lggwrcg0JPRgNCw0YTQuNC60Lgg0L7QvdC70LDQudC9IMK3INCY0L3RhNC-0YDQvNC10YDRiyAtINCa0YPRgNGBINCy0LDQu9GO0YIg0KbQkSDQuCDQpNC-0YDQtdC60YEgCjIg0JrQvtGC0LjRgNC-0LLQutC4INCy0LDQu9GO0YIgwrcg0JrRg9GA0YEg0LTQvtC70LvQsNGA0LAg0Log0YDRg9Cx0LvRjiDCtyDQmtGD0YDRgSDQtdCy0YDQviDQuiDRgNGD0LHQu9GOIMK3INCa0YPRgNGB0Ysg0LLQsNC70Y7RgiDQuiDRgNGD0LHQu9GOIMK3INCa0L7RgtC40YDQvtCy0LrQuCDQsNC60YbQuNC5IMK3INCd0LXRhNGC0Ywgwrcg0JfQvtC70L7RgtC-IMK3INCR0LjRgtC60L7QuNC9IMK3INCd0LXRhNGC0YwgVXJhbHMgCjIg0JDRgNGF0LjQsiDQvdC-0LLQvtGB0YLQtdC5INCy0LDQu9GO0YLQvdC-0LPQviDQuCDRhNC-0L3QtNC-0LLQvtCz0L4g0YDRi9C90LrQsCDCtyDQkNGA0YXQuNCyINGN0LrQvtC90L7QvNC40YfQtdGB0LrQuNGFINC90L7QstC-0YHRgtC10Lkg0Lgg0YHQvtCx0YvRgtC40LkgCjIg0KTQvtGA0LXQutGBINCk0L7RgNGD0LwgCg%3D%3D&uniformat=true&callback=Ya%5B6115543062283%5D

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

c4915527ac7c2fd2ce672afd86c68d44210c057d911bed0bcb7e91c9db27ed9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
x-yandex-req-id: 1637482643245649-60948605221901079800311-production-app-host-man-pcode-152
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
uniformat-product-type: Direct
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sun, 21 Nov 2021 08:17:23 GMT
strict-transport-security: max-age=31536000
content-type: application/json
access-control-allow-origin: https://www.profinance.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
uniformat: true
expires: Sun, 21 Nov 2021 08:17:23 GMT

GET
H2 200 18572788e0234929ab87.js Show response
yastatic.net/partner-code-bundles/49004/ 630 KB
127 KB 171ms
105ms Script
text/javascript 2a02:6b8:20::215
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/49004/18572788e0234929ab87.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

71c4db2e5d2e856aa7c037ec8fbca11d6bc09590f079c1f134934ebc5e436e3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.profinance.ru/
Origin: https://www.profinance.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: br
vary: Accept-Encoding
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 129611
last-modified: Thu, 18 Nov 2021 15:15:58 GMT
server: nginx/1.17.9
etag: "7617212d86238e7571bcbc68d51526c4"
x-robots-tag: noindex, noarchive, nofollow
strict-transport-security: max-age=43200000; includeSubDomains;
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2051 14:53:01 GMT

POST
H2 200 counter
top-fwz1.mail.ru/ 43 B
927 B 59ms
58ms Ping
image/gif 217.69.133.145
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to

Full URL

https://top-fwz1.mail.ru/counter?js=13;id=74564;u=https%3A//www.profinance.ru/;st=1637482643010;title=%D0%A4%D0%BE%D1%80%D0%B5%D0%BA%D1%81%20%D0%BD%D0%B0%20ProFinance.Ru.%20%D0%9A%D1%83%D1%80%D1%81%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82.%20%D0%9F%D1%80%D0%BE%D0%B3%D0%BD%D0%BE%D0%B7%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D1%8B%D0%BD%D0%BA%D0%B0.;s=1600*1200;vp=1600*1692;touch=0;hds=1;frame=0;flash=;sid=072db7b90d4f3286;ver=60.3.0;tz=0%2FEtc%2FUnknown;ni=9.3//4g/0/0/;lvid=1637482643217%3A1637482643224%3A1%3A30db78e725973cd238b568baf2be3152;visible=true;_=0.06558689748698265

Requested by

Host: top-fwz1.mail.ru
URL: https://top-fwz1.mail.ru/js/code.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),

Reverse DNS

top-fwz1.mail.ru

Software

nginx /

Resource Hash

24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
x-content-type-options: nosniff
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length: 43
pragma: no-cache
amp-access-control-allow-source-origin: https://www.profinance.ru
server: nginx
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: https://www.profinance.ru
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: private, no-cache, no-store, max-age=0
access-control-allow-credentials: true
accept-ch-lifetime: 86400
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
timing-allow-origin: https://www.profinance.ru
access-control-allow-headers: *

GET
H2 200 getcookie Show response
matchid.adfox.yandex.ru/ 88 B
375 B 233ms
67ms XHR
application/json 2a02:6b8::16b
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://matchid.adfox.yandex.ru/getcookie

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/header-bidding.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a02:6b8::16b Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

10505836d229d8e486d2f87c2ad2ff90e442438b7085b35f5017c2e98711805e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin: https://www.profinance.ru
date: Sun, 21 Nov 2021 08:17:23 GMT
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 88
x-content-type-options: nosniff
content-type: application/json

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ 117 KB
38 KB 74ms
22ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.js
Requested by: Host: yandex.ru
URL: https://yandex.ru/ads/system/header-bidding.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: c0fb763f2f2e80a902d63860360c9ae467315055f06d4ac3a8cf0bd5982573ef

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
last-modified: Thu, 11 Nov 2021 06:35:13 GMT
server: nginx
etag: W/"618cb9a1-1d4ec"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 22 Nov 2021 08:17:23 GMT

POST
H2 204 bids Show response
adfox-c2s-ams.creativecdn.com/bidder/adfox/ 0
211 B 59ms
19ms XHR
application/json 185.184.8.65
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://adfox-c2s-ams.creativecdn.com/bidder/adfox/bids
Requested by: Host: yandex.ru
URL: https://yandex.ru/ads/system/header-bidding.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.65 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-65.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.profinance.ru
date: Sun, 21 Nov 2021 08:17:23 GMT
access-control-allow-credentials: true
access-control-max-age: 3600
vary: Origin
access-control-allow-methods: POST
content-type: application/json;charset=utf-8

POST
H2

200

yandex_hb Show response
px.adhigh.net/rtb/
Redirect Chain

https://px.adhigh.net/rtb/yandex_hb
https://px.adhigh.net/rtb/yandex_hb?bounced=1

11 B
319 B

103ms
103ms

XHR
application/json

193.232.150.45
UMA-TECH-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://px.adhigh.net/rtb/yandex_hb?bounced=1
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Server: 193.232.150.45 , Russian Federation, ASN48061 (UMA-TECH-AS, RU),
Reverse DNS: smtp18.sender.ltmse.com
Software: nginx /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:23 GMT
server: nginx
x-backend-id: f3-ru
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
access-control-allow-origin: https://www.profinance.ru
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 11
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:23 GMT
server: nginx
access-control-allow-origin: https://www.profinance.ru
x-backend-id: f22-ru
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://px.adhigh.net/rtb/yandex_hb?bounced=1
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H/1.1 200
OK / Show response
ad.mail.ru/hbid_yandex/ 676 B
1007 B 264ms
142ms XHR
application/json 2a00:1148:db00::17
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.mail.ru/hbid_yandex/
Requested by: Host: yandex.ru
URL: https://yandex.ru/ads/system/header-bidding.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a00:1148:db00::17 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),
Reverse DNS
Software: nginx /
Resource Hash: 22183691806f231b4bd2f4df10195e165b6da322ddf9362fe17c84892e449634

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

Date: Sun, 21 Nov 2021 08:17:23 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: https://www.profinance.ru
Cache-Control: private, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *

POST
H2 200 adjson Show response
ads.betweendigital.com/ 11 B
229 B 100ms
99ms XHR
application/json 96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.betweendigital.com/adjson?t=adfox
Requested by: Host: yandex.ru
URL: https://yandex.ru/ads/system/header-bidding.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.profinance.ru
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json

POST
H2 200 yhb Show response
yhb.p.otm-r.com/ 11 B
255 B 53ms
12ms XHR
text/plain 195.201.152.110
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://yhb.p.otm-r.com/yhb
Requested by: Host: yandex.ru
URL: https://yandex.ru/ads/system/header-bidding.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 195.201.152.110 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.110.152.201.195.clients.your-server.de
Software: nginx/1.17.6 /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.profinance.ru
date: Sun, 21 Nov 2021 08:17:23 GMT
access-control-allow-credentials: true
server: nginx/1.17.6
content-length: 11
vary: Origin
content-type: text/plain; charset=utf-8

POST
H2

200

adfox Show response
exchange.buzzoola.com/ssp/
Redirect Chain

https://exchange.buzzoola.com/ssp/adfox
https://exchange.buzzoola.com/ssp/adfox?set_buzzoola_cookie=t

11 B
321 B

129ms
129ms

XHR
text/plain

116.202.236.172
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://exchange.buzzoola.com/ssp/adfox?set_buzzoola_cookie=t
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Server: 116.202.236.172 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.172.236.202.116.clients.your-server.de
Software: nginx /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
server: nginx
serverid: TODO
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.profinance.ru
access-control-expose-headers: Set-Cookie, Etag
access-control-allow-credentials: true
access-control-allow-headers: Set-Cookie, X-Alt-Referer, X-First-Party-Cookie, If-None-Match
content-length: 11

Redirect headers

date: Sun, 21 Nov 2021 08:17:23 GMT
server: nginx
access-control-allow-origin: https://www.profinance.ru
etag: W/"6cc8beff76aa59f78048ad38e6a10d522ab1a702145419eed37a596ff92ebf0e"
serverid: TODO
location: /ssp/adfox?set_buzzoola_cookie=t
access-control-expose-headers: Set-Cookie, Etag
access-control-allow-credentials: true
access-control-allow-headers: Set-Cookie, X-Alt-Referer, X-First-Party-Cookie, If-None-Match
content-length: 0

POST
H/1.1 204
No Content bid.cgi Show response
pb.adriver.ru/cgi-bin/ 0
305 B 257ms
69ms XHR
text/plain 195.209.111.20
ADRIVER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.adriver.ru/cgi-bin/bid.cgi
Requested by: Host: yandex.ru
URL: https://yandex.ru/ads/system/header-bidding.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.209.111.20 , Russian Federation, ASN52007 (ADRIVER-AS, RU),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.profinance.ru
Pragma: no-cache
Date: Sun, 21 Nov 2021 08:17:23 GMT
Cache-control: no-cache, max-age=0, must-revalidate, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 40ms
40ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_inf_scr&r=p&pg_h=1692&su=www.profinance.ru&d=5000&eid=31063793%2C31062930

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:23 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bidder_18.html Show response
cache.betweendigital.com/code/ Frame 5D9F 4 KB
1 KB 110ms
18ms Document
text/html 151.236.118.210
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.betweendigital.com/code/bidder_18.html?USER_ID=f9781672-40fe-5345-9b2f-3aa1fab53a32&CACHEBUSTER=821503
Requested by: Host: ads.betweendigital.com
URL: https://ads.betweendigital.com/sspmatch-js?p=43185&randsalt=4020879901
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.118.210 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 0efe00c23297e5c56485eabb6ea548c2669b896704fcb2c426d898148543ccad

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

server: nginx
date: Sun, 21 Nov 2021 08:17:23 GMT
content-type: text/html
last-modified: Tue, 08 Jun 2021 15:45:03 GMT
etag: W/"60bf907f-ee9"
content-encoding: gzip

GET
H2

200

match
ads.betweendigital.com/
Redirect Chain

https://x.bidswitch.net/sync?ssp=between
https://x.bidswitch.net/ul_cb/sync?ssp=between
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=between&bsw_custom_parameter=a6afb578-f865-4b6c-8844-06e685d836eb
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=between&bsw_custom_parameter=a6afb578-f865-4b6c-8844-06e685d836eb
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=6aae418f-4438-4f79-94d1-f36ccbbd20b9&user_group=1&ssp=between&bsw_param=a6afb578-f865-4b6c-8844-06e685d836eb
https://ads.betweendigital.com/match?bidder_id=22&external_user_id=a6afb578-f865-4b6c-8844-06e685d836eb

68 B
607 B

96ms
96ms

Image
image/png

96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=22&external_user_id=a6afb578-f865-4b6c-8844-06e685d836eb
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

Location: //ads.betweendigital.com/match?bidder_id=22&external_user_id=a6afb578-f865-4b6c-8844-06e685d836eb
Date: Sun, 21 Nov 2021 08:17:23 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2

200

match
ads.betweendigital.com/
Redirect Chain

https://px.adhigh.net/p/cm/btw
https://px.adhigh.net/p/cm/btw?bounced=1
https://ads.betweendigital.com/match?bidder_id=37&external_user_id=757XPJUJirc.AikABlF9QZJAEw

68 B
607 B

96ms
96ms

Image
image/png

96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=37&external_user_id=757XPJUJirc.AikABlF9QZJAEw
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:23 GMT
server: nginx
access-control-allow-origin: *
x-backend-id: f18-ru
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ads.betweendigital.com/match?bidder_id=37&external_user_id=757XPJUJirc.AikABlF9QZJAEw
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

match
ads.betweendigital.com/
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fads.betweendigital.com%2Fmatch%3Fbidder_id%3D114%26external_user_id%3D%24UID
https://ap.lijit.com/pixel?redir=https%3A%2F%2Fads.betweendigital.com%2Fmatch%3Fbidder_id%3D114%26external_user_id%3D%24UID&sovrn_retry=true
https://ads.betweendigital.com/match?bidder_id=114&external_user_id=bdd357d828d3283218fa44ff

68 B
607 B

96ms
96ms

Image
image/png

96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=114&external_user_id=bdd357d828d3283218fa44ff
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

Date: Sun, 21 Nov 2021 08:17:24 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://ads.betweendigital.com/match?bidder_id=114&external_user_id=bdd357d828d3283218fa44ff
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap2sea1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H2

200

match
ads.betweendigital.com/
Redirect Chain

https://sync.bumlam.com/?src=bw1&uid=f9781672-40fe-5345-9b2f-3aa1fab53a32
https://sync3.adsniper.ru/?src=ss1&s_data=CAEQABiTgeiMBlIFvp7KygpiJGY5NzgxNjcyLTQwZmUtNTM0NS05YjJmLTNhYTFmYWI1M2EzMg**
https://sync3.adsniper.ru/?src=ss1&s_data=CAIQARiTgeiMBlIFvp7KygpiJGY5NzgxNjcyLTQwZmUtNTM0NS05YjJmLTNhYTFmYWI1M2EzMqIBEHRcLCJKoxHspukAJZDIJDc*
https://sync.bumlam.com/?src=bw1&s_data=CAIQABiTgeiMBmIkZjk3ODE2NzItNDBmZS01MzQ1LTliMmYtM2FhMWZhYjUzYTMyogEQdFwsIkqjEeym6QAlkMgkNw**
https://sync.bumlam.com/?src=bw1&s_data=CAIQARiTgeiMBmIkZjk3ODE2NzItNDBmZS01MzQ1LTliMmYtM2FhMWZhYjUzYTMyogEQdFwsIkqjEeym6QAlkMgkNw**
https://ads.betweendigital.com/match?bidder_id=18&external_user_id=745c2c22-4aa3-11ec-a6e9-002590c82437

68 B
607 B

99ms
98ms

Image
image/png

96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=18&external_user_id=745c2c22-4aa3-11ec-a6e9-002590c82437
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

Date: Sun, 21 Nov 2021 08:17:23 GMT
Server: nginx
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: https://ads.betweendigital.com/match?bidder_id=18&external_user_id=745c2c22-4aa3-11ec-a6e9-002590c82437
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate, s-maxage=0
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0

GET
H2

200

1 Show response
mc.yandex.com/watch/9524/
Redirect Chain

https://mc.yandex.com/watch/9524?wmode=7&page-url=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&cnt-class=1&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmizds872r%3Afp%3A742%3Afu%3A0%3Aen%3Aut...
https://mc.yandex.com/watch/9524/1?wmode=7&page-url=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&cnt-class=1&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmizds872r%3Afp%3A742%3Afu%3A0%3Aen%3A...

167 B
249 B

49ms
48ms

XHR
application/json

2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/9524/1?wmode=7&page-url=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&cnt-class=1&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmizds872r%3Afp%3A742%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A700%3Acn%3A1%3Adp%3A0%3Als%3A758213256447%3Ahid%3A986956526%3Az%3A0%3Ai%3A20211121081723%3Aet%3A1637482643%3Ac%3A1%3Arn%3A760018196%3Arqn%3A1%3Au%3A1637482643647252450%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1637482642181%3Ads%3A0%2C116%2C103%2C1%2C346%2C0%2C%2C249%2C2%2C%2C%2C%2C873%3Adsn%3A0%2C116%2C103%2C1%2C345%2C0%2C%2C263%2C1%2C%2C%2C%2C873%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1637482643%3At%3A%D0%A4%D0%BE%D1%80%D0%B5%D0%BA%D1%81%20%D0%BD%D0%B0%20ProFinance.Ru.%20%D0%9A%D1%83%D1%80%D1%81%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82.%20%D0%9F%D1%80%D0%BE%D0%B3%D0%BD%D0%BE%D0%B7%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D1%8B%D0%BD%D0%BA%D0%B0.&t=gdpr%2814%29ti%282%29

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

a6f1da8af27838a767ad82d3881fe923f224c7c221f81c8cef0cc47490f262ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 21-Nov-2021 08:17:23 GMT
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.profinance.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 167
x-xss-protection: 1; mode=block
expires: Sun, 21-Nov-2021 08:17:23 GMT

Redirect headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:23 GMT
last-modified: Sun, 21-Nov-2021 08:17:23 GMT
location: /watch/9524/1?wmode=7&page-url=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&cnt-class=1&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmizds872r%3Afp%3A742%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A700%3Acn%3A1%3Adp%3A0%3Als%3A758213256447%3Ahid%3A986956526%3Az%3A0%3Ai%3A20211121081723%3Aet%3A1637482643%3Ac%3A1%3Arn%3A760018196%3Arqn%3A1%3Au%3A1637482643647252450%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1637482642181%3Ads%3A0%2C116%2C103%2C1%2C346%2C0%2C%2C249%2C2%2C%2C%2C%2C873%3Adsn%3A0%2C116%2C103%2C1%2C345%2C0%2C%2C263%2C1%2C%2C%2C%2C873%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1637482643%3At%3A%D0%A4%D0%BE%D1%80%D0%B5%D0%BA%D1%81%20%D0%BD%D0%B0%20ProFinance.Ru.%20%D0%9A%D1%83%D1%80%D1%81%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82.%20%D0%9F%D1%80%D0%BE%D0%B3%D0%BD%D0%BE%D0%B7%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D1%8B%D0%BD%D0%BA%D0%B0.&t=gdpr%2814%29ti%282%29
strict-transport-security: max-age=31536000
access-control-allow-origin: https://www.profinance.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Sun, 21-Nov-2021 08:17:23 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
190 B 57ms
15ms XHR
text/plain 178.250.2.131
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?ptv=116&profileId=184&cb=65366695236
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.131 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: bidder.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://www.profinance.ru
date: Sun, 21 Nov 2021 08:17:22 GMT
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Finatra
timing-allow-origin: *
vary: Origin

POST
H2 204 events
bidder.criteo.com/csm/ 0
190 B 14ms
13ms Ping
text/plain 178.250.2.131
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/csm/events
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.131 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: bidder.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.profinance.ru
date: Sun, 21 Nov 2021 08:17:22 GMT
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Finatra
timing-allow-origin: *
vary: Origin

GET
H2 200 pixel.gif
static.criteo.net/images/ 43 B
337 B 24ms
24ms Image
image/gif 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=1
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "493ea254-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 43
expires: Wed, 16 Nov 2022 08:17:23 GMT

GET
H2 200 pixel.gif
static.criteo.net/images/ 43 B
337 B 24ms
24ms Image
image/gif 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=2
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "493ea254-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 43
expires: Wed, 16 Nov 2022 08:17:23 GMT

POST
H2 200 1 Show response
mc.yandex.com/watch/9524/ 43 B
100 B 46ms
45ms XHR
image/gif 2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/9524/1?page-url=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&cnt-class=1&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmizds872r%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A700%3Acn%3A1%3Adp%3A1%3Als%3A758213256447%3Ahid%3A986956526%3Az%3A0%3Ai%3A20211121081723%3Aet%3A1637482643%3Ac%3A1%3Arn%3A935415496%3Arqn%3A2%3Au%3A1637482643647252450%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Aeu%3A1%3Ans%3A1637482642181%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1637482643&t=gdpr(14)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:23 GMT
last-modified: Sun, 21-Nov-2021 08:17:23 GMT
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: https://www.profinance.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Sun, 21-Nov-2021 08:17:23 GMT

GET
H2

200

match
ads.betweendigital.com/ Frame 5D9F
Redirect Chain

https://x.bidswitch.net/sync?ssp=between
https://bidswitch-eu.splicky.com/cm?bidswitch_ssp_id=between&bsw_custom_parameter=a6afb578-f865-4b6c-8844-06e685d836eb
https://x.bidswitch.net/sync?dsp_id=311&user_id=&user_group=2&ssp=between&expires=10&bsw_param=a6afb578-f865-4b6c-8844-06e685d836eb
https://ads.betweendigital.com/match?bidder_id=22&external_user_id=a6afb578-f865-4b6c-8844-06e685d836eb

68 B
607 B

96ms
96ms

Image
image/png

96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=22&external_user_id=a6afb578-f865-4b6c-8844-06e685d836eb
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cache.betweendigital.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

Location: //ads.betweendigital.com/match?bidder_id=22&external_user_id=a6afb578-f865-4b6c-8844-06e685d836eb
Date: Sun, 21 Nov 2021 08:17:23 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2 200 v2 Show response
an.yandex.ru/adfox/341266/getBulk/ 14 KB
4 KB 297ms
297ms XHR
application/json 2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/adfox/341266/getBulk/v2?dl=https%3A%2F%2Fwww.profinance.ru%2F&date=2021-11-21T08%3A17%3A23.518%2B00%3A00&pd=21&pdh=1200&pdw=1600&pr1=3605703746&pr=1577951840&prr=&pv=8&pw=0&extid_loader=MTYzNzQ4MjY0MzY0NzI1MjQ1MA%3D%3D&extid_tag_loader=www.profinance.ru&ylv=0.49004&ybv=0.49004&ytt=481586629969941&is-turbo=0&skip-token=&ad-session-id=6873661637482643189&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A9.3%2C%22quirks%22%3Atrue%2C%22w%22%3A1600%2C%22h%22%3A0%2C%22width%22%3A1600%2C%22height%22%3A0%2C%22visible%22%3A1%2C%22left%22%3A0%2C%22top%22%3A0%2C%22fontFamily%22%3A%22roboto%22%2C%22req_no%22%3A0%2C%22ad_no%22%3A0%7D&enable-flat-highlight=1&pcode-version=49004&availableWidth=1600&availableHeight=0&pp=g&ps=dxjd&p2=gyqo&slotNumber=1&bids=W3siY2FtcGFpZ25faWQiOjEzMjQ0MTYsInJlc3BvbnNlX3RpbWUiOjE2MywiZXJyb3IiOnsiY29kZSI6MX0sInBsYWNlbWVudF9pZCI6IjE1NTQ0NDMifSx7ImNhbXBhaWduX2lkIjoxMzI0NDYzLCJyZXNwb25zZV90aW1lIjo2MywiZXJyb3IiOnsiY29kZSI6NH0sInBsYWNlbWVudF9pZCI6IjRxSUJUdlRnQXlzSjJxMEJHY3BuIn0seyJjYW1wYWlnbl9pZCI6MTMyNDQ2NiwicmVzcG9uc2VfdGltZSI6MjcyLCJlcnJvciI6eyJjb2RlIjoxfSwicGxhY2VtZW50X2lkIjoiNjZfOTcweDI1MF9hbGZhZGFydCJ9LHsiY2FtcGFpZ25faWQiOjEzMjQ0NzEsInJlc3BvbnNlX3RpbWUiOjI2OSwiZXJyb3IiOnsiY29kZSI6MX0sInBsYWNlbWVudF9pZCI6IjgyODUyNSJ9LHsiY2FtcGFpZ25faWQiOjEzMjQ0NzcsInJlc3BvbnNlX3RpbWUiOjEwNCwiZXJyb3IiOnsiY29kZSI6MX0sInBsYWNlbWVudF9pZCI6IjM5NTU0MTQifSx7ImNhbXBhaWduX2lkIjoxNTYzMTY4LCJyZXNwb25zZV90aW1lIjo1OCwiZXJyb3IiOnsiY29kZSI6MX0sInBsYWNlbWVudF9pZCI6Ijk4MDFfXzcwMjkifSx7ImNhbXBhaWduX2lkIjoxNjAwNDA2LCJyZXNwb25zZV90aW1lIjoxNzYsImVycm9yIjp7ImNvZGUiOjF9LCJwbGFjZW1lbnRfaWQiOiIxMjIxNTMyIn0seyJjYW1wYWlnbl9pZCI6MTU3ODQxOSwicmVzcG9uc2VfdGltZSI6MjYyLCJlcnJvciI6eyJjb2RlIjo0fSwicGxhY2VtZW50X2lkIjoiOTg6cHJvZmluYW5jZV85NzB4MjUwX3RvcCJ9XQ%3D%3D&utf8=%E2%9C%93&duid=MTYzNzQ4MjY0MzY0NzI1MjQ1MA%3D%3D&pcode-test-ids=458424%2C0%2C95%3B456656%2C0%2C68%3B426972%2C0%2C73%3B452125%2C0%2C30%3B456562%2C0%2C31%3B452578%2C0%2C74%3B456227%2C0%2C38%3B457740%2C0%2C36%3B456244%2C0%2C91%3B457474%2C0%2C64%3B456345%2C0%2C65%3B451371%2C0%2C15%3B456500%2C0%2C68%3B458066%2C0%2C51%3B440126%2C0%2C-1%3B457847%2C0%2C-1&pcode-flags-map=%7B%22ENABLE_CODECS_WHITELIST%22%3A%5B%7B%22value%22%3A%22TRUE%22%2C%22testId%22%3A%22429059%22%7D%5D%2C%22DISABLE_DEFAULT_THEME_EMPTY_DURATION%22%3A%5B%7B%22value%22%3A%22TRUE%22%2C%22testId%22%3A%22429073%22%7D%5D%2C%22MEDIA_FILE_BITRATE_PRIORITY_FACTOR%22%3A%5B%7B%22value%22%3A%220.000001%22%2C%22testId%22%3A%22429074%22%7D%5D%2C%22VOLUME_BUTTON_ANIMATION%22%3A%5B%7B%22value%22%3A%22ENABLE%22%2C%22testId%22%3A%22429077%22%7D%5D%2C%22UNIFORMAT%22%3A%5B%7B%22value%22%3A%22ENABLE%22%2C%22testId%22%3A%22429079%22%7D%5D%2C%22CHANGE_CLICK_THROUGH_LOGIC%22%3A%5B%7B%22value%22%3A%22ACTION_BUTTON_PRIORITY%22%2C%22testId%22%3A%22432722%22%7D%5D%2C%22ENABLE_SKIN_THEME_EMPTY%22%3A%5B%7B%22value%22%3A%22TRUE%22%2C%22testId%22%3A%22441341%22%7D%5D%2C%22ENABLE_VP9_CODECS%22%3A%5B%7B%22value%22%3A%22TRUE%22%2C%22testId%22%3A%22441791%22%7D%5D%2C%22ENABLE_MEDIA_FILES_WITH_MSE_FILTER_UNDER_ABD_ONLY%22%3A%5B%7B%22value%22%3A%22TRUE%22%2C%22testId%22%3A%22445424%22%7D%5D%2C%22VAS_STABLE_VERSION%22%3A%5B%7B%22value%22%3A%22456068%22%2C%22testId%22%3A%22458411%22%7D%5D%2C%22ADFOX_MRC_VISIBILITY_ON_CLICK%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22427330%22%7D%5D%2C%22UNILOADER_FOR_AMP%22%3A%5B%7B%22value%22%3Atrue%2C%22testId%22%3A%22428390%22%7D%5D%2C%22USE_SSR_IN_AMP%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22428390%22%7D%5D%2C%22FULL_SSR_PERCENT_LOG_META%22%3A%5B%7B%22value%22%3A0.0001%2C%22testId%22%3A%22445452%22%7D%5D%2C%22DEFAULT_SSR_FORMATS%22%3A%5B%7B%22value%22%3A%5B%22zen%22%2C%22zen2%22%2C%22zen2-gallery%22%2C%22billboard%22%2C%22horizontal%22%2C%22horizontal0318%22%2C%22adaptiveConstructor%22%2C%22modernAdaptive%22%2C%22posterCarousel%22%2C%22adaptiveCarousel%22%2C%22smart_tile%22%5D%2C%22testId%22%3A%22445452%22%7D%5D%2C%22RTB_BANNER_FLAGS%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22445452%22%7D%5D%2C%22HBVER%22%3A%5B%7B%22value%22%3A42153%2C%22testId%22%3A%22445452%22%7D%5D%2C%22RMP_SEND_BEACON%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22433605%22%7D%5D%2C%22ADFOX_MRC_VISIBILITY_BY_OWNER%22%3A%5B%7B%22value%22%3A%5B168627%2C259055%2C258881%2C354188%2C239538%2C235076%2C264443%2C202100%2C354188%2C309667%2C270901%5D%2C%22testId%22%3A%22443574%22%7D%5D%2C%22AD_SEEN_OBSERVER%22%3A%5B%7B%22value%22%3A%22enable%22%2C%22testId%22%3A%22436297%22%7D%5D%2C%22FIXED_FORMAT_RENDER%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22436894%22%7D%5D%2C%22COMPRESS_FLAGS_MAP%22%3A%5B%7B%22value%22%3A1%2C%22testId%22%3A%22438661%22%7D%5D%2C%22FIX_IMAGES_PROTOCOL%22%3A%5B%7B%22value%22%3A1%2C%22testId%22%3A%22440194%22%7D%5D%2C%22SSR_HEADER_FORCE_ANSWER%22%3A%5B%7B%22value%22%3A1%2C%22testId%22%3A%22441777%22%7D%5D%2C%22FIX_MIN_HEIGHT_NTP%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22445391%22%7D%5D%2C%22FIX_SDK_LAYOUT_CONFIG%22%3A%5B%7B%22value%22%3A1%2C%22testId%22%3A%22445453%22%7D%5D%2C%22POSTER_PRICE%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22448272%22%7D%5D%2C%22PRICE_DISABLED_FORMATS%22%3A%5B%7B%22value%22%3A%5B%22posterVertical%22%2C%22posterHorizontal%22%2C%22posterCarousel%22%5D%2C%22testId%22%3A%22448272%22%7D%5D%2C%22ZEN2_REDESIGN_21_Q3_STEP_3%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22452293%22%7D%5D%2C%22VAS_ENABLE_AD_LABEL_OF_YANDEX_DIRECT%22%3A%5B%7B%22value%22%3A%22TRUE%22%2C%22testId%22%3A%22458424%22%7D%5D%2C%22ADSDKVER%22%3A%5B%7B%22value%22%3A%22456656%22%2C%22testId%22%3A%22456656%22%7D%5D%2C%22SMART_BANNER_PALETTE%22%3A%5B%7B%22value%22%3A%5B%5D%2C%22testId%22%3A%22426972%22%7D%5D%2C%22MULTIBANNER%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22452125%22%7D%5D%2C%22LOAD_NEW_MEDIA%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22456562%22%7D%5D%2C%22LEADERBOARD_HORIZONTAL_SD%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22452578%22%7D%5D%2C%22REMOVE_HORIZONTAL_ALIGN%22%3A%5B%7B%22value%22%3A%22ctl%22%2C%22testId%22%3A%22456227%22%7D%5D%2C%22SMART_BANNER_DISABLE_BOTTOM_PADDING%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22457740%22%7D%5D%2C%22ADAPTIVE_NEW_FULLSCREEN%22%3A%5B%7B%22value%22%3A%22ctl%22%2C%22testId%22%3A%22456244%22%7D%5D%2C%22ADAPTIVE_0418_NEW_FULLSCREEN%22%3A%5B%7B%22value%22%3A%22ctl%22%2C%22testId%22%3A%22456244%22%7D%5D%2C%22MOTION_NEW_FULLSCREEN%22%3A%5B%7B%22value%22%3A%22clt%22%2C%22testId%22%3A%22456244%22%7D%5D%2C%22WIDGET_LOAD_VAS_MODULE%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22457474%22%7D%5D%2C%22KEBAB_CLICKABLE_AREA%22%3A%5B%7B%22value%22%3A%22ctl%22%2C%22testId%22%3A%22456345%22%7D%5D%2C%22PREACT_RTB_INLINE%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22451371%22%7D%5D%2C%22ADFOX_MRC_VISIBILITY%22%3A%5B%7B%22value%22%3Atrue%2C%22testId%22%3A%22456500%22%7D%5D%2C%22ADFOX_RELOAD_IF_AD_WAS_SEEN%22%3A%5B%7B%22value%22%3A%22ctl%22%2C%22testId%22%3A%22456500%22%7D%5D%2C%22PCODEVER%22%3A%5B%7B%22value%22%3A%2249004%22%2C%22testId%22%3A%22458066%22%7D%5D%2C%22SMART_BANNER_HIDEABLE_BUTTONS%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22440126%22%7D%5D%2C%22SMART_QUEUE%22%3A%5B%7B%22value%22%3A%22queue_full%22%2C%22testId%22%3A%22457847%22%7D%5D%7D&use-server-side-rendering=1&server-side-rendering-enabled-formats=zen%0Azen2%0Azen2-gallery%0Abillboard%0Ahorizontal%0Ahorizontal0318%0AadaptiveConstructor%0AmodernAdaptive%0AposterCarousel%0AadaptiveCarousel%0Asmart_tile&price-disabled-formats=adaptive0418%0Aadaptive%0AmodernAdaptive%0Ahorizontal%0Ahorizontal0318%0Agrid%0A160x600%0A240x400%0A200x300%0A300x300%0A300x250%0A250x250%0A728x90%0A1000x120%0A320x50%0A320x100%0A400x240%0A320x480%0A480x320%0A336x280%0A300x600%0A300x500%0A970x250%0A970x90%0AposterVertical%0AposterHorizontal%0AposterCarousel%0AposterVertical%0AposterHorizontal%0AposterCarousel&raw-smart-content=1&smart-format-names=smart-banner-adaptive_v1%0Asmart-banner-mosaic_v1&pcode-icookie=9ZnCuKhqaHflVazmG5IiIJ8WjY7h%2BM92qtSigr60ONrsLdKazRyABdbuNLRkoBqa1iqQnrdthj6J0Q%2FW0wle4usyJro%3D&grab-orig-len=1028&grab=dNCk0L7RgNC10LrRgSDQvdCwIFByb0ZpbmFuY2UuUnUuINCa0YPRgNGB0Ysg0LLQsNC70Y7Rgi4g0J_RgNC-0LPQvdC-0LfRiyDQstCw0LvRjtGC0L3QvtCz0L4g0YDRi9C90LrQsC4KMiDQoNC10LTQsNC60YbQuNGPIMK3INCg0LXQutC70LDQvNCwIMK3INCa0L7QvdGC0LDQutGC0YsgCjIg0JrQvtGC0LjRgNC-0LLQutC4IMK3INCa0L7RgtC40YDQvtCy0LrQuCDQvtC90LvQsNC50L0gwrcg0JPRgNCw0YTQuNC60Lggwrcg0JPRgNCw0YTQuNC60Lgg0L7QvdC70LDQudC9IMK3INCY0L3RhNC-0YDQvNC10YDRiyAtINCa0YPRgNGBINCy0LDQu9GO0YIg0KbQkSDQuCDQpNC-0YDQtdC60YEgCjIg0JrQvtGC0LjRgNC-0LLQutC4INCy0LDQu9GO0YIgwrcg0JrRg9GA0YEg0LTQvtC70LvQsNGA0LAg0Log0YDRg9Cx0LvRjiDCtyDQmtGD0YDRgSDQtdCy0YDQviDQuiDRgNGD0LHQu9GOIMK3INCa0YPRgNGB0Ysg0LLQsNC70Y7RgiDQuiDRgNGD0LHQu9GOIMK3INCa0L7RgtC40YDQvtCy0LrQuCDQsNC60YbQuNC5IMK3INCd0LXRhNGC0Ywgwrcg0JfQvtC70L7RgtC-IMK3INCR0LjRgtC60L7QuNC9IMK3INCd0LXRhNGC0YwgVXJhbHMgCjIg0JDRgNGF0LjQsiDQvdC-0LLQvtGB0YLQtdC5INCy0LDQu9GO0YLQvdC-0LPQviDQuCDRhNC-0L3QtNC-0LLQvtCz0L4g0YDRi9C90LrQsCDCtyDQkNGA0YXQuNCyINGN0LrQvtC90L7QvNC40YfQtdGB0LrQuNGFINC90L7QstC-0YHRgtC10Lkg0Lgg0YHQvtCx0YvRgtC40LkgCjIg0KTQvtGA0LXQutGBINCk0L7RgNGD0LwgCg%3D%3D&tga-with-creatives=1

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

6e7370d59ce4bd24ad3704a243da63eb220fa582bd958038cc8511eaa5bdc479

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
last-modified: Sun, 21 Nov 2021 08:17:23 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-yandex-req-id: 1637482643585736-81109728742322913800317-production-app-host-vla-pcode-40
strict-transport-security: max-age=31536000
content-type: application/json
access-control-allow-origin: https://www.profinance.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 21 Nov 2021 08:17:23 GMT

OPTIONS
H2 200 event_confirmation
an.yandex.ru/ Frame 0
0 137ms
47ms Preflight 2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/event_confirmation

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.profinance.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

timing-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
date: Sun, 21 Nov 2021 08:17:23 GMT
access-control-max-age: 1728000
access-control-allow-headers: content-type
access-control-allow-origin: https://www.profinance.ru
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-encoding: gzip
strict-transport-security: max-age=31536000

POST
H2 200 event_confirmation Show response
an.yandex.ru/ 0
296 B 70ms
69ms XHR
text/plain 2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/event_confirmation

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
last-modified: Sun, 21 Nov 2021 08:17:23 GMT
strict-transport-security: max-age=31536000
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin: https://www.profinance.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 21 Nov 2021 08:17:23 GMT

GET
H2 200 9524 Show response
mc.yandex.com/watch/ 43 B
73 B 46ms
46ms XHR
image/gif 2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/9524?page-url=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&cnt-class=1&browser-info=pv%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3A9ezyymqkmizds872r%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A700%3Acn%3A1%3Adp%3A1%3Als%3A758213256447%3Ahid%3A986956526%3Az%3A0%3Ai%3A20211121081723%3Aet%3A1637482644%3Ac%3A1%3Arn%3A397088485%3Arqn%3A3%3Au%3A1637482643647252450%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Aeu%3A1%3Ans%3A1637482642181%3Aco%3A0%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1637482644%3At%3A%D0%A4%D0%BE%D1%80%D0%B5%D0%BA%D1%81%20%D0%BD%D0%B0%20ProFinance.Ru.%20%D0%9A%D1%83%D1%80%D1%81%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82.%20%D0%9F%D1%80%D0%BE%D0%B3%D0%BD%D0%BE%D0%B7%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D1%8B%D0%BD%D0%BA%D0%B0.&t=gdpr(14)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:23 GMT
last-modified: Sun, 21-Nov-2021 08:17:23 GMT
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: https://www.profinance.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Sun, 21-Nov-2021 08:17:23 GMT

GET
H2 200 x300
avatars.mds.yandex.net/get-direct/5313224/PGRBwB_XfkIsRXtF6xKLLQ/ 10 KB
11 KB 114ms
37ms Image
image/webp 2a02:6b8::184
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://avatars.mds.yandex.net/get-direct/5313224/PGRBwB_XfkIsRXtF6xKLLQ/x300
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a02:6b8::184 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software: nginx /
Resource Hash: 0626f064e3bc528bf3ca8a8d42abdb95102a32941e805b91c83bc49329a5e3ce

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
last-modified: Wed, 22 Sep 2021 10:44:24 GMT
server: nginx
nel: {"report_to": "network-errors", "max_age": 600, "success_fraction": 0.001, "failure_fraction": 0.01}
report-to: {"group": "network-errors", "max_age": 600, "endpoints": [ { "url": "https://dr.yandex.net/s3_nel"}]}
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=604800,immutable
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 10536
x-request-id: 42015a588a006fcb

GET
H2 200 y300
avatars.mds.yandex.net/get-direct/4576471/DjlvSzuimUl3t8gmvEsPUA/ 11 KB
11 KB 114ms
38ms Image
image/webp 2a02:6b8::184
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://avatars.mds.yandex.net/get-direct/4576471/DjlvSzuimUl3t8gmvEsPUA/y300
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a02:6b8::184 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software: nginx /
Resource Hash: f5737d03b8ab39fead5245d364588723fa5a5e3316b66d3efc40e8b0de976ac5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
last-modified: Wed, 11 Aug 2021 14:14:17 GMT
server: nginx
nel: {"report_to": "network-errors", "max_age": 600, "success_fraction": 0.001, "failure_fraction": 0.01}
report-to: {"group": "network-errors", "max_age": 600, "endpoints": [ { "url": "https://dr.yandex.net/s3_nel"}]}
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000,immutable
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 10864
x-request-id: a867bec63dd2bd4

GET
H2 200 x300
avatars.mds.yandex.net/get-direct/225309/addSm6e82LUuQ6Xl04EG8Q/ 14 KB
14 KB 114ms
38ms Image
image/webp 2a02:6b8::184
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://avatars.mds.yandex.net/get-direct/225309/addSm6e82LUuQ6Xl04EG8Q/x300
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a02:6b8::184 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software: nginx /
Resource Hash: cc49433eff175de8a4e21dc4358b4d76945221a6a08cbaece2514ca09ee0dcd2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
last-modified: Wed, 09 Jan 2019 07:52:31 GMT
server: nginx
nel: {"report_to": "network-errors", "max_age": 600, "success_fraction": 0.001, "failure_fraction": 0.01}
report-to: {"group": "network-errors", "max_age": 600, "endpoints": [ { "url": "https://dr.yandex.net/s3_nel"}]}
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=31536000,immutable
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 14164
x-request-id: 476d2be1fc3301e5

GET
H2 200 render.html Show response
yastatic.net/safeframe-bundles/0.83/1-1-0/ Frame BE53 24 KB
7 KB 134ms
44ms Document
text/html 2a02:6b8:20::215
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/safeframe-bundles/0.83/1-1-0/render.html

Requested by

Host: yastatic.net
URL: https://yastatic.net/safeframe-bundles/0.83/host.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

9c911ab93cf6099aeeddb19cb1903d0ef838329443c3a0549c754da47f90a70a

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

server: nginx/1.17.9
date: Sun, 21 Nov 2021 08:17:23 GMT
content-type: text/html
content-length: 6262
access-control-allow-origin: *
cache-control: public, max-age=946708560
content-encoding: br
etag: "eb77de48712912aadc9aa8171ac75ede"
expires: Tue, 21 Nov 2051 14:48:48 GMT
last-modified: Wed, 03 Nov 2021 13:42:58 GMT
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
strict-transport-security: max-age=43200000; includeSubDomains;
timing-allow-origin: *
vary: Accept-Encoding
x-robots-tag: noindex, noarchive, nofollow
accept-ranges: bytes

GET
H/1.1

200
OK

/
sync3.sniperlog.ru/ Frame 5D9F
Redirect Chain

https://sync.bumlam.com/?src=aid0
https://x01.aidata.io/0.gif?pid=ADSNIPER&id=745c2c22-4aa3-11ec-a6e9-002590c82437
https://x01.aidata.io/0.gif?pid=ADSNIPER&id=745c2c22-4aa3-11ec-a6e9-002590c82437&bounce=1
https://sync.bumlam.com/?src=aid1&uid=AGOQCT5D0W8OlHuu3aFRAg&
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_cm&extra1=AGOQCT5D0W8OlHuu3aFRAg&extra2=aidata
https://sync3.sniperlog.ru/?src=ggl&extra1=AGOQCT5D0W8OlHuu3aFRAg&extra2=aidata&google_gid=CAESEID2CBUsYdoSHxOowkuTFgc&google_cver=1

43 B
516 B

68ms
7ms

Image
image/gif

31.172.81.160
DE-FIRSTCOLO www....

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync3.sniperlog.ru/?src=ggl&extra1=AGOQCT5D0W8OlHuu3aFRAg&extra2=aidata&google_gid=CAESEID2CBUsYdoSHxOowkuTFgc&google_cver=1
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: HTTP/1.1
Server: 31.172.81.160 Muehlheim am Main, Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cache.betweendigital.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Sun, 21 Nov 2021 08:17:23 GMT
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate, s-maxage=0
Server: nginx
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Redirect headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:23 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync3.sniperlog.ru/?src=ggl&extra1=AGOQCT5D0W8OlHuu3aFRAg&extra2=aidata&google_gid=CAESEID2CBUsYdoSHxOowkuTFgc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 345
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 event_confirmation
an.yandex.ru/ Frame 0
0 48ms
47ms Preflight 2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/event_confirmation

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.profinance.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

timing-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
date: Sun, 21 Nov 2021 08:17:23 GMT
access-control-max-age: 1728000
access-control-allow-headers: content-type
access-control-allow-origin: https://www.profinance.ru
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-encoding: gzip
strict-transport-security: max-age=31536000

POST
H2 200 event_confirmation Show response
an.yandex.ru/ 0
51 B 64ms
64ms XHR
text/plain 2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/event_confirmation

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
last-modified: Sun, 21 Nov 2021 08:17:23 GMT
strict-transport-security: max-age=31536000
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin: https://www.profinance.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 21 Nov 2021 08:17:23 GMT

GET
H2 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/ Frame ADB8 24 KB
6 KB 37ms
13ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8940ae07bce3a0ebfe919bb1a2e29e7667be5330d17efc556f51a8c863783e43

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
timing-allow-origin: *
date: Fri, 19 Nov 2021 07:22:13 GMT
expires: Sat, 19 Nov 2022 07:22:13 GMT
last-modified: Sun, 22 Aug 2021 12:21:40 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 4663
age: 176110
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 3720 0
0 50ms
49ms Fetch
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CPh1vkwCaYbmnCca17gO_rajIBp7jxvVllKfK6voNnf2F8NQIEAEg5pyMaWCV-vCBjAegAb6Dh6MDyAEJqAMByANIqgTOAU_QccDqmT_1FywS1r5SLxaUegNt7sNrbI8rUgoIjv3t_SivoLWDEZsZcJUYCaF65yC5NW_-mUzhBzrpH20SeCPtgqJev9CaINWRgQczIl_7o_EfS5E0Xp6AM2apnS7J94MkmxRxwjdy-8Nffm2pmORDqHMcF1XlNc7tvSp97IK4JuZe2ruqyDbRnaTMmifHCwBKRRVdVmcR_OUr2cOygKcnD0De6m0h0v1H8Uw3_TQRgsbQqsx_QqL5hDQVtOukfyv6MM-gBuy8gejnzytmwASa0trc3AOSBQQIBBgBkgUECAUYBKAGLoAHqvz4XKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcEEOfjbtIICQiA4YAQEAEYX4AKAcgLAdgTDYgUAtAVAYAXAbIXHAoaCAASFHB1Yi0yMjE1OTY3Mzg5OTUxMDYwGAA&sigh=JM2ptpez5N8&uach_m=[UACH]&template_id=419

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9865432956&adk=870026366&adf=2297262845&pi=t.ma~as.9865432956&w=240&lmt=1637482624&psa=0&format=240x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643031&bpp=1&bdt=269&idt=94&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=580x400&correlator=4749937713146&frm=20&pv=1&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1345&ady=67&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=L1WxLcXsQE&p=https%3A//www.profinance.ru&dtd=97
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 21 Nov 2021 08:17:23 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 21 Nov 2021 08:17:23 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 3720 19 KB
8 KB 30ms
8ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9865432956&adk=870026366&adf=2297262845&pi=t.ma~as.9865432956&w=240&lmt=1637482624&psa=0&format=240x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643031&bpp=1&bdt=269&idt=94&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=580x400&correlator=4749937713146&frm=20&pv=1&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1345&ady=67&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=L1WxLcXsQE&p=https%3A//www.profinance.ru&dtd=97

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 330
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Dec 2021 08:11:53 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 3720 2 KB
1 KB 35ms
13ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 07:59:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1050
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Dec 2021 07:59:53 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3720 119 KB
37 KB 49ms
24ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 21 Nov 2021 08:17:23 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 3720 15 KB
6 KB 31ms
9ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:14:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 144
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Dec 2021 08:14:59 GMT

GET
H/1.1 200
Ok d.png
ysa-static.passport.yandex.ru/static/1/d959d7e39d5067fad30d9c06204866e9/ Frame BE53 95 B
400 B 144ms
45ms Image
image/png 2a02:6b8::5:114
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ysa-static.passport.yandex.ru/static/1/d959d7e39d5067fad30d9c06204866e9/d.png?ex=yes

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::5:114 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

18c327afa903633f86c3efcf12b77f098077eacaa8be101bb007846fd74f8b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Sun, 21 Nov 2021 08:17:23 GMT
Server: nginx/1.14.2
Strict-Transport-Security: max-age=315360000; includeSubDomains
X-RT-IH: 0.0002
Content-Type: image/png
Cache-Control: private
Connection: close
X-RT-IQ: 0.0001
Content-Length: 95
Expires: Mon, 22 Nov 2021 08:17:23 GMT

GET
H2

200

/
an.yandex.ru/mapuid/ditmsk/ Frame BE53
Redirect Chain

https://stats.mos.ru/gc/ynd/
https://an.yandex.ru/mapuid/ditmsk/?time=1637482643.927

43 B
152 B

65ms
64ms

Image
image/gif

2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/ditmsk/?time=1637482643.927

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
last-modified: Sun, 21 Nov 2021 08:17:24 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 21 Nov 2021 08:17:24 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/ditmsk/?time=1637482643.927
date: Sun, 21 Nov 2021 08:17:23 GMT
server: nginx
content-length: 145
content-type: text/html

GET
H2

200

spixel.php
sonar.semantiqo.com/983we/ Frame BE53
Redirect Chain

https://sonar.semantiqo.com/dmp/scr.php
https://counter.yadro.ru/id127/reff-id.gif?sid=200a2a5733e24da09c51d742c90219b2
https://sonar.semantiqo.com/fbfli/data_sess_sync.php?spid=85EDB671FCCA0060&sid=200a2a5733e24da09c51d742c90219b2
https://cdn3.caltat.com/fbfc504c-89b0-4a80-bef4-c8e39daeee6f/sess.php?sid=200a2a5733e24da09c51d742c90219b2&spid=85EDB671FCCA0060&v=
https://sync.magnitent.com/fbfli/ct_sync.php?ct=db23968d0c9244889ae670108adf59a5&sonar=200a2a5733e24da09c51d742c90219b2&spid=85EDB671FCCA0060&v=
https://redirect.frontend.weborama.fr/rd?url=https%3A%2F%2Fsonar.semantiqo.com%2F983we%2Fspixel.php%3Fsid%3D200a2a5733e24da09c51d742c90219b2%26c%3Ddb23968d0c9244889ae670108adf59a5%26w%3D={WEBO_CID}
https://sonar.semantiqo.com/983we/spixel.php?sid=200a2a5733e24da09c51d742c90219b2&c=db23968d0c9244889ae670108adf59a5&w==Kua8/7Y6CNyeZBfyg77upO

0
355 B

43ms
43ms

Image
text/html

95.217.109.66
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sonar.semantiqo.com/983we/spixel.php?sid=200a2a5733e24da09c51d742c90219b2&c=db23968d0c9244889ae670108adf59a5&w==Kua8/7Y6CNyeZBfyg77upO
Protocol: H2
Server: 95.217.109.66 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.66.109.217.95.clients.your-server.de
Software: nginx/1.20.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
server: nginx/1.20.1
mode: no-cors
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: Access-Control-Allow-Headers, Origin,Accept, x-compress, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers

Redirect headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
via: 1.1 google
last-modified: Sun, 21 Nov 2021 08:17:24 GMT
server: nginx/1.12.0
location: https://sonar.semantiqo.com/983we/spixel.php?sid=200a2a5733e24da09c51d742c90219b2&c=db23968d0c9244889ae670108adf59a5&w==Kua8/7Y6CNyeZBfyg77upO
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Tue, 03 Jul 2001 06:00:00 GMT

GET
H/1.1 200
OK sync.cgi
ssp.adriver.ru/cgi-bin/ Frame BE53 42 B
201 B 313ms
80ms Image
image/gif 81.222.128.213
ELTEL-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssp.adriver.ru/cgi-bin/sync.cgi?dsp_id=109
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.222.128.213 , Russian Federation, ASN20597 (ELTEL-AS, RU),
Reverse DNS: ad13.adriver.ru
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Sun, 21 Nov 2021 08:17:24 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: image/gif

GET
H2

200

spacer.gif
an.yandex.ru/resource/ Frame BE53
Redirect Chain

https://an.yandex.ru/mapuid/google/
https://cm.g.doubleclick.net/pixel?google_nid=yandexru&google_hm=9039DC576DC58715&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
https://an.yandex.ru/resource/spacer.gif

43 B
135 B

67ms
64ms

Image
image/gif

2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/resource/spacer.gif

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
last-modified: Wed, 18 Apr 2001 10:28:03 GMT
strict-transport-security: max-age=31536000
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif
x-xss-protection: 1; mode=block
expires: Sun, 06 Nov 2022 08:17:23 GMT

Redirect headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:23 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://an.yandex.ru/resource/spacer.gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 237
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

5LCg54p-4KQ196F7-rfK
an.yandex.ru/mapuid/dmpamberdata/ Frame BE53
Redirect Chain

https://dmg.digitaltarget.ru/1/119/i/i?i=1637482643
https://dmg.digitaltarget.ru/awg/custom/119/i/i?call_source=awg&i=1637482643
https://an.yandex.ru/mapuid/dmpamberdata/5LCg54p-4KQ196F7-rfK

43 B
80 B

65ms
65ms

Image
image/gif

2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/dmpamberdata/5LCg54p-4KQ196F7-rfK

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
last-modified: Sun, 21 Nov 2021 08:17:24 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 21 Nov 2021 08:17:24 GMT

Redirect headers

Date: Sun, 21 Nov 2021 08:17:24 GMT
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Server: nginx
X-Frame-Options: DENY
Access-Control-Allow-Methods: GET, POST, OPTIONS
Location: https://an.yandex.ru/mapuid/dmpamberdata/5LCg54p-4KQ196F7-rfK
X-XSS-Protection: 1; mode=block
X-Permitted-Cross-Domain-Policies: master-only
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 86400
Connection: keep-alive
Request-Time: 6
Content-Length: 0
X-Content-Type-Options: nosniff

GET
H2

200

-mq_4tg-4Elf
an.yandex.ru/mapuid/dmpsegmento/ Frame BE53
Redirect Chain

https://yandex-dmp-sync.rutarget.ru/sync
https://an.yandex.ru/mapuid/dmpsegmento/-mq_4tg-4Elf?sign=2039831926

43 B
80 B

84ms
84ms

Image
image/gif

2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/dmpsegmento/-mq_4tg-4Elf?sign=2039831926

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
last-modified: Sun, 21 Nov 2021 08:17:24 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 21 Nov 2021 08:17:24 GMT

Redirect headers

Location: https://an.yandex.ru/mapuid/dmpsegmento/-mq_4tg-4Elf?sign=2039831926
Date: Sun, 21 Nov 2021 08:17:24 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
P3P: CP="This is not a P3P policy. Please visit http://rutarget.ru/p3p/ to get more information."

GET
H2

200

LvuCPyUdHkde
an.yandex.ru/mapuid/rutargetis/ Frame BE53
Redirect Chain

https://yandex-sync.rutarget.ru/sync
https://an.yandex.ru/mapuid/rutargetis/LvuCPyUdHkde

43 B
80 B

81ms
80ms

Image
image/gif

2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/rutargetis/LvuCPyUdHkde

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
last-modified: Sun, 21 Nov 2021 08:17:24 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 21 Nov 2021 08:17:24 GMT

Redirect headers

Location: https://an.yandex.ru/mapuid/rutargetis/LvuCPyUdHkde
Date: Sun, 21 Nov 2021 08:17:24 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
P3P: CP="This is not a P3P policy. Please visit http://rutarget.ru/p3p/ to get more information."

GET
H2

200

AGOQCT5D0W8OlHuu3aFRAg
an.yandex.ru/mapuid/dmpaidatame/ Frame BE53
Redirect Chain

https://x01.aidata.io/0.gif?pid=YANDEX
https://an.yandex.ru/mapuid/dmpaidatame/AGOQCT5D0W8OlHuu3aFRAg?sign=1054776853

43 B
101 B

67ms
67ms

Image
image/gif

2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/dmpaidatame/AGOQCT5D0W8OlHuu3aFRAg?sign=1054776853

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
last-modified: Sun, 21 Nov 2021 08:17:23 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 21 Nov 2021 08:17:23 GMT

Redirect headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:23 GMT
last-modified: Sun, 21 Nov 2021 08:17:22 GMT
server: nginx
access-control-allow-methods: GET, POST
p3p: CP='NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA'
location: https://an.yandex.ru/mapuid/dmpaidatame/AGOQCT5D0W8OlHuu3aFRAg?sign=1054776853
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Sun, 21 Nov 2021 08:17:22 GMT

GET
H2

200

74999670-4aa3-11ec-8677-901b0e934d81
an.yandex.ru/mapuid/dmpcleverdata/ Frame BE53
Redirect Chain

https://sync.1dmp.io/pixel.gif?cid=3cbc2ec8-1421-4677-89fe-2ac6fc52a09a&pid=w&o=au
https://sync.1dmp.io/pixel.gif?cid=3cbc2ec8-1421-4677-89fe-2ac6fc52a09a&pid=w&o=au&cs=1
https://an.yandex.ru/mapuid/dmpcleverdata/74999670-4aa3-11ec-8677-901b0e934d81?sign=691522040

43 B
80 B

66ms
65ms

Image
image/gif

2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/dmpcleverdata/74999670-4aa3-11ec-8677-901b0e934d81?sign=691522040

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
last-modified: Sun, 21 Nov 2021 08:17:23 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 21 Nov 2021 08:17:23 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/dmpcleverdata/74999670-4aa3-11ec-8677-901b0e934d81?sign=691522040
date: Sun, 21 Nov 2021 08:17:23 GMT
cache-control: private, no-cache, no-store, no-cache=Set-Cookie, proxy-revalidate, private, no-cache, no-store, no-cache=Set-Cookie, proxy-revalidate
server: nginx
content-length: 0
expires: 0, 0

GET
H2

200

7Y6CNyeZBfyg77upO
an.yandex.ru/mapuid/dmpweborama/Kua8/ Frame BE53
Redirect Chain

https://redirect.frontend.weborama.fr/redirect/standard?url=https://an.yandex.ru/mapuid/dmpweborama/{WEBO_CID}
https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fdmpweborama%2F%7BWEBO_CID%7D&bounce=1&random=4098449766
https://an.yandex.ru/mapuid/dmpweborama/Kua8/7Y6CNyeZBfyg77upO

43 B
80 B

67ms
67ms

Image
image/gif

2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/dmpweborama/Kua8/7Y6CNyeZBfyg77upO

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
last-modified: Sun, 21 Nov 2021 08:17:24 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 21 Nov 2021 08:17:24 GMT

Redirect headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
via: 1.1 google
last-modified: Sun, 21 Nov 2021 08:17:24 GMT
server: nginx/1.12.0
location: https://an.yandex.ru/mapuid/dmpweborama/Kua8/7Y6CNyeZBfyg77upO
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Tue, 03 Jul 2001 06:00:00 GMT

GET
H2

200

/
an.yandex.ru/mapuid/ramblerssp/ Frame BE53
Redirect Chain

https://profile.ssp.rambler.ru/sync3.302?pid=188
https://an.yandex.ru/mapuid/ramblerssp/

43 B
80 B

68ms
68ms

Image
image/gif

2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/ramblerssp/

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
last-modified: Sun, 21 Nov 2021 08:17:24 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 21 Nov 2021 08:17:24 GMT

Redirect headers

date: Sun, 21 Nov 2021 08:17:23 GMT
server: nginx
strict-transport-security: max-age=0
p3p: policyref="/w3c/p3p.xml", CP="NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA"
location: //an.yandex.ru/mapuid/ramblerssp/
x-passed: 0bal1
content-type: application/x-javascript; charset=Windows-1251
content-length: 0

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame BE53
Redirect Chain

https://an.yandex.ru/mapuid/adobedmp/
https://dpm.demdex.net/ibs:dpid=423652&dpuuid=4448C936A772D434
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=423652&dpuuid=4448C936A772D434

42 B
945 B

35ms
35ms

Image
image/gif

52.208.121.178
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=423652&dpuuid=4448C936A772D434

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

HTTP/1.1

Server

52.208.121.178 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-208-121-178.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v019-0fd187a7f.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: QZ3CtFI+STE=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v019-06aa8172b.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: bOTJ8MqrTbs=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=423652&dpuuid=4448C936A772D434
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 204 yandexdmp-match
dm.hybrid.ai/ Frame BE53 0
238 B 171ms
56ms Image
text/plain 37.18.16.23
HYBRID-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dm.hybrid.ai/yandexdmp-match

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

37.18.16.23 , Netherlands, ASN205675 (HYBRID-AS, RU),

Reverse DNS

Software

Hybrid Web Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
server: Hybrid Web Server
p3p: CP="NOI DSP COR CUR ADMa DEVo TAIo PSAo PSDo IVAo IVDo OUR IND COM NAV INT STA OTC"
access-control-allow-origin: *
cache-control: no-cache, no-store
x-mode: 106
x-xss-protection: 1; mode=block
expires: -1

GET
H2

200

a378063c59ff0390bfb04bb09492a88fd18729db0569565ff416cb007d11284a
an.yandex.ru/mapuid/mediascope/ Frame BE53
Redirect Chain

https://cm.tns-counter.ru/yacm
https://an.yandex.ru/mapuid/mediascope/a378063c59ff0390bfb04bb09492a88fd18729db0569565ff416cb007d11284a

43 B
80 B

81ms
81ms

Image
image/gif

2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/mediascope/a378063c59ff0390bfb04bb09492a88fd18729db0569565ff416cb007d11284a

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
last-modified: Sun, 21 Nov 2021 08:17:24 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 21 Nov 2021 08:17:24 GMT

Redirect headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
server: ms-counter-3.2.14/1.20.1
content-type: text/html
location: https://an.yandex.ru/mapuid/mediascope/a378063c59ff0390bfb04bb09492a88fd18729db0569565ff416cb007d11284a
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate
timing-allow-origin: *
content-length: 0
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2

200

4868825d-76cb-4b65-a19c-5246f372c51c
an.yandex.ru/mapuid/upravelis/ Frame BE53
Redirect Chain

https://sync.upravel.com/yandex/sync
https://sync.upravel.com/yandex/sync?session_tpt=eyJoZWFkZXJzIjp7InJlZmVyZXIiOlsiaHR0cHM6Ly95YXN0YXRpYy5uZXQvIl19fQ
https://4868825d-76cb-4b65-a19c-5246f372c51c.sync.upravel.com/yandex/sync?ud_tpt=eyJoZWFkZXJzIjp7InJlZmVyZXIiOlsiaHR0cHM6Ly95YXN0YXRpYy5uZXQvIiwiaHR0cHM6Ly95YXN0YXRpYy5uZXQvIl19fQ
https://an.yandex.ru/mapuid/upravelis/4868825d-76cb-4b65-a19c-5246f372c51c

43 B
80 B

65ms
65ms

Image
image/gif

2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/upravelis/4868825d-76cb-4b65-a19c-5246f372c51c

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
last-modified: Sun, 21 Nov 2021 08:17:24 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 21 Nov 2021 08:17:24 GMT

Redirect headers

date: Sun, 21 Nov 2021 08:17:24 GMT
server: nginx
location: https://an.yandex.ru/mapuid/upravelis/4868825d-76cb-4b65-a19c-5246f372c51c
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-credentials: false
content-type: image/png
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9977 143 B
163 B 7ms
7ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9865432956&adk=870026366&adf=2297262845&pi=t.ma~as.9865432956&w=240&lmt=1637482624&psa=0&format=240x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643031&bpp=1&bdt=269&idt=94&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=580x400&correlator=4749937713146&frm=20&pv=1&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1345&ady=67&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=L1WxLcXsQE&p=https%3A//www.profinance.ru&dtd=97

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 21 Nov 2021 08:02:14 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 909
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame ADB8 9 KB
3 KB 27ms
9ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sat, 20 Nov 2021 16:08:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58132
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 21 Nov 2021 16:08:31 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame ADB8 26 KB
10 KB 24ms
7ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sat, 20 Nov 2021 16:13:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57824
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 21 Nov 2021 16:13:39 GMT

GET
H3 200 e44a1870dde377916acf726604a31357.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/ Frame ADB8 75 KB
19 KB 26ms
9ms Script
application/x-javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/e44a1870dde377916acf726604a31357.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b6b18a504ddf391b93dc00363f531252279897fae1e63c430e7ce198c02847c

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 317803
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19646
x-xss-protection: 0
last-modified: Sun, 22 Aug 2021 12:21:40 GMT
server: sffe
date: Wed, 17 Nov 2021 16:00:40 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 17 Nov 2022 16:00:40 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9977
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

65ms
63ms

Document
text/html

2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 21 Nov 2021 08:17:24 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 21 Nov 2021 08:17:24 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 21 Nov 2021 08:17:23 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 3720 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 400b3546b00dc904403e7922e825533b8dca24eab88fe3fdc6c1102c32d52820

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame 2A39 77 KB
26 KB 38ms
20ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e0d71e9e83d526a320cdee881361d1abcf386a92a21c116a31976690453bc75c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1050 / 485 of 1000 / last-modified: 1637363240"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26883
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 21 Nov 2021 08:17:23 GMT

GET
H2 204 event
ads.adfox.ru/341266/ 0
230 B 200ms
82ms Image
text/plain 77.88.21.179
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.adfox.ru/341266/event?pm=bmo&hash=9663945f7afba1fc&duid=1637482643647252450&pxo=Oib-n9LedjHurYZjDI3JFf9gvAZ2wXrUCwkUaoVOZau-l4OzXqsAqhQy43lhzHiCmDVkw2vh82RFfauFZcYiNXTIQ1GUlIm_qVudFZ2lyaRhPNZJrTNpHCVLRhGllDD8EByB9mklYQxclQapt_g5EPuOmMnUQ3kAMrvp7GWUWgyS5abvPXPC&p5=inscz&rand=ercjlui&sj=u0afF_EeO4o94xUzHSZ5ECoh9RBZ45aUXtDykfgT-Wx-C3I61XhSTW7f0MX7jA%3D%3D&ad-session-id=6873661637482643189&lts=fhvhvpr&ytt=481586629969941&ybv=0.49004&ylv=0.49004&dl=https%3A%2F%2Fwww.profinance.ru%2F&pr=fcvauhk&p1=cmmml&rqs=k9TiEQqlpzGTAJphX61bFvkezBGFvQnT&rtb-si=b&p2=gyqo

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

77.88.21.179 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

adfox-external-l3-engine.stable.qloud-b.yandex.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 21 Nov 2021 08:17:24 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
expires: Mon, 04 Dec 1999 21:29:02 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame ADB8 7 KB
833 B 56ms
16ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Oswald:400|Oswald:500|Roboto:400|Roboto:700

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/e44a1870dde377916acf726604a31357.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

31373fcf3a18f623c7acf57123c03a99e7235431585e35e222c6f2a456cef2d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 21 Nov 2021 08:10:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 21 Nov 2021 08:17:23 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 21 Nov 2021 08:17:23 GMT

GET
H3 200 cc842de60e04652eeec3d531b1b88d01.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/ Frame ADB8 45 KB
45 KB 13ms
11ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/cc842de60e04652eeec3d531b1b88d01.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79892653898c36fc21eacb8652255051534e9773146a556973aacf6a2c00e1a4

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 355331
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46386
x-xss-protection: 0
last-modified: Sun, 22 Aug 2021 12:21:40 GMT
server: sffe
date: Wed, 17 Nov 2021 05:35:12 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 17 Nov 2022 05:35:12 GMT

GET
H3 200 9322b6ab99a86c0135aa121cf7035855.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/ Frame ADB8 9 KB
9 KB 11ms
9ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/9322b6ab99a86c0135aa121cf7035855.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

16897a2019e175ddd7d60216ddbc439a3bb1cd69f4730f9b65825caeb6a83cf0

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 301734
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8900
x-xss-protection: 0
last-modified: Sun, 22 Aug 2021 12:21:40 GMT
server: sffe
date: Wed, 17 Nov 2021 20:28:29 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 17 Nov 2022 20:28:29 GMT

GET
H3 200 11a33c765c5dcad9875759072cdc0129.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/ Frame ADB8 20 KB
20 KB 16ms
14ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/11a33c765c5dcad9875759072cdc0129.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07c0c8f2507c084364c734ac87603da7b5659992547e8efdee4914b2955e9872

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 317052
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20883
x-xss-protection: 0
last-modified: Sun, 22 Aug 2021 12:21:40 GMT
server: sffe
date: Wed, 17 Nov 2021 16:13:11 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 17 Nov 2022 16:13:11 GMT

GET
H3 200 cefa96b6a4640e96d7c61877e4854843.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/ Frame ADB8 6 KB
3 KB 24ms
23ms Image
image/svg+xml 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/cefa96b6a4640e96d7c61877e4854843.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3adb195b62e3b1173810fb5c8012622a5837dbb74acd708d64688d1d8f2c32d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 421073
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2683
x-xss-protection: 0
last-modified: Sun, 22 Aug 2021 12:21:40 GMT
server: sffe
date: Tue, 16 Nov 2021 11:19:30 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 16 Nov 2022 11:19:30 GMT

GET
H3 200 4f0e013dd724e608af80d0ae9eea42c2.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/ Frame ADB8 3 KB
985 B 26ms
25ms Image
image/svg+xml 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/4f0e013dd724e608af80d0ae9eea42c2.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

00b8057748cb1a1ffe57065edefeb4da34edead26d8546e1f782074502e8ac98

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 178537
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 955
x-xss-protection: 0
last-modified: Sun, 22 Aug 2021 12:21:40 GMT
server: sffe
date: Fri, 19 Nov 2021 06:41:46 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 19 Nov 2022 06:41:46 GMT

GET
H3 200 3cc5fbf40214b9fd7294f5dcbad66e6f.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/ Frame ADB8 2 KB
2 KB 29ms
27ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/3cc5fbf40214b9fd7294f5dcbad66e6f.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2687a9ff78a0ba6437a6c692111f9d22f9cd59341b63ccb2eb543050415b8de7

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 316750
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2529
x-xss-protection: 0
last-modified: Sun, 22 Aug 2021 12:21:40 GMT
server: sffe
date: Wed, 17 Nov 2021 16:18:13 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 17 Nov 2022 16:18:13 GMT

GET
H3 200 211f221ecbbcad2b3fe644e4e3eb79fb.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/ Frame ADB8 3 KB
3 KB 27ms
25ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/211f221ecbbcad2b3fe644e4e3eb79fb.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e90c764ee39f9c708d904f3e8a02be12c7dce80d20370af741cd069107a1befe

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 389845
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3521
x-xss-protection: 0
last-modified: Sun, 22 Aug 2021 12:21:40 GMT
server: sffe
date: Tue, 16 Nov 2021 19:59:58 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 16 Nov 2022 19:59:58 GMT

GET
H3 200 31bda189c8553ad8388319b49c8dc2fb.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/ Frame ADB8 2 KB
2 KB 26ms
24ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/31bda189c8553ad8388319b49c8dc2fb.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b04971f034aaa7d11ff261dfb9de37579a97210eca29ceeaf3d696fce13857e6

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 317803
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2232
x-xss-protection: 0
last-modified: Sun, 22 Aug 2021 12:21:40 GMT
server: sffe
date: Wed, 17 Nov 2021 16:00:40 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 17 Nov 2022 16:00:40 GMT

GET
H3 200 0deb51c44d112eb9ac2b80d4c2d0b649.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/ Frame ADB8 3 KB
3 KB 27ms
26ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/media/0deb51c44d112eb9ac2b80d4c2d0b649.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/1591624239863002377/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d24fbeca7e243636b98cd2a0245a752ce002a6974b164ce6e75de44f1c286174

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 393342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3194
x-xss-protection: 0
last-modified: Sun, 22 Aug 2021 12:21:40 GMT
server: sffe
date: Tue, 16 Nov 2021 19:01:41 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 16 Nov 2022 19:01:41 GMT

GET
H2 200 548bdb63b969e5c27f75e62faf543d70.js Show response
www.gstatic.com/mysidia/ Frame EA8B 7 KB
4 KB 43ms
7ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/548bdb63b969e5c27f75e62faf543d70.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1637482624&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643028&bpp=3&bdt=267&idt=78&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=4749937713146&frm=20&pv=2&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=439&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3QXWafL7QZ&p=https%3A//www.profinance.ru&dtd=90

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

541a22e85f3238899f2589d44b9390a8d6d6e193a5d436c10e8ec9ce7b256e76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 18:05:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 310320
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3286
x-xss-protection: 0
last-modified: Thu, 11 Nov 2021 03:03:10 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 15 Feb 2022 18:05:23 GMT

GET
H2 200 e896defd9da58cd70544d59688f4a346.js Show response
www.gstatic.com/mysidia/ Frame EA8B 11 KB
5 KB 43ms
8ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/e896defd9da58cd70544d59688f4a346.js?tag=pingback

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1637482624&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643028&bpp=3&bdt=267&idt=78&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=4749937713146&frm=20&pv=2&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=439&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3QXWafL7QZ&p=https%3A//www.profinance.ru&dtd=90

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

67e6599b9fd28869eb047c72fd7486c191b54a661ec61accdf9b2de87f246ce9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 19 Nov 2021 13:12:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 155074
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4792
x-xss-protection: 0
last-modified: Tue, 16 Nov 2021 04:29:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 17 Feb 2022 13:12:49 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame EA8B 2 KB
1 KB 50ms
15ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1637482624&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643028&bpp=3&bdt=267&idt=78&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=4749937713146&frm=20&pv=2&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=439&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3QXWafL7QZ&p=https%3A//www.profinance.ru&dtd=90

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e89a316ebf1c63ea09e2b7b5889fb55e1ffb326c7b2b172027da0948f5709f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 21 Nov 2021 08:01:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 21 Nov 2021 08:17:23 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 21 Nov 2021 08:17:23 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame EA8B 1 KB
888 B 7ms
6ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1637482624&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643028&bpp=3&bdt=267&idt=78&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=4749937713146&frm=20&pv=2&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=439&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3QXWafL7QZ&p=https%3A//www.profinance.ru&dtd=90

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:10:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 426
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 853
x-xss-protection: 0
server: cafe
etag: 7170004918125193417
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Dec 2021 08:10:17 GMT

GET
H2 200 b85b9965a6c1d8af98ff0fb9e6466ad8.js Show response
www.gstatic.com/mysidia/ Frame EA8B 6 KB
3 KB 41ms
9ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/b85b9965a6c1d8af98ff0fb9e6466ad8.js?tag=analytics_pingback_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1637482624&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643028&bpp=3&bdt=267&idt=78&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=4749937713146&frm=20&pv=2&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=439&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3QXWafL7QZ&p=https%3A//www.profinance.ru&dtd=90

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

64e62b6ed84c308d8011efc4a92b313480ca230a7c2df6e3992aec36d300de37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 17:02:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 400465
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2518
x-xss-protection: 0
last-modified: Thu, 11 Nov 2021 03:03:10 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 14 Feb 2022 17:02:58 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame EA8B 19 KB
8 KB 13ms
11ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1637482624&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643028&bpp=3&bdt=267&idt=78&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=4749937713146&frm=20&pv=2&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=439&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3QXWafL7QZ&p=https%3A//www.profinance.ru&dtd=90

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 330
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Dec 2021 08:11:53 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame EA8B 2 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1637482624&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643028&bpp=3&bdt=267&idt=78&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=4749937713146&frm=20&pv=2&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=439&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3QXWafL7QZ&p=https%3A//www.profinance.ru&dtd=90

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:11:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 370
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Dec 2021 08:11:13 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EA8B 119 KB
36 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1637482624&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643028&bpp=3&bdt=267&idt=78&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=4749937713146&frm=20&pv=2&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=439&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3QXWafL7QZ&p=https%3A//www.profinance.ru&dtd=90

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 21 Nov 2021 08:17:23 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame EA8B 15 KB
6 KB 14ms
12ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1637482624&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643028&bpp=3&bdt=267&idt=78&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=4749937713146&frm=20&pv=2&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=439&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3QXWafL7QZ&p=https%3A//www.profinance.ru&dtd=90

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:12:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 273
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Dec 2021 08:12:50 GMT

GET
H3 200 163b3e9c260ab6fd774ac5b5c6fd1d76.js Show response
www.gstatic.com/mysidia/ Frame EA8B 27 KB
11 KB 25ms
7ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/163b3e9c260ab6fd774ac5b5c6fd1d76.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1637482624&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643028&bpp=3&bdt=267&idt=78&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=4749937713146&frm=20&pv=2&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=439&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3QXWafL7QZ&p=https%3A//www.profinance.ru&dtd=90

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 11:25:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 247886
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11360
x-xss-protection: 0
last-modified: Tue, 16 Nov 2021 04:29:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 16 Feb 2022 11:25:57 GMT

GET
H2 200 pubads_impl_2021111601.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 2A39 344 KB
116 KB 43ms
17ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

sffe /

Resource Hash

3eee78aaf4f9dc8d0d36d3dddbaad9094ace5d91611f9aee6fe0b44b0ed46ccc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 118471
x-xss-protection: 0
last-modified: Tue, 16 Nov 2021 09:34:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 21 Nov 2021 08:17:23 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame EA8B 0
0 51ms
51ms Fetch
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CgBowkwCaYdi3CZST4gHR0YKoB_3thcJm4-z9po0OtIjkzdAnEAEg5pyMaWCV-vCBjAegAeG9gKgCyAEJqQLH11qaggOFPqgDAcgDywSqBMYBT9BufJy_YGQLglbQ1ew-uAOVVEJ1mWfS5ROFsUzAt4mK6RegGSVVVOoTjcz0_fr53lJESDdsvtaK5H3pAAXnHmHuSlBOuNfIjJ7faRQKueQo0IwNoQ09G4eAy-ALFO_oYDgDRxLtfL-_vMKgdXS7p3sK1tUW1hL9wr41sbiFjyURweobrm8GWiYoDSMutOa1dCrDwqRcNAxdiEStFSoJ8pS6tQvTmappMwD0m06f4pv93IR4J9i-Oh6M-5d8O5fzuyKIyhCqwASO5ZaQ0gOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAHrZa4swGoB47OG6gHk9gbqAfulrECqAf-nrECqAemvhvYBwDyBwUQ88TnAdIICQiA4YAQEAEYX4AKAcgLAdgTDtAVAYAXAbIXHAoaCAASFHB1Yi0yMjE1OTY3Mzg5OTUxMDYwGAA&sigh=GhNC8n0tARo&uach_m=[UACH]&template_id=494

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1637482624&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643028&bpp=3&bdt=267&idt=78&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=4749937713146&frm=20&pv=2&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=439&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3QXWafL7QZ&p=https%3A//www.profinance.ru&dtd=90

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1637482624&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643028&bpp=3&bdt=267&idt=78&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=4749937713146&frm=20&pv=2&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=439&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3QXWafL7QZ&p=https%3A//www.profinance.ru&dtd=90
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 21 Nov 2021 08:17:23 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame EA8B 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4f03328df37c79cd4f726e815e789f24edd35d3f43c640520fc8c794fc442357

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2
fonts.gstatic.com/s/roboto/v29/ Frame ADB8 9 KB
9 KB 44ms
14ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Oswald:400|Oswald:500|Roboto:400|Roboto:700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

053508cc4ed1acf7db8ed96deca42ffebfa1669c5cecd62f4415b926d07b5aaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 18:07:18 GMT
x-content-type-options: nosniff
age: 310206
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9544
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:33 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 17 Nov 2022 18:07:18 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu5mxKOzY.woff2
fonts.gstatic.com/s/roboto/v29/ Frame ADB8 9 KB
10 KB 45ms
16ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu5mxKOzY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Oswald:400|Oswald:500|Roboto:400|Roboto:700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8dd3b91ca60e6a0486326c5c275590dd1d753240c2efa9f94730815813997fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 19 Nov 2021 04:11:53 GMT
x-content-type-options: nosniff
age: 187531
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:21 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 19 Nov 2022 04:11:53 GMT

GET
H2 200 TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlSHYjedg.woff2
fonts.gstatic.com/s/oswald/v40/ Frame ADB8 14 KB
14 KB 49ms
19ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/oswald/v40/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlSHYjedg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Oswald:400|Oswald:500|Roboto:400|Roboto:700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fa146d638d3c5f0262a686a32a156520687072962e72008a13c35961f7e2e6ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 19 Nov 2021 04:18:53 GMT
x-content-type-options: nosniff
age: 187111
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14552
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:16:25 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 19 Nov 2022 04:18:53 GMT

GET
H2 200 TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2
fonts.gstatic.com/s/oswald/v40/ Frame ADB8 24 KB
24 KB 45ms
16ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/oswald/v40/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Oswald:400|Oswald:500|Roboto:400|Roboto:700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c21b3dbf862e916d2689453d7f27dcc0539a0239bf323e5f2db397fca0e5d21

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 09:50:41 GMT
x-content-type-options: nosniff
age: 340003
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24080
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:16:47 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 17 Nov 2022 09:50:41 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame ADB8 15 KB
16 KB 32ms
7ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Oswald:400|Oswald:500|Roboto:400|Roboto:700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 19 Nov 2021 13:39:48 GMT
x-content-type-options: nosniff
age: 153456
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 19 Nov 2022 13:39:48 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame ADB8 15 KB
16 KB 30ms
9ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Oswald:400|Oswald:500|Roboto:400|Roboto:700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 17:56:19 GMT
x-content-type-options: nosniff
age: 310865
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 17 Nov 2022 17:56:19 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 372E
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=btwnex&endpoint=eu
https://eus.rubiconproject.com/usync.html?p=btwnex&endpoint=eu

281 B
554 B

31ms
7ms

Document
text/html

23.79.143.124
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=btwnex&endpoint=eu
Requested by: Host: cache.betweendigital.com
URL: https://cache.betweendigital.com/code/bidder_18.html?USER_ID=f9781672-40fe-5345-9b2f-3aa1fab53a32&CACHEBUSTER=821503
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.79.143.124 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-79-143-124.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: about:blank

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 26 Oct 2021 17:01:05 GMT
ETag: "40019-119-5cf446c48f640"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sun, 21 Nov 2021 08:17:24 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?p=btwnex&endpoint=eu
Date: Sun, 21 Nov 2021 08:17:24 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H2 200 ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
fonts.gstatic.com/s/googlesansdisplay/v15/ Frame EA8B 20 KB
21 KB 17ms
17ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesansdisplay/v15/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

475700259e64d480d1a70023e14741bb298a025e338bb608552e2472d4505a65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 09:49:59 GMT
x-content-type-options: nosniff
age: 340045
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20900
x-xss-protection: 0
last-modified: Mon, 19 Apr 2021 22:53:16 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 17 Nov 2022 09:49:59 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ Frame 2A39 107 B
122 B 37ms
22ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.profinance.ru

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 2A39 107 B
122 B 30ms
16ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.profinance.ru

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 2A39 108 KB
36 KB 454ms
437ms XHR
text/plain 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3855780858690825&correlator=2760906842011030&output=ldjh&impl=fifs&eid=31063813%2C31063182&vrg=2021111601&ptt=17&sc=1&sfv=1-0-38&ecs=20211121&iu_parts=21951151498%2Cprofinance.ru%2C970x250quote_show_2&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=970x250&cust_params=Bids%3D40&cookie=ID%3Db046667b4c3d3571-2220cbcad5cb0087%3AT%3D1637482643%3ART%3D1637482643%3AS%3DALNI_MYusOnOylohcs4ULHrf9ST4ZC0fXg&cdm=www.profinance.ru&bc=31&abxe=1&lmt=1637482644&dt=1637482644067&dlt=1637482643852&idt=171&ea=0&frm=23&biw=1600&bih=1200&isw=970&ish=250&oid=2&adxs=315&adys=0&adks=4257258892&ucis=gpjxvu6hou7n&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&url=https%3A%2F%2Fwww.profinance.ru%2F&top=https%3A%2F%2Fwww.profinance.ru%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x250&msz=970x-1&ga_vid=1569288266.1637482644&ga_sid=1637482644&ga_hid=1710387136&ga_fc=false&fws=256&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

8fe6638a360a194c7d72568f9fa8a7f92c196653d5034dadd391a51c57c5b920

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLbt0JqCqfQCFa6A_Qcdw_UOLg&gqi=&layout=/sadbundle/%24csp%253Der3%24/6667110001810498197/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLbt0JqCqfQCFa6A_Qcdw_UOLg&gqi=&layout=/sadbundle/%24csp%253Der3%24/6667110001810498197/index.html
content-encoding: br
x-content-type-options: nosniff
google-creative-id: -1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36659
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
date: Sun, 21 Nov 2021 08:17:24 GMT
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.profinance.ru
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 2A39 12 KB
9 KB 40ms
22ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021111601&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8e5ab963337784ed8115aa123b98bfc07c46779ad2ca0dc1ebd5ff2066d8b845

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9227
x-xss-protection: 0

GET
H2 200 container.html Show response
7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 89BB 6 KB
4 KB 57ms
18ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sun, 21 Nov 2021 08:17:24 GMT
expires: Mon, 21 Nov 2022 08:17:24 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame EA8B 17 KB
18 KB 39ms
12ms Image
image/jpeg 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcSqmTWek047CK4jKpq7bNLKnYyUHVGqiLvIWCTfD4A5lKRdQ4iNQyGtUjOgjQ&usqp=CAI

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e92a72b0961cd5277b96030a6883350446962b996402d06208c0f1ffaeb54db6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 15 Nov 2021 18:20:14 GMT
x-content-type-options: nosniff
age: 482230
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17430
x-xss-protection: 0
last-modified: Tue, 28 Sep 2021 07:16:01 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Tue, 15 Nov 2022 18:20:14 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame EA8B 18 KB
18 KB 55ms
13ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcSOivngbUdauqf8u2oDFrnWSP3M3620txj7AAiHlAohhEjoIR9MP4b01VE67A&usqp=CAI

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

657127e26fe71bc476225c213eb076c82b53262e8fd12fa729ce0ee803947b9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 05:36:08 GMT
x-content-type-options: nosniff
age: 355276
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18091
x-xss-protection: 0
last-modified: Tue, 28 Sep 2021 10:24:17 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Thu, 17 Nov 2022 05:36:08 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame EA8B 22 KB
23 KB 49ms
8ms Image
image/jpeg 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcSlyPTDuvpGHLl6JHUiTnJhD7-pXT3BnpON9eiCb9uWsP5jaSOTMOIi1YNTCts&usqp=CAI

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44b755dcb797baa040108fc4895dc7081f2a4e5759d22357cfb48657a10169bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 06:59:08 GMT
x-content-type-options: nosniff
age: 436696
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22427
x-xss-protection: 0
last-modified: Tue, 28 Sep 2021 04:00:08 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Wed, 16 Nov 2022 06:59:08 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame EA8B 20 KB
21 KB 63ms
8ms Image
image/png 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcQGf1qvBhe4eMUI7YDfMwlPOZTQ9fi8aboTpIYAZI42xJGRXE0&usqp=CAI

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

521f0bfdd8ceae71ad2a22fd57646b8355d6dd23726bd5c940db69ae4f7978c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 12:25:11 GMT
x-content-type-options: nosniff
age: 417133
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20449
x-xss-protection: 0
last-modified: Mon, 25 Oct 2021 08:52:23 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Wed, 16 Nov 2022 12:25:11 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EA8B 0
20 B 42ms
41ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=CgcIByoDd2ViCgcICCoDbHRyChEIASoNdG93ZXIyLXNxdWFyZQoKCAIqBnNlcnZlcgooCAQqJGxvYWRfaW1hZ2VfcGwsbXlzaWRpYV9hbmFseXRpY3NfZXhwMgoNECshAAAAAAAAJkAwBAoNEAMhAACAzMysiUAwBAoNEAohAAAAAGZm5j8wBAoNEA0hAAAAAAAAAAAwBAoNEB4qBzU4MHg0MDAwBAoNEBkqBzU4MHg0MDAwBAoNEA4hAAAAAAAAAAAwBAoNEAQhAACAmZm5iUAwBAoNEA8hAAAAAAAAAAAwBAoNECshAAAAAAAALEAwBAoNEAUhAAAAMzO7iUAwBAoNEBAhAAAAAKDe4EAwBAoNEBEhAAAAAIADzUAwBAoNEBIhAAAAAAAAFEAwBAoNEBMhAAAAAAAACEAwBAoNEBchAAAAAACEikAwBAoNEBQhAAAAAACB40AwBAoNEBUhAAAAAAAAKEAwBAoNEBYhAAAAAAAAFEAwBAoNEBghAACAmZmxjkAwBBIaQ0pqTmxacUNxZlFDRlpTSk9Bb2QwYWdBZFEiEmdwYS9tYXhpbWFsX3YxX29jaCgM

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/e896defd9da58cd70544d59688f4a346.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Ydwwnsiz0RrvfpNl89rQqoBRiFg6eVxNIdbgsmjvwYM.js Show response
pagead2.googlesyndication.com/bg/ Frame 5E6C 35 KB
13 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ydwwnsiz0RrvfpNl89rQqoBRiFg6eVxNIdbgsmjvwYM.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1637482624&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637482643028&bpp=3&bdt=267&idt=78&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&correlator=4749937713146&frm=20&pv=2&ga_vid=719699987.1637482643&ga_sid=1637482643&ga_hid=780895128&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=439&ady=730&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063793%2C31062930&oid=2&pvsid=658001991795503&pem=618&tmod=1423418367&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=3QXWafL7QZ&p=https%3A//www.profinance.ru&dtd=90

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61dc309ec8b3d11aef7e9365f3dad0aa805188583a795c4d21d6e0b268efc183

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 19 Nov 2021 22:47:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 120623
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13476
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 19 Nov 2022 22:47:01 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 2A39 17 KB
6 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 21 Nov 2021 08:17:24 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 372E 32 KB
10 KB 12ms
11ms Script
text/html 23.79.143.124
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=btwnex&endpoint=eu
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.79.143.124 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-79-143-124.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 9c9f8a04e885955196b786c5dd265420afafe6f60fca767eb43693fc7e0d874a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=btwnex&endpoint=eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Sun, 21 Nov 2021 08:17:24 GMT
Content-Encoding: gzip
Last-Modified: Wed, 10 Nov 2021 00:01:00 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=68694
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9511
Expires: Mon, 22 Nov 2021 03:22:18 GMT

GET
H3 200 Ydwwnsiz0RrvfpNl89rQqoBRiFg6eVxNIdbgsmjvwYM.js Show response
pagead2.googlesyndication.com/bg/ Frame ADB8 35 KB
13 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ydwwnsiz0RrvfpNl89rQqoBRiFg6eVxNIdbgsmjvwYM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61dc309ec8b3d11aef7e9365f3dad0aa805188583a795c4d21d6e0b268efc183

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 19 Nov 2021 22:47:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 120623
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13476
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 19 Nov 2022 22:47:01 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 372E 284 B
536 B 49ms
10ms Image
image/jpg 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=btwnex&endpoint=eu
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Content-Type: image/jpg

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame F0BC 12 KB
5 KB 7ms
7ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Sat, 20 Nov 2021 20:36:35 GMT
expires: Sun, 20 Nov 2022 20:36:35 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 42049
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0361 783 B
536 B 42ms
21ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

691feca86b9ed0cca66f465c829483b81c8f72616b87eb93ba10ffbcf7006b1d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-AoTKZ/W5RJzHJlCJKybqlw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Sun, 21 Nov 2021 08:17:24 GMT
date: Sun, 21 Nov 2021 08:17:24 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-AoTKZ/W5RJzHJlCJKybqlw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 821503
www.tns-counter.ru/V13a****betweenx_ru/ru/CP1251/tmsec=betweenx_bx-ban-1/ Frame 5D9F 43 B
414 B 53ms
47ms Image
image/gif 2001:6d0:4001::226
TNSMSK-

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tns-counter.ru/V13a****betweenx_ru/ru/CP1251/tmsec=betweenx_bx-ban-1/821503

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:6d0:4001::226 , Russian Federation, ASN52016 (TNSMSK-, RU),

Reverse DNS

Software

ms-counter-3.2.14/1.20.1 /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=2678400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cache.betweendigital.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: ms-counter-3.2.14/1.20.1
strict-transport-security: max-age=2678400
content-type: image/gif
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate
timing-allow-origin: *
content-length: 43
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H3 200 Ydwwnsiz0RrvfpNl89rQqoBRiFg6eVxNIdbgsmjvwYM.js Show response
pagead2.googlesyndication.com/bg/ Frame F0BC 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ydwwnsiz0RrvfpNl89rQqoBRiFg6eVxNIdbgsmjvwYM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61dc309ec8b3d11aef7e9365f3dad0aa805188583a795c4d21d6e0b268efc183

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 19 Nov 2021 22:47:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 120623
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13476
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 19 Nov 2022 22:47:01 GMT

GET
H2

200

match
ad.360yield.com/ul_cb/ Frame 5D9F
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=429&user_id=f9781672-40fe-5345-9b2f-3aa1fab53a32&expires=60
https://ad.360yield.com/match?publisher_dsp_id=191&external_user_id=a6afb578-f865-4b6c-8844-06e685d836eb
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=191&external_user_id=a6afb578-f865-4b6c-8844-06e685d836eb

43 B
445 B

34ms
34ms

Image
image/gif

99.81.7.40
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=191&external_user_id=a6afb578-f865-4b6c-8844-06e685d836eb
Protocol: H2
Server: 99.81.7.40 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-81-7-40.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cache.betweendigital.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sun, 21 Nov 2021 08:17:24 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

location: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=191&external_user_id=a6afb578-f865-4b6c-8844-06e685d836eb
date: Sun, 21 Nov 2021 08:17:24 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0361 0
0 59ms
59ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021111601&jk=3855780858690825&rc=
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 12 KB
9 KB 21ms
20ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20211111&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b3f4533979460879a4bbb8ac4d9306815b6b14430e8db8f23ee8b17e992e4b82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9282
x-xss-protection: 0

POST
H2 200 tracker
top-fwz1.mail.ru/ 43 B
928 B 58ms
58ms Ping
image/gif 217.69.133.145
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to

Full URL

https://top-fwz1.mail.ru/tracker?js=13;id=74564;u=https%3A//www.profinance.ru/;st=1637482643010;s=1600*1200;vp=1600*1942;touch=0;hds=1;frame=0;flash=;sid=072db7b90d4f3286;ver=60.3.0;tz=0%2FEtc%2FUnknown;nt=0/0/1637482642181/////346/346/346/346/462/352/462/565/566/580/829/873/875/2176/2176/;ni=9.3//4g/0/0/;lvid=1637482643217%3A1637482644358%3A2%3A30db78e725973cd238b568baf2be3152;visible=true;_=0.12448345727942045;e=RT/load;et=1637482644357

Requested by

Host: top-fwz1.mail.ru
URL: https://top-fwz1.mail.ru/js/code.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),

Reverse DNS

top-fwz1.mail.ru

Software

nginx /

Resource Hash

24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Sun, 21 Nov 2021 08:17:24 GMT
x-content-type-options: nosniff
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length: 43
pragma: no-cache
amp-access-control-allow-source-origin: https://www.profinance.ru
server: nginx
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: https://www.profinance.ru
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: private, no-cache, no-store, max-age=0
access-control-allow-credentials: true
accept-ch-lifetime: 86400
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
timing-allow-origin: https://www.profinance.ru
access-control-allow-headers: *

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 0393 11 KB
5 KB 61ms
20ms Document
text/html 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.profinance.ru

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

9413ac70f0dfa293eae8e934799be6a1cde8cd96db876ce9bd127c41630847ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 1858
date: Sun, 21 Nov 2021 08:17:24 GMT
content-length: 4683

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 21 Nov 2021 08:17:24 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 762C 12 KB
5 KB 7ms
6ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Sat, 20 Nov 2021 20:36:35 GMT
expires: Sun, 20 Nov 2022 20:36:35 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 42049
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 3FE4 783 B
535 B 19ms
19ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

7177dec249ea08da88872a76228cbd8fc1f4d9601e2c4c74e2af4b8bd3e7b7f8

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-DRoNINObXkRfN7D0qshUkw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Sun, 21 Nov 2021 08:17:24 GMT
date: Sun, 21 Nov 2021 08:17:24 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-DRoNINObXkRfN7D0qshUkw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2A39 0
20 B 44ms
43ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021111601&jk=3855780858690825&bg=!vL-lv_vNAAZQLpa_UC47ACkAdvg8Wk_RXP1VJlQcYf96RraV8vkSL2W0pEQR85pa5Ca4ECJM76ebGAIAAABlUgAAAAxoAQcKAGFoqYNhjP5ZUQuKagC3GMwdWkqQwTMRWf1PY1Ds4vSlxi4kOXUEuvFFKUU_oxYXXamgQyKYzSozUI5qgrdHi8jn0U3Mh3jIZwkyrTLus_GyXo12ZrjnPYcbzsIPDM6EK1c5mQKhf8RjQgAH6x9srtrqiyDNEUlCTaVFEpguy9C2KynKGiMPALUDkDYYpJvgxOlv8YzecxST7eeHUtYP65PHatxl8wXyx5TdYj_wLQxcxnfnVqnuSYDNnjh8auLlx83fiZprfswHBOFIullNrV65JeWC71FrJE0gLcX3ixMz_X5hy5y27josdW9eem--5GCLn2o8h8V_AY3cFFvcwaqJrG7t9MeDHTLh6q6d0Wuxdhd7CYhwAAqezBiPqYTOnYUUPIcj5RrrA1AP7Cqdu8U7hg-pVb8OlobVWlxay6aX7HfyjNmEbtwwxcW4UZaJnedVagu3T2U5WhGg1q2VkTs2bB6L8Io93HtoTs6185ZByyjZC3T8YV6s4wP1w9RvHMGc3vtgfyGkpl1XS3Zc_-YI_1EtUob214Gdg3xT1zbbJLeoEFrYyOuNjLIoUAZRpy1Mu8h5gEBOd3DNt9kr8HzXpyVPGewaday-_nVICMS4_83XXc78YPvo--DhEpTGNpWQb_MHyIUKR-P88FuRhLDN86e5OMLVe8_o8WMHMR6OEwvBGTZbqLtbi8iQYtZzCCXZdJt9YhJV8MEqa0sjoN9vwZzSMyKNkSO4o7SQcCJ17v2q29P9-DxGkUXjNtrX51MtSC7s5D0aD5v0qVY7FK22kss2DZwR8ynwoy3tNjayX7TdwDQ2N_hdHV2mBlG1O9WdWhJ4cJhAoTqD7VBPM0zdT9CusaUMbQH7EVLqniQkd3B6EJz9j7Fh-TEr8C3JEFsnqM488gNSK_qKlcxJ6UO-vSuzgccxnoqLwwkBiuM2wZvEsBswUtRxjRHEwO05YEns78Vk9RhcDDY54RtIydugfVmylH7NaQZvd1WwzXcQ_lhT9r_bHWNqH7vw3Rxw1nE5yL1ZMQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 0393
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=profinance.ru&sn=ChromeSyncframe&so=0&topUrl=www.profinance.ru&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=PXjxtXw5bExVVFl2aStTajk5UFp5Y3d6RTZudXNsQlNSeEJHQkZ3ZXlLSXhvdHZGSlh0YUY5ZnJaS1NrakFBbE9MQ2swZkVXcGhqTG4raklmMHB5Q3dobThIMmlJajRZREJuQU5SZHpWT1VNSVNQbVN2SHRpWWI5V2RzMk...

431 B
620 B

63ms
18ms

Fetch
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=PXjxtXw5bExVVFl2aStTajk5UFp5Y3d6RTZudXNsQlNSeEJHQkZ3ZXlLSXhvdHZGSlh0YUY5ZnJaS1NrakFBbE9MQ2swZkVXcGhqTG4raklmMHB5Q3dobThIMmlJajRZREJuQU5SZHpWT1VNSVNQbVN2SHRpWWI5V2RzMkdtSHFGOEdKNjNpYUZERFhqV2M1Zm9zMHhsL21Yb2RzeG9QQnF5VHF6MmtUbCtMV2V6N3NldklKQlpQdDAwRG5XSWFtQW5tcXVDWFJvM01SWTRBbytLNUwxSG5YVjdpM3BMN0o4NTE2Z1NLcllnS0NiV3ZaQ1ZSNjQwMnlyMGV2bFhSRlFRQTF0YWVKMVhMTEw1L2hxenRsN3ROY1lLQT09fA&cppv=2

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

55f42c76cbe24e237989f2f5dca30264b9e00266d38a18ec0609b49117743c33

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Sun, 21 Nov 2021 08:17:24 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 4179
expires: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Sun, 21 Nov 2021 08:17:23 GMT
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=PXjxtXw5bExVVFl2aStTajk5UFp5Y3d6RTZudXNsQlNSeEJHQkZ3ZXlLSXhvdHZGSlh0YUY5ZnJaS1NrakFBbE9MQ2swZkVXcGhqTG4raklmMHB5Q3dobThIMmlJajRZREJuQU5SZHpWT1VNSVNQbVN2SHRpWWI5V2RzMkdtSHFGOEdKNjNpYUZERFhqV2M1Zm9zMHhsL21Yb2RzeG9QQnF5VHF6MmtUbCtMV2V6N3NldklKQlpQdDAwRG5XSWFtQW5tcXVDWFJvM01SWTRBbytLNUwxSG5YVjdpM3BMN0o4NTE2Z1NLcllnS0NiV3ZaQ1ZSNjQwMnlyMGV2bFhSRlFRQTF0YWVKMVhMTEw1L2hxenRsN3ROY1lLQT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1754
content-length: 541
expires: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 3FE4 0
0 93ms
92ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gda_r20211111&jk=658001991795503&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 Ydwwnsiz0RrvfpNl89rQqoBRiFg6eVxNIdbgsmjvwYM.js Show response
pagead2.googlesyndication.com/bg/ Frame 762C 35 KB
13 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ydwwnsiz0RrvfpNl89rQqoBRiFg6eVxNIdbgsmjvwYM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61dc309ec8b3d11aef7e9365f3dad0aa805188583a795c4d21d6e0b268efc183

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 19 Nov 2021 22:47:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 120623
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13476
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 19 Nov 2022 22:47:01 GMT

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 995E 2 KB
823 B 34ms
8ms Document
text/html 51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=5d1628750185ace

Requested by

Host: cache.betweendigital.com
URL: https://cache.betweendigital.com/code/bidder_18.html?USER_ID=f9781672-40fe-5345-9b2f-3aa1fab53a32&CACHEBUSTER=821503

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip253.ip-51-89-9.eu

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cache.betweendigital.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H3 200 container.html Show response
7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6A67 6 KB
3 KB 26ms
9ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sun, 21 Nov 2021 08:17:24 GMT
expires: Mon, 21 Nov 2022 08:17:24 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 204 event
ads.adfox.ru/341266/ 0
18 B 70ms
70ms Image
text/plain 77.88.21.179
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.adfox.ru/341266/event?pm=bmu&hash=60f828b9d8f28646&duid=1637482643647252450&pxo=Oib-n9LedjHurYZjDI3JFf9gvAZ2wXrUCwkUaoVOZau-l4OzXqsAqhQy43lhzHiCmDVkw2vh82RFfauFZcYiNXTIQ1GUlIm_qVudFZ2lyaRhPNZJrTNpHCVLRhGllDD8EByB9mklYQxclQapt_g5EPuOmMnUQ3kAMrvp7GWUWgyS5abvPXPC&p5=inscz&rand=icbumas&sj=u0afF_EeO4o94xUzHSZ5ECoh9RBZ45aUXtDykfgT-Wx-C3I61XhSTW7f0MX7jA%3D%3D&ad-session-id=6873661637482643189&lts=fhvhvpr&ytt=481586629969941&ybv=0.49004&ylv=0.49004&dl=https%3A%2F%2Fwww.profinance.ru%2F&pr=fcvauhk&p1=cmmml&rqs=k9TiEQqlpzGTAJphX61bFvkezBGFvQnT&rtb-si=b&p2=gyqo&resp-time=701

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

77.88.21.179 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

adfox-external-l3-engine.stable.qloud-b.yandex.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 21 Nov 2021 08:17:24 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
expires: Mon, 04 Dec 1999 21:29:02 GMT

GET
H2

200

f9781672-40fe-5345-9b2f-3aa1fab53a32
an.yandex.ru/mapuid/betweendigitalis/ Frame 5D9F
Redirect Chain

https://ads.betweendigital.com/match?bidder_id=43554&callback_url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fbetweendigitalis%2Ff9781672-40fe-5345-9b2f-3aa1fab53a32
https://an.yandex.ru/mapuid/betweendigitalis/f9781672-40fe-5345-9b2f-3aa1fab53a32

43 B
80 B

65ms
65ms

Image
image/gif

2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/betweendigitalis/f9781672-40fe-5345-9b2f-3aa1fab53a32

Protocol

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cache.betweendigital.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
last-modified: Sun, 21 Nov 2021 08:17:24 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 21 Nov 2021 08:17:24 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/betweendigitalis/f9781672-40fe-5345-9b2f-3aa1fab53a32
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H3 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/ Frame A3A1 3 KB
1 KB 8ms
8ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/index.html

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

734339d8a1eea0491989092bb6188148ad9bdfbf934ec50300e17f4874b67aae

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
timing-allow-origin: *
content-length: 1496
date: Wed, 17 Nov 2021 20:20:54 GMT
expires: Thu, 17 Nov 2022 20:20:54 GMT
last-modified: Wed, 22 Sep 2021 16:29:00 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 302190
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

B26136620.308725970;dc_pre=CMWOgJuCqfQCFYm8dwodMBQGWQ;dc_trk_aid=501600486;dc_trk_cid=123773641;ord=2043734709;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd= Show response
ad.doubleclick.net/ddm/trackimp/N393201.3392460GDNPROGRAMMATIC/ Frame 6A67
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N393201.3392460GDNPROGRAMMATIC/B26136620.308725970;dc_trk_aid=501600486;dc_trk_cid=123773641;ord=2043734709;dc_lat=;dc_rdid=;tag_for_child_directed_treatment...
https://ad.doubleclick.net/ddm/trackimp/N393201.3392460GDNPROGRAMMATIC/B26136620.308725970;dc_pre=CMWOgJuCqfQCFYm8dwodMBQGWQ;dc_trk_aid=501600486;dc_trk_cid=123773641;ord=2043734709;dc_lat=;dc_rdid...

42 B
63 B

49ms
31ms

Fetch
image/gif

142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/trackimp/N393201.3392460GDNPROGRAMMATIC/B26136620.308725970;dc_pre=CMWOgJuCqfQCFYm8dwodMBQGWQ;dc_trk_aid=501600486;dc_trk_cid=123773641;ord=2043734709;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=?

Requested by

Host: 7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com
URL: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N393201.3392460GDNPROGRAMMATIC/B26136620.308725970;dc_pre=CMWOgJuCqfQCFYm8dwodMBQGWQ;dc_trk_aid=501600486;dc_trk_cid=123773641;ord=2043734709;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=?
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 6A67 0
0 49ms
49ms Fetch
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C1xaQlACaYbbTB66B9u8Pw-u78ALPxqO1ZqSh59jBDr_hHhABIJzbw3tglfrwgYwHoAG_57vEA8gBCakCx1-OxGftsj7gAgCoAwHIAwiqBOIBT9C0KQ5KDeGo4ZpmwfetGfQ4Eo-zGd8GDKeIiOeFtSeKhWLpR8yLO7z7CBabPvSicQ33IvN2G9xDcJD3Szg9rZBU1y-u0lO5O5-yUxp5Ouu77MtbyWQbPFieBmZvIsmOpTY3wIuKqLAEU80QbbkC1WM23BjXFHzw8T-Bh5JvTdCsYjspzqFEaWyaTExhBY3aY1RLJ_HC635YPYnZnCngShVVT0dY9wKiP611BGprdnO-yVWOfDJ7xf97MsmxfLpv4oiIGkS1Q1NZ0tKdo9JKTltPgnIVaLxdjootG4F6_l1q3sAEvbPvprAD4AQBkgUECAQYAZIFBAgFGASgBi6AB8CJlR-oB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAPIHBRDe8-kB0ggJCIDhgBAQARgdgAoDyAsB2BMNiBQB0BUBgBcBshceChwIABIUcHViLTkwNTQ3MTM2NzQzMjE5MjkYu-B0&sigh=gfPHHSgCRvg&uach_m=[UACH]&template_id=419
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s06-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 6A67 19 KB
8 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Host: 7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com
URL: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:11:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 331
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Dec 2021 08:11:53 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 6A67 2 KB
1 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Host: 7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com
URL: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:11:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 371
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Dec 2021 08:11:13 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6A67 119 KB
36 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com
URL: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 21 Nov 2021 08:17:24 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 6A67 15 KB
6 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com
URL: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:12:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 274
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Dec 2021 08:12:50 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 6A67 0
0 15ms
14ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQndH20vSnvP4pwKK1o3Cr3CKNCpMfmVqo4DG_KMt6m22qj-GVFHEC8ek5kTXVYrkua113qrq6lhgW3ZLA85-2WJvbnKw
Requested by: Host: 7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com
URL: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame A3A1 9 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sat, 20 Nov 2021 16:08:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 58133
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 21 Nov 2021 16:08:31 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame A3A1 26 KB
10 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sat, 20 Nov 2021 16:13:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57825
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 21 Nov 2021 16:13:39 GMT

GET
H2 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame A3A1 236 KB
63 KB 1074ms
1050ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Nov 2021 08:17:25 GMT

GET
H3 200 index.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/ Frame A3A1 386 KB
89 KB 11ms
11ms Script
application/x-javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/index.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a294ab4b87b1464e1e24d9358ef1eaed7d7f5b77a08471652efc3d776f71140

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 302255
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 90835
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:29:00 GMT
server: sffe
date: Wed, 17 Nov 2021 20:19:49 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 17 Nov 2022 20:19:49 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 43ms
43ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20211111&jk=658001991795503&bg=!vL-lv_vNAAZQLpa_UC47ACkAdvg8WvNOOcfpLE6KFKs57V-xYbZGGQUTKNzonMp6VcCWJjyoGsMQsgIAAACDUgAAAAtoAQcKAK1CvRjFWMPZJLJ-dD65ArtO6PY8pW0n8ZjIr_LmdphGB9cdix6xjPOk2rmB7OQd46p_OM7xKZ0I1CK7Lsv8BZQ41DRjuvZ63YdKRuy5T1c14tvUjWezBHiGdUz2WnoTnjc0f64qw1w6DdNysvNqO9EZNaU8dMA0S4sEG4O6oyTwuUf3pW4gG96t4-O-be1wqPIBO5g__fXMEdlUs9j6OLsbdU-ucJGfA6pJfemKxpkCdtCfavNiu9j7_vL-A67dEbiq5lbSLd4cbgCuNhurTbpfif35JSkWarolXJYR_k-vnjI_bBQQN3f21Z2-rISyu_guwZy1XcdMWbrS5_QW_V9cla3CoZjm6khQs32g4ZNTYALyBO4ECud5mxxgbLY6EFKk32SppxxWQUlv0hgvBArQV8Ly__4sQ_59KnKaxwHzgLR_6cs3RKlYMHhgp4znDuweiBWcnl7CwFEwecuWWxbB7XExHq3fiyjCDKNI4Uf7RQqiQs1HUtkiITw5FNHQGKDDjtG5mypvT3tmSE264a3gRfVBCOX945d9wkttl7n13Qu9fhNfGa1bhBSaweV19JirLoxYfKdlv0exES5acD6g8hMxsGFGFFYLlI8ZlFQDnATn_ZZrSh-xvWUsr6enLh6o6RoYt3WB4BPNn4TFGjZWWQMxtGP_CQDFZ4R-_JhpVvlUZKOTqyjpgCU6g74dghIyUczxRsqjvI8I4jWjhW7Kb_eHW_BYEMwXklWl5bpOteDCokeCHIYc-oumgAaKabJxT6j1WDOnhfsjjAMmdhShGFbcvCU5KHJDnHEn7veZVCSFTFtqpVQVEgf51aNPifiZBYH3iuBQbfXdw3kg32TZlL4Cvj8Vgnm-6NBhsi228Y6zvV63UMRlyUYuMuQryFdKpiXX1dxVcgwQJB1k4DEScSbx6yK7cXvyAQL2ZfbyvvMrDxKsLYZdJB1r9TnjTeVoXYvI6RP0MeUwTd-uwG5nRGkMXmxnX-9RUFUNJDO4NO95cLiL2wxMTjlRO8Desg3Kh_CEInRm1paBW3E55bHfFPwHC2qTX7iBAt17P86K9HFCOaTOfA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 6A67 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c08c0906e9d466f6dfbed61b0817522e048463e048487ca2729b796123f0b4a7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 sync
t.adx.opera.com/ Frame 5D9F 0
410 B 58ms
15ms Image
text/plain 82.145.213.8
NO-OPERA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.adx.opera.com/sync?vendor=60079&uid=f9781672-40fe-5345-9b2f-3aa1fab53a32
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 82.145.213.8 , Norway, ASN39832 (NO-OPERA, NO),
Reverse DNS: n-sysadmin-jumpbox-03.feednews.opera.technology
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cache.betweendigital.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
server: Tengine
access-control-allow-methods: POST, GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
content-length: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3720 42 B
64 B 46ms
46ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvlCTEsl-l4sDcku05A2_PFgpR3rO_N9AhFDO5Y4m8p7MTF3rNr7KkCsG0mCFfwB0-Qpx-YDqpoJhLDmLfNEmnhb7BbU6SWGWT6RJkJm2s-CSQzMhnEsA&sai=AMfl-YS7LXFGuma-1eCESX1wmWS6DdTikS3qg3lYNYnPoN618XwuVquazwCQfKpQuLnTfqUFRXNF1cFRPAQv&sig=Cg0ArKJSzPxHZdZZCTBYEAE&id=lidar2&mcvt=1001&p=0,0,400,200&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20211110&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=2&adk=870026366&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1637482643715&rpt=121&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:24 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame EA8B 42 B
64 B 42ms
41ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvgiT5lxYfYIHx-qPFcv4C80Yv4ShSzc-HpuRP4kiQTcQgJhK9sXRKezDcDUSeHgFMucAAhWrjd43iVGXIX3FOIbn-FInIQmU0FsV8q_gZj2zQf94TiKw&sai=AMfl-YSChKEEm8mlVqBpplXEUotXqBWLlv40e-2-bra7pfH7LDWlFS_YyR_CdMkz0JJAvLPMmPS9VMrKrMYG&sig=Cg0ArKJSzCZyLH9ynVwnEAE&id=lidar2&mcvt=1000&p=0,0,400,580&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&v=20211110&bin=7&avms=nio&bs=0,0&mc=0.55&if=1&app=0&itpl=22&adk=2895220004&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1637482643119&rpt=983&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bundle.js Show response
yastatic.net/q/set/s/rsya-tag-users/ Frame BE53 105 KB
37 KB 60ms
59ms Script
application/javascript 2a02:6b8:20::215
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/q/set/s/rsya-tag-users/bundle.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e1cff21864c46e1da263fa83c14ed6d190bc5afbdd35188de15f10eb8bedd264

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/safeframe-bundles/0.83/1-1-0/render.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:25 GMT
content-encoding: br
last-modified: Fri, 29 Oct 2021 11:19:01 GMT
server: nginx/1.17.9
etag: W/"82bdc8db563d3e71c35534315f8a9fd5"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: application/javascript
access-control-allow-origin: *
expires: Tue, 23 Nov 2021 20:14:38 GMT
cache-control: public, max-age=31556952
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
strict-transport-security: max-age=43200000; includeSubDomains;
timing-allow-origin: *
x-nginx-request-id: 7388b5ed9e24b78e

GET
H2 200 watch.js Show response
mc.yandex.ru/metrika/ Frame BE53 130 KB
46 KB 88ms
87ms Script
application/javascript 2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/watch.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/q/set/s/rsya-tag-users/bundle.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

2d8618e3d2de4948e82bbce7cd6e1cefb6d720a09adb2cae9ea3886785493a0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:25 GMT
content-encoding: br
last-modified: Wed, 17 Nov 2021 12:17:49 GMT
etag: "6194c8bd-b7ad"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
content-length: 47021
expires: Sun, 21 Nov 2021 09:17:25 GMT

GET
H2 200 data Show response
yandex.ru/set/s/rsya-tag-users/ Frame BE53 403 B
846 B 99ms
98ms Fetch
application/json 2a02:6b8:a::a
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/set/s/rsya-tag-users/data?referrer=https%3A%2F%2Fwww.profinance.ru%2F

Requested by

Host: yastatic.net
URL: https://yastatic.net/q/set/s/rsya-tag-users/bundle.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

1b2fca2f1f8ec3152ed627fae295ecea1caca66d76491b7942d7156865555591

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 86400, "success_fraction": 0.001, "failure_fraction": 0.1}
report-to: { "group": "network-errors", "max_age": 86400, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: application/json; charset=utf-8
access-control-allow-origin: https://yastatic.net
cache-control: public,max-age=300
access-control-allow-credentials: true
x-xss-protection: 1; mode=block

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6A67 42 B
64 B 46ms
46ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv49Ze6qEnudrMCAmN8k31ZiR7bYQXesnZoqhH7bNyW-lINvlhwwdg1nf0bY5a5O2W4PNJj8h_EHTS7Ub-lJSAcvRU5XgS8WyOLGGVimoRlnxcZmmZvwg&sai=AMfl-YT6X3uVPxzF_JRTQRZVCt8rKqr0195QtYs4sKHgHoE1ECtjyqnnpFGu_Z7JrB1VYJLGADj8PHsbpkz-N28Zazsov7mDYilVnlahLrFywfdG97kwSDMmBBZY2G1X&sig=Cg0ArKJSzIoHKs7V1z2tEAE&cid=CAASF-RosjsGmfDx3VoDwxN3CrI7Yu57_CxB&id=lidar2&mcvt=1000&p=0,315,250,1285&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211110&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=2&adk=4257258892&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1637482644549&rpt=111&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 auto.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/ Frame A3A1 11 KB
11 KB 9ms
9ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/auto.png?1631719989339

Requested by

Host: 7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com
URL: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3231b59737ed6b1c3f0219cb5ac799081fa4624888dc84d2f48470b970174d3

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 318356
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10962
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:29:00 GMT
server: sffe
date: Wed, 17 Nov 2021 15:51:29 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 17 Nov 2022 15:51:29 GMT

GET
H3 200 p0.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/ Frame A3A1 17 KB
17 KB 7ms
7ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/p0.png?1631719989339

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e73c4e45e07036fe98c2924d626acf3b9b54fbaaf5e3085ada1833c157054f0

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 389822
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17344
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:29:00 GMT
server: sffe
date: Tue, 16 Nov 2021 20:00:23 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 16 Nov 2022 20:00:23 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ Frame BE53 37 KB
14 KB 53ms
24ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/q/set/s/rsya-tag-users/bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

2e8548e063ae8b8f6225ac344af4bb535397ebd3003665e27e8d4b2716770db9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14378
x-xss-protection: 0
server: cafe
etag: 684346926396516684
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 21 Nov 2021 08:17:25 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/1014923426/ Frame BE53
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=lQCaYdKzMOK9x_AP2rOk0A...
https://www.google.com/pagead/1p-user-list/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=854152467&crd=&is_vtc=1&random=230247769
https://www.google.de/pagead/1p-user-list/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=854152467&crd=&is_vtc=1&random=230247769&ipr=y

42 B
108 B

31ms
19ms

Image
image/gif

2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=854152467&crd=&is_vtc=1&random=230247769&ipr=y

Protocol

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=854152467&crd=&is_vtc=1&random=230247769&ipr=y
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/1014923426/ Frame BE53
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=lQCaYeiyMP7Mx_APpZe-6A...
https://www.google.com/pagead/1p-user-list/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1534136822&crd=&is_vtc=1&random=1769873107
https://www.google.de/pagead/1p-user-list/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1534136822&crd=&is_vtc=1&random=1769873107&ipr=y

42 B
108 B

44ms
19ms

Image
image/gif

2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1534136822&crd=&is_vtc=1&random=1769873107&ipr=y

Protocol

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1534136822&crd=&is_vtc=1&random=1769873107&ipr=y
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 p1.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/ Frame A3A1 21 KB
21 KB 8ms
7ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6667110001810498197/p1.png?1631719989339

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd85483cc4b56d5c80412f7079607ecea72f1579a84b852d901e0ad92f63eb1d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 301428
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20997
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:29:00 GMT
server: sffe
date: Wed, 17 Nov 2021 20:33:37 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 17 Nov 2022 20:33:37 GMT

GET
H2 200 3 Show response
mc.yandex.com/watch/ Frame BE53 167 B
262 B 47ms
47ms XHR
application/json 2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/3?wmode=7&page-url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&page-ref=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A%3Avf%3A9ezyymqkmizds872r%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A700%3Acn%3A1%3Adp%3A0%3Als%3A1025121559865%3Ahid%3A20702602%3Az%3A0%3Ai%3A20211121081725%3Aet%3A1637482646%3Ac%3A1%3Arn%3A104076255%3Arqn%3A1%3Au%3A1637482646130754690%3Aw%3A1x1%3As%3A1600x1200x24%3Ask%3A1%3Aifr%3A1%3Acpf%3A1%3Ans%3A1637482643593%3Ads%3A0%2C89%2C45%2C5%2C1%2C0%2C%2C15%2C0%2C166%2C166%2C0%2C166%3Adsn%3A0%2C89%2C44%2C6%2C0%2C0%2C%2C25%2C0%2C166%2C166%2C0%2C165%3Aco%3A0%3Ast%3A1637482646&t=gdpr()ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

29e10980d94f31327e61ddad85605337c703a818af3573c3ab7b43d76593092a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 21-Nov-2021 08:17:25 GMT
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: https://yastatic.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 167
x-xss-protection: 1; mode=block
expires: Sun, 21-Nov-2021 08:17:25 GMT

GET
H2 200 advert.gif
mc.yandex.com/metrika/ Frame BE53 43 B
112 B 46ms
46ms Image
image/gif 2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif?t=ti(4)

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 21 Nov 2021 08:17:25 GMT
last-modified: Wed, 17 Nov 2021 12:17:49 GMT
etag: "6194c8bd-2b"
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Sun, 21 Nov 2021 09:17:25 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/947884341/ Frame BE53 3 KB
1 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/947884341/?random=1637482645857&cv=9&fst=1637482645857&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2c385860bebc3614be74a855dff4da24fe5ffa5865df712fc15f26abc74878c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1117
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/693627671/ Frame BE53 3 KB
1 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/693627671/?random=1637482645861&cv=9&fst=1637482645861&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

abcc56bf73d2b66b3c39d9bfc231a873706c3390610984fcbb69c3ba7bb19e93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1117
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/947884341/ Frame BE53 3 KB
1 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/947884341/?random=1637482645863&cv=9&fst=1637482645863&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a387c9dfd7660f75732c68210841ac1d540533b17db06dc383c9b920d6cc2dec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1116
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/693627671/ Frame BE53 3 KB
1 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/693627671/?random=1637482645864&cv=9&fst=1637482645864&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

376c0ce27ca164646474d3c8500678e80e92fd65538d463029c11ea3991f78c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1117
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 event
ads.adfox.ru/341266/ 0
66 B 72ms
72ms Image
text/plain 77.88.21.179
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.adfox.ru/341266/event?pm=bmp&hash=5c73f5d441927d12&duid=1637482643647252450&pxo=Oib-n9LedjHurYZjDI3JFf9gvAZ2wXrUCwkUaoVOZau-l4OzXqsAqhQy43lhzHiCmDVkw2vh82RFfauFZcYiNXTIQ1GUlIm_qVudFZ2lyaRhPNZJrTNpHCVLRhGllDD8EByB9mklYQxclQapt_g5EPuOmMnUQ3kAMrvp7GWUWgyS5abvPXPC&p5=inscz&rand=cqaeala&sj=u0afF_EeO4o94xUzHSZ5ECoh9RBZ45aUXtDykfgT-Wx-C3I61XhSTW7f0MX7jA%3D%3D&ad-session-id=6873661637482643189&lts=fhvhvpr&ytt=481586629969941&ybv=0.49004&ylv=0.49004&dl=https%3A%2F%2Fwww.profinance.ru%2F&pr=fcvauhk&p1=cmmml&rqs=k9TiEQqlpzGTAJphX61bFvkezBGFvQnT&rtb-si=b&p2=gyqo

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

77.88.21.179 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

adfox-external-l3-engine.stable.qloud-b.yandex.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 21 Nov 2021 08:17:25 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
expires: Mon, 04 Dec 1999 21:29:02 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/693627671/ Frame BE53 42 B
64 B 25ms
24ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/693627671/?random=1637482645861&cv=9&fst=1637481600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&async=1&fmt=3&is_vtc=1&random=474786049&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/693627671/ Frame BE53 42 B
548 B 34ms
18ms Image
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/693627671/?random=1637482645861&cv=9&fst=1637481600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&async=1&fmt=3&is_vtc=1&random=474786049&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/947884341/ Frame BE53 42 B
64 B 21ms
21ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/947884341/?random=1637482645857&cv=9&fst=1637481600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&async=1&fmt=3&is_vtc=1&random=2380577859&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/947884341/ Frame BE53 42 B
108 B 33ms
18ms Image
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/947884341/?random=1637482645857&cv=9&fst=1637481600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&async=1&fmt=3&is_vtc=1&random=2380577859&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/693627671/ Frame BE53 42 B
64 B 22ms
20ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/693627671/?random=1637482645864&cv=9&fst=1637481600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&async=1&fmt=3&is_vtc=1&random=1954771536&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/693627671/ Frame BE53 42 B
108 B 34ms
21ms Image
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/693627671/?random=1637482645864&cv=9&fst=1637481600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&async=1&fmt=3&is_vtc=1&random=1954771536&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/947884341/ Frame BE53 42 B
64 B 21ms
21ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/947884341/?random=1637482645863&cv=9&fst=1637481600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&async=1&fmt=3&is_vtc=1&random=2458444388&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/947884341/ Frame BE53 42 B
108 B 52ms
41ms Image
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/947884341/?random=1637482645863&cv=9&fst=1637481600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&async=1&fmt=3&is_vtc=1&random=2458444388&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 37412095 Show response
mc.yandex.com/watch/ Frame BE53 350 B
409 B 47ms
46ms XHR
application/json 2a02:6b8::1:119
YNDX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/37412095?wmode=7&page-url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.83%2F1-1-0%2Frender.html&page-ref=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&site-info=%7B%22extensions%22%3A%22%22%2C%22fromGoogle%22%3A%22false%22%2C%22fromCancel%22%3A%22false%22%2C%22loyal%22%3A%220%22%2C%22sbscrb%22%3A%22%22%2C%22p%22%3A%22%22%2C%22b%22%3A%22%22%2C%22fresh%22%3A%220%22%2C%22infected%22%3A%22%22%2C%22slow%22%3A%22%22%2C%22os%22%3A%22windows%22%2C%22browser%22%3A%22chrome%22%2C%22winxp%22%3A%22false%22%2C%22old%22%3A%22actual%22%2C%22yabroAge%22%3Anull%7D&browser-info=pv%3A1%3Agdpr%3A6%3Avf%3A9ezyymqkmizds872r%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A700%3Acn%3A2%3Adp%3A1%3Als%3A773912148648%3Ahid%3A20702602%3Az%3A0%3Ai%3A20211121081725%3Aet%3A1637482646%3Ac%3A1%3Arn%3A454343072%3Arqn%3A1%3Au%3A1637482646130754690%3Aw%3A1x1%3As%3A1600x1200x24%3Ask%3A1%3Aifr%3A1%3Acpf%3A1%3Ans%3A1637482643593%3Ads%3A0%2C89%2C45%2C5%2C1%2C0%2C%2C15%2C0%2C166%2C166%2C0%2C166%3Adsn%3A0%2C89%2C44%2C6%2C0%2C0%2C%2C25%2C0%2C166%2C166%2C0%2C165%3Aco%3A0%3Arqnl%3A1%3Ast%3A1637482646%3At%3A&t=gdpr(6)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

ba40ec743f18b4d4ec75ade1f588399b8256ab8e67f2818ebb12ce9adc4a6e17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 21-Nov-2021 08:17:25 GMT
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: https://yastatic.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 350
x-xss-protection: 1; mode=block
expires: Sun, 21-Nov-2021 08:17:25 GMT

GET
H2 200 WKGejI_zO980rGa0911VKqpYNPLFZ0K0aW4GW8200J6J09fX000003Zeb0680aQv0jl0X-mipWuiy0BZbQZw0y31RV050Q06uWB91fCeRoqFzdTpgGVgpk1XbG7wNy07XFtfMe0A0OWA2OWBZ06g2n1vvhnlwiu00BVsHYD8qV0B1fWEa-cC_OpVthz3g0_gdOFLr...
an.yandex.ru/count/ 43 B
152 B 76ms
74ms Image
image/gif 2a02:6b8::90
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/count/WKGejI_zO980rGa0911VKqpYNPLFZ0K0aW4GW8200J6J09fX000003Zeb0680aQv0jl0X-mipWuiy0BZbQZw0y31RV050Q06uWB91fCeRoqFzdTpgGVgpk1XbG7wNy07XFtfMe0A0OWA2OWBZ06g2n1vvhnlwiu00BVsHYD8qV0B1fWEa-cC_OpVthz3g0_gdOFLrhA0_L-G4CJiXDMRrQpafW7u40Z2_hGjy188u1G1s1N1YlRieu-y_6FmoHRmFu4Ng1SDcHZG627u680Pk1d06PFfujhRdAYrAT8P4dbXOdDVSsLoTcLoBt8rE3SjCUWPy07m6O320u8S3Kr3GJfCJqbwOcvvLJVf780T_tyH051al6iGA8QDGS5T5GsJw1P2Jec1kMnrL-Qh2i_Oy55pgBfab5T47iQjTixW2Nzi8eSOu1u0~1=WfSejI_zO1u2RHG012EmblL17WFAz-gGYnQ00G680OZ_dhHNa07SyvA0qu20W0AO0Tppae1Je07Mg07Mk066l8Q_8DW1dgEqbG7W0OIRj9K1w0780VW1d8ZUlW6W0igKhHZ00Wkm0_03Y0M2yqEG1UgtSR05-VKYk0NvzIB01U75emJ81Vt7g07G1Sl42-05bAW6uWAm1u20a2Iu1u05q0SMs0SGu0Ua3_470032WgNAbWndlKfImJB1FydP2-hEu66L0VfVw0k2yqE839o8thu1w0oR1fWDmA5AFw0Em8GziWy2K0604C_FWXkQ41i9000H-3yPXeclNvWHyV8Ru17UhQ42w16KwVFg_jJvbGr06V50kJYHYNb2uJ-O4mAe4-AFsQEUkU3S5k0J-VKYY1J4sw2RcuBtxhO1e1JvzIAe5EgtSS0KW92y_QxozJ_O59B0u8i6w1IC0j0Lai3WYmRO5S6AzkoZZxpyOw0M0R0MiWF95j0Md8ZUlW615vWNXFJ9AxWN0S0NjHBG5z260zWNuDu-w1S1cHYW61Mm69hQvum6k1W1-1ZuWVkqzB7_bUq1W1c96RZm1W000000a1a1e1d00RWP_m7W6GBe6V01y1c0mWE16l__Kx6GGcsmY1h0X3sG6e10e1ghxC2BjBk7-_q1zHe10000c1l0eKhO6u20W801wHl9cNMvgQblGV0RXftR6VWRcD_t3UaS0F0_W1t_VvaT0F0_g1u1q1wplENsYuALX1ZO7lpQ7Xy0G12G6a630-pWXDs6CZYAP1eYrNb47_9yZ2rj8Fap7HQosHz9k9X1JJ8-n-LVTIHyLxUM8bP1OnCGTBwWHSRM8HaCd7aks3HY32qMH4zMIgS6rhKc8S4s0GS0~1=WfiejI_zO1u2ZHG0L2D4uV2C7WFSrg-WfGg00VlAri2weTRW6eW1fx2L_tUG0PojYv_GW8200fW1dAsBdr2W0QYgg06egekVKBW1WFJmaYBO0SB1yfe1u06MbQ-P0UW1cWEW0exwXG6O0y24FQ031B03yGI81TIy9f05_kOpi0NibGsu1UoL3S05WA1Ko0NPjHNG1QkY1U05BgW6uWAm1u20a2Iu1u05yGS008Y7_KA02W712cyHL4oQlkC_oVWAWBKOsGlgpk1XbG7wN-WBrBmcY0oycmQO3S2XIh0-e0x0X3so3m9G0O0GuTxX7S2ma881c17nyXlW4TwjeGBe4PJfy-h-rFcL3K0PyK2lG_633tV3FvWJ0gWJue_PevwvuDmMu1FibGs058200eWKnDkWcvk2z-ws0Q0Kx9KDg1J-vZEm5Ek1CBWKWDCE0j0KtztM7jWKcx7bYWRe58m2q1MRiUMA1jWLmOhsxAEFlFnZe1O1i1Qo0yaM003mFz0MlA3UlW615vWNbxMqBBWN0S0NjHBG5z260zWNo-ayw1S1cHYW60Um69RCvum6k1W2-1ZuWVkqzB7_bUq1W1c96RZm1W000000a1a1e1d00QWPyegQbWIu6Vy1u1a4w1dm0V0PWC83WHh__rSSliG8XuWQm8Gza1g0GBWQ0_KQ0G0009WRmA5AwHjs1-Ddx41_GV0RnycxFVWRzOd24-aS0F0_W1t_VvaT0F0_u1sXmWMe7W7G7g3YslMf-9U0NzWU-jeU7G10490Qe9K1pkC4tuQ2EKhodg5V40hGBcg9nmP24jDXzPezT4kMPU1LgBi8g8703uJ4X23EQ3jMsNSalU_eUU0vOc1iiR4LHlZaubTAPm3s-yZ4DRCEjWau~1=Wf0ejI_zO142DHG0v2AFus9H4GEg-xAiZH-00QgZvH280VpIkxb6a07-_zFTDfW1dfNpsJsW0OI0rDqsg06obFFPFRW1jC_1_HtO0OI0vHlW0TYyv0de0Vm3e0B2ggqKc0F0X3sW0mQm0ua7Y0Mjb1MG1PBw6h05mhK9k0N2jGd01Sx-4iW5fD46q0NktWBW1NUe1k82i0U0W90ak0U01P0DyGS00CAXrPRdcIG4jxBtFydP2-hEu66L0VfVw0kjb1MR1fWDmA5AS3sW3i24FR8F0b01W132kzaMmB0Gc17nyXlW4TwjeGBe4PJfy-h-rFcL3K0PyK0ZR_liGnB6FvWJ0gWJue_PevwvuDmMu1F2jGc058200eWKnDkWcvk2z-ws0Q0KmhK9g1II-Xgm5CAftmAu5829Ui0KW8IlNyWK1D0Kg_297TWK_e67YWRe58m2q1N-WOUA1jWLmOhsxAEFlFnZe1O1i1Qo0yaMq1RYnjw-0O4Nc1UdgOa5k1S1m1Ur4j0Nq8O3s1UNlphe5m6P6A0O2B0OcjhdZ0Qu60Vu6FY1-xJqiV-LxG606OaPkF060000002G6G6W6S01g1cDxlMG1BWP_m7W6GJe6V01y1c0mWE16l__GvGw8rl1Y1h0X3sG6e28GA0QiOwxyOAM-B84zHe10000c1l0eKhf6v4bHW8OzKn1y1lr_vO5-1lnZS02wHm0y3-07Vz_cHq0y3_W7R7A1QWU0T0UrkBAwiQ8d-bws1xxsXuS040Ga3f0WmFXnicu3GLp5CaqHDgiHwAiWP2lT5YePezx4BB0kmgr4W4r49X_a1YododrOHK97R7XG1QKvuB9Y45qnGPHeE2J2rWfdO4nVcgEmJPH1000~1?stat-id=70&test-tag=481637917840945&banner-sizes=eyI3MjA1NzYwNTE3ODE1NDIyMiI6IjI0MHgxOTYiLCI3MjA1NzYwNDgwNzk0NTAzOCI6IjI0MHgxOTYiLCI3MzQ1OTYzMDA3IjoiMjQweDE5NiJ9&format-type=117&actual-format=13&pcodever=49004&banner-test-tags=eyI3MjA1NzYwNTE3ODE1NDIyMiI6IjU3MzYxIiwiNzIwNTc2MDQ4MDc5NDUwMzgiOiI1ODE2NTAiLCI3MzQ1OTYzMDA3IjoiNTczNjMifQ%3D%3D&pcode-active-testids=456345%2C0%2C65%3B457847%2C0%2C-1%3B456500%2C0%2C68&width=240&height=598&confirmTime=2101000&confirmRatio=150000&wmode=0

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:26 GMT
content-encoding: gzip
last-modified: Sun, 21 Nov 2021 08:17:26 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sun, 21 Nov 2021 08:17:26 GMT

GET
H2 204 event
ads.adfox.ru/341266/ 0
66 B 79ms
78ms Image
text/plain 77.88.21.179
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.adfox.ru/341266/event?pm=bmn&hash=044c02de1e48c413&duid=1637482643647252450&pxo=Oib-n9LedjHurYZjDI3JFf9gvAZ2wXrUCwkUaoVOZau-l4OzXqsAqhQy43lhzHiCmDVkw2vh82RFfauFZcYiNXTIQ1GUlIm_qVudFZ2lyaRhPNZJrTNpHCVLRhGllDD8EByB9mklYQxclQapt_g5EPuOmMnUQ3kAMrvp7GWUWgyS5abvPXPC&p5=inscz&rand=jfspshg&sj=u0afF_EeO4o94xUzHSZ5ECoh9RBZ45aUXtDykfgT-Wx-C3I61XhSTW7f0MX7jA%3D%3D&ad-session-id=6873661637482643189&lts=fhvhvpr&ytt=481586629969941&ybv=0.49004&ylv=0.49004&dl=https%3A%2F%2Fwww.profinance.ru%2F&pr=fcvauhk&p1=cmmml&rqs=k9TiEQqlpzGTAJphX61bFvkezBGFvQnT&rtb-si=b&p2=gyqo

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

77.88.21.179 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

adfox-external-l3-engine.stable.qloud-b.yandex.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 21 Nov 2021 08:17:26 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
expires: Mon, 04 Dec 1999 21:29:02 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 40ms
40ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_inf_scr&r=s&pg_h=1942&su=www.profinance.ru&d=5000&eid=31063793%2C31062930

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 event
ads.adfox.ru/341266/ 0
66 B 79ms
79ms Image
text/plain 77.88.21.179
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.adfox.ru/341266/event?pm=bmq&hash=7ccb81fca8a62b5f&duid=1637482643647252450&pxo=Oib-n9LedjHurYZjDI3JFf9gvAZ2wXrUCwkUaoVOZau-l4OzXqsAqhQy43lhzHiCmDVkw2vh82RFfauFZcYiNXTIQ1GUlIm_qVudFZ2lyaRhPNZJrTNpHCVLRhGllDD8EByB9mklYQxclQapt_g5EPuOmMnUQ3kAMrvp7GWUWgyS5abvPXPC&p5=inscz&rand=gxvwlon&sj=u0afF_EeO4o94xUzHSZ5ECoh9RBZ45aUXtDykfgT-Wx-C3I61XhSTW7f0MX7jA%3D%3D&ad-session-id=6873661637482643189&lts=fhvhvpr&ytt=481586629969941&ybv=0.49004&ylv=0.49004&dl=https%3A%2F%2Fwww.profinance.ru%2F&pr=fcvauhk&p1=cmmml&rqs=k9TiEQqlpzGTAJphX61bFvkezBGFvQnT&rtb-si=b&p2=gyqo

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

77.88.21.179 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

adfox-external-l3-engine.stable.qloud-b.yandex.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 21 Nov 2021 08:17:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 21 Nov 2021 08:17:28 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
expires: Mon, 04 Dec 1999 21:29:02 GMT

Verdicts & Comments Add Verdict or Comment

94 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

75 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
yastatic.net/safeframe-bundles/0.83/1-1-0	1970-01-19 22:52:49	Name: afpix Value: 1
yastatic.net/safeframe-bundles/0.83/1-1-0	1970-01-19 23:00:01	Name: pcssspb Value: 1
yastatic.net/safeframe-bundles/0.83/1-1-0	1970-01-19 22:52:49	Name: pcs3 Value: 1
www.profinance.ru/	1969-12-31 23:59:59	Name: user_yndxpfs_ablc Value: null
.yadro.ru/	1970-01-20 07:36:17	Name: FTID Value: 1XcW2V0cfceC1XcW2V002LnK
.profinance.ru/	1970-01-20 07:36:58	Name: _ym_uid Value: 1637482643647252450
.profinance.ru/	1970-01-20 07:36:58	Name: _ym_d Value: 1637482643
.betweendigital.com/	1970-01-20 07:36:58	Name: dc Value: was1
.betweendigital.com/	1970-01-20 07:36:58	Name: tuuid Value: f9781672-40fe-5345-9b2f-3aa1fab53a32
.betweendigital.com/	1970-01-20 07:36:58	Name: ss Value: 1
.yadro.ru/	1970-01-20 07:36:17	Name: VID Value: 0DwJvt3qhu8C1XcW2V0029ir
.profinance.ru/	1970-01-20 06:50:53	Name: tmr_lvid Value: 30db78e725973cd238b568baf2be3152
.profinance.ru/	1970-01-20 06:50:53	Name: tmr_lvidTS Value: 1637482643217
.mc.yandex.com/	1970-01-19 22:51:23	Name: sync_cookie_csrf Value: 57589261fake
.profinance.ru/	1970-01-19 22:52:34	Name: _ym_isad Value: 2
.mc.yandex.ru/	1970-01-19 22:51:23	Name: sync_cookie_csrf Value: 180672019fake
.exchange.buzzoola.com/	1970-01-19 23:34:34	Name: uuid Value: 467919fd-62fe-4019-5332-f4571f8fb25c
.otm-r.com/	1970-01-20 07:36:58	Name: mpid Value: NjE5YTAwOTMwYjA0ZDkyMg==
.bidswitch.net/	1970-01-20 07:36:58	Name: tuuid Value: a6afb578-f865-4b6c-8844-06e685d836eb
.bidswitch.net/	1970-01-20 07:36:58	Name: c Value: 1637482643
.bidswitch.net/	1970-01-20 07:36:58	Name: tuuid_lu Value: 1637482643
.yandex.com/	1970-01-20 07:36:58	Name: yandexuid Value: 4308931281637482643
.yandex.com/	1970-01-20 07:36:58	Name: yuidss Value: 4308931281637482643
mc.yandex.com/	1969-12-31 23:59:59	Name: yabs-sid Value: 2194755971637482643
.yandex.com/	1970-01-23 14:27:22	Name: i Value: 43DOCZcg8bz8G44cMor0520ukD4aQYGxUgZf9q/FPi0RdJVU3YqCKhwNfGxvv6zNjeeRTKmLjDdC/neXMXyMSZQhTbo=
.yandex.com/	1970-01-20 07:36:58	Name: ymex Value: 1669018643.yrts.1637482643#1669018643.yrtsi.1637482643
.adsniper.ru/	1970-01-27 06:03:22	Name: uuid3 Value: IiQ3NDVjMmMyMi00YWEzLTExZWMtYTZlOS0wMDI1OTBjODI0Mzc*
.bumlam.com/	1970-01-27 06:03:22	Name: suuid3 Value: IiQ3NDVjMmMyMi00YWEzLTExZWMtYTZlOS0wMDI1OTBjODI0Mzc*
.yandex.ru/	1970-01-23 14:27:22	Name: yandexuid Value: 3578009891637482643
.adhigh.net/	1970-01-20 07:36:58	Name: gi_u Value: 757XPJUJirc.AikABlF9QZJAEw
.an.yandex.ru/	1970-01-19 23:01:27	Name: yabs-vdrf Value: A0
.adhigh.net/	1970-01-20 07:36:58	Name: btw_sync Value: IGK
.aidata.io/	1970-01-20 16:22:34	Name: __upin Value: AGOQCT5D0W8OlHuu3aFRAg
.aidata.io/	1970-01-20 16:22:34	Name: __upints Value: 1637482643
pool.admedo.com/	1970-01-20 07:36:58	Name: tuuid Value: 6aae418f-4438-4f79-94d1-f36ccbbd20b9
pool.admedo.com/	1970-01-20 07:36:58	Name: c Value: 1637482643
pool.admedo.com/	1970-01-20 07:36:58	Name: tuuid_lu Value: 1637482643
.lijit.com/	1970-01-20 07:36:58	Name: ljt_reader Value: bdd357d828d3283218fa44ff
.doubleclick.net/	1970-01-20 08:12:58	Name: IDE Value: AHWqTUlE8chqNP0Apzwj5YP7rvYCfmh8Emloh-7Qahbl_hsT-EMOLbxl2_VIUezuv8U
.1dmp.io/	1970-01-20 07:36:58	Name: uid Value: 74999670-4aa3-11ec-8677-901b0e934d81
x01.aidata.io/	1970-01-19 23:01:27	Name: yaya Value: 1
.yandex.ru/	1970-01-23 14:27:22	Name: yuidss Value: 3578009891637482643
.1dmp.io/	1970-01-19 22:51:22	Name: ru-seq Value: null
.sonar.semantiqo.com/	1970-01-21 19:29:46	Name: semantiqo_a Value: 200a2a5733e24da09c51d742c90219b2
.sonar.semantiqo.com/	1970-01-20 07:47:03	Name: check Value: e4d638bd43704809989994ad3e62d078
.sniperlog.ru/	1970-01-20 11:48:58	Name: guid Value: 38E792AEB0BDD08F
.dmg.digitaltarget.ru/	1970-01-21 00:46:34	Name: viuserid Value: 5LCg54p-4KQ196F7-rfK
.demdex.net/	1970-01-20 03:10:34	Name: demdex Value: 11913097892823865934573655127775615474
.doubleclick.net/	1970-01-19 22:51:26	Name: DSID Value: NO_DATA
.weborama.fr/	1970-01-20 08:23:03	Name: AFFICHE_W Value: ptzoiFu7HFOm87
.dpm.demdex.net/	1970-01-20 03:10:34	Name: dpm Value: 11913097892823865934573655127775615474
.rutarget.ru/	1970-01-20 03:10:34	Name: userId Value: -mq_4tg-4Elf
.tns-counter.ru/	1970-01-20 07:36:58	Name: guid Value: 6A9D6920619A0094X1637482644
.upravel.com/	1970-01-19 22:51:22	Name: session_tptc Value: 1637482644092
.upravel.com/	1970-01-23 14:27:22	Name: user_id Value: 4868825d-76cb-4b65-a19c-5246f372c51c
.caltat.com/	1970-01-21 19:29:46	Name: caltat Value: db23968d0c9244889ae670108adf59a5
.profinance.ru/	1970-01-20 06:50:53	Name: tmr_reqNum Value: 2
.mail.ru/	1970-01-20 07:38:25	Name: VID Value: 3ukBRU2sYXY600000X12H426:::0-0-0-6b45953:CAASEB2NvOSERfki2u78TyaHOWAaYMVJz1yRV-_1lsZgDsFECve3nvFypltgxSRAg3xJmIBw5gXsvxAMCJhTMpyb_ew_Lby39GTRrA1l_F3nnjZQtzc1mGZZ02EXkJUttHUjkOAnO6pncHo0K3iBT1yedVBYEg
.magnitent.com/	1970-01-21 19:29:46	Name: sonar Value: 200a2a5733e24da09c51d742c90219b2
.magnitent.com/	1970-01-21 19:29:46	Name: ct Value: db23968d0c9244889ae670108adf59a5
.magnitent.com/	1970-01-21 19:29:46	Name: spid Value: 85EDB671FCCA0060
.magnitent.com/	1970-01-19 23:36:01	Name: 3db Value: 85EDB671FCCA0060
.criteo.com/	1970-01-20 08:12:58	Name: uid Value: b4e9ba9d-fb0f-4983-bba5-14dbe4fa7d72
.360yield.com/	1970-01-20 01:00:58	Name: tuuid Value: cc4c6269-b603-4594-b249-52db7789ab97
.360yield.com/	1970-01-20 01:00:58	Name: tuuid_lu Value: 1637482644
.360yield.com/	1970-01-20 01:00:58	Name: um Value: !191,U..HlETwUXhJ-L-a0cXgHMM35xW1Z.jpPPhsYOZTIqrWmyQhiXGQVHAci8fpTbTiUoM=,1645258644
.360yield.com/	1970-01-20 01:00:58	Name: umeh Value: !191,0,1699690644,-1
.profinance.ru/	1970-01-20 08:12:58	Name: __gads Value: ID=b046667b4c3d3571:T=1637482643:S=ALNI_MaRmPlQQvDx3bHh5rm2bAt0_MJiVw
.profinance.ru/	1970-01-20 08:12:58	Name: cto_bundle Value: XDel5F9kbWUlMkJtWUhqMklyS1ZaSml3MVpubCUyRnZRY2x4ajNObUhoeEt3a0hJeVlpMkRUM280ZWFaOGdBcms5UnJlSWVXaWJuTVg5SGJOViUyQnlWamlmWlpiTzR1QjdqVWF5JTJGemxBQnV6dUcyc2E4NlZGSnBJVEhJcFpEMFZ6ckpUVEhCRG9BQTlWUzRsamhiMDZBMmZmcHZQbWxLZyUzRCUzRA
.betweendigital.com/	1970-01-20 07:36:58	Name: ut Value: YZoAlAAJ40DzLTjLYCJWp_7XRPrGCDsmVHWUGA==
.adx.opera.com/	1970-01-19 23:34:34	Name: UID Value: 8df00b953fbc4336bdd6d3bcbce5288f
www.profinance.ru/	1970-01-19 22:52:49	Name: tmr_detect Value: 0%7C1637482645621
.yandex.ru/	1970-01-20 16:22:34	Name: is_gdpr Value: 1
.yandex.ru/	1970-01-20 16:22:34	Name: is_gdpr_b Value: CObxWhCbUhgB
.yandex.ru/	1970-01-20 16:22:34	Name: i Value: wSWMNVQCCt5qvhuDY92mhHnAuJXWAiX22e20XD3AZX+NBPq70vZlyQ0zmkdjf9KUQFYzyrGzax6Ib9de2wHPJiN5esw=

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://mc.yandex.com/sync_cookie_image_decide?token=9464.zkQUjmd8nFei5ui3qX57jiBXz6GiqsUKHTuZpBdVwXaZcOtmbA4RbMVTsontAw44T_MVBiVStEgXXuGXvNaO6w%2C%2C.qIf4XEmzsLLIVIsRibSt3ewos2o%2C Message: Failed to load resource: the server responded with a status of 400 ()
security	error	URL: https://7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1(Line 12) Message: Refused to frame 'https://pagead2.googlesyndication.com/' because it violates the following Content Security Policy directive: "frame-src cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp=er3$/6667110001810498197/index.html".

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4868825d-76cb-4b65-a19c-5246f372c51c.sync.upravel.com
7bbc53da93de33fb969963540952f81a.safeframe.googlesyndication.com
ad.360yield.com
ad.doubleclick.net
ad.mail.ru
adfox-c2s-ams.creativecdn.com
ads.adfox.ru
ads.betweendigital.com
adservice.google.com
adservice.google.de
an.yandex.ru
ap.lijit.com
avatars.mds.yandex.net
bidder.criteo.com
bidswitch-eu.splicky.com
cache.betweendigital.com
cdn3.caltat.com
cm.g.doubleclick.net
cm.tns-counter.ru
counter.yadro.ru
dm.hybrid.ai
dmg.digitaltarget.ru
dpm.demdex.net
encrypted-tbn0.gstatic.com
encrypted-tbn2.gstatic.com
encrypted-tbn3.gstatic.com
eus.rubiconproject.com
exchange.buzzoola.com
fonts.googleapis.com
fonts.gstatic.com
forexpf.ru
googleads.g.doubleclick.net
gum.criteo.com
informers.forexpf.ru
matchid.adfox.yandex.ru
mc.yandex.com
mc.yandex.ru
mug.criteo.com
onetag-sys.com
pagead2.googlesyndication.com
partner.googleadservices.com
pb.adriver.ru
pool.admedo.com
profile.ssp.rambler.ru
px.adhigh.net
redirect.frontend.weborama.fr
s0.2mdn.net
secure-assets.rubiconproject.com
securepubads.g.doubleclick.net
sonar.semantiqo.com
ssl.google-analytics.com
ssp.adriver.ru
static.criteo.net
stats.mos.ru
sync.1dmp.io
sync.bumlam.com
sync.magnitent.com
sync.upravel.com
sync3.adsniper.ru
sync3.sniperlog.ru
t.adx.opera.com
token.rubiconproject.com
top-fwz1.mail.ru
tpc.googlesyndication.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagservices.com
www.gstatic.com
www.profinance.ru
www.tns-counter.ru
x.bidswitch.net
x01.aidata.io
yandex-dmp-sync.rutarget.ru
yandex-sync.rutarget.ru
yandex.ru
yastatic.net
yhb.p.otm-r.com
ysa-static.passport.yandex.ru
116.202.236.172
142.250.185.162
142.250.186.34
142.250.186.70
142.250.186.98
148.251.236.115
148.251.236.118
151.236.118.210
157.90.167.185
178.250.0.157
178.250.2.131
185.15.175.158
185.184.8.65
193.232.150.45
195.201.152.110
195.209.111.20
2001:6d0:4001::226
212.11.155.167
217.69.133.145
23.37.42.132
23.79.143.124
2a00:1148:db00::17
2a00:1450:4001:801::2006
2a00:1450:4001:803::2002
2a00:1450:4001:808::2002
2a00:1450:4001:809::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::2001
2a00:1450:4001:810::200e
2a00:1450:4001:811::200a
2a00:1450:4001:812::2002
2a00:1450:4001:813::2008
2a00:1450:4001:828::2004
2a00:1450:4001:82a::2001
2a00:1450:4001:82a::200e
2a00:1450:4001:82b::2003
2a00:1450:4001:82b::200e
2a00:1450:4001:830::2002
2a00:1450:4001:831::2003
2a02:2638:1::13
2a02:2638:1::3
2a02:6b8:20::215
2a02:6b8::16b
2a02:6b8::184
2a02:6b8::1:119
2a02:6b8::5:114
2a02:6b8::90
2a02:6b8:a::a
3.124.225.84
31.172.81.158
31.172.81.160
35.190.16.14
35.210.53.219
37.18.16.23
51.89.9.253
52.208.121.178
63.251.14.3
69.173.144.139
77.88.21.179
78.46.100.125
80.64.106.147
80.64.106.149
81.177.34.136
81.177.34.158
81.222.128.213
82.145.213.8
88.212.201.204
89.108.120.76
91.192.150.14
95.217.109.66
96.46.186.57
99.81.7.40
00b8057748cb1a1ffe57065edefeb4da34edead26d8546e1f782074502e8ac98
053508cc4ed1acf7db8ed96deca42ffebfa1669c5cecd62f4415b926d07b5aaa
0626f064e3bc528bf3ca8a8d42abdb95102a32941e805b91c83bc49329a5e3ce
07878131250c810ce67539c1e45c5930389a0609a97edd176ae3806f9276f293
07c0c8f2507c084364c734ac87603da7b5659992547e8efdee4914b2955e9872
09cb736cb51c04a9c25e66bc769097be3b6aee29e7a8a9b2250344cca527c210
0e73c4e45e07036fe98c2924d626acf3b9b54fbaaf5e3085ada1833c157054f0
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
0efe00c23297e5c56485eabb6ea548c2669b896704fcb2c426d898148543ccad
10505836d229d8e486d2f87c2ad2ff90e442438b7085b35f5017c2e98711805e
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
1424ef028f97cd5d48afe88370d0a83d59d96f69f8181bc3c48dbcfba0a228c4
1484b97dfb6d3aeaf32de990df919f0c59458097e85e61c57ec0cd3863a2aa17
16897a2019e175ddd7d60216ddbc439a3bb1cd69f4730f9b65825caeb6a83cf0
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
183732f738678d361ae726869c4464577519acbbb8f1d73dea5acbf3cd7c09d8
18c327afa903633f86c3efcf12b77f098077eacaa8be101bb007846fd74f8b93
1b2fca2f1f8ec3152ed627fae295ecea1caca66d76491b7942d7156865555591
1d8e062d702af857fd52b30f1795176ce35eac925bdd5fbeee1e2bed69171556
21be95910910148502d7064d8f8028d0424b88cc34a07858a433e48ed64c4bbf
22183691806f231b4bd2f4df10195e165b6da322ddf9362fe17c84892e449634
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
2687a9ff78a0ba6437a6c692111f9d22f9cd59341b63ccb2eb543050415b8de7
273ba0c52e57a5c00ec7e68d64c13805cf735edee215ae624b0df5c01979de4a
29e10980d94f31327e61ddad85605337c703a818af3573c3ab7b43d76593092a
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2b6b18a504ddf391b93dc00363f531252279897fae1e63c430e7ce198c02847c
2c967cac40158b4a25c3f77d4123e5d9c203f5527322e6d51b6469df29abe2ae
2d77dbc1c9f7a53c580fdd0c2c312d2afbaff938e7b0ee2383b10975533572ca
2d8618e3d2de4948e82bbce7cd6e1cefb6d720a09adb2cae9ea3886785493a0e
2e8548e063ae8b8f6225ac344af4bb535397ebd3003665e27e8d4b2716770db9
31373fcf3a18f623c7acf57123c03a99e7235431585e35e222c6f2a456cef2d4
34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
376c0ce27ca164646474d3c8500678e80e92fd65538d463029c11ea3991f78c1
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
3eee78aaf4f9dc8d0d36d3dddbaad9094ace5d91611f9aee6fe0b44b0ed46ccc
3f2ddfa3bbb632bc1bd8b7725d83b552a7589a1978dc1f326ce3fd1aa73e0c53
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
400b3546b00dc904403e7922e825533b8dca24eab88fe3fdc6c1102c32d52820
4428fa8a11efdc34826dd51d4e75030b868039b258d3854f45b1222e1794bb1b
44b755dcb797baa040108fc4895dc7081f2a4e5759d22357cfb48657a10169bf
4688af76f0aa4851953c45d5f4472b4328d046c0e5214de1502c79c6409948d9
46f16a08e79604e878917477b6d17e0a00d3bc2b07a5f3bb9d4c5274f3fbe6d2
475700259e64d480d1a70023e14741bb298a025e338bb608552e2472d4505a65
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
4f03328df37c79cd4f726e815e789f24edd35d3f43c640520fc8c794fc442357
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
521f0bfdd8ceae71ad2a22fd57646b8355d6dd23726bd5c940db69ae4f7978c1
536cd983c5ac840349770984405fe9eb9e67b9d7e35e0c45673a653b003173b6
541a22e85f3238899f2589d44b9390a8d6d6e193a5d436c10e8ec9ce7b256e76
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
55f42c76cbe24e237989f2f5dca30264b9e00266d38a18ec0609b49117743c33
57599ac6bcd9086c0d269b788fdf7ae81ede1f8f2a9476bf75e03b95650dadbd
5c45c312dc1ba44ddeecb86f06d442b85f7816d393b81d3d8197971f80dae7da
5cedd5abd94d64b07e3779451d057665572b89caa8b445a5e9efa42bad9c4274
5f1ab65fe2ad6b381a1ae036716475bf78c9b2e309528cf22170c1ddeefddcbf
5f8a6e6ed3d25c671cff494344b9b30fdad846dfe411fd22de4588640a31ff0c
61d1757c075921df8d4a5aa73c80b1a516506e6edf14d9786dccb3968e6b9a29
61dc309ec8b3d11aef7e9365f3dad0aa805188583a795c4d21d6e0b268efc183
62be3464b67e788249ff9ce386d13ce5bdd3185f4d2fad8ec562c5bab46171c3
64e62b6ed84c308d8011efc4a92b313480ca230a7c2df6e3992aec36d300de37
65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e
657127e26fe71bc476225c213eb076c82b53262e8fd12fa729ce0ee803947b9c
65c1eec846990c5831250ac37e698c949675bbdce85f99a0f8be29193f022892
65d6a6ab5690cd0dde5027a379df67242ce89be2a12d6caf5fc9272bc03b9a97
67d966655f66192caeabb47ca4d7ea5271a9a3083e906a44850a6932d5a0e2be
67e6599b9fd28869eb047c72fd7486c191b54a661ec61accdf9b2de87f246ce9
691feca86b9ed0cca66f465c829483b81c8f72616b87eb93ba10ffbcf7006b1d
6e7370d59ce4bd24ad3704a243da63eb220fa582bd958038cc8511eaa5bdc479
7040b31ac3f3ba32dfd38d23a4f4972a093f0930faa8526ac5a78c49998c5ddc
7177dec249ea08da88872a76228cbd8fc1f4d9601e2c4c74e2af4b8bd3e7b7f8
71c4db2e5d2e856aa7c037ec8fbca11d6bc09590f079c1f134934ebc5e436e3f
734339d8a1eea0491989092bb6188148ad9bdfbf934ec50300e17f4874b67aae
79892653898c36fc21eacb8652255051534e9773146a556973aacf6a2c00e1a4
79b7e258aaf300b72a9bee5527f8dc12ac369833c502f35641aecdab816a8142
7b82d70c7d4367a40c2ce524867410716831c036c90d5614561b513a7c4e4775
7badd5384528f2966a3161f7986ed2537f58dbdcd47480069bb89c409c7ea486
7df5774ffcccb6de91ea0c3e95ea530c054c80d1150c517bd2b9920e9b3c3ace
7e1e066fbf2de0d0703956d8e95b15e51a7a444289ca1bffae0d841f5c53c9b8
8074284dcb2a2e278ea8c7cd4c88d2a685027616b1bb9807dfda25144086b877
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b
88e5dc8f8a7799f095f0f957096776105f22b3c74a13a138431ae5e2487efa2f
8940ae07bce3a0ebfe919bb1a2e29e7667be5330d17efc556f51a8c863783e43
8a294ab4b87b1464e1e24d9358ef1eaed7d7f5b77a08471652efc3d776f71140
8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8
8ae9c30c2bb4f823d269a0a54b0dd8d4de924461520b2d15183c4420aa382d55
8d95bff25156e15e179589e93e70867ffcb65e4ff16834088bfb995f69b2f9f8
8dd3b91ca60e6a0486326c5c275590dd1d753240c2efa9f94730815813997fee
8e5ab963337784ed8115aa123b98bfc07c46779ad2ca0dc1ebd5ff2066d8b845
8ed705aab168de2a691e736e320622de21c10361048111100d539a75e3a8101e
8fe6638a360a194c7d72568f9fa8a7f92c196653d5034dadd391a51c57c5b920
92b73c1401907b7e391360b9e7bb79de1d2f25896649434a0eb36d72cbb43210
9413ac70f0dfa293eae8e934799be6a1cde8cd96db876ce9bd127c41630847ee
99297d3ca7b65b05d85e5a1f33e9685962430730b2736d628ad8cf01323266b2
9b64a3adaddf9e73cc1ba8465732e00807a306d0ab4c2fe3d49a207b27e7d890
9c21b3dbf862e916d2689453d7f27dcc0539a0239bf323e5f2db397fca0e5d21
9c911ab93cf6099aeeddb19cb1903d0ef838329443c3a0549c754da47f90a70a
9c9f8a04e885955196b786c5dd265420afafe6f60fca767eb43693fc7e0d874a
9d144b8737d7b53227cc0b6bb9920de9091f3db8bc68522a78a0ba6647a0e150
a31a1fd9bd52ee5ebad50ba28eb8a6ef873cc1be5e8d712761c42ae7d7cf47a3
a387c9dfd7660f75732c68210841ac1d540533b17db06dc383c9b920d6cc2dec
a41a08961f5d7e2efc5048aaaa95fccf73212484b5eb95880edcdcf5aab6dc86
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a6f1da8af27838a767ad82d3881fe923f224c7c221f81c8cef0cc47490f262ef
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
abcc56bf73d2b66b3c39d9bfc231a873706c3390610984fcbb69c3ba7bb19e93
b04971f034aaa7d11ff261dfb9de37579a97210eca29ceeaf3d696fce13857e6
b0866549b1f1e9ba2859efe300f0ff9754b30146182f7fe4e169d696bfb02851
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2c385860bebc3614be74a855dff4da24fe5ffa5865df712fc15f26abc74878c
b3f4533979460879a4bbb8ac4d9306815b6b14430e8db8f23ee8b17e992e4b82
b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e
b72dce7fd4e527c1ce955795e14a8fc87395f8460eeb4790eb36e656d199edc9
ba40ec743f18b4d4ec75ade1f588399b8256ab8e67f2818ebb12ce9adc4a6e17
bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27
bfd21dab62097e79d0a8736b29a340243e73d1472d427742117cd299f64461ee
c0489ecb12247fa7c6305949de4d92dba7e183559f236f28a3c449fddca5f52c
c08c0906e9d466f6dfbed61b0817522e048463e048487ca2729b796123f0b4a7
c0fb763f2f2e80a902d63860360c9ae467315055f06d4ac3a8cf0bd5982573ef
c4915527ac7c2fd2ce672afd86c68d44210c057d911bed0bcb7e91c9db27ed9d
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cc49433eff175de8a4e21dc4358b4d76945221a6a08cbaece2514ca09ee0dcd2
cee961b83115cc0c2d2dacebf3744eb2307d32d8cd753350ed61600e262017c7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf8bd56da9c27a9f162ddaa7ac04e6f3217f55621fa538160b558409a306c90f
d24fbeca7e243636b98cd2a0245a752ce002a6974b164ce6e75de44f1c286174
d3231b59737ed6b1c3f0219cb5ac799081fa4624888dc84d2f48470b970174d3
d3adb195b62e3b1173810fb5c8012622a5837dbb74acd708d64688d1d8f2c32d
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d7b6ed9e8166c815f86b056bb3caa013f5ac25dd030cc17ebe1b3fc2ebf06bbb
dae6ffaec90ebdf8d644e69c53b5773def35e0f2ffba2b55492ff35ce37ee48a
de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096
dfdac8d559ad6777c9d1cfab6038b05e4b5a8f38e15963e8708c5545f0f40866
e0371710b9ebdb4886d7e854b54fa3cbf606b7b9cefff78a01c9175a0174baca
e0d71e9e83d526a320cdee881361d1abcf386a92a21c116a31976690453bc75c
e1574f8d5343d7b6218010a1e4a78b5a6f896a45eeab77317b6c29b28bc4509b
e1cff21864c46e1da263fa83c14ed6d190bc5afbdd35188de15f10eb8bedd264
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e56916a41fd9c332af2b9eeaf98126db892a2be83d85b3bbaffdf828be2f2fc2
e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00
e89a316ebf1c63ea09e2b7b5889fb55e1ffb326c7b2b172027da0948f5709f6a
e90c764ee39f9c708d904f3e8a02be12c7dce80d20370af741cd069107a1befe
e92a72b0961cd5277b96030a6883350446962b996402d06208c0f1ffaeb54db6
ea418f0311393888cfee5111296147ec5be28a407f6a213d192d400cbb2f8250
ecc05c55d6e7c828b235348fb0780e48361aaee003dfc79f9fd51f9879a5347f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5737d03b8ab39fead5245d364588723fa5a5e3316b66d3efc40e8b0de976ac5
f5a6c07e4ea32d17c0a919fb3d067b69261842c99c94a58b53e497c125082f04
fa146d638d3c5f0262a686a32a156520687072962e72008a13c35961f7e2e6ef
fd85483cc4b56d5c80412f7079607ecea72f1579a84b852d901e0ad92f63eb1d

www.profinance.ru Open in urlscan Pro 81.177.34.158 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

243 Requests

86 %HTTPS

39 %IPv6

52 Domains

79 Subdomains

56 IPs

10 Countries

2014 kBTransfer

5701 kBSize

75 Cookies

4 Outgoing links

Page URL History

Redirected requests

243 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.profinance.ru Open in urlscan Pro
81.177.34.158 Public Scan

Screenshot
Live screenshot

Full Image

243
Requests

86 %
HTTPS

39 %
IPv6

52
Domains

79
Subdomains

56
IPs

10
Countries

2014 kB
Transfer

5701 kB
Size

75
Cookies

243 HTTP transactions
1 data transactions