geocult.ru Open in urlscan Pro
185.182.111.117 Public Scan

1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
an-x-request-uuid: e2eb282d-95ea-4655-a151-356c72884fae
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI5OTEzODIzNzUyNDY2NTg2Ng%3D%3D
x-proxy-origin: 37.58.57.4; 37.58.57.4; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C855
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDpLklVdFVw2g8myp1B5WMw&google_cver=1

43 B
737 B

40ms
40ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDpLklVdFVw2g8myp1B5WMw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUGv7FXZ0aEXCUXpZIBwmvCCZWWUwJSR-uFgzj1LhKOpTWt97-3ZZU77cjoVZ3bF8DLgLdT5-XHD8Pss6jp-aA2OFKZ8tG5gmpHmOym5lhQV4TWWGAwolkLqsgmITL2iP5aK9CWCe0s2j654dR0yb7dU-dHH3fDXS7zm_zvlW1bcxoBTiM
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q73IVU8n%2Brx4tBDtr78EJb6XopeTKOUAgsrj7Mx%2FabiubE6CwY%2BcjRLZfXLmEv%2ByYW7TNRFqwIhtYkccrLrDWzfPC7%2FW1szUf9HKdO2gjl63KUyMrVjeE1ZMMxJiefTFLTbJyYxHuG4M9w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 830b0efaae6b3623-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDpLklVdFVw2g8myp1B5WMw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C855
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZW7lBGwgmAmK1u-LWDSnIwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDpLklVdFVw2g8myp1B5WMw&google_cver=1

43 B
734 B

21ms
21ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDpLklVdFVw2g8myp1B5WMw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUGv7FXZ0aEXCUXpZIBwmvCCZWWUwJSR-uFgzj1LhKOpTWt97-3ZZU77cjoVZ3bF8DLgLdT5-XHD8Pss6jp-aA2OFKZ8tG5gmpHmOym5lhQV4TWWGAwolkLqsgmITL2iP5aK9CWCe0s2j654dR0yb7dU-dHH3fDXS7zm_zvlW1bcxoBTiM
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oixFT%2BDoTrRAwwpaDEHim%2BlZ1EsVov9MH6B4qAC9gXD0YSApiJ9DlNh6SnIT8BdYJ2eoiRAZjXOZGPseA6et3E%2BYWJcC5Ke1Ig33OcP%2FAJa3yp%2FvbTjfEwOAYzF8ac0Dc6AZlqdA4r8Cqg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 830b0efaeec73623-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDpLklVdFVw2g8myp1B5WMw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame C855
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEJakeL5BnyDrEoGEoDB_a68&google_cver=1

43 B
836 B

22ms
22ms

Image
image/gif

37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEJakeL5BnyDrEoGEoDB_a68&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUGv7FXZ0aEXCUXpZIBwmvCCZWWUwJSR-uFgzj1LhKOpTWt97-3ZZU77cjoVZ3bF8DLgLdT5-XHD8Pss6jp-aA2OFKZ8tG5gmpHmOym5lhQV4TWWGAwolkLqsgmITL2iP5aK9CWCe0s2j654dR0yb7dU-dHH3fDXS7zm_zvlW1bcxoBTiM

Protocol

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
an-x-request-uuid: cf39f946-6339-4ba9-b7a4-9a997b62fd44
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 37.58.57.4; 37.58.57.4; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEJakeL5BnyDrEoGEoDB_a68&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame C855
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI5OTEzODIzNzUyNDY2NTg2Ng%3D%3D

170 B
232 B

69ms
69ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI5OTEzODIzNzUyNDY2NTg2Ng%3D%3D

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
an-x-request-uuid: 4bcaaf6b-e240-4111-a5b1-d89cd1cabdca
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI5OTEzODIzNzUyNDY2NTg2Ng%3D%3D
x-proxy-origin: 37.58.57.4; 37.58.57.4; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BED4 0
20 B 61ms
60ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6232132534374&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BED4 0
20 B 50ms
50ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6232132534374&version=m202309260101&ct=77&x=1&cor=12895752974091387000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame BED4 20 KB
14 KB 181ms
181ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CcD7Xoe4T6LOjRnIZislbl9T7p4lV2fe4o9ZDHw-PMcF90scJtDAl89rpc9CyyidXUgnu1o0tVoJ2YuYj0KFy-QQnv_M7QgzEF3zxbiMjIF_ZLd3F67otPmBZQlKJYwfHs6GZO9GUxuh2734l_5D1v8pagEbASk8XwVgZRChNLpjeDjII&cry=1&dbm_d=AKAmf-BndXJEUKRY0cWdmkigsSHLbYSyQyPeQfwrpp1ii3wGEc9wBFJfpIjrn3CmZUJfEdeiPRtbDOJ8LWKQ42sf9fBR02cv1L3jSx3pj0ON82VRDhhwSsGuZtCsvfO8ExlmHO0ly5YmMKDevptppq2NWE1trTtF6ek80rwhNwTJY6cg7i-za1iE5B10EXH3gz9eE2ZQ2gzpJ5yRF-pxLA-DLRbV2Mgz0e47IvqyNJkKACnGWkAmbMSIpmAoS6I9c_1nEYAKfTxiyJZzL3yiuumBkUh_dYQX_jZmUXaGAou9482YlDBSqeq2IffLV3dhqjlTWNr69JzHflgXR76jrdObNuqelMrEmxnZ1PNIbniE7LUZOk7x7hTW-6kvYA1J3oJowUCeUMLUJF86KsTAW6gDm8ELd_6oOJ1Vz3WQyw13hA42d8FXdudY0GroyrvNrXRvdZpnkoMP29lOmtC3Kii0wqdzmdxHsuX2LuGZY9ddu1LXPxiTrzjEmgnaHLu_UGDnxP7CM0PA35pCiqeTEe7uIEMaQwmttou3k9PooVgmeZSlZXY_dZ5z7euaBiMAFacsc37RlToUR1ccBJIEIQ5SxiQ0nqNljgPvhrQ94b7Jzk0kzsZraKocWrOmCGb1D82_0szt_PqvGZkcrEwFGVnC5TeB8F7x4i9z4nVs90eTIVbdFQpfKl8MacSkN98LhJKxyIiRypd05jW9mpTa4eFQBRuFGCCFgpJu45ig9KX_ijB-19SUTXgiDfK7B--d6vLW7xSUC_93DrfyptN7naXgO_AJDu6XpJhUWL-WyreY5Ut2dE5iCFPFfKIScjFBhGonXdaSbAEexVw60hC-gIXIoxdBRgnG1d8A6LEIzfHSqg3grVBI6vc5SPuhJ5TV_F9PZjODY8QKlzI9UKq_hyZW36PSwhTd6r0AHwTkcDis5K0TwOdzUvqWjz2trTAhJWNbzZHzwbRUMTyG9JYiBVrJbKrsAs_rsDVgVR1C-DjCHpjRwoaqQvFaQByCr2Vd2qRzZIpoU-8tD9uZ_l_CcLY66krVgxtPoyAB-N2YUYFbINdWUQHDgOomP05Z4KThgZOsrxnhTEHT6cmLTc0fFAjGtnU5p5FnJv7-032VXxI6awXDf7Tp9r2145RjMscVeQurIplJ75dmZcKTrsaP3WkR1KiWeQv4MBai8CeYuogsey7GAXcR238r43ZkfcZNNddnvsnjEpbZ25g-18yAzS-N1lHl7zSq5eFcKBv8Capcon2poH3P7Ep5DWGdsZV3oKm4jYFWmTSG2kEkGD6yLP33v6up3d9g38vEoKD0ZJtW2FolZ94cWd-ahC8RmwhZMnzQ4-5KOzv67Q98aHnUHRmhUXNQ1BK3PKcddXCzuwTdv3CXz8wpkK9FJhmakOVKGMZI_n_KSCtf3ABWEPNJruj0VEIMKOcMEepCIRDXcBrVQFuqe_wWTy63f24hXGk988kKv1re6XJPtuas2UvoKZb4gJJiGlFF9GxLVOwHNSRm3kzPyT5yOmkYX6VwmkMQCX3zaE6Tts8c3uGBezRLBniyOR42mZIvCpb5YaiHayF6zIlSmmbKj4IAYfXX_B28WvLU8bFDdok95Z8kZnverFrjM5EV5m_ZZHsgIrF8MH8QeSMMPGb2CiBb9DAWbE5Ji22-dOg20DlJy3r34jV_BS1IKKUe8x_7nYHklJdOpNWgVoeq1CrkrhhQ5E177t1QhZ7D4MS2ksPKpDKyIC9p2rU_cysoXs53aAoeeDF8X90VDwKQXp9dYJv726V8uokXVKkMRzX1ikz9kRqMJZkEb-av1Era8zyN-ni2bK5zpg1_l2vPZtl6tMb88G7KecrLYbAQisd525peFbMne_XNbqA21WhApOT5kEE_YeCRd0DopwJH0CwQsr2h3ylOc8HW7rey85xIM5CkCWGjp-M3qRdWsrJVKGTHtPFClTp1YdAtPWr_mrFwycg5w3PNY4GoB4nGnz_7oKlvA8HMopAww3Ceq6D8Kf2xD2CuB6BGGRwXr5J81j_EUsXUv_fFWBygBsFvYqj_IBF0MksfaKAdRIG3yzpFSKgDM44rqgclLDIiDn2i2CYjkYeQGS6mpkFegxaDSD3pm1ADHCBUMKtcued69BrN-MVM_voKl6VUOpXS5P760Ja1V5beufnCeh4FnxiJUSomuXKPM4hTSdc0GJg1mknAKpdX7C37hkiKvgDUOF-6KcpF9MoIgUAsWBhC-sGXwU9JocCjZT1vLXqrULCP3QYL9h5vq-FNnxuIivQ-_e7y5oIj5GdB69DAsQtvj-1yGghgjteH6tPRz9HW1g48ONMPLyM2YJbLKyKRdVVv8JHvYJQyUIsEl3Omp6eEZM8GkPcwh-H9Qrln0zi0dYyl1LKUD86OWbeZhidXTcfEEYG0dH7y4ZFQF3Vf_ehtywqec3PfhdkkLQgyaL9mnwHP2IbfG-YPMrg1oZDgeKhYt7mcYIWZ2pZQqr_RGR-fOVZpvn449lTKM0Iep6Rcdc3lpKKdBl6vXickPXq5YbqEBROJvcHIWgUoWm7wrhxxzoJKuKHZDZ1_B-YrfMNC1RwsaaMwgsm6k3l-qUObP-kOJgOBdQHGcLvqt4iAdS3Wi36IKKDfsEk03-UX0nb2S1AVOdTALaOj8ypvncDLP3UcDvIWwGlv86nZd7HhrHpj6uAkiUPfEOZvgIbaoi16lZ7qJCD-nKEE2emrqFueIbsLYEEoK-TzOUWI7UUXpmXZt88d1Dxm47zR3MF0NqwdWTKfoOhuDkIqIMo-X_b7-Ra-nDcK4b2mZafJDI2pVQ_qjxRHhpHFqc3TDi2nKBqUkV6TSFlY7WeafsjuDAhlSdAgAANu6hGbG7Q28DMwgeDp7ffTeMqp-77Iw4q-tMg9j6Wz8uAKLO0qpv05_hdvJF2rQc2FgF1NthfWbZVU4xYVpKeDjDVk4hZs7_vEP8V33NYVsxJO039u6Man1F2mDfV9ef6l8GDJDDLX3YyFXdyMpHdiH90ZatNU4HV6x6OBS0XR_qRlQw3bBWdwnGLoe_W5LPJ7j07_qHBADRhmqmfnPdlWO8Yb21G0T1e-V4Cpucb8eAzsQfXBRif70mIgtQUe3WmU5EvwDZedDsSDkke-wbs--1XgQ9yIB0Ki71IZP8K9ovFHkUgfhMsWtpgaWLFRTW0v-Afs53bKKYIqlnFwrbCQ3cVgkyX6XkbPml5HT52cT0ftHBwCRd6VXh5Tsu-HlX8hugy9xsjRz0phh_JyecgY15ZipmjbE71PqqwLoOWbP9Y2SOYR1fson1i7zijJaheWsXx_DkXvm0HRY5-oZXjpxK0wH9XzyTZE3XdsP2sOtcmrGV9VYl7yFHdVRU0xXOTGUJ4eK05YZWb6pO0Hv3weFVYVLcdXdEVbOWRMzn-Y1e6NNDxzDlQx3ajOlLYHyIq7_85I-1bG3UPs8MSi7l--w0BIeMESJ5LXgFkA-2H5iQJQwSniUpIopJXCMakhm84GpqQq1T8kfgZaivGzblQjisBr6cvgIwcfKFknWARKq4fH-5VTz0sdz6EQcGJOvsdibVWAdXSr7ZVRjH8eKPAvYC3daY_sLSa3MAbxjkUuwoRcfpUVM8wFUcFdkVS7pKZSv2hugOLiWtdDyc2G56I4JTncSHv13zJg8CXwrS2A4VsC-FrIiNe38n7q2_BJLSa5ibp4cGw3jSG_9gBcmeWFcw7tCcFWs7ubPkfUtU-RrVyYdoBoIqcT5D6QIHJNASGWM78VPxeV5H44QppwXhjFtXWqzy4CBn9ZFOhQ9bWAKKIdHdGCDKN_UdGUsqoMqJiBZ0zxUa9OUlvlRXi7mDE8jxDsuqDyoKaNFGD_xvV59z-6wuKF-MOKz0-nf4sLDY2XwGZcvvmWwmvWRIhoWcP1zYc6vmXRS00haTfeR04OdgTyu9F1n0HM_y7Gd-09gmbFLSdTcJQ2RmhgKtjcGhXrPIh74KCjvyWIrKFypJ5X_s929QJU2vDozuwnLgO3cnpGJvMR73mcUy5kZqWJ7wIsxh40meWY6nD4EBFNJdePd6C_VnzpVg&cid=CAQSTwDICaaNHF86hX2HGE09gXCpvp5PIVdzkeb0NIfXkQqw_5m9dAa0eWLBMN9iI8iRt7ZlxO9A6HOWQ1YV_X4mOqMEWo6k-wAL_ekJ3kl4Y10YAQ&dc_eid=31079495&dv3_ver=m202309260101&rfl=https%3A%2F%2Fgeocult.ru%2F&ds=l&xdt=1&iif=1&cor=12895752974091387000&adk=250412561&idt=81&cac=0&dtd=29

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

69d993cd01056abdccd12530cde1304fb6b878cff78869eba538865fb73802f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&slotname=6315164047&adk=1815116396&adf=2119670097&pi=t.ma~as.6315164047&w=160&lmt=1693404896&format=160x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403291&bpp=1&bdt=198&idt=335&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1080&ady=1897&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=338
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13829
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F498 0
20 B 52ms
52ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6759143072701&version=m202311060101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F498 0
20 B 52ms
52ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6759143072701&version=m202311060101&ct=77&x=1&cor=5450131159634827000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F498 20 KB
14 KB 161ms
161ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Dd-eRWv55sTlKdBY98EPZF1VOuRlEsgPCkNIJk6MKQOyWv0RBqeI4TUqzf4xIMZTnmTmw3AhMCRu0klM10_K7PUfkL6uDPj_htqdd_6TzK046e4DxsG6zKkYvgkEJleQgMPcAk14FN9qGDRNbwaapt88hi552TBTRydmomkVgHXrByXOY&cry=1&dbm_d=AKAmf-CIw4cPenJlAXaH2r3juh9ZjIG14Apw1jCxPYYzEMxi5HFRC6h_fodNPlnsfZQ_YAN_fe-gk8hFRxKldvcGxwSrjDBjOvVN6t4cnO9ySaqX_EOvGEt5REvPGV3JxGwhdqz1YyajWfUVNMTqk10Id4cuj3rcFOfjWQo9ltoM_eCvZsSWV1xi1wMUHpFaCn7al-dalYaIbJ6Xb8o0TryZxUNJFHk44jdP1-wzs_XxwEUoEtbOzR_VI-GD32VT23HMpNBmOM3pc7wSj1zImYL2IRW3NSfU6lhUL1rP2It7DEjEweaSIc9KsSjMfqXAUDMaWSYJOoL8Q9yp0fqjE4aGsMOYUaRby3wjZ9b-IUL0ykaSs83-BnwebA-YDrC06Ku6l6srzba9Eu2u-OzeR6x0lQOQtcBTxrmDps_yGRlrhUW-Bz8DqhUJ1kR4F814tHok01Blno2JUwLCVm8HmEWqnSUkSSwJXIqot_vnLQI6xvis-v_slKKUTr1z7A-WMSx0JdHf_6jWqFw9XjY3qS9p8tC4pFKEIp7nQZSzkMORw4cMdu6CnwMh0iBtKjGdhe8zvsk1vbCx0bhRtH4pOjMQDqZXbe9d6k3Uib3Z2UsxPDTNGZEEpumB3dwUgo_8TC-TYMCQnxR8BwiupMp6JYsX2kJJZak1Is57L1akaAijBuvcjXpn1IaLrp7atuhBbrvEevO7jFMp9w6gdIGydlba1fwGe6q6N16O0yEBon0rEH3SB-knxKxmf1i8jWMbOGqF7j2UiU75oHM7sKx-prQenOpl6ayKUMZImYQT4yQlcXZRxbhvl6HXZl62rYPCrbezmdQJPSrZhSqRMrBqKthEIbjxff0KGLtdKY1AuLa2MxwQAIHH9BHSXNavTjK9hTfbz3YyJX81QGlzc6kVc4_z2p-4qthzu7XZqQU0IpSgIVt5trZFQK9ELF9hAa5l399o6ag2F91AT-lXiEIt8XvbUQQciyrZuKDwuYpuCMFnTuPNspam_o5oePmLXV6VO3Mp4Q4DPVTDxNQ4dCX5XVgDFAkC1YTfApZQeV4namS6h7rJ4vAADFthrXWV0LavUh8ck6-8Hc6fNX8mAPpPmge0FY82NK9gKemCiXESVbgMn3itrugEIBjJe9SQ5hByy91K0cX08ujLAzdXJnkR-vn6SC4v3975wB_34pnnaxqV_U3PxoGbS7AeSH-6EdpX8nsNj4q8-8LdSc3oxF6bXAUQtr9wy_Hjox053vpKzTx_vRRGN6dGVgy1aqm2P8EL5XKHBHsu0zaG1rtytn9_nIs2CWVELCMaVa5vofjLUJmEVCZgVR0KQ5RgWVwEg5Z8SXqwk42mb9qwBdrYjddMtrcSn9ERgQ2LWFsH15Wk_WhCZxqVleEIMCkwaUqOXxZZB_irzNIx_bbVkqKzze1Ra1AsaLUTuSwvpdD3S7zLOx3uxxeoeWvske8nhFt2NJvfaHDAfOTVtrctjurUaq2yvxYep9ipo-7o9oBx8vQ4pe6tBBV6pw_5bjo15OL1DDg2XBkIZDlCtAmlvNbHNmfzHrlDgWjgHKb_2Oq-hnKOuDBY8iQhpQhVnGVfC-uaOCqG_0mpzdMLQY3D6PS-lGRJOwAXZh1oBo10MLrtTy1aDivXPBUnUoy97hcKWT8YUIivAj7qTENc4golTMIA8Hp3s3cAnkUzJJdIHO8DkQdFDXbwD9XDir95tM8igvSYZuELicwNrEC88VV4hwmVHbq4wbpoF9J5h2OyQsR7IyXeR9JqXWXACwNHPSsj2l76l31YEVOY_BQvVyiohlZhP1p11g8zR-MbG3zb8ii8rARpCDD0_auGXvLlmqYCgx5w82x0FvixabTwGBHhnHi5TtUqQ_wHEl4G8i1PUjzlWSCAtoSprvmH6oULaIDX84USI9wEbAcP4rT4KwIvhCG9zSH6Wjw0hTLM-ExbRYhIPbLdXeEktDvK6pIi09yBS6sgM-QTrPxkMtLvx8x7SznKo4ZiySXUXzItGaJuz6w4D-DAdKy0KF19XzxPHIjxYB7nnF315PKNTT2yA7zL42M2uXx-_QGEOvMSkNam-Npi16iRLYSI7QdSH-uUo8mpGHRDhTZtiNteWrv4u4orXuUKUtCRsmW9C5DTWPwFe2yV7jU7kL7XBk6srAY5HTbwLFSc9q200RSkB9OrxqmzWMihJV8ELnmt6vBKjqFvD0OSaqdbabqW-oQE42lSSWXrztp_hQIEKxMxSdjSRHPghmeEbew2Xim2931B4UaxVlbzYalXSA-BHX7E4aIoJNjG6VG44RJfpDT9Z_lQvC2d-qF107ti3a6mjOeazO85nPm71uZRO2JgtEOyTBnI3oHOR8VI9DR3csX9piHmfjnBMC7Dpe3zlhC8rSqb6_BBATnkjTeOr5jveijs3bP3-CoyMYVwNyVd-NXS2IhBesO0MU6kIlruSVfVYSFvb3SKeX0kvkWDqwbVns8xdZhffARjJCwgJjd7ieq2Q0zY2Lbcih5kepXfVIWV6WjbDZD10p_rjfwUclaB7lnr2jnfd9nfvmsXjRWR66w6zfSQZ9Yto7uyHZJI1sywVUISWlM13vt4cSG2J4PsqV3BmnCdd6KlMyTSt3Xe_90ZbhVP-NRuMLqs6H5axqJOnLBBMBRoTDOSltb0QJWMsqOZyABxPWN_r0eeE1cIWIYFAorh_e-04C7P0zT83p7dZ-71JQBueDCIBdvFmPzcEzNr76o_gkLTgdVoO3ZHhMViSgVks4LHHnfAfWGTs6ZeSZVa8UhQ6acuHBEpCPhBTmb0pfdmoEmvGbohfYV8EEKDNhu0zQYlCz9r57Fq32C7jbypD5ItIitP-eL2kEai9s_DZvieRLPF_OpwKbPUKPmTxoFKwPtfImV7fCoe33ciBbFBBC4nV-jA0dPjNnzRvV2BQWQuliZcLw8zycbLYVUYUVXhzC1vWi9UlBpwkrk9SqaFQ-tW0MTQDbp5XTVa4xLpkrH01vb76e1mF8uNAGYef1NOq7vJReHsOP0oEWiGGx-MMgcFb8FGClVKbfaFBltp5Avi0TS0GPOi2WQbCJgjZumoJDozZ37DVCZAOlKJw-mI-Uzi2DaPHJEZ6kFIt3b-_kY7dzlDB_3qQOVQB_Z_HV0GrpH9f3v1h6sEF-AkykRy3lm2wB_XftT5Jq5HL8xARxkBWKjSSw0l2N33p380-y9iARBVzorxVPr0PhI5kFRxAlai_LDOvqctnbjbBJDc7hK7RcvfyGGDpnBWQ7Ei8A6VBp2gdAmNdkbBY7yHx5uBxWszBx4CFnMc0D-x26GvPLxUkMkGSpflx_uZ7rKtjZzjFZZAevRM5wWhdCKFwwtBig2PDKxUhESerBKzaYL-gLV0_EtVCl2RhhthVdEAxX7PkfBnYKlHD-rT811p_7PWWGZOrVfl8pmkmNgGMWbvBWLjomSoqy3Wz42A51Nft0Ly4xmEFlQFSywaLuWSBYDw4UDrVdCYZQupZy3YDYJehN5JCeew68OWkHEXTneBv39BuWgnRNoAtY_okaSDB7N3ih3TU0gTGr80kkynVvnbyoqGghlCKP_OGK3qMsXIu7S0Dpjx7MHkXALuTd9zwjXsdNgKBG_j5OmIXV8SHfPkmVmkTxHqsMBqbXtSMNYw9FZmBUQDx_zw8WM_EgohNWl8Br_9-Qrr1Qx0lVgUmfyvYSrkFXZFRzl9XL30kd5IhgiaVjhFCosmZZyHDBZwkKs37WvUIaAxuQ5l3KHDilMhKcUuZR-egiLgmFe-WtxzVGWACm939s0r2C_jBBqSJTgND-0alsiwaddBdxhN0geSqwuLhFG_Hb7djWpAG3_vbj3Y5tKWu2oiikQ-MZlxK69kQx73QFHQFEYcVJDwuV_08m2QDdyr3Ay0IBcLFBK6gd5XFXyS7NfdtUBZwP19N8XzxTrXVUz_Ub0QMju9cL3aRl8JvNqhCXx_5-qw70ROkmtPbJUhzDs3qOtROJiHFB2rdku8IEaKbT64UtpqMujGyNd0PpdaYA8XCv3EXvWeQ4srjXBo&cid=CAQSTgDICaaNo1mRdXugpOPTt7ijsWk5xc078XSXSYdbdmDuGYir-_9siyqlnL4VWNhahiguHsdKJJmO-MXMyokpJCxpXt7Njt0GKpU-jPUWIhgB&dc_eid=31079496&dv3_ver=m202311060101&rfl=https%3A%2F%2Fgeocult.ru%2F&ds=l&xdt=1&iif=1&cor=5450131159634827000&adk=2228999114&idt=158&cac=0&dtd=7

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2b3849b22078f260721044127668c4e71ce08631a88671c08150b4cccf0d2e4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=6212002511&adk=1854347006&adf=3400082548&pi=t.ma~as.6212002511&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403292&bpp=1&bdt=200&idt=347&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=2725&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=348
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13920
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/ 160 KB
55 KB 84ms
84ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f56c992220809803659fac17b031df76868dc17731007bd737347e63a3b09fc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55944
x-xss-protection: 0
server: cafe
etag: 11986719648617664176
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 08:53:24 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8959 109 KB
41 KB 526ms
526ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=371214980&pi=t.aa~a.542385254~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1252&idt=-M&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280&nras=2&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=776&ady=1268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef5557d1c83d5e10f4aa2ce5a77f8ec1aa100eb9588a00038bafc52d8c07a3cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://geocult.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 41680
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 08:53:24 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2A70 29 KB
13 KB 512ms
512ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5c14cd03d445fd28ab9a6ab1dc666d783d6aa4af40fc4ee991e48c47165a2b28

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://geocult.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 12872
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 08:53:24 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame BED4 41 KB
14 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CcD7Xoe4T6LOjRnIZislbl9T7p4lV2fe4o9ZDHw-PMcF90scJtDAl89rpc9CyyidXUgnu1o0tVoJ2YuYj0KFy-QQnv_M7QgzEF3zxbiMjIF_ZLd3F67otPmBZQlKJYwfHs6GZO9GUxuh2734l_5D1v8pagEbASk8XwVgZRChNLpjeDjII&cry=1&dbm_d=AKAmf-BndXJEUKRY0cWdmkigsSHLbYSyQyPeQfwrpp1ii3wGEc9wBFJfpIjrn3CmZUJfEdeiPRtbDOJ8LWKQ42sf9fBR02cv1L3jSx3pj0ON82VRDhhwSsGuZtCsvfO8ExlmHO0ly5YmMKDevptppq2NWE1trTtF6ek80rwhNwTJY6cg7i-za1iE5B10EXH3gz9eE2ZQ2gzpJ5yRF-pxLA-DLRbV2Mgz0e47IvqyNJkKACnGWkAmbMSIpmAoS6I9c_1nEYAKfTxiyJZzL3yiuumBkUh_dYQX_jZmUXaGAou9482YlDBSqeq2IffLV3dhqjlTWNr69JzHflgXR76jrdObNuqelMrEmxnZ1PNIbniE7LUZOk7x7hTW-6kvYA1J3oJowUCeUMLUJF86KsTAW6gDm8ELd_6oOJ1Vz3WQyw13hA42d8FXdudY0GroyrvNrXRvdZpnkoMP29lOmtC3Kii0wqdzmdxHsuX2LuGZY9ddu1LXPxiTrzjEmgnaHLu_UGDnxP7CM0PA35pCiqeTEe7uIEMaQwmttou3k9PooVgmeZSlZXY_dZ5z7euaBiMAFacsc37RlToUR1ccBJIEIQ5SxiQ0nqNljgPvhrQ94b7Jzk0kzsZraKocWrOmCGb1D82_0szt_PqvGZkcrEwFGVnC5TeB8F7x4i9z4nVs90eTIVbdFQpfKl8MacSkN98LhJKxyIiRypd05jW9mpTa4eFQBRuFGCCFgpJu45ig9KX_ijB-19SUTXgiDfK7B--d6vLW7xSUC_93DrfyptN7naXgO_AJDu6XpJhUWL-WyreY5Ut2dE5iCFPFfKIScjFBhGonXdaSbAEexVw60hC-gIXIoxdBRgnG1d8A6LEIzfHSqg3grVBI6vc5SPuhJ5TV_F9PZjODY8QKlzI9UKq_hyZW36PSwhTd6r0AHwTkcDis5K0TwOdzUvqWjz2trTAhJWNbzZHzwbRUMTyG9JYiBVrJbKrsAs_rsDVgVR1C-DjCHpjRwoaqQvFaQByCr2Vd2qRzZIpoU-8tD9uZ_l_CcLY66krVgxtPoyAB-N2YUYFbINdWUQHDgOomP05Z4KThgZOsrxnhTEHT6cmLTc0fFAjGtnU5p5FnJv7-032VXxI6awXDf7Tp9r2145RjMscVeQurIplJ75dmZcKTrsaP3WkR1KiWeQv4MBai8CeYuogsey7GAXcR238r43ZkfcZNNddnvsnjEpbZ25g-18yAzS-N1lHl7zSq5eFcKBv8Capcon2poH3P7Ep5DWGdsZV3oKm4jYFWmTSG2kEkGD6yLP33v6up3d9g38vEoKD0ZJtW2FolZ94cWd-ahC8RmwhZMnzQ4-5KOzv67Q98aHnUHRmhUXNQ1BK3PKcddXCzuwTdv3CXz8wpkK9FJhmakOVKGMZI_n_KSCtf3ABWEPNJruj0VEIMKOcMEepCIRDXcBrVQFuqe_wWTy63f24hXGk988kKv1re6XJPtuas2UvoKZb4gJJiGlFF9GxLVOwHNSRm3kzPyT5yOmkYX6VwmkMQCX3zaE6Tts8c3uGBezRLBniyOR42mZIvCpb5YaiHayF6zIlSmmbKj4IAYfXX_B28WvLU8bFDdok95Z8kZnverFrjM5EV5m_ZZHsgIrF8MH8QeSMMPGb2CiBb9DAWbE5Ji22-dOg20DlJy3r34jV_BS1IKKUe8x_7nYHklJdOpNWgVoeq1CrkrhhQ5E177t1QhZ7D4MS2ksPKpDKyIC9p2rU_cysoXs53aAoeeDF8X90VDwKQXp9dYJv726V8uokXVKkMRzX1ikz9kRqMJZkEb-av1Era8zyN-ni2bK5zpg1_l2vPZtl6tMb88G7KecrLYbAQisd525peFbMne_XNbqA21WhApOT5kEE_YeCRd0DopwJH0CwQsr2h3ylOc8HW7rey85xIM5CkCWGjp-M3qRdWsrJVKGTHtPFClTp1YdAtPWr_mrFwycg5w3PNY4GoB4nGnz_7oKlvA8HMopAww3Ceq6D8Kf2xD2CuB6BGGRwXr5J81j_EUsXUv_fFWBygBsFvYqj_IBF0MksfaKAdRIG3yzpFSKgDM44rqgclLDIiDn2i2CYjkYeQGS6mpkFegxaDSD3pm1ADHCBUMKtcued69BrN-MVM_voKl6VUOpXS5P760Ja1V5beufnCeh4FnxiJUSomuXKPM4hTSdc0GJg1mknAKpdX7C37hkiKvgDUOF-6KcpF9MoIgUAsWBhC-sGXwU9JocCjZT1vLXqrULCP3QYL9h5vq-FNnxuIivQ-_e7y5oIj5GdB69DAsQtvj-1yGghgjteH6tPRz9HW1g48ONMPLyM2YJbLKyKRdVVv8JHvYJQyUIsEl3Omp6eEZM8GkPcwh-H9Qrln0zi0dYyl1LKUD86OWbeZhidXTcfEEYG0dH7y4ZFQF3Vf_ehtywqec3PfhdkkLQgyaL9mnwHP2IbfG-YPMrg1oZDgeKhYt7mcYIWZ2pZQqr_RGR-fOVZpvn449lTKM0Iep6Rcdc3lpKKdBl6vXickPXq5YbqEBROJvcHIWgUoWm7wrhxxzoJKuKHZDZ1_B-YrfMNC1RwsaaMwgsm6k3l-qUObP-kOJgOBdQHGcLvqt4iAdS3Wi36IKKDfsEk03-UX0nb2S1AVOdTALaOj8ypvncDLP3UcDvIWwGlv86nZd7HhrHpj6uAkiUPfEOZvgIbaoi16lZ7qJCD-nKEE2emrqFueIbsLYEEoK-TzOUWI7UUXpmXZt88d1Dxm47zR3MF0NqwdWTKfoOhuDkIqIMo-X_b7-Ra-nDcK4b2mZafJDI2pVQ_qjxRHhpHFqc3TDi2nKBqUkV6TSFlY7WeafsjuDAhlSdAgAANu6hGbG7Q28DMwgeDp7ffTeMqp-77Iw4q-tMg9j6Wz8uAKLO0qpv05_hdvJF2rQc2FgF1NthfWbZVU4xYVpKeDjDVk4hZs7_vEP8V33NYVsxJO039u6Man1F2mDfV9ef6l8GDJDDLX3YyFXdyMpHdiH90ZatNU4HV6x6OBS0XR_qRlQw3bBWdwnGLoe_W5LPJ7j07_qHBADRhmqmfnPdlWO8Yb21G0T1e-V4Cpucb8eAzsQfXBRif70mIgtQUe3WmU5EvwDZedDsSDkke-wbs--1XgQ9yIB0Ki71IZP8K9ovFHkUgfhMsWtpgaWLFRTW0v-Afs53bKKYIqlnFwrbCQ3cVgkyX6XkbPml5HT52cT0ftHBwCRd6VXh5Tsu-HlX8hugy9xsjRz0phh_JyecgY15ZipmjbE71PqqwLoOWbP9Y2SOYR1fson1i7zijJaheWsXx_DkXvm0HRY5-oZXjpxK0wH9XzyTZE3XdsP2sOtcmrGV9VYl7yFHdVRU0xXOTGUJ4eK05YZWb6pO0Hv3weFVYVLcdXdEVbOWRMzn-Y1e6NNDxzDlQx3ajOlLYHyIq7_85I-1bG3UPs8MSi7l--w0BIeMESJ5LXgFkA-2H5iQJQwSniUpIopJXCMakhm84GpqQq1T8kfgZaivGzblQjisBr6cvgIwcfKFknWARKq4fH-5VTz0sdz6EQcGJOvsdibVWAdXSr7ZVRjH8eKPAvYC3daY_sLSa3MAbxjkUuwoRcfpUVM8wFUcFdkVS7pKZSv2hugOLiWtdDyc2G56I4JTncSHv13zJg8CXwrS2A4VsC-FrIiNe38n7q2_BJLSa5ibp4cGw3jSG_9gBcmeWFcw7tCcFWs7ubPkfUtU-RrVyYdoBoIqcT5D6QIHJNASGWM78VPxeV5H44QppwXhjFtXWqzy4CBn9ZFOhQ9bWAKKIdHdGCDKN_UdGUsqoMqJiBZ0zxUa9OUlvlRXi7mDE8jxDsuqDyoKaNFGD_xvV59z-6wuKF-MOKz0-nf4sLDY2XwGZcvvmWwmvWRIhoWcP1zYc6vmXRS00haTfeR04OdgTyu9F1n0HM_y7Gd-09gmbFLSdTcJQ2RmhgKtjcGhXrPIh74KCjvyWIrKFypJ5X_s929QJU2vDozuwnLgO3cnpGJvMR73mcUy5kZqWJ7wIsxh40meWY6nD4EBFNJdePd6C_VnzpVg&cid=CAQSTwDICaaNHF86hX2HGE09gXCpvp5PIVdzkeb0NIfXkQqw_5m9dAa0eWLBMN9iI8iRt7ZlxO9A6HOWQ1YV_X4mOqMEWo6k-wAL_ekJ3kl4Y10YAQ&dc_eid=31079495&dv3_ver=m202309260101&rfl=https%3A%2F%2Fgeocult.ru%2F&ds=l&xdt=1&iif=1&cor=12895752974091387000&adk=250412561&idt=81&cac=0&dtd=29

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 312496
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Nov 2024 18:05:08 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTc2NjQwNDIzMTYxMAogIHNlcnZlcl9pcDogMTI2MDY5MzEyCiAgcHJvY2Vzc19pZDogMjI2NTUxMDIxNQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame BED4 0
949 B 99ms
51ms Image
image/png 142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTc2NjQwNDIzMTYxMAogIHNlcnZlcl9pcDogMTI2MDY5MzEyCiAgcHJvY2Vzc19pZDogMjI2NTUxMDIxNQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiA5NzU5MDQ5MTg1NzkzMzc2NDgyCmRlYnVnX2tleTogMjc4MjU5ODExNzc5MTY2NTQ3OQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QUk9EVUNUX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjMtMTItMDUiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0ZMT09ETElHSFRfQ09ORklHX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxMTg2ODk0MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT1JFX1BMQVRGT1JNX1NFUlZJQ0UKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBVEZPUk1fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9RVUVSWV9DT1VOVFJZCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIlVTIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFDRU1FTlRfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMzMjE3NTQzNwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQURWRVJUSVNFUl9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogODc4MjQzNjk2CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19MSU5FX0lURU1fSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDE2NjYwMTQyMDYzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19DUkVBVElWRV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNDE2MjE2Nzg3CiAgfQp9CmFyY2hldHlwZV9pZDogMTIKYXJjaGV0eXBlX2lkOiAxMwphcmNoZXR5cGVfaWQ6IDE0CmFyY2hldHlwZV9pZDogMTUKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL3JlZGludGVsbGlnZW5jZS5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9hZC1zcnYubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8va2xpY2std2VsdC5kZSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNAo

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x67c171d8ba4de45f0000000000000000","13":"0xb668e6866b4772090000000000000000","14":"0xd33526cf05b9123c0000000000000000","15":"0x7e2690c92362edfc0000000000000000"},"debug_key":"2782598117791665479","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"9759049185793376482"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 33lgkyejwpt3 Show response
hal9000.redintelligence.net/zone/ Frame BED4 11 KB
4 KB 44ms
13ms Script
text/html 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/33lgkyejwpt3?subid=&gdpr=&gdpr_consent=&rnd=1701766403724336&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCfoufA-VuZfCaLLOptOUPrrus0Amm5b2gaZ2cnKfJD_AuEAEg1MealwFglYKAgLAHyAEJqQItzKQgCzCyPqgDAcgDmwSqBN4BT9BwQfF9DL_2kxjOU1C2wJ7GRpHnmmOuawCGopIlVvqR6aExWTqG8r94ZItq_EpN3pWqhW1VjsMNpTsNkzTeIrKGobzEpxJF3bRebclhBgeh9gNtT1OCc7QympbuhCq3WWK-kzLMsfwvqgmfyyMINWOXrjUZXs79A7y1r7s4zga341uSrW-8VqdpKyMbZGLMVID9yPzgqzI4KZiTqSkMc2R3GJ5pXF7vuLF1qFNeYuEYkPFbh-3U_x1XDiHnDsOhFFzxP16PAfHB9Cb6JSjD-NYNpOWybH5qXU90iqlgwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WLDy6-_194IDgAoBmAsByAsBgAwBogwUKhIKEOS0sQLutbECtbixAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNHF86hX2HGE09gXCpvp5PIVdzkeb0NIfXkQqw_5m9dAa0eWLBMN9iI8iRt7ZlxO9A6HOWQ1YV_X4mOqMEWo6k-wAL_ekJ3kl4Y10YAQ%26sig%3DAOD64_1axh9X3It710RN4QiVoXZAS8rOLg%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-C0wm2_mn2FDxxYfh2Hl2xPPBKOMrmYM9iY34F1Qcx7YivITHfQU_2XaYgvdkqiCQbmousCha60B6Hc14IQKTCIQ9NXjAOCQ0O3HOUST3wnq0EiD4lLZlZS-0jSjb_ruDSOMIxewV2jeE5s-NUrYNKIGgKPRuMCA47cPs5Y8RBJ_IWa2w0%26cry%3D1%26dbm_d%3DAKAmf-DvhNlxJhFv_lEzT4wXw8dPrMc9LZ5RGIi76wKuXsX_rJo2JYGilxRpz_pImeMLnQBdDfeHUVU3BzO2ZGFej5DV24TwJ6AmA-xWURhYwnNgAlWyjJF3HUTf98jhXZGKEKYq5uqVqedX3jVi01HCokSbhWFfRILKd8fr-hSLAb0jrz9kB-OZrJhaUcunebCWdcmxQK3D59vEwNozwQT-ZUHmv87C3Sb2LmZyi48j2VXzxcqAnpmnaL2qseDaUWtpORUxe-8hInHO0zsp4XnTwURq1riH-eaKiTa5j1wJOPPuTxtu5qDJ86X3O4t9j1wZCwruPQ5hR7lUSDMxcQetaJ713swugb95JHGZNCUuyiLBAtGuxzGGY01Rb73jLo0TISilU7ht28Fdy_r5kT5znaoJeX-BeKpgwAFwBz9aBQJyUAqwuLC72Eh_6MIXcjMiBDCgzaffYVfqs8tIXK78ocQXyaIN-74eM3EZmiWUaHxMOX0zL1y05AYmuZ0SqGymghvaQZ93nCu4Y_rU40uZbvZ3PR_qGeTb-Jc9iO_anR5AOSuXqU4%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&slotname=6315164047&adk=1815116396&adf=2119670097&pi=t.ma~as.6315164047&w=160&lmt=1693404896&format=160x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403291&bpp=1&bdt=198&idt=335&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1080&ady=1897&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=338
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: 4d75d5593f37f843609d062535c32912dce832ac9e8f86e9bbb88cc52ff12b27

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 08:53:24 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4160
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231130/r20110914/ Frame 54FA 9 KB
4 KB 13ms
12ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231130/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9f6e245ec73203f99ecb888db309a2bdaf91f8696c1cebaa94e477a953fab30a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://geocult.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 22852
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4121
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 02:32:32 GMT
etag: 12051592065903069241
expires: Tue, 19 Dec 2023 02:32:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 79E0 624 B
245 B 54ms
54ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMY0oro4gEwAQ&v=APEucNV43S2kbvK3AoU5zrPTMQSg0b-YSdPWgVZlxicq4diHS-brAYXEVxTU7kZKUz0eSeZ-F3hGEk2oVyNBMthDyC49LzL31-cak_LSE236xPS_kvuIaQA_iO23YqCBuy3p9RrQnVI9emy78eXBpZLrirA6fMOdoJ0XuU_hz7Cr29eBOyFe160

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231130/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 08:53:24 GMT
expires: Tue, 05 Dec 2023 08:53:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame BC14 172 KB
61 KB 50ms
14ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 11:48:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75895
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Dec 2023 11:48:29 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231130/r20110914/elements/html/ Frame BC14 7 KB
3 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231130/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 20:43:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 43817
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 20:43:07 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231130/r20110914/ Frame BC14 24 KB
9 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231130/r20110914/abg_lite_fy2021.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50a7b1c8d19c1d74836d2aaaaaf1fb2bde2a42708f6d4bb4c9168d7609503fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:32:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48065
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9313
x-xss-protection: 0
server: cafe
etag: 8709779397046830652
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 19:32:19 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame BC14 41 KB
14 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 312496
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Nov 2024 18:05:08 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/ Frame BC14 3 KB
1 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/window_focus_fy2021.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 22:00:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39177
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 22:00:27 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/ Frame BC14 20 KB
8 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

240ed2cf95df9fa682cc2a820a6681e8faa474dcd678ffbe844351ccbda9bb6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:51:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 139
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8549
x-xss-protection: 0
server: cafe
etag: 755982428571291914
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 08:51:05 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame BC14 202 KB
64 KB 55ms
54ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Dec 2023 08:53:24 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame BC14 42 B
63 B 47ms
47ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ANpqU5YhdyEEnvPJ_sDPtcyuKVmgkwOHtj9wX28V5bO1XoGz_HfhWo8FjBkIQUJ9aK0HdSYvhwnB6rioAERbJAEZLnssWTp5i8LjTEUyaN2oa_lNg

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame EF55 38 KB
13 KB 14ms
14ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 126288
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 03 Dec 2023 21:48:36 GMT
expires: Mon, 02 Dec 2024 21:48:36 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 48ms
48ms Fetch
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-2920555573584698&plah=geocult.ru
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://geocult.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame F498 41 KB
14 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Dd-eRWv55sTlKdBY98EPZF1VOuRlEsgPCkNIJk6MKQOyWv0RBqeI4TUqzf4xIMZTnmTmw3AhMCRu0klM10_K7PUfkL6uDPj_htqdd_6TzK046e4DxsG6zKkYvgkEJleQgMPcAk14FN9qGDRNbwaapt88hi552TBTRydmomkVgHXrByXOY&cry=1&dbm_d=AKAmf-CIw4cPenJlAXaH2r3juh9ZjIG14Apw1jCxPYYzEMxi5HFRC6h_fodNPlnsfZQ_YAN_fe-gk8hFRxKldvcGxwSrjDBjOvVN6t4cnO9ySaqX_EOvGEt5REvPGV3JxGwhdqz1YyajWfUVNMTqk10Id4cuj3rcFOfjWQo9ltoM_eCvZsSWV1xi1wMUHpFaCn7al-dalYaIbJ6Xb8o0TryZxUNJFHk44jdP1-wzs_XxwEUoEtbOzR_VI-GD32VT23HMpNBmOM3pc7wSj1zImYL2IRW3NSfU6lhUL1rP2It7DEjEweaSIc9KsSjMfqXAUDMaWSYJOoL8Q9yp0fqjE4aGsMOYUaRby3wjZ9b-IUL0ykaSs83-BnwebA-YDrC06Ku6l6srzba9Eu2u-OzeR6x0lQOQtcBTxrmDps_yGRlrhUW-Bz8DqhUJ1kR4F814tHok01Blno2JUwLCVm8HmEWqnSUkSSwJXIqot_vnLQI6xvis-v_slKKUTr1z7A-WMSx0JdHf_6jWqFw9XjY3qS9p8tC4pFKEIp7nQZSzkMORw4cMdu6CnwMh0iBtKjGdhe8zvsk1vbCx0bhRtH4pOjMQDqZXbe9d6k3Uib3Z2UsxPDTNGZEEpumB3dwUgo_8TC-TYMCQnxR8BwiupMp6JYsX2kJJZak1Is57L1akaAijBuvcjXpn1IaLrp7atuhBbrvEevO7jFMp9w6gdIGydlba1fwGe6q6N16O0yEBon0rEH3SB-knxKxmf1i8jWMbOGqF7j2UiU75oHM7sKx-prQenOpl6ayKUMZImYQT4yQlcXZRxbhvl6HXZl62rYPCrbezmdQJPSrZhSqRMrBqKthEIbjxff0KGLtdKY1AuLa2MxwQAIHH9BHSXNavTjK9hTfbz3YyJX81QGlzc6kVc4_z2p-4qthzu7XZqQU0IpSgIVt5trZFQK9ELF9hAa5l399o6ag2F91AT-lXiEIt8XvbUQQciyrZuKDwuYpuCMFnTuPNspam_o5oePmLXV6VO3Mp4Q4DPVTDxNQ4dCX5XVgDFAkC1YTfApZQeV4namS6h7rJ4vAADFthrXWV0LavUh8ck6-8Hc6fNX8mAPpPmge0FY82NK9gKemCiXESVbgMn3itrugEIBjJe9SQ5hByy91K0cX08ujLAzdXJnkR-vn6SC4v3975wB_34pnnaxqV_U3PxoGbS7AeSH-6EdpX8nsNj4q8-8LdSc3oxF6bXAUQtr9wy_Hjox053vpKzTx_vRRGN6dGVgy1aqm2P8EL5XKHBHsu0zaG1rtytn9_nIs2CWVELCMaVa5vofjLUJmEVCZgVR0KQ5RgWVwEg5Z8SXqwk42mb9qwBdrYjddMtrcSn9ERgQ2LWFsH15Wk_WhCZxqVleEIMCkwaUqOXxZZB_irzNIx_bbVkqKzze1Ra1AsaLUTuSwvpdD3S7zLOx3uxxeoeWvske8nhFt2NJvfaHDAfOTVtrctjurUaq2yvxYep9ipo-7o9oBx8vQ4pe6tBBV6pw_5bjo15OL1DDg2XBkIZDlCtAmlvNbHNmfzHrlDgWjgHKb_2Oq-hnKOuDBY8iQhpQhVnGVfC-uaOCqG_0mpzdMLQY3D6PS-lGRJOwAXZh1oBo10MLrtTy1aDivXPBUnUoy97hcKWT8YUIivAj7qTENc4golTMIA8Hp3s3cAnkUzJJdIHO8DkQdFDXbwD9XDir95tM8igvSYZuELicwNrEC88VV4hwmVHbq4wbpoF9J5h2OyQsR7IyXeR9JqXWXACwNHPSsj2l76l31YEVOY_BQvVyiohlZhP1p11g8zR-MbG3zb8ii8rARpCDD0_auGXvLlmqYCgx5w82x0FvixabTwGBHhnHi5TtUqQ_wHEl4G8i1PUjzlWSCAtoSprvmH6oULaIDX84USI9wEbAcP4rT4KwIvhCG9zSH6Wjw0hTLM-ExbRYhIPbLdXeEktDvK6pIi09yBS6sgM-QTrPxkMtLvx8x7SznKo4ZiySXUXzItGaJuz6w4D-DAdKy0KF19XzxPHIjxYB7nnF315PKNTT2yA7zL42M2uXx-_QGEOvMSkNam-Npi16iRLYSI7QdSH-uUo8mpGHRDhTZtiNteWrv4u4orXuUKUtCRsmW9C5DTWPwFe2yV7jU7kL7XBk6srAY5HTbwLFSc9q200RSkB9OrxqmzWMihJV8ELnmt6vBKjqFvD0OSaqdbabqW-oQE42lSSWXrztp_hQIEKxMxSdjSRHPghmeEbew2Xim2931B4UaxVlbzYalXSA-BHX7E4aIoJNjG6VG44RJfpDT9Z_lQvC2d-qF107ti3a6mjOeazO85nPm71uZRO2JgtEOyTBnI3oHOR8VI9DR3csX9piHmfjnBMC7Dpe3zlhC8rSqb6_BBATnkjTeOr5jveijs3bP3-CoyMYVwNyVd-NXS2IhBesO0MU6kIlruSVfVYSFvb3SKeX0kvkWDqwbVns8xdZhffARjJCwgJjd7ieq2Q0zY2Lbcih5kepXfVIWV6WjbDZD10p_rjfwUclaB7lnr2jnfd9nfvmsXjRWR66w6zfSQZ9Yto7uyHZJI1sywVUISWlM13vt4cSG2J4PsqV3BmnCdd6KlMyTSt3Xe_90ZbhVP-NRuMLqs6H5axqJOnLBBMBRoTDOSltb0QJWMsqOZyABxPWN_r0eeE1cIWIYFAorh_e-04C7P0zT83p7dZ-71JQBueDCIBdvFmPzcEzNr76o_gkLTgdVoO3ZHhMViSgVks4LHHnfAfWGTs6ZeSZVa8UhQ6acuHBEpCPhBTmb0pfdmoEmvGbohfYV8EEKDNhu0zQYlCz9r57Fq32C7jbypD5ItIitP-eL2kEai9s_DZvieRLPF_OpwKbPUKPmTxoFKwPtfImV7fCoe33ciBbFBBC4nV-jA0dPjNnzRvV2BQWQuliZcLw8zycbLYVUYUVXhzC1vWi9UlBpwkrk9SqaFQ-tW0MTQDbp5XTVa4xLpkrH01vb76e1mF8uNAGYef1NOq7vJReHsOP0oEWiGGx-MMgcFb8FGClVKbfaFBltp5Avi0TS0GPOi2WQbCJgjZumoJDozZ37DVCZAOlKJw-mI-Uzi2DaPHJEZ6kFIt3b-_kY7dzlDB_3qQOVQB_Z_HV0GrpH9f3v1h6sEF-AkykRy3lm2wB_XftT5Jq5HL8xARxkBWKjSSw0l2N33p380-y9iARBVzorxVPr0PhI5kFRxAlai_LDOvqctnbjbBJDc7hK7RcvfyGGDpnBWQ7Ei8A6VBp2gdAmNdkbBY7yHx5uBxWszBx4CFnMc0D-x26GvPLxUkMkGSpflx_uZ7rKtjZzjFZZAevRM5wWhdCKFwwtBig2PDKxUhESerBKzaYL-gLV0_EtVCl2RhhthVdEAxX7PkfBnYKlHD-rT811p_7PWWGZOrVfl8pmkmNgGMWbvBWLjomSoqy3Wz42A51Nft0Ly4xmEFlQFSywaLuWSBYDw4UDrVdCYZQupZy3YDYJehN5JCeew68OWkHEXTneBv39BuWgnRNoAtY_okaSDB7N3ih3TU0gTGr80kkynVvnbyoqGghlCKP_OGK3qMsXIu7S0Dpjx7MHkXALuTd9zwjXsdNgKBG_j5OmIXV8SHfPkmVmkTxHqsMBqbXtSMNYw9FZmBUQDx_zw8WM_EgohNWl8Br_9-Qrr1Qx0lVgUmfyvYSrkFXZFRzl9XL30kd5IhgiaVjhFCosmZZyHDBZwkKs37WvUIaAxuQ5l3KHDilMhKcUuZR-egiLgmFe-WtxzVGWACm939s0r2C_jBBqSJTgND-0alsiwaddBdxhN0geSqwuLhFG_Hb7djWpAG3_vbj3Y5tKWu2oiikQ-MZlxK69kQx73QFHQFEYcVJDwuV_08m2QDdyr3Ay0IBcLFBK6gd5XFXyS7NfdtUBZwP19N8XzxTrXVUz_Ub0QMju9cL3aRl8JvNqhCXx_5-qw70ROkmtPbJUhzDs3qOtROJiHFB2rdku8IEaKbT64UtpqMujGyNd0PpdaYA8XCv3EXvWeQ4srjXBo&cid=CAQSTgDICaaNo1mRdXugpOPTt7ijsWk5xc078XSXSYdbdmDuGYir-_9siyqlnL4VWNhahiguHsdKJJmO-MXMyokpJCxpXt7Njt0GKpU-jPUWIhgB&dc_eid=31079496&dv3_ver=m202311060101&rfl=https%3A%2F%2Fgeocult.ru%2F&ds=l&xdt=1&iif=1&cor=5450131159634827000&adk=2228999114&idt=158&cac=0&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 312496
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Nov 2024 18:05:08 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTc2NjQwNDI5MzcwMQogIHNlcnZlcl9pcDogMTQ2NTI4OTEwCiAgcHJvY2Vzc19pZDogMzM1NTcyNTI5OQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame F498 0
590 B 52ms
51ms Image
image/png 142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTc2NjQwNDI5MzcwMQogIHNlcnZlcl9pcDogMTQ2NTI4OTEwCiAgcHJvY2Vzc19pZDogMzM1NTcyNTI5OQp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiA3ODM3Nzg2OTgyNjk0ODQ5NjE2CmRlYnVnX2tleTogMTE5NTk2NDI0MjMyNTc0ODMzMTQKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDIzLTEyLTA1IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIyNTk3NDEKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIxMjMyMAogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vYWQtc3J2Lm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2tsaWNrLXdlbHQuZGUiCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3MzgxOTc1MDQK

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x67c171d8ba4de45f0000000000000000","13":"0xb668e6866b4772090000000000000000","14":"0xd33526cf05b9123c0000000000000000","15":"0xff96e38e0e3df10a0000000000000000"},"debug_key":"11959642423257483314","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"7837786982694849616"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

request.php Show response
hal90009.redintelligence.net/ Frame BED4
Redirect Chain

https://hal90009.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=55ec811907&subid=&uid=7d9ff7c1ff1a7f81&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90009.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=55ec811907&subid=&uid=7d9ff7c1ff1a7f81&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

4 KB
2 KB

135ms
108ms

Script
application/x-javascript

138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90009.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=55ec811907&subid=&uid=7d9ff7c1ff1a7f81&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=160x600&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCfoufA-VuZfCaLLOptOUPrrus0Amm5b2gaZ2cnKfJD_AuEAEg1MealwFglYKAgLAHyAEJqQItzKQgCzCyPqgDAcgDmwSqBN4BT9BwQfF9DL_2kxjOU1C2wJ7GRpHnmmOuawCGopIlVvqR6aExWTqG8r94ZItq_EpN3pWqhW1VjsMNpTsNkzTeIrKGobzEpxJF3bRebclhBgeh9gNtT1OCc7QympbuhCq3WWK-kzLMsfwvqgmfyyMINWOXrjUZXs79A7y1r7s4zga341uSrW-8VqdpKyMbZGLMVID9yPzgqzI4KZiTqSkMc2R3GJ5pXF7vuLF1qFNeYuEYkPFbh-3U_x1XDiHnDsOhFFzxP16PAfHB9Cb6JSjD-NYNpOWybH5qXU90iqlgwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WLDy6-_194IDgAoBmAsByAsBgAwBogwUKhIKEOS0sQLutbECtbixAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNHF86hX2HGE09gXCpvp5PIVdzkeb0NIfXkQqw_5m9dAa0eWLBMN9iI8iRt7ZlxO9A6HOWQ1YV_X4mOqMEWo6k-wAL_ekJ3kl4Y10YAQ%26sig%3DAOD64_1axh9X3It710RN4QiVoXZAS8rOLg%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-C0wm2_mn2FDxxYfh2Hl2xPPBKOMrmYM9iY34F1Qcx7YivITHfQU_2XaYgvdkqiCQbmousCha60B6Hc14IQKTCIQ9NXjAOCQ0O3HOUST3wnq0EiD4lLZlZS-0jSjb_ruDSOMIxewV2jeE5s-NUrYNKIGgKPRuMCA47cPs5Y8RBJ_IWa2w0%26cry%3D1%26dbm_d%3DAKAmf-DvhNlxJhFv_lEzT4wXw8dPrMc9LZ5RGIi76wKuXsX_rJo2JYGilxRpz_pImeMLnQBdDfeHUVU3BzO2ZGFej5DV24TwJ6AmA-xWURhYwnNgAlWyjJF3HUTf98jhXZGKEKYq5uqVqedX3jVi01HCokSbhWFfRILKd8fr-hSLAb0jrz9kB-OZrJhaUcunebCWdcmxQK3D59vEwNozwQT-ZUHmv87C3Sb2LmZyi48j2VXzxcqAnpmnaL2qseDaUWtpORUxe-8hInHO0zsp4XnTwURq1riH-eaKiTa5j1wJOPPuTxtu5qDJ86X3O4t9j1wZCwruPQ5hR7lUSDMxcQetaJ713swugb95JHGZNCUuyiLBAtGuxzGGY01Rb73jLo0TISilU7ht28Fdy_r5kT5znaoJeX-BeKpgwAFwBz9aBQJyUAqwuLC72Eh_6MIXcjMiBDCgzaffYVfqs8tIXK78ocQXyaIN-74eM3EZmiWUaHxMOX0zL1y05AYmuZ0SqGymghvaQZ93nCu4Y_rU40uZbvZ3PR_qGeTb-Jc9iO_anR5AOSuXqU4%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=5967515733121&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&slotname=6315164047&adk=1815116396&adf=2119670097&pi=t.ma~as.6315164047&w=160&lmt=1693404896&format=160x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403291&bpp=1&bdt=198&idt=335&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1080&ady=1897&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=338
Protocol: HTTP/1.1
Server: 138.201.63.149 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a9c108c83809da258404b3a9708875c76531c1ec8a2aa11da27bf727444a7f86

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Dec 2023 08:53:24 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 96583300048368004444556012529009
Connection: close
Content-Length: 1360
Expires: Tue, 05 Dec 2023 08:53:24 +0100

Redirect headers

Pragma: no-cache
Date: Tue, 05 Dec 2023 08:53:24 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=55ec811907&subid=&uid=7d9ff7c1ff1a7f81&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=160x600&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCfoufA-VuZfCaLLOptOUPrrus0Amm5b2gaZ2cnKfJD_AuEAEg1MealwFglYKAgLAHyAEJqQItzKQgCzCyPqgDAcgDmwSqBN4BT9BwQfF9DL_2kxjOU1C2wJ7GRpHnmmOuawCGopIlVvqR6aExWTqG8r94ZItq_EpN3pWqhW1VjsMNpTsNkzTeIrKGobzEpxJF3bRebclhBgeh9gNtT1OCc7QympbuhCq3WWK-kzLMsfwvqgmfyyMINWOXrjUZXs79A7y1r7s4zga341uSrW-8VqdpKyMbZGLMVID9yPzgqzI4KZiTqSkMc2R3GJ5pXF7vuLF1qFNeYuEYkPFbh-3U_x1XDiHnDsOhFFzxP16PAfHB9Cb6JSjD-NYNpOWybH5qXU90iqlgwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WLDy6-_194IDgAoBmAsByAsBgAwBogwUKhIKEOS0sQLutbECtbixAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNHF86hX2HGE09gXCpvp5PIVdzkeb0NIfXkQqw_5m9dAa0eWLBMN9iI8iRt7ZlxO9A6HOWQ1YV_X4mOqMEWo6k-wAL_ekJ3kl4Y10YAQ%26sig%3DAOD64_1axh9X3It710RN4QiVoXZAS8rOLg%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-C0wm2_mn2FDxxYfh2Hl2xPPBKOMrmYM9iY34F1Qcx7YivITHfQU_2XaYgvdkqiCQbmousCha60B6Hc14IQKTCIQ9NXjAOCQ0O3HOUST3wnq0EiD4lLZlZS-0jSjb_ruDSOMIxewV2jeE5s-NUrYNKIGgKPRuMCA47cPs5Y8RBJ_IWa2w0%26cry%3D1%26dbm_d%3DAKAmf-DvhNlxJhFv_lEzT4wXw8dPrMc9LZ5RGIi76wKuXsX_rJo2JYGilxRpz_pImeMLnQBdDfeHUVU3BzO2ZGFej5DV24TwJ6AmA-xWURhYwnNgAlWyjJF3HUTf98jhXZGKEKYq5uqVqedX3jVi01HCokSbhWFfRILKd8fr-hSLAb0jrz9kB-OZrJhaUcunebCWdcmxQK3D59vEwNozwQT-ZUHmv87C3Sb2LmZyi48j2VXzxcqAnpmnaL2qseDaUWtpORUxe-8hInHO0zsp4XnTwURq1riH-eaKiTa5j1wJOPPuTxtu5qDJ86X3O4t9j1wZCwruPQ5hR7lUSDMxcQetaJ713swugb95JHGZNCUuyiLBAtGuxzGGY01Rb73jLo0TISilU7ht28Fdy_r5kT5znaoJeX-BeKpgwAFwBz9aBQJyUAqwuLC72Eh_6MIXcjMiBDCgzaffYVfqs8tIXK78ocQXyaIN-74eM3EZmiWUaHxMOX0zL1y05AYmuZ0SqGymghvaQZ93nCu4Y_rU40uZbvZ3PR_qGeTb-Jc9iO_anR5AOSuXqU4%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=5967515733121&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Tue, 05 Dec 2023 08:53:24 +0100

GET
H/1.1 200
OK wmoiqux43uzw Show response
hal9000.redintelligence.net/zone/ Frame F498 11 KB
4 KB 41ms
18ms Script
text/html 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1701766403723472&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCXAaUA-VuZZCULOX8xtYPxP6v-Aqm5b2gab2TnKfJD_AuEAEg1MealwFglYKAgLAHyAEJqQIzljctyC6yPqgDAcgDmwSqBN4BT9CR0LJgxMTs6GrdSIUzLNRLhv-GuEGIV2QjKampOov8mttxXyw7vVe2C5T6IavAbsxwkWR2ph7nxZXE5dP_Mykq_D0f6BDCr1OTRJcGbCFfuLLbHHmoW9IM6ezXDFbTOoDgKAX8atynJmq8Irm180al7K5oR91_eH4PEi3lgkAXx0KCVtndMt540J5WZdFe5nUHruz3kEcnRciIdK1ogJFrs01-WyOXUuoIX3rWDiOatwIlaqr6hzUDIVffeiNfWVfa89ETaru-JBYUNYvQo_NPS70GWuq9_R8_Z4yGwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WL3b7O_194IDgAoBmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNo1mRdXugpOPTt7ijsWk5xc078XSXSYdbdmDuGYir-_9siyqlnL4VWNhahiguHsdKJJmO-MXMyokpJCxpXt7Njt0GKpU-jPUWIhgB%26sig%3DAOD64_3ypx6k4yCigD8eIcS9XdDdh5IvZA%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-DaHybOQMQ3vwG9tFozg5-Bbu9ZcWN8-HuXCRnY2-4iObSYMWxSkG0KZUz28E3sDD3747HORVtF4WRYVQeLmnC_GLcZ1dppg7g6KgvBvNJiYKMXUqFpe8mPqTvGAObVzlAimCT9R4rRtgkLDFiM3EdCFGGUCiP7K-VCrdLh45hfanbAZlI%26cry%3D1%26dbm_d%3DAKAmf-A1Bd8i_HwZvECAVHkEQAUz3DULEzs-jSRASeC_BhlJ9diAuYBr_gXyoxPjM9YMsbKQmvkKbDt2eZLr-GqgIBXMYeud6oLguqgz1D1W8cQ0ydL6NPDEF0WSeUZJTGGMfgHkv_rbUBpNgqXz6c5MbWXPgn41RUi2-NEXz56FS8ZNTebUNFGvSOCN5Ez7LOWy-Lp1CopvfE7EcLm98xzGBjA5XrvkZYdqlRPebAmD4NCR75KADcaGU1gwQW4IA4vPJwAzeuTI225QyscxFU31zqr34sFpfqr2mCHebAG8XckT7xwRHlV0cRxXO-McLLjOYGBTcdvOX763VLGoVfmYgKGw4dPJA1SmS8r2js76yD_W71UQXt6V6GOSu6EPWVRX1nuDw-dj-mEs3VkqcvqXkm8A69yZkZB0VWwlBuBotB88q34-plA1mdFv4KlxsTwiZzLN9mFrBVpqkIl1K7nrUca1kWiCtIq3qtFmQJeJY1c0FMJd74BmPgNECrweN14EcJ1rW7yGbsWbNGp_oQXVLw1WKN0jL2JCmuPufXUlIiAg9gV_PH0%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=6212002511&adk=1854347006&adf=3400082548&pi=t.ma~as.6212002511&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403292&bpp=1&bdt=200&idt=347&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=2725&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=348
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: 4e4ecb7e0fe182c8b8625b76a1b862bd64280c9d99be97e218cbb2575c879168

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 08:53:24 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4151
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame C97B 38 KB
13 KB 14ms
13ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 126288
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 03 Dec 2023 21:48:36 GMT
expires: Mon, 02 Dec 2024 21:48:36 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame BC14 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4a675848fc6424230cb3ed04c778fde9a8ca56f8cc34ee4d9d007f0705874566

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame EF55 39 KB
15 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 00:33:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29972
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Dec 2024 00:33:52 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 9E08 38 KB
13 KB 15ms
15ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 126288
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 03 Dec 2023 21:48:36 GMT
expires: Mon, 02 Dec 2024 21:48:36 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame C97B 39 KB
15 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 00:33:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29972
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Dec 2024 00:33:52 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 79E0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDpLklVdFVw2g8myp1B5WMw&google_cver=1

43 B
735 B

28ms
28ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDpLklVdFVw2g8myp1B5WMw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMY0oro4gEwAQ&v=APEucNV43S2kbvK3AoU5zrPTMQSg0b-YSdPWgVZlxicq4diHS-brAYXEVxTU7kZKUz0eSeZ-F3hGEk2oVyNBMthDyC49LzL31-cak_LSE236xPS_kvuIaQA_iO23YqCBuy3p9RrQnVI9emy78eXBpZLrirA6fMOdoJ0XuU_hz7Cr29eBOyFe160
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w0v%2BVlLBgkDTQ5Q48uGcwhPSFCcoy5X8wVS88yixcFitbXCAUoL8oKtmrLnDRvrva1GC3KF%2FJjBb1OMYtF2qI%2FmSJmZSVZliAagvuWZFWgJgYQPXw2L6bJ0o%2B1iOfLJk8oLezNgPvMhFrw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 830b0efc78b43623-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDpLklVdFVw2g8myp1B5WMw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 79E0
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZW7lBGwgmAmK1u-LWDSnIwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDpLklVdFVw2g8myp1B5WMw&google_cver=1

43 B
742 B

25ms
25ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDpLklVdFVw2g8myp1B5WMw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMY0oro4gEwAQ&v=APEucNV43S2kbvK3AoU5zrPTMQSg0b-YSdPWgVZlxicq4diHS-brAYXEVxTU7kZKUz0eSeZ-F3hGEk2oVyNBMthDyC49LzL31-cak_LSE236xPS_kvuIaQA_iO23YqCBuy3p9RrQnVI9emy78eXBpZLrirA6fMOdoJ0XuU_hz7Cr29eBOyFe160
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gxCz%2BcCoF8m9r%2FAbRxGSdz4VllsjFb2khFVIw%2FREB3FL%2FgSDI%2BCFvfsAd6BKNGOP2UGW9Ofuv3DwmDPVkTRQWzaCm%2Buv0ZGl1kXCUbOYUx1BfwdyIzWx7fhS%2BcL%2F80N46qn3c9axtDUJwQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 830b0efcb9193623-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDpLklVdFVw2g8myp1B5WMw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 79E0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEJakeL5BnyDrEoGEoDB_a68&google_cver=1

43 B
835 B

13ms
13ms

Image
image/gif

37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEJakeL5BnyDrEoGEoDB_a68&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMY0oro4gEwAQ&v=APEucNV43S2kbvK3AoU5zrPTMQSg0b-YSdPWgVZlxicq4diHS-brAYXEVxTU7kZKUz0eSeZ-F3hGEk2oVyNBMthDyC49LzL31-cak_LSE236xPS_kvuIaQA_iO23YqCBuy3p9RrQnVI9emy78eXBpZLrirA6fMOdoJ0XuU_hz7Cr29eBOyFe160

Protocol

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
an-x-request-uuid: 7a40fe62-f509-459b-aeb2-ec5dca0c8f55
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 37.58.57.4; 37.58.57.4; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEJakeL5BnyDrEoGEoDB_a68&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 79E0
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI5OTEzODIzNzUyNDY2NTg2Ng%3D%3D

170 B
188 B

26ms
26ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI5OTEzODIzNzUyNDY2NTg2Ng%3D%3D

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
an-x-request-uuid: fa7f5dd6-ebf3-410a-a318-5421bd2cc07f
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzI5OTEzODIzNzUyNDY2NTg2Ng%3D%3D
x-proxy-origin: 37.58.57.4; 37.58.57.4; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

request.php Show response
hal90007.redintelligence.net/ Frame F498
Redirect Chain

https://hal90007.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=3a313e69d6&subid=&uid=5cb252426c0a51f8&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90007.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=3a313e69d6&subid=&uid=5cb252426c0a51f8&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

4 KB
2 KB

108ms
81ms

Script
application/x-javascript

138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=3a313e69d6&subid=&uid=5cb252426c0a51f8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCXAaUA-VuZZCULOX8xtYPxP6v-Aqm5b2gab2TnKfJD_AuEAEg1MealwFglYKAgLAHyAEJqQIzljctyC6yPqgDAcgDmwSqBN4BT9CR0LJgxMTs6GrdSIUzLNRLhv-GuEGIV2QjKampOov8mttxXyw7vVe2C5T6IavAbsxwkWR2ph7nxZXE5dP_Mykq_D0f6BDCr1OTRJcGbCFfuLLbHHmoW9IM6ezXDFbTOoDgKAX8atynJmq8Irm180al7K5oR91_eH4PEi3lgkAXx0KCVtndMt540J5WZdFe5nUHruz3kEcnRciIdK1ogJFrs01-WyOXUuoIX3rWDiOatwIlaqr6hzUDIVffeiNfWVfa89ETaru-JBYUNYvQo_NPS70GWuq9_R8_Z4yGwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WL3b7O_194IDgAoBmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNo1mRdXugpOPTt7ijsWk5xc078XSXSYdbdmDuGYir-_9siyqlnL4VWNhahiguHsdKJJmO-MXMyokpJCxpXt7Njt0GKpU-jPUWIhgB%26sig%3DAOD64_3ypx6k4yCigD8eIcS9XdDdh5IvZA%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-DaHybOQMQ3vwG9tFozg5-Bbu9ZcWN8-HuXCRnY2-4iObSYMWxSkG0KZUz28E3sDD3747HORVtF4WRYVQeLmnC_GLcZ1dppg7g6KgvBvNJiYKMXUqFpe8mPqTvGAObVzlAimCT9R4rRtgkLDFiM3EdCFGGUCiP7K-VCrdLh45hfanbAZlI%26cry%3D1%26dbm_d%3DAKAmf-A1Bd8i_HwZvECAVHkEQAUz3DULEzs-jSRASeC_BhlJ9diAuYBr_gXyoxPjM9YMsbKQmvkKbDt2eZLr-GqgIBXMYeud6oLguqgz1D1W8cQ0ydL6NPDEF0WSeUZJTGGMfgHkv_rbUBpNgqXz6c5MbWXPgn41RUi2-NEXz56FS8ZNTebUNFGvSOCN5Ez7LOWy-Lp1CopvfE7EcLm98xzGBjA5XrvkZYdqlRPebAmD4NCR75KADcaGU1gwQW4IA4vPJwAzeuTI225QyscxFU31zqr34sFpfqr2mCHebAG8XckT7xwRHlV0cRxXO-McLLjOYGBTcdvOX763VLGoVfmYgKGw4dPJA1SmS8r2js76yD_W71UQXt6V6GOSu6EPWVRX1nuDw-dj-mEs3VkqcvqXkm8A69yZkZB0VWwlBuBotB88q34-plA1mdFv4KlxsTwiZzLN9mFrBVpqkIl1K7nrUca1kWiCtIq3qtFmQJeJY1c0FMJd74BmPgNECrweN14EcJ1rW7yGbsWbNGp_oQXVLw1WKN0jL2JCmuPufXUlIiAg9gV_PH0%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=9949805174950&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=6212002511&adk=1854347006&adf=3400082548&pi=t.ma~as.6212002511&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403292&bpp=1&bdt=200&idt=347&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=2725&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=348
Protocol: HTTP/1.1
Server: 138.201.63.157 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: fb12df34477c96b6ced8358bf28aa77166a0aa782ea784115c57936a1adbc735

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Dec 2023 08:53:24 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 36847600040911104444994012529007
Connection: close
Content-Length: 1327
Expires: Tue, 05 Dec 2023 08:53:24 +0100

Redirect headers

Pragma: no-cache
Date: Tue, 05 Dec 2023 08:53:24 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=3a313e69d6&subid=&uid=5cb252426c0a51f8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCXAaUA-VuZZCULOX8xtYPxP6v-Aqm5b2gab2TnKfJD_AuEAEg1MealwFglYKAgLAHyAEJqQIzljctyC6yPqgDAcgDmwSqBN4BT9CR0LJgxMTs6GrdSIUzLNRLhv-GuEGIV2QjKampOov8mttxXyw7vVe2C5T6IavAbsxwkWR2ph7nxZXE5dP_Mykq_D0f6BDCr1OTRJcGbCFfuLLbHHmoW9IM6ezXDFbTOoDgKAX8atynJmq8Irm180al7K5oR91_eH4PEi3lgkAXx0KCVtndMt540J5WZdFe5nUHruz3kEcnRciIdK1ogJFrs01-WyOXUuoIX3rWDiOatwIlaqr6hzUDIVffeiNfWVfa89ETaru-JBYUNYvQo_NPS70GWuq9_R8_Z4yGwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WL3b7O_194IDgAoBmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNo1mRdXugpOPTt7ijsWk5xc078XSXSYdbdmDuGYir-_9siyqlnL4VWNhahiguHsdKJJmO-MXMyokpJCxpXt7Njt0GKpU-jPUWIhgB%26sig%3DAOD64_3ypx6k4yCigD8eIcS9XdDdh5IvZA%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-DaHybOQMQ3vwG9tFozg5-Bbu9ZcWN8-HuXCRnY2-4iObSYMWxSkG0KZUz28E3sDD3747HORVtF4WRYVQeLmnC_GLcZ1dppg7g6KgvBvNJiYKMXUqFpe8mPqTvGAObVzlAimCT9R4rRtgkLDFiM3EdCFGGUCiP7K-VCrdLh45hfanbAZlI%26cry%3D1%26dbm_d%3DAKAmf-A1Bd8i_HwZvECAVHkEQAUz3DULEzs-jSRASeC_BhlJ9diAuYBr_gXyoxPjM9YMsbKQmvkKbDt2eZLr-GqgIBXMYeud6oLguqgz1D1W8cQ0ydL6NPDEF0WSeUZJTGGMfgHkv_rbUBpNgqXz6c5MbWXPgn41RUi2-NEXz56FS8ZNTebUNFGvSOCN5Ez7LOWy-Lp1CopvfE7EcLm98xzGBjA5XrvkZYdqlRPebAmD4NCR75KADcaGU1gwQW4IA4vPJwAzeuTI225QyscxFU31zqr34sFpfqr2mCHebAG8XckT7xwRHlV0cRxXO-McLLjOYGBTcdvOX763VLGoVfmYgKGw4dPJA1SmS8r2js76yD_W71UQXt6V6GOSu6EPWVRX1nuDw-dj-mEs3VkqcvqXkm8A69yZkZB0VWwlBuBotB88q34-plA1mdFv4KlxsTwiZzLN9mFrBVpqkIl1K7nrUca1kWiCtIq3qtFmQJeJY1c0FMJd74BmPgNECrweN14EcJ1rW7yGbsWbNGp_oQXVLw1WKN0jL2JCmuPufXUlIiAg9gV_PH0%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=9949805174950&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Tue, 05 Dec 2023 08:53:24 +0100

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 9E08 39 KB
15 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 00:33:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29972
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Dec 2024 00:33:52 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/15415463092317913147/ Frame 9D6A 1 KB
767 B 48ms
21ms Document
text/html 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=J4FK7qRkCH&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

51c012cf2461bf8b29f345373366183c7fd121579b6178e942be0b61d8c7da14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 739
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 08:53:24 GMT
expires: Wed, 04 Dec 2024 08:53:24 GMT
last-modified: Thu, 27 Apr 2023 13:50:29 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame BC14 0
0 66ms
65ms Fetch
image/gif 142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsu5tPDtvqtjPppV4lF2CeHiWHZCr_J8Rr4oMwWwmv7eC2YNnSZAhmmXUx1Uoo5qAaFzh6GcT3qGMIWUiiK4zkLQ7V8nBiarWAlDhdNIg9tW0m_gPUZhgxmbSfT_vZ8ddyRGycES0GNzZiBH5E1mBn5EVMN9B7P-iZNKQHdP6R3eKJWAYMVSsnZ9122cQ6BwFQW_oppp8kq0L0KrRwdxD3fMv9ey4FtLncYm1GtzR5fcQBQ09LiYCw8D95reD_5TbF-9YqJSZ4df-MpI_biBx1x4geTwXt98iDXkC65AwbZ5ghGDpl0H4g-kXKl5f_-cZfd-VE0YHdnDNAGKutY9xUWjxdaxc8TVrsVMkJIjcnXgAPEE3CCBJYFbyvSN_8_4KNnNLIFeajaVO3AmQLrWZ4wilHCfqCxOtvZuwQZjctCVgNEdNams26pFl_NXLxZw0r_RdjKfKufnC8o4sPaJA_Yrcl2xUYo7bFhZJrGYBPoDJXy_C4Dps39oxaVd8vcOB8ZwLveA62f_0WrYbKPeXW-B_VsOyiHRG4KxTwVxSBzLLwt18gFl2mloDW1o2PzViirOO6HVXIv6LAltqZjyEd77T98VWpqM3_DZ-cmBHiabY8wCeB92YOt33KSWwc7LJAwg3kQCJHQNKPZMH5KiNGc_kfkPZfzD3T4CRy0UpQC7FmjrSuH9B7q1BaukLKs5klwFyFO8d3QoipaAwYCvyCkxvPoR4BDqxBKX7lgR3JhgPk7_9l7pzDaRwrbvfDlDkz_CF39rnUpB8xAuy8f5tQ75eZlSWiSoxR3zxWjI6FaTC50kyC8l7YMmjPScWekZHxx3LHOU1OrvL2_DrfUlRSmajIdpLbxZC7O-NDJKwqmZZanf4gFDCsoT7FDopI7rZG_0W548BEwncol4BaTrYZLRfmP1sSo9Dlm08bGy5swswwo114p96dSdheYLSTozu0R5kRX8p3CX9MJdumfSGZVIbjh3d-jmCuyZwGaaVKvHFDz1Xm-mp1uk4mLlnHDHJmb1dLfYTJ3qrGJLq2j9d5VXd7b1QozmPJWFsMZxvOehCoK4APHjkwo5cKI7epcx7SwyEivMHuwCnprWgZ0FW3l55sk5VBA-Gneg_mMhDbK2uh-E3RUnDkjJ7VPahp2waT3nRRpkVjja-CRTGCqekussaqW_82A1iPfHoDgb_0TGTMZjha73qK9D346YJp2ScWNXYWIzbYgRN3__QjDgSO2NpsKxA2Sc0duxGOgzB-dZGl6_SeErFPBL9vjIUtwAI6lhwFNWryyI1VR4lWNNBxMf_HKhHx-SOn8_qBdqMyx4F-RBBaABX8Z0Ja1VF5W6Num9OPwUs2eZp7pneZRdRRKc4i5l&sai=AMfl-YQTfXA73pxnwiNKMGp3h4ubusuhgiMb5Zywufqz0k0GbcxMun8gTtTOXVZ_Ypu8eVsj8JYuMocUb8LzN_anKxHF5E9qq4hH610UBJjhR29B90JWUNlxQkp-EbOBZM_XTcgGF9feZed-7wQm9qMgQB3NtX59jDH6fFY1a-zxBwIoeZoQWo5Q61S_1I515DwroJ7qRux9gIy6qqMqCXdvaJftqBdadDY7a8FImgqZhqbXN1l0pdZqbvgXnvVn9t2D4tNNJl1Y4GbR72KKuli544_3ZV6l-Q_b4pSOknHyUJ1lBym1f7ZCBgf0-94RKZfHQxqBYac08jOwaUOei_ixM4Yt1-BqiRSr18uvJx_rIT9DIwzhwcWUc6nYqB-f9ogeWIbbvtSi4ZvR96BEXRsW-QjW3XsJ0k4hXRY-gLnCbUNVzKrsbwVqVormGqZaNQNl995nwym27j-OFfOCpzf4ck2W5EIfj5lW4hqMy5cO4XWu8RouRpY7Dc7Gu4GkoXK6qBXZgCQpjD1ufA&sig=Cg0ArKJSzHvNwNlk1M72EAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9sdWZ0aGFuc2EuY29tLGh0dHBzOi8vZXhhY3RhZy5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=120&cbvp=1&cstd=115&cisv=r20231130.34287&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-56-205-163.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 05 Dec 2023 08:53:24 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame BC14 43 B
1 KB 98ms
32ms Image
image/gif 85.14.248.71
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvId=63&extPu=lh-mindshare&extProvApi=lh_de&extLi=26915561&extCr=180481255&extPm=361577796&gdpr_consent=&gdpr=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231130/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

85.14.248.71 Neukirchen-Vluyn, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Date: Tue, 05 Dec 2023 08:53:23 GMT
X-Content-Type-Options: nosniff
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Di, 05 Dez 2023 08:53:24 GMT
X-ET-Code: 0
Accept-CH: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://googleads.g.doubleclick.net
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 1119
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 tweenmax_2.0.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 9D6A 113 KB
38 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_2.0.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=J4FK7qRkCH&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62afec092c21b138eeb1fc55859f60c19dd12ca3c02bdfeb336a820b016a547b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=J4FK7qRkCH&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38915
x-xss-protection: 0
last-modified: Tue, 19 Jun 2018 18:02:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Dec 2023 08:53:24 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 9D6A 118 KB
40 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=J4FK7qRkCH&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=J4FK7qRkCH&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:12:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16851
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 06 Dec 2023 04:12:33 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EF55 0
20 B 53ms
52ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BWO1-BOVuZbqRDsDUjuwPx-KjuAgAAAAAOAHgBAI&bg=!3N-l35DNAAY3kmNgF5I7ADQBe5WfOEqEl9EKiteMqEfgXg0RmBAAEs53-n6TsGpE1TigZ8hgXfSLB8_zK6I61osHj1_SAgAAAIhSAAAAAmgBBwoAqrc6DLejjQD0onmJXkaC0oMSihO4LIv9PHjh7rtaQnSe9GO33qE7RlZHM4IpIdfGQVROWjei-YnsuHmDAF7sNze2lDLT7GoHiYGQNSklDPsmPBWvtJDcudVO9mlwaVFSBcsdvS-rPc4vWgmr6YudnfOLFwoHSUUfhBXSHmNF7HLKe5DJrjLsUbaKWRtKdcr89wF_Wm_lBed7oZa_D5oPBmM9YoCkIPje1S0GmQLlj_JYU6ZhTBI4_yRkB50F9Ioz2eWXqaMzgHENXfitkj890d3mqbVEEMpD6ozh8tQ6Oa-9gZmaHDZ1443J87EQ7muw5rGM-owIQmlGBEDRRjaJHrRRAZS7Vva1J_ADkggoNrseCuT9b7fLCfLKolI1H34U26Kt5RhtHiIZ3M2EV8QnYeP2obBzygcDVMP8ToI9kGnJ1AT9V3ISScn5I6WFH_R5BssdhK10GFcfSVTVLzdczCZxUTZJh-0mDFTkra9sVCxGQ7M-8MCTLEN2qPb0sg9L_YNhueP8_K6l4JhMdIWK5E-pG0IcuLYnzXTH_7vYgFMyNSQGhH9DC3wEwOJ-SZhkZqlY1Eof7I8EktHYqL40E9w7ncnAwNVewDc1Ta7T8MfT_TpWwiafbYZsrGd5qeVl2Kii-lX3DNDWSKf0c1AGnIIHMYhK_ZDE6RxdUWaymDZnVCZyaQLr_N9BqDT0duWaofKnPj1Fdw6u9Pcim9938Q8zSLce0Gh3dFuxuMatq7WvM3l144HrrviZxvQI9spQ9PKSzocCnHe6NB-xfa3vk1lqZfZ6YaSHCYSiRaQyD0ydo9I_7pp86xUdRb6YZRPy9YpWr0JwLf0Q8c3V1dCO1_pF-wU0mTa_o3kqPCCVoWZwPKO7igROfGw-jevXm0iU_Dkp91Sjzrb7SsM7hbygTkjDF1eA2Vyp6iRegjXQgRrgeD6QwGnAuZIF9J3h_EwfamCShw4FCE12W0O1Z5jVRD3zDj2HMeIZ_hHqWMBXajC-_S-YS8nCjyCDCabzKHkduxNJwhJKhI5eLsedTUbU6prYKtVMpaSqjknieZ-l6iBZdyF8BZ-9uDNVb6pQhKj3fp_1TgbR9I6EsSBKvn7df1BkgdR5RzYBleEZf0ZExc-LvHDuG2UAllPJiyzVyTqqc3BX1qU-I3hVC9YM-uo9Ia0QfZ9N9ptVgPjB9G6TYowJR1refYjkKLdyYjRUdHhn-ZAA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C97B 0
20 B 53ms
53ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BDnUBA-VuZdSjK8utxtYPqryayAcAAAAAOAHgBAI&bg=!OTqlOnXNAAY3kmNgF5I7ADQBe5WfOJN8EiUdW6zWYOjgoHZ_Lsz8m6EBhWJ2ftixPY8PghG_MjAMgbEfKOVIezPI6CjdAgAAAHlSAAAAAmgBB5kDB0kh3T_IsIj-6Z2239FPKu6oQoCmQoyZN3B3-4M35or_pyKq56Yf3P5HT2apYVRuC9xhG5nGsMKBtSf4-51O2JsrJ92PoXMcKgsGb-8kNzc3tPsnsie8QElpcViH2kIcxbb_vr9WX4868BAH3tjH_Yi5kdvf78CL1fjcXYavAKG9dZ_aiWlmLFJ7O8Qd2lQI68GFfmuQbQGTvysjn8u9_nx97V9B9pO2Ux_sINYxFJnvwoSsjJ-iUg2JWVewcrtSBSdsHztXLVGtL4EvGgDxK3GGJGXlFfCxaKkhR0-T7ergWfgFwWlV9WnrIWW-CBaEUTZLciMP96BT-Clj5ePzafeLoFcwzYLUK2pGfdeV0ZnuBs-B6skBHDYOfOsPlOu0Qjffbm7m66pa7Dp_8kcKDuoZ-OPvhhe-J1mL63kbAA-aCNn3UDNIHSBEKpwHeukWWIdVXlo_bUvtlhuBUnBIqDuTepar2iwMoODhSRcQIX2v0Glya1H-o4GDVD93nvx0XkitXNgodrQoAKqcRKmJoIgjpf-dPLdwJJaDL9J9Zt2DTkM_VUeq3rDKpKvJAZaDCf8n7O_jx2eQ7wRALh2c7SwVDg2X8Nt427vw-HUP_OWWcHSH29S1N4QAXNZtEq5_NNVLJMov6TcvmO4GFg9ups4qCmBXoAbNIZri0eWN9d0Uyiuzs28BCZGUBjp4jfnqNsrNiS0sLHG_m_ZwuVoOlWYiyg25wdDZA_vw2V7o0tYUEmoLP9IiiuT5gPY3aYFFMfGc7nslB78LYqScOorj2n1JcnDW8B90LgPkxmNVFWc1veOJGKA4TNeOnhufvu41sx-W_E_4Mw9qDKZ43efJ16XBM6qFLxy6bkdQISJS3Eua8iPAxhfFDyiO-opAg3Ung4yCOBygNA6XIYz4gHlmQ97jBx_NFtNsOmDzSGYnnN6p1h3fYbC19tGnC1d_2uQmpYzK58Zzq52Sd4pFnHshLfUMgLkfG9pavO1DdrKI1HQ-jisA90ec5OinsNuPZJK6ZSHPm6pWde8

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231130/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
adv.office-partner.de/ Frame 372F 930 B
922 B 30ms
8ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=55ec811907&subid=&uid=7d9ff7c1ff1a7f81&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=160x600&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCfoufA-VuZfCaLLOptOUPrrus0Amm5b2gaZ2cnKfJD_AuEAEg1MealwFglYKAgLAHyAEJqQItzKQgCzCyPqgDAcgDmwSqBN4BT9BwQfF9DL_2kxjOU1C2wJ7GRpHnmmOuawCGopIlVvqR6aExWTqG8r94ZItq_EpN3pWqhW1VjsMNpTsNkzTeIrKGobzEpxJF3bRebclhBgeh9gNtT1OCc7QympbuhCq3WWK-kzLMsfwvqgmfyyMINWOXrjUZXs79A7y1r7s4zga341uSrW-8VqdpKyMbZGLMVID9yPzgqzI4KZiTqSkMc2R3GJ5pXF7vuLF1qFNeYuEYkPFbh-3U_x1XDiHnDsOhFFzxP16PAfHB9Cb6JSjD-NYNpOWybH5qXU90iqlgwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WLDy6-_194IDgAoBmAsByAsBgAwBogwUKhIKEOS0sQLutbECtbixAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNHF86hX2HGE09gXCpvp5PIVdzkeb0NIfXkQqw_5m9dAa0eWLBMN9iI8iRt7ZlxO9A6HOWQ1YV_X4mOqMEWo6k-wAL_ekJ3kl4Y10YAQ%26sig%3DAOD64_1axh9X3It710RN4QiVoXZAS8rOLg%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-C0wm2_mn2FDxxYfh2Hl2xPPBKOMrmYM9iY34F1Qcx7YivITHfQU_2XaYgvdkqiCQbmousCha60B6Hc14IQKTCIQ9NXjAOCQ0O3HOUST3wnq0EiD4lLZlZS-0jSjb_ruDSOMIxewV2jeE5s-NUrYNKIGgKPRuMCA47cPs5Y8RBJ_IWa2w0%26cry%3D1%26dbm_d%3DAKAmf-DvhNlxJhFv_lEzT4wXw8dPrMc9LZ5RGIi76wKuXsX_rJo2JYGilxRpz_pImeMLnQBdDfeHUVU3BzO2ZGFej5DV24TwJ6AmA-xWURhYwnNgAlWyjJF3HUTf98jhXZGKEKYq5uqVqedX3jVi01HCokSbhWFfRILKd8fr-hSLAb0jrz9kB-OZrJhaUcunebCWdcmxQK3D59vEwNozwQT-ZUHmv87C3Sb2LmZyi48j2VXzxcqAnpmnaL2qseDaUWtpORUxe-8hInHO0zsp4XnTwURq1riH-eaKiTa5j1wJOPPuTxtu5qDJ86X3O4t9j1wZCwruPQ5hR7lUSDMxcQetaJ713swugb95JHGZNCUuyiLBAtGuxzGGY01Rb73jLo0TISilU7ht28Fdy_r5kT5znaoJeX-BeKpgwAFwBz9aBQJyUAqwuLC72Eh_6MIXcjMiBDCgzaffYVfqs8tIXK78ocQXyaIN-74eM3EZmiWUaHxMOX0zL1y05AYmuZ0SqGymghvaQZ93nCu4Y_rU40uZbvZ3PR_qGeTb-Jc9iO_anR5AOSuXqU4%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=5967515733121&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Tue, 05 Dec 2023 08:53:24 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Tue, 12 Dec 2023 08:53:24 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame 0940 0
327 B 23ms
18ms Document
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=96583300048368004444556012529009&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=55ec811907&subid=&uid=7d9ff7c1ff1a7f81&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=160x600&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCfoufA-VuZfCaLLOptOUPrrus0Amm5b2gaZ2cnKfJD_AuEAEg1MealwFglYKAgLAHyAEJqQItzKQgCzCyPqgDAcgDmwSqBN4BT9BwQfF9DL_2kxjOU1C2wJ7GRpHnmmOuawCGopIlVvqR6aExWTqG8r94ZItq_EpN3pWqhW1VjsMNpTsNkzTeIrKGobzEpxJF3bRebclhBgeh9gNtT1OCc7QympbuhCq3WWK-kzLMsfwvqgmfyyMINWOXrjUZXs79A7y1r7s4zga341uSrW-8VqdpKyMbZGLMVID9yPzgqzI4KZiTqSkMc2R3GJ5pXF7vuLF1qFNeYuEYkPFbh-3U_x1XDiHnDsOhFFzxP16PAfHB9Cb6JSjD-NYNpOWybH5qXU90iqlgwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WLDy6-_194IDgAoBmAsByAsBgAwBogwUKhIKEOS0sQLutbECtbixAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNHF86hX2HGE09gXCpvp5PIVdzkeb0NIfXkQqw_5m9dAa0eWLBMN9iI8iRt7ZlxO9A6HOWQ1YV_X4mOqMEWo6k-wAL_ekJ3kl4Y10YAQ%26sig%3DAOD64_1axh9X3It710RN4QiVoXZAS8rOLg%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-C0wm2_mn2FDxxYfh2Hl2xPPBKOMrmYM9iY34F1Qcx7YivITHfQU_2XaYgvdkqiCQbmousCha60B6Hc14IQKTCIQ9NXjAOCQ0O3HOUST3wnq0EiD4lLZlZS-0jSjb_ruDSOMIxewV2jeE5s-NUrYNKIGgKPRuMCA47cPs5Y8RBJ_IWa2w0%26cry%3D1%26dbm_d%3DAKAmf-DvhNlxJhFv_lEzT4wXw8dPrMc9LZ5RGIi76wKuXsX_rJo2JYGilxRpz_pImeMLnQBdDfeHUVU3BzO2ZGFej5DV24TwJ6AmA-xWURhYwnNgAlWyjJF3HUTf98jhXZGKEKYq5uqVqedX3jVi01HCokSbhWFfRILKd8fr-hSLAb0jrz9kB-OZrJhaUcunebCWdcmxQK3D59vEwNozwQT-ZUHmv87C3Sb2LmZyi48j2VXzxcqAnpmnaL2qseDaUWtpORUxe-8hInHO0zsp4XnTwURq1riH-eaKiTa5j1wJOPPuTxtu5qDJ86X3O4t9j1wZCwruPQ5hR7lUSDMxcQetaJ713swugb95JHGZNCUuyiLBAtGuxzGGY01Rb73jLo0TISilU7ht28Fdy_r5kT5znaoJeX-BeKpgwAFwBz9aBQJyUAqwuLC72Eh_6MIXcjMiBDCgzaffYVfqs8tIXK78ocQXyaIN-74eM3EZmiWUaHxMOX0zL1y05AYmuZ0SqGymghvaQZ93nCu4Y_rU40uZbvZ3PR_qGeTb-Jc9iO_anR5AOSuXqU4%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=5967515733121&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript; charset=utf-8
date: Tue, 05 Dec 2023 08:53:24 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
vary: Origin

GET
H2 200 link.html Show response
track.webgains.com/ Frame BED4 2 KB
2 KB 162ms
79ms Script
text/html 18.170.182.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=96583300048368004444556012529009&nw=1
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.170.182.156 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-170-182-156.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 73e0cbe9c127bdd98e8943eae9dedec327676c9df0e4ed621f1b9f67e03d61e2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
last-modified: Tue, 05 Dec 2023 08:53:24 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Tue, 05 Dec 2023 08:54:24 GMT

GET
H2 200 e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame BED4 0
326 B 102ms
19ms Script
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=96583300048368004444556012529009&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=55ec811907&subid=&uid=7d9ff7c1ff1a7f81&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=160x600&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCfoufA-VuZfCaLLOptOUPrrus0Amm5b2gaZ2cnKfJD_AuEAEg1MealwFglYKAgLAHyAEJqQItzKQgCzCyPqgDAcgDmwSqBN4BT9BwQfF9DL_2kxjOU1C2wJ7GRpHnmmOuawCGopIlVvqR6aExWTqG8r94ZItq_EpN3pWqhW1VjsMNpTsNkzTeIrKGobzEpxJF3bRebclhBgeh9gNtT1OCc7QympbuhCq3WWK-kzLMsfwvqgmfyyMINWOXrjUZXs79A7y1r7s4zga341uSrW-8VqdpKyMbZGLMVID9yPzgqzI4KZiTqSkMc2R3GJ5pXF7vuLF1qFNeYuEYkPFbh-3U_x1XDiHnDsOhFFzxP16PAfHB9Cb6JSjD-NYNpOWybH5qXU90iqlgwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WLDy6-_194IDgAoBmAsByAsBgAwBogwUKhIKEOS0sQLutbECtbixAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNHF86hX2HGE09gXCpvp5PIVdzkeb0NIfXkQqw_5m9dAa0eWLBMN9iI8iRt7ZlxO9A6HOWQ1YV_X4mOqMEWo6k-wAL_ekJ3kl4Y10YAQ%26sig%3DAOD64_1axh9X3It710RN4QiVoXZAS8rOLg%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-C0wm2_mn2FDxxYfh2Hl2xPPBKOMrmYM9iY34F1Qcx7YivITHfQU_2XaYgvdkqiCQbmousCha60B6Hc14IQKTCIQ9NXjAOCQ0O3HOUST3wnq0EiD4lLZlZS-0jSjb_ruDSOMIxewV2jeE5s-NUrYNKIGgKPRuMCA47cPs5Y8RBJ_IWa2w0%26cry%3D1%26dbm_d%3DAKAmf-DvhNlxJhFv_lEzT4wXw8dPrMc9LZ5RGIi76wKuXsX_rJo2JYGilxRpz_pImeMLnQBdDfeHUVU3BzO2ZGFej5DV24TwJ6AmA-xWURhYwnNgAlWyjJF3HUTf98jhXZGKEKYq5uqVqedX3jVi01HCokSbhWFfRILKd8fr-hSLAb0jrz9kB-OZrJhaUcunebCWdcmxQK3D59vEwNozwQT-ZUHmv87C3Sb2LmZyi48j2VXzxcqAnpmnaL2qseDaUWtpORUxe-8hInHO0zsp4XnTwURq1riH-eaKiTa5j1wJOPPuTxtu5qDJ86X3O4t9j1wZCwruPQ5hR7lUSDMxcQetaJ713swugb95JHGZNCUuyiLBAtGuxzGGY01Rb73jLo0TISilU7ht28Fdy_r5kT5znaoJeX-BeKpgwAFwBz9aBQJyUAqwuLC72Eh_6MIXcjMiBDCgzaffYVfqs8tIXK78ocQXyaIN-74eM3EZmiWUaHxMOX0zL1y05AYmuZ0SqGymghvaQZ93nCu4Y_rU40uZbvZ3PR_qGeTb-Jc9iO_anR5AOSuXqU4%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=5967515733121&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx
host: pv.medialead.de
vary: Origin
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 0
proxy-host: pv.medialead.de

GET
H2 200 e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame BED4 43 B
360 B 102ms
20ms Image
image/gif 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=96583300048368004444556012529009&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=55ec811907&subid=&uid=7d9ff7c1ff1a7f81&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=160x600&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCfoufA-VuZfCaLLOptOUPrrus0Amm5b2gaZ2cnKfJD_AuEAEg1MealwFglYKAgLAHyAEJqQItzKQgCzCyPqgDAcgDmwSqBN4BT9BwQfF9DL_2kxjOU1C2wJ7GRpHnmmOuawCGopIlVvqR6aExWTqG8r94ZItq_EpN3pWqhW1VjsMNpTsNkzTeIrKGobzEpxJF3bRebclhBgeh9gNtT1OCc7QympbuhCq3WWK-kzLMsfwvqgmfyyMINWOXrjUZXs79A7y1r7s4zga341uSrW-8VqdpKyMbZGLMVID9yPzgqzI4KZiTqSkMc2R3GJ5pXF7vuLF1qFNeYuEYkPFbh-3U_x1XDiHnDsOhFFzxP16PAfHB9Cb6JSjD-NYNpOWybH5qXU90iqlgwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WLDy6-_194IDgAoBmAsByAsBgAwBogwUKhIKEOS0sQLutbECtbixAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNHF86hX2HGE09gXCpvp5PIVdzkeb0NIfXkQqw_5m9dAa0eWLBMN9iI8iRt7ZlxO9A6HOWQ1YV_X4mOqMEWo6k-wAL_ekJ3kl4Y10YAQ%26sig%3DAOD64_1axh9X3It710RN4QiVoXZAS8rOLg%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-C0wm2_mn2FDxxYfh2Hl2xPPBKOMrmYM9iY34F1Qcx7YivITHfQU_2XaYgvdkqiCQbmousCha60B6Hc14IQKTCIQ9NXjAOCQ0O3HOUST3wnq0EiD4lLZlZS-0jSjb_ruDSOMIxewV2jeE5s-NUrYNKIGgKPRuMCA47cPs5Y8RBJ_IWa2w0%26cry%3D1%26dbm_d%3DAKAmf-DvhNlxJhFv_lEzT4wXw8dPrMc9LZ5RGIi76wKuXsX_rJo2JYGilxRpz_pImeMLnQBdDfeHUVU3BzO2ZGFej5DV24TwJ6AmA-xWURhYwnNgAlWyjJF3HUTf98jhXZGKEKYq5uqVqedX3jVi01HCokSbhWFfRILKd8fr-hSLAb0jrz9kB-OZrJhaUcunebCWdcmxQK3D59vEwNozwQT-ZUHmv87C3Sb2LmZyi48j2VXzxcqAnpmnaL2qseDaUWtpORUxe-8hInHO0zsp4XnTwURq1riH-eaKiTa5j1wJOPPuTxtu5qDJ86X3O4t9j1wZCwruPQ5hR7lUSDMxcQetaJ713swugb95JHGZNCUuyiLBAtGuxzGGY01Rb73jLo0TISilU7ht28Fdy_r5kT5znaoJeX-BeKpgwAFwBz9aBQJyUAqwuLC72Eh_6MIXcjMiBDCgzaffYVfqs8tIXK78ocQXyaIN-74eM3EZmiWUaHxMOX0zL1y05AYmuZ0SqGymghvaQZ93nCu4Y_rU40uZbvZ3PR_qGeTb-Jc9iO_anR5AOSuXqU4%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=5967515733121&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx
host: pv.medialead.de
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 43
proxy-host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame BED4 43 B
703 B 183ms
102ms Image
image/gif 23.56.205.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=96583300048368004444556012529009&pv=1

Requested by

Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request.php?zone=33lgkyejwpt3&nw=20&renderingType=javascript&namespace=55ec811907&subid=&uid=7d9ff7c1ff1a7f81&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=160x600&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCfoufA-VuZfCaLLOptOUPrrus0Amm5b2gaZ2cnKfJD_AuEAEg1MealwFglYKAgLAHyAEJqQItzKQgCzCyPqgDAcgDmwSqBN4BT9BwQfF9DL_2kxjOU1C2wJ7GRpHnmmOuawCGopIlVvqR6aExWTqG8r94ZItq_EpN3pWqhW1VjsMNpTsNkzTeIrKGobzEpxJF3bRebclhBgeh9gNtT1OCc7QympbuhCq3WWK-kzLMsfwvqgmfyyMINWOXrjUZXs79A7y1r7s4zga341uSrW-8VqdpKyMbZGLMVID9yPzgqzI4KZiTqSkMc2R3GJ5pXF7vuLF1qFNeYuEYkPFbh-3U_x1XDiHnDsOhFFzxP16PAfHB9Cb6JSjD-NYNpOWybH5qXU90iqlgwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WLDy6-_194IDgAoBmAsByAsBgAwBogwUKhIKEOS0sQLutbECtbixAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNHF86hX2HGE09gXCpvp5PIVdzkeb0NIfXkQqw_5m9dAa0eWLBMN9iI8iRt7ZlxO9A6HOWQ1YV_X4mOqMEWo6k-wAL_ekJ3kl4Y10YAQ%26sig%3DAOD64_1axh9X3It710RN4QiVoXZAS8rOLg%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-C0wm2_mn2FDxxYfh2Hl2xPPBKOMrmYM9iY34F1Qcx7YivITHfQU_2XaYgvdkqiCQbmousCha60B6Hc14IQKTCIQ9NXjAOCQ0O3HOUST3wnq0EiD4lLZlZS-0jSjb_ruDSOMIxewV2jeE5s-NUrYNKIGgKPRuMCA47cPs5Y8RBJ_IWa2w0%26cry%3D1%26dbm_d%3DAKAmf-DvhNlxJhFv_lEzT4wXw8dPrMc9LZ5RGIi76wKuXsX_rJo2JYGilxRpz_pImeMLnQBdDfeHUVU3BzO2ZGFej5DV24TwJ6AmA-xWURhYwnNgAlWyjJF3HUTf98jhXZGKEKYq5uqVqedX3jVi01HCokSbhWFfRILKd8fr-hSLAb0jrz9kB-OZrJhaUcunebCWdcmxQK3D59vEwNozwQT-ZUHmv87C3Sb2LmZyi48j2VXzxcqAnpmnaL2qseDaUWtpORUxe-8hInHO0zsp4XnTwURq1riH-eaKiTa5j1wJOPPuTxtu5qDJ86X3O4t9j1wZCwruPQ5hR7lUSDMxcQetaJ713swugb95JHGZNCUuyiLBAtGuxzGGY01Rb73jLo0TISilU7ht28Fdy_r5kT5znaoJeX-BeKpgwAFwBz9aBQJyUAqwuLC72Eh_6MIXcjMiBDCgzaffYVfqs8tIXK78ocQXyaIN-74eM3EZmiWUaHxMOX0zL1y05AYmuZ0SqGymghvaQZ93nCu4Y_rU40uZbvZ3PR_qGeTb-Jc9iO_anR5AOSuXqU4%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=5967515733121&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.56.205.163 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Dec 2023 08:53:24 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame BC14 0
0 53ms
52ms Fetch
image/gif 142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsu5tPDtvqtjPppV4lF2CeHiWHZCr_J8Rr4oMwWwmv7eC2YNnSZAhmmXUx1Uoo5qAaFzh6GcT3qGMIWUiiK4zkLQ7V8nBiarWAlDhdNIg9tW0m_gPUZhgxmbSfT_vZ8ddyRGycES0GNzZiBH5E1mBn5EVMN9B7P-iZNKQHdP6R3eKJWAYMVSsnZ9122cQ6BwFQW_oppp8kq0L0KrRwdxD3fMv9ey4FtLncYm1GtzR5fcQBQ09LiYCw8D95reD_5TbF-9YqJSZ4df-MpI_biBx1x4geTwXt98iDXkC65AwbZ5ghGDpl0H4g-kXKl5f_-cZfd-VE0YHdnDNAGKutY9xUWjxdaxc8TVrsVMkJIjcnXgAPEE3CCBJYFbyvSN_8_4KNnNLIFeajaVO3AmQLrWZ4wilHCfqCxOtvZuwQZjctCVgNEdNams26pFl_NXLxZw0r_RdjKfKufnC8o4sPaJA_Yrcl2xUYo7bFhZJrGYBPoDJXy_C4Dps39oxaVd8vcOB8ZwLveA62f_0WrYbKPeXW-B_VsOyiHRG4KxTwVxSBzLLwt18gFl2mloDW1o2PzViirOO6HVXIv6LAltqZjyEd77T98VWpqM3_DZ-cmBHiabY8wCeB92YOt33KSWwc7LJAwg3kQCJHQNKPZMH5KiNGc_kfkPZfzD3T4CRy0UpQC7FmjrSuH9B7q1BaukLKs5klwFyFO8d3QoipaAwYCvyCkxvPoR4BDqxBKX7lgR3JhgPk7_9l7pzDaRwrbvfDlDkz_CF39rnUpB8xAuy8f5tQ75eZlSWiSoxR3zxWjI6FaTC50kyC8l7YMmjPScWekZHxx3LHOU1OrvL2_DrfUlRSmajIdpLbxZC7O-NDJKwqmZZanf4gFDCsoT7FDopI7rZG_0W548BEwncol4BaTrYZLRfmP1sSo9Dlm08bGy5swswwo114p96dSdheYLSTozu0R5kRX8p3CX9MJdumfSGZVIbjh3d-jmCuyZwGaaVKvHFDz1Xm-mp1uk4mLlnHDHJmb1dLfYTJ3qrGJLq2j9d5VXd7b1QozmPJWFsMZxvOehCoK4APHjkwo5cKI7epcx7SwyEivMHuwCnprWgZ0FW3l55sk5VBA-Gneg_mMhDbK2uh-E3RUnDkjJ7VPahp2waT3nRRpkVjja-CRTGCqekussaqW_82A1iPfHoDgb_0TGTMZjha73qK9D346YJp2ScWNXYWIzbYgRN3__QjDgSO2NpsKxA2Sc0duxGOgzB-dZGl6_SeErFPBL9vjIUtwAI6lhwFNWryyI1VR4lWNNBxMf_HKhHx-SOn8_qBdqMyx4F-RBBaABX8Z0Ja1VF5W6Num9OPwUs2eZp7pneZRdRRKc4i5l&sai=AMfl-YQTfXA73pxnwiNKMGp3h4ubusuhgiMb5Zywufqz0k0GbcxMun8gTtTOXVZ_Ypu8eVsj8JYuMocUb8LzN_anKxHF5E9qq4hH610UBJjhR29B90JWUNlxQkp-EbOBZM_XTcgGF9feZed-7wQm9qMgQB3NtX59jDH6fFY1a-zxBwIoeZoQWo5Q61S_1I515DwroJ7qRux9gIy6qqMqCXdvaJftqBdadDY7a8FImgqZhqbXN1l0pdZqbvgXnvVn9t2D4tNNJl1Y4GbR72KKuli544_3ZV6l-Q_b4pSOknHyUJ1lBym1f7ZCBgf0-94RKZfHQxqBYac08jOwaUOei_ixM4Yt1-BqiRSr18uvJx_rIT9DIwzhwcWUc6nYqB-f9ogeWIbbvtSi4ZvR96BEXRsW-QjW3XsJ0k4hXRY-gLnCbUNVzKrsbwVqVormGqZaNQNl995nwym27j-OFfOCpzf4ck2W5EIfj5lW4hqMy5cO4XWu8RouRpY7Dc7Gu4GkoXK6qBXZgCQpjD1ufA&sig=Cg0ArKJSzHvNwNlk1M72EAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9sdWZ0aGFuc2EuY29tLGh0dHBzOi8vZXhhY3RhZy5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=243&vt=11&dtpt=123&dett=3&cstd=115&cisv=r20231130.34287&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcfraa-aa-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9E08 0
20 B 52ms
52ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B2b_fBOVuZcX2EY617_UP85uRwAwAAAAAOAHgBAI&bg=!hoWlhcrNAAY3kmNgF5I7ADQBe5WfOHcHQreGiV1BUX2Ii52-hWgLN_06lupuYMCztnhANYcPNR56ibEXQHR22TzZQk2-AgAAAFtSAAAAAmgBBwoAhJHFuQ3FVa3gppI5wrolRkODOqcXg2sL_abEYaQeTtaQeZ0dXljxTHDhYzBdwdKRsmeCMhstauTZxOE1x4rsLiacddQREWmXcVTrGBJwgtvdTQJLczbo5ibgPoylMLsHOqYITKEbOcoGUwpIXjsSM-C0ArhfJJR7ZYyD_vcuw88uQa-AA5kC6A1om7wLAbe_kQII60-5G5oo2nBzOiZA2akD5gMo2jIruq6O7IRGfORD1muYKoRTt_pluAV_bV80MXLlWYO_RlxSmooRO-PjfrjO0N6k7hMYSqV9yOCpGsUIzSSIDz2y9FLxbWyCn732Ak6ANrmsQbgxumavOxlIboLVal2zINwTGoSdIEut2yGbW-XpnNd6tP6vklefLRErvNRpGRKFOs30iSuga2smWkLBwcjn1-Ob8RHbSUgjI6RaVGFMHDGrR2qBKwIiLJBmIU9sbWPcnhP4lpqH9ix3sh9lufOaWP_kifXHA0eBlsuMWRkZ5jJagw8M17IMx55BiRd2c9kJr_Zmx8ZhjUd5JR3aoOH8CYg7_ozGBoN6gBaFqjY9zxmRuAXXD0Evx58MMI4cL5BedcyyihJkLjDh8mVGBqITEOlNQ_oOcl0dVDqTDiNR8w8TE5nyJsqf3RrTEAqG8w7CqsKhsgDisydPkN4TpaVhPTB5jLSBK-zOqjHePhwP66qqKEWa3c2iRKJeY893_nVfTo5qRQMUmMRgMeuhPhQmO0nN0OaZigc8fOZ_HFoi2GGX74MU3v3MyN2MHVlpfpUJg4PtulkiIoDVg-Vbupkb0yrtuYQGZhafs5HKLm9hbRS77WQXyYiuRrsWq_-4Lq8utm1hqg6UVViFAYw-QXQEs-L-HuMjBqpGYwYf-vrGPr4w-IDwPlmKcNwK4Eb4bkWnMwsqpeZYfFrP4oPEyUmeZSWahT-u3H_qwq7B9S1UxUUxRTXV3A9Rzu3pRZleF9dWbPttShIyQjodhSQJJdqQ0NW-l7PlllxvlAnhW_hmXRSvNRd8zRKwK_AjCL76-TiYjS_LFN9D_30z-_jz3Yv9Cnd8NQ111imFnXHRa4UG0zWgmG4YK7vf-KdQibK3MBrX9XpTQ80tMxpSGAIcXN5uI4djyWKU10DxlXyWlXlSlNq6PLi53y1V9QQ7jx_22EFNExtHELOtkG9kQQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
adv.office-partner.de/ Frame C007 930 B
923 B 28ms
7ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=3a313e69d6&subid=&uid=5cb252426c0a51f8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCXAaUA-VuZZCULOX8xtYPxP6v-Aqm5b2gab2TnKfJD_AuEAEg1MealwFglYKAgLAHyAEJqQIzljctyC6yPqgDAcgDmwSqBN4BT9CR0LJgxMTs6GrdSIUzLNRLhv-GuEGIV2QjKampOov8mttxXyw7vVe2C5T6IavAbsxwkWR2ph7nxZXE5dP_Mykq_D0f6BDCr1OTRJcGbCFfuLLbHHmoW9IM6ezXDFbTOoDgKAX8atynJmq8Irm180al7K5oR91_eH4PEi3lgkAXx0KCVtndMt540J5WZdFe5nUHruz3kEcnRciIdK1ogJFrs01-WyOXUuoIX3rWDiOatwIlaqr6hzUDIVffeiNfWVfa89ETaru-JBYUNYvQo_NPS70GWuq9_R8_Z4yGwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WL3b7O_194IDgAoBmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNo1mRdXugpOPTt7ijsWk5xc078XSXSYdbdmDuGYir-_9siyqlnL4VWNhahiguHsdKJJmO-MXMyokpJCxpXt7Njt0GKpU-jPUWIhgB%26sig%3DAOD64_3ypx6k4yCigD8eIcS9XdDdh5IvZA%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-DaHybOQMQ3vwG9tFozg5-Bbu9ZcWN8-HuXCRnY2-4iObSYMWxSkG0KZUz28E3sDD3747HORVtF4WRYVQeLmnC_GLcZ1dppg7g6KgvBvNJiYKMXUqFpe8mPqTvGAObVzlAimCT9R4rRtgkLDFiM3EdCFGGUCiP7K-VCrdLh45hfanbAZlI%26cry%3D1%26dbm_d%3DAKAmf-A1Bd8i_HwZvECAVHkEQAUz3DULEzs-jSRASeC_BhlJ9diAuYBr_gXyoxPjM9YMsbKQmvkKbDt2eZLr-GqgIBXMYeud6oLguqgz1D1W8cQ0ydL6NPDEF0WSeUZJTGGMfgHkv_rbUBpNgqXz6c5MbWXPgn41RUi2-NEXz56FS8ZNTebUNFGvSOCN5Ez7LOWy-Lp1CopvfE7EcLm98xzGBjA5XrvkZYdqlRPebAmD4NCR75KADcaGU1gwQW4IA4vPJwAzeuTI225QyscxFU31zqr34sFpfqr2mCHebAG8XckT7xwRHlV0cRxXO-McLLjOYGBTcdvOX763VLGoVfmYgKGw4dPJA1SmS8r2js76yD_W71UQXt6V6GOSu6EPWVRX1nuDw-dj-mEs3VkqcvqXkm8A69yZkZB0VWwlBuBotB88q34-plA1mdFv4KlxsTwiZzLN9mFrBVpqkIl1K7nrUca1kWiCtIq3qtFmQJeJY1c0FMJd74BmPgNECrweN14EcJ1rW7yGbsWbNGp_oQXVLw1WKN0jL2JCmuPufXUlIiAg9gV_PH0%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=9949805174950&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Tue, 05 Dec 2023 08:53:24 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Tue, 12 Dec 2023 08:53:24 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 e99aace94e6e5873881d3400993e1e7e Show response
pv.medialead.de/trck/epv/ Frame 861D 0
326 B 23ms
19ms Document
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=36847600040911104444994012529007&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=3a313e69d6&subid=&uid=5cb252426c0a51f8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCXAaUA-VuZZCULOX8xtYPxP6v-Aqm5b2gab2TnKfJD_AuEAEg1MealwFglYKAgLAHyAEJqQIzljctyC6yPqgDAcgDmwSqBN4BT9CR0LJgxMTs6GrdSIUzLNRLhv-GuEGIV2QjKampOov8mttxXyw7vVe2C5T6IavAbsxwkWR2ph7nxZXE5dP_Mykq_D0f6BDCr1OTRJcGbCFfuLLbHHmoW9IM6ezXDFbTOoDgKAX8atynJmq8Irm180al7K5oR91_eH4PEi3lgkAXx0KCVtndMt540J5WZdFe5nUHruz3kEcnRciIdK1ogJFrs01-WyOXUuoIX3rWDiOatwIlaqr6hzUDIVffeiNfWVfa89ETaru-JBYUNYvQo_NPS70GWuq9_R8_Z4yGwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WL3b7O_194IDgAoBmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNo1mRdXugpOPTt7ijsWk5xc078XSXSYdbdmDuGYir-_9siyqlnL4VWNhahiguHsdKJJmO-MXMyokpJCxpXt7Njt0GKpU-jPUWIhgB%26sig%3DAOD64_3ypx6k4yCigD8eIcS9XdDdh5IvZA%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-DaHybOQMQ3vwG9tFozg5-Bbu9ZcWN8-HuXCRnY2-4iObSYMWxSkG0KZUz28E3sDD3747HORVtF4WRYVQeLmnC_GLcZ1dppg7g6KgvBvNJiYKMXUqFpe8mPqTvGAObVzlAimCT9R4rRtgkLDFiM3EdCFGGUCiP7K-VCrdLh45hfanbAZlI%26cry%3D1%26dbm_d%3DAKAmf-A1Bd8i_HwZvECAVHkEQAUz3DULEzs-jSRASeC_BhlJ9diAuYBr_gXyoxPjM9YMsbKQmvkKbDt2eZLr-GqgIBXMYeud6oLguqgz1D1W8cQ0ydL6NPDEF0WSeUZJTGGMfgHkv_rbUBpNgqXz6c5MbWXPgn41RUi2-NEXz56FS8ZNTebUNFGvSOCN5Ez7LOWy-Lp1CopvfE7EcLm98xzGBjA5XrvkZYdqlRPebAmD4NCR75KADcaGU1gwQW4IA4vPJwAzeuTI225QyscxFU31zqr34sFpfqr2mCHebAG8XckT7xwRHlV0cRxXO-McLLjOYGBTcdvOX763VLGoVfmYgKGw4dPJA1SmS8r2js76yD_W71UQXt6V6GOSu6EPWVRX1nuDw-dj-mEs3VkqcvqXkm8A69yZkZB0VWwlBuBotB88q34-plA1mdFv4KlxsTwiZzLN9mFrBVpqkIl1K7nrUca1kWiCtIq3qtFmQJeJY1c0FMJd74BmPgNECrweN14EcJ1rW7yGbsWbNGp_oQXVLw1WKN0jL2JCmuPufXUlIiAg9gV_PH0%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=9949805174950&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript; charset=utf-8
date: Tue, 05 Dec 2023 08:53:24 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
vary: Origin

GET
H2 200 link.html Show response
track.webgains.com/ Frame F498 2 KB
2 KB 126ms
73ms Script
text/html 18.170.182.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=36847600040911104444994012529007&nw=1
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.170.182.156 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-170-182-156.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 19407360e9ed56e2d49377575d788d6aee9915b1818540efd79848177cbd4a25

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
last-modified: Tue, 05 Dec 2023 08:53:24 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Tue, 05 Dec 2023 08:54:24 GMT

GET
H2

200

activityi;dc_pre=CMrSs_D194IDFaHHOwIdYT4Fyw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1320501837867.7158 Show response
5994599.fls.doubleclick.net/ Frame 2484
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1320501837867.7158?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CMrSs_D194IDFaHHOwIdYT4Fyw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1320501837867.7158?

392 B
327 B

63ms
62ms

Document
text/html

216.58.206.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CMrSs_D194IDFaHHOwIdYT4Fyw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1320501837867.7158?

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ad5a5fa4215d33b83560899fe406f1c6458100bfbce6a2dfc2ad35a41f2b6d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 218
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 08:53:24 GMT
expires: Tue, 05 Dec 2023 08:53:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 08:53:24 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CMrSs_D194IDFaHHOwIdYT4Fyw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1320501837867.7158?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90007.redintelligence.net/ Frame 6B76 7 KB
2 KB 36ms
12ms Document
text/html 138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/request_content.php?s=36847600040911104444994012529007&a=9f0734ff
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=3a313e69d6&subid=&uid=5cb252426c0a51f8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCXAaUA-VuZZCULOX8xtYPxP6v-Aqm5b2gab2TnKfJD_AuEAEg1MealwFglYKAgLAHyAEJqQIzljctyC6yPqgDAcgDmwSqBN4BT9CR0LJgxMTs6GrdSIUzLNRLhv-GuEGIV2QjKampOov8mttxXyw7vVe2C5T6IavAbsxwkWR2ph7nxZXE5dP_Mykq_D0f6BDCr1OTRJcGbCFfuLLbHHmoW9IM6ezXDFbTOoDgKAX8atynJmq8Irm180al7K5oR91_eH4PEi3lgkAXx0KCVtndMt540J5WZdFe5nUHruz3kEcnRciIdK1ogJFrs01-WyOXUuoIX3rWDiOatwIlaqr6hzUDIVffeiNfWVfa89ETaru-JBYUNYvQo_NPS70GWuq9_R8_Z4yGwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WL3b7O_194IDgAoBmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRFsBOH77EV0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNo1mRdXugpOPTt7ijsWk5xc078XSXSYdbdmDuGYir-_9siyqlnL4VWNhahiguHsdKJJmO-MXMyokpJCxpXt7Njt0GKpU-jPUWIhgB%26sig%3DAOD64_3ypx6k4yCigD8eIcS9XdDdh5IvZA%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-DaHybOQMQ3vwG9tFozg5-Bbu9ZcWN8-HuXCRnY2-4iObSYMWxSkG0KZUz28E3sDD3747HORVtF4WRYVQeLmnC_GLcZ1dppg7g6KgvBvNJiYKMXUqFpe8mPqTvGAObVzlAimCT9R4rRtgkLDFiM3EdCFGGUCiP7K-VCrdLh45hfanbAZlI%26cry%3D1%26dbm_d%3DAKAmf-A1Bd8i_HwZvECAVHkEQAUz3DULEzs-jSRASeC_BhlJ9diAuYBr_gXyoxPjM9YMsbKQmvkKbDt2eZLr-GqgIBXMYeud6oLguqgz1D1W8cQ0ydL6NPDEF0WSeUZJTGGMfgHkv_rbUBpNgqXz6c5MbWXPgn41RUi2-NEXz56FS8ZNTebUNFGvSOCN5Ez7LOWy-Lp1CopvfE7EcLm98xzGBjA5XrvkZYdqlRPebAmD4NCR75KADcaGU1gwQW4IA4vPJwAzeuTI225QyscxFU31zqr34sFpfqr2mCHebAG8XckT7xwRHlV0cRxXO-McLLjOYGBTcdvOX763VLGoVfmYgKGw4dPJA1SmS8r2js76yD_W71UQXt6V6GOSu6EPWVRX1nuDw-dj-mEs3VkqcvqXkm8A69yZkZB0VWwlBuBotB88q34-plA1mdFv4KlxsTwiZzLN9mFrBVpqkIl1K7nrUca1kWiCtIq3qtFmQJeJY1c0FMJd74BmPgNECrweN14EcJ1rW7yGbsWbNGp_oQXVLw1WKN0jL2JCmuPufXUlIiAg9gV_PH0%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=9949805174950&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.157 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 84ee712aa22c562550f65898a076b35e125558787f63a5eb73ac24e7d9ba8261

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2111
Content-Type: text/html; charset=utf-8
Date: Tue, 05 Dec 2023 08:53:24 GMT
Expires: Tue, 05 Dec 2023 08:53:24 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H2

200

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame F498
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=36847600040911104444994012529007&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=36847600040911104444994012529007&t=htlp&gdpr=1&consent=1&gdpr_consent=

43 B
360 B

20ms
19ms

Image
image/gif

91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=36847600040911104444994012529007&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=6212002511&adk=1854347006&adf=3400082548&pi=t.ma~as.6212002511&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403292&bpp=1&bdt=200&idt=347&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=2725&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=348
Protocol: H2
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx
host: pv.medialead.de
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 43
proxy-host: pv.medialead.de

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=36847600040911104444994012529007&t=htlp&gdpr=1&consent=1&gdpr_consent=
date: Tue, 05 Dec 2023 08:53:24 GMT
server: nginx
content-length: 138
content-type: text/html

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame F498 43 B
703 B 135ms
85ms Image
image/gif 23.56.205.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=36847600040911104444994012529007&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.56.205.163 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-205-163.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Dec 2023 08:53:24 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
DATA 200
OK truncated
/ Frame F498 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 65e31a8eff137a3bef947769a3de610af393a4091df5874a5918b5074350d08c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame F1C4 640 B
265 B 54ms
53ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGP6N3_QBMAE&v=APEucNVxXyfYqIMP1lnG3-i-wjQsIcJ4A_jtZ59YcEFVr0uk701VjaKNLOAnVqE_JdKz7Ut1akTdrL7FG0ZsLMXJJhQX7VWe_bi5vjgR9GN9aEK2Y_rkUr2l8BSsjctI19DITmi_mcGTavHTJM5jAcFHR0FXX-FLzT5XzjKpPbUZRmdCrfFeydo

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=4347476252&adk=504672438&adf=3417920651&pi=t.ma~as.4347476252&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403292&bpp=1&bdt=200&idt=339&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=342

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=4347476252&adk=504672438&adf=3417920651&pi=t.ma~as.4347476252&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403292&bpp=1&bdt=200&idt=339&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=342
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 08:53:24 GMT
expires: Tue, 05 Dec 2023 08:53:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame C771 89 KB
31 KB 72ms
72ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 08:53:24 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/ Frame C771 3 KB
1 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 22:00:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39177
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 22:00:27 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/ Frame C771 20 KB
8 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

240ed2cf95df9fa682cc2a820a6681e8faa474dcd678ffbe844351ccbda9bb6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:51:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 139
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8549
x-xss-protection: 0
server: cafe
etag: 755982428571291914
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 08:51:05 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame C771 202 KB
64 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Dec 2023 08:53:24 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C771 42 B
63 B 48ms
48ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cf8bMAcqDcIWOWAooWHe5o2QoL34urR-5_50iJYWwyR_7J4pwNkcxNkzvhOFjyVtwP9Qrd-9XFTr5wWDKAh7ZdAUagjhoFKRCYMwxD_n4c8iT1icM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/creatives/assets/4703545/ Frame 9D6A 3 KB
1 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4703545/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=J4FK7qRkCH&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c1b2da575466eb30982e08c1020f55bcf2d9565f53bd64c3da87a1d774d75588

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=J4FK7qRkCH&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:51:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 102
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1100
x-xss-protection: 0
last-modified: Fri, 05 May 2023 10:07:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Dec 2023 09:06:42 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 9D6A 8 KB
6 KB 58ms
58ms XHR
application/json 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a6ef7c03bb9fa2faf5ddb623078decce8ec80f28fdf8bb348f5bb01634e0d484

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5963
x-xss-protection: 0

GET
H2

200

activityi;dc_pre=CK_es_D194IDFePMOwIdchgETw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7421131836471.022 Show response
5994599.fls.doubleclick.net/ Frame A9FE
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7421131836471.022?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CK_es_D194IDFePMOwIdchgETw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7421131836471.022?

391 B
286 B

63ms
62ms

Document
text/html

216.58.206.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CK_es_D194IDFePMOwIdchgETw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7421131836471.022?

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcfraa-aa-in-f6.1e100.net

Software

cafe /

Resource Hash

16e9faae5c54c37aa733bb0df8989a1617576da0239a51aefd451e229d9f8784

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 217
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 08:53:24 GMT
expires: Tue, 05 Dec 2023 08:53:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 08:53:24 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CK_es_D194IDFePMOwIdchgETw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7421131836471.022?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90009.redintelligence.net/ Frame 5CDC 7 KB
2 KB 35ms
12ms Document
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90009.redintelligence.net/request_content.php?s=96583300048368004444556012529009&a=429de8bd
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&slotname=6315164047&adk=1815116396&adf=2119670097&pi=t.ma~as.6315164047&w=160&lmt=1693404896&format=160x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403291&bpp=1&bdt=198&idt=335&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1080&ady=1897&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=338
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 5deff97591ba6239eb143fa47d3ad22f0e04f16f7ff39090d8b710db68924989

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2038
Content-Type: text/html; charset=utf-8
Date: Tue, 05 Dec 2023 08:53:24 GMT
Expires: Tue, 05 Dec 2023 08:53:24 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame BED4 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 64e837d05fce89f92d05b6074ef0d257b37b0cfcb3211e1853a10e149e41ebb3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 css
fonts.googleapis.com/ Frame 6B76 5 KB
1 KB 60ms
24ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=36847600040911104444994012529007&a=9f0734ff

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 07:52:26 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 05 Dec 2023 08:53:24 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 6B76 16 KB
16 KB 37ms
14ms Image
image/png 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=36847600040911104444994012529007&a=9f0734ff
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: a1c52a37bc7c3c9e035c1817a0c78665ff491a9854bbb4b665ee774450e9b672

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 08:53:24 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16513
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 6B76 17 KB
17 KB 35ms
13ms Image
image/png 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=36847600040911104444994012529007&a=9f0734ff
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: 41d5c049a8bfb1cbe82bf1d536244753f48c2e0240005f2ad753b70bf606a4c2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 08:53:24 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16982
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 6B76 11 KB
11 KB 41ms
17ms Image
image/png 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native2.png
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=36847600040911104444994012529007&a=9f0734ff
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: ee60dc9f4a5a261552c9432f27ce50a66664dacc6bcd21d6651141c579e77d03

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 08:53:24 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10940
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame C007 175 KB
63 KB 24ms
23ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a52e8ca9507299459bbcd4eab3662692194062bc229709101973442010815d12

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64116
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 08:53:24 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame 372F 175 KB
63 KB 29ms
29ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9b328d831b112c1505a892a225cc9a0fb223620a8eee293e92bd4850e302bb94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64119
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 08:53:24 GMT

GET
H3 200 728x90_de-de_performance.js Show response
s0.2mdn.net/creatives/assets/4703545/ Frame 9D6A 80 KB
19 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4703545/728x90_de-de_performance.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/creatives/assets/4703545/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e22e6a4c1770831466a702ad01381d6e8ad3facca6587e0f70bd4fe77679b00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=J4FK7qRkCH&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:48:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 324
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19260
x-xss-protection: 0
last-modified: Wed, 15 Nov 2023 13:32:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Dec 2023 09:03:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 5CDC 5 KB
755 B 44ms
26ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request_content.php?s=96583300048368004444556012529009&a=429de8bd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90009.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 07:54:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 05 Dec 2023 08:53:24 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 5CDC 25 KB
25 KB 41ms
16ms Image
image/png 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=150&height=90&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request_content.php?s=96583300048368004444556012529009&a=429de8bd
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: 3271b11460d9dfccfb1c4c9b819592b1f15492ff7876305668a6ca01e8f52e71

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90009.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 08:53:24 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 25830
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 5CDC 27 KB
27 KB 40ms
14ms Image
image/png 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=150&height=90&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request_content.php?s=96583300048368004444556012529009&a=429de8bd
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: 4d678f9af176e0292e8352df4b3602be14f67de82def44b6f2e0491e7435c4e2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90009.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 08:53:24 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 27706
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 5CDC 16 KB
17 KB 46ms
21ms Image
image/png 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=150&height=90&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native2.png
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request_content.php?s=96583300048368004444556012529009&a=429de8bd
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: 9599861e9654c8fe1514fc4279f7b785e53cbcf4ee76acef18e237aadd432aba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90009.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 08:53:24 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16833
Vary: Accept-Encoding
Content-Type: image/png

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame F1C4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEB692UzCI4ZuT6Fqoh5A5pM&google_cver=1

43 B
264 B

33ms
21ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEB692UzCI4ZuT6Fqoh5A5pM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGP6N3_QBMAE&v=APEucNVxXyfYqIMP1lnG3-i-wjQsIcJ4A_jtZ59YcEFVr0uk701VjaKNLOAnVqE_JdKz7Ut1akTdrL7FG0ZsLMXJJhQX7VWe_bi5vjgR9GN9aEK2Y_rkUr2l8BSsjctI19DITmi_mcGTavHTJM5jAcFHR0FXX-FLzT5XzjKpPbUZRmdCrfFeydo
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEB692UzCI4ZuT6Fqoh5A5pM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame F1C4 43 B
136 B 66ms
22ms Image
image/gif 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGP6N3_QBMAE&v=APEucNVxXyfYqIMP1lnG3-i-wjQsIcJ4A_jtZ59YcEFVr0uk701VjaKNLOAnVqE_JdKz7Ut1akTdrL7FG0ZsLMXJJhQX7VWe_bi5vjgR9GN9aEK2Y_rkUr2l8BSsjctI19DITmi_mcGTavHTJM5jAcFHR0FXX-FLzT5XzjKpPbUZRmdCrfFeydo
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame F1C4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEMouwITdqLyOrtAIpCMUYVo&google_cver=1

23 B
163 B

61ms
45ms

Image
image/gif

2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEMouwITdqLyOrtAIpCMUYVo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGP6N3_QBMAE&v=APEucNVxXyfYqIMP1lnG3-i-wjQsIcJ4A_jtZ59YcEFVr0uk701VjaKNLOAnVqE_JdKz7Ut1akTdrL7FG0ZsLMXJJhQX7VWe_bi5vjgR9GN9aEK2Y_rkUr2l8BSsjctI19DITmi_mcGTavHTJM5jAcFHR0FXX-FLzT5XzjKpPbUZRmdCrfFeydo
Protocol: H2
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

expires: Tue, 05 Dec 2023 08:53:24 GMT
pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEMouwITdqLyOrtAIpCMUYVo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame F1C4 23 B
163 B 79ms
33ms Image
image/gif 2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGP6N3_QBMAE&v=APEucNVxXyfYqIMP1lnG3-i-wjQsIcJ4A_jtZ59YcEFVr0uk701VjaKNLOAnVqE_JdKz7Ut1akTdrL7FG0ZsLMXJJhQX7VWe_bi5vjgR9GN9aEK2Y_rkUr2l8BSsjctI19DITmi_mcGTavHTJM5jAcFHR0FXX-FLzT5XzjKpPbUZRmdCrfFeydo
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

expires: Tue, 05 Dec 2023 08:53:24 GMT
pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame F498 53 KB
19 KB 62ms
23ms Script
application/javascript 108.157.4.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=36847600040911104444994012529007&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-70.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fbc6bed540723f219a878e5735ae8cb1c05aa9f7012bf21870cd79e41af25bcd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 12:36:09 GMT
content-encoding: gzip
via: 1.1 374989d04bb9f7efef831637d8f4b234.cloudfront.net (CloudFront)
last-modified: Thu, 23 Nov 2023 16:26:10 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P2
age: 73036
x-amz-server-side-encryption: AES256
etag: W/"1180a1bfee0aad979766ecd6180b923e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: YF6mB23HIsyXfSbzuXvIE4BGxFLKDmXtA0YED1kx5XVnt21RS05E-w==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame F498 85 B
438 B 48ms
19ms Image
image/gif 18.154.63.65
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1701766704&Signature=F2U3lMPxZhpCY-87jBbmkr7hfdxzlyrkgglOEvk30pLRyPa8EZh4bpqmmdYldrRxyYKsTZqVBZ9m1PxcHnBUaPL8dN-irWaXIMUP~r-9FQWFH4VLCByuC7S-ptf7I-zuesed6b~1izQHbUtCTiwRFSqznKDiJ5mXsCjqKQ03BL5pbc01IBS4PRs-NmPHqT-eLdjvxPgTKNtA2wKHQ6gdbkamnRSDM1VfLX9T0vJ2s0ToXOYMGQWNGE2xSW4-ep-BBUfHVv4fmv9INBW3jNaHL73wOMw6rZROYnUR4MO-liTsLv-qttO-1sPnvR51xmGVsvJxY-2OdRdUNFISP2SvZQ__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=6212002511&adk=1854347006&adf=3400082548&pi=t.ma~as.6212002511&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403292&bpp=1&bdt=200&idt=347&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=2725&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=348
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.63.65 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-154-63-65.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id: null
date: Mon, 04 Dec 2023 14:20:46 GMT
via: 1.1 e854bbca657208a759bb2d8d135f9d78.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P4
age: 66758
etag: "70af33d70b6810475aae19743c8c435b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 85
x-amz-cf-id: oRDpqbfiegbiDsUBjKLadQOyN7PHVSC6YFf78dpVFD6QXsC8QWwLGA==

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame BED4 53 KB
19 KB 46ms
12ms Script
application/javascript 108.157.4.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=96583300048368004444556012529009&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-70.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fbc6bed540723f219a878e5735ae8cb1c05aa9f7012bf21870cd79e41af25bcd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 12:36:09 GMT
content-encoding: gzip
via: 1.1 374989d04bb9f7efef831637d8f4b234.cloudfront.net (CloudFront)
last-modified: Thu, 23 Nov 2023 16:26:10 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P2
age: 73036
x-amz-server-side-encryption: AES256
etag: W/"1180a1bfee0aad979766ecd6180b923e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: 1a4ECftl9amG-2bkdMZMTSRwN17OTfDT1yQVK8MDpICLORC2QWgp-w==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame BED4 3 KB
3 KB 38ms
15ms Image
image/png 18.154.63.65
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1701766704&Signature=QoTS5g2bcv1trjAoGmcjkZKS5nyCsG0U-KmlzT7RbtW9QatvqROMXMQt6jEziVyxDzswaxohK-pg~I8GbfGOAYuM-0yDOz~EGEL5kAkS~CKWBnLy9XXta2MO2aidZMKeVIPUmu7s42DzUY2s7qjQnlCG~DCTqld8Kivmryvmf3~a7w8zYsxnYXCUve65WJTckGPqExrU~CqGmht8~ySe-azOBV3WHWVObPcVQmDQm59Xn7nJYXQxL2jolqmKUFq29unx3gQkOqaF~1-6NlVbj5shPcqj9ZJKC1llIU7OsM3biiW4ZQQYuHc4dCbPKn2-ApydYYvirc6CiNN3BxsSlg__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&slotname=6315164047&adk=1815116396&adf=2119670097&pi=t.ma~as.6315164047&w=160&lmt=1693404896&format=160x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403291&bpp=1&bdt=198&idt=335&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1080&ady=1897&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=338
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.63.65 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-154-63-65.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 02:43:34 GMT
x-amz-version-id: null
via: 1.1 e854bbca657208a759bb2d8d135f9d78.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P4
age: 22191
etag: "4e57de0506fbdb487ffcd53b450caee1"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: bvO_gGapqkNtUfzxCuu2G6EIyt3Elcao8S5NuBZTsEtT-R6oSvpRhg==

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 9D6A 17 KB
6 KB 2947ms
2947ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 05 Dec 2023 08:53:27 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame C007 274 KB
91 KB 25ms
25ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

471a358e7d25ae685d5161a0ede8c02718479e6b31b7fd91d8e2b324c579b6fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93078
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Dec 2023 08:53:24 GMT

GET
H3 200 star_alliance.svg Show response
s0.2mdn.net/creatives/assets/4689654/ Frame 9D6A 6 KB
2 KB 54ms
50ms Fetch
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4689654/star_alliance.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/creatives/assets/4703545/728x90_de-de_performance.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

563d8b655debf02dc76ee9cad7e2114692c770d009bfc9ed1f9153eb384593d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=J4FK7qRkCH&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:52:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 45
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2334
x-xss-protection: 0
last-modified: Thu, 29 Jun 2023 11:06:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Dec 2023 09:07:39 GMT

GET
H3 200 lh_logotype_single.svg Show response
s0.2mdn.net/creatives/assets/4689654/ Frame 9D6A 5 KB
2 KB 52ms
48ms Fetch
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4689654/lh_logotype_single.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/creatives/assets/4703545/728x90_de-de_performance.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7502e785bdc8f7184cab7e278053c49be4458393085eb2fbddabf35b895c310

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=J4FK7qRkCH&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:40:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 775
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2151
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 09:41:58 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Dec 2023 08:55:29 GMT

GET
H3 200 lh_crane.svg Show response
s0.2mdn.net/creatives/assets/4689654/ Frame 9D6A 2 KB
1 KB 68ms
64ms Fetch
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4689654/lh_crane.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/creatives/assets/4703545/728x90_de-de_performance.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d2067d4b9b5b9d3003ffa4dc17b44616dc00a543f59eea17df555e959f20b53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=J4FK7qRkCH&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:41:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 685
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1311
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 09:41:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Dec 2023 08:56:59 GMT

GET
H3 200 NH_D_AP_Pavilion_728x90.jpg
s0.2mdn.net/creatives/assets/4703548/ Frame 9D6A 58 KB
58 KB 69ms
65ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/creatives/assets/4703548/NH_D_AP_Pavilion_728x90.jpg

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82851291e24304ad72ba40c9e041610a7dbf8f7b2eff1255bfb49a6ec18133a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=J4FK7qRkCH&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:43:38 GMT
x-content-type-options: nosniff
age: 586
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 59292
x-xss-protection: 0
last-modified: Mon, 07 Nov 2022 17:03:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Dec 2023 08:58:38 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C771 0
20 B 61ms
58ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7169415829019&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C771 0
20 B 51ms
50ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7169415829019&version=m202309260101&ct=76&x=1&cor=6760921527256195000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C771 110 KB
41 KB 66ms
65ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DK09jNzP3pBz0QAex-lUgI9UEA-3FET-kJWEsxRRGJSSTsIAFVWd4DlG9P67dcltGPIybp7PovDt4mo5_K-J01HGdTQ0gG_bm_Ur7XoKJHYKRBIKZlBV6-6g42PAkvqabmvFXky2CiAff0kTkydv66vYvdzmQB8dEZCQdR0cMsU_RfoOc&dbm_d=AKAmf-AKoh78JMO5X5-ljHI_Pk1ypX9ioPT4M0HXFY9Bl68ZtgGa8q1u1HV1JV_TH5V5d_56KDs01r4FN8DmxbmlJEtsPd2ujLUTH578gZeXZ2xGImh6cUZh8oM2lxmWzFtSfMwQmEHJY0YdWwThGA2nqcMzf3t2r2xr6W59qsO214Cl67VZImN7wGNVcu1j7T-8L3HJDmz4qtEN8OXMMWO2Db3tGb9B2v7NSiQ5LxzheeGKDpGM-ZUQ6P2lrP0IQYdjGwg-Z1oyNvL03Z-V7v-qeOCr625FwsL_0ujm3HUE5S4hLuAdwChCKguOK-2iR7zy4OF0S0IfaZdGeZxlNA4j66Ms3Z4H5tqvaXw5Ax-ItnpaBH1LZjP3nX3TI01-mUyOp1rorHcvTxZVt4MnnlR_AZHJBtbqQ2UeNaPgpyLyfmxo5tTentdLicJvVfFeclXLuSWbLDIw38Cg3oaPSj6Ri7zHwZotgt6GL81-zRbT16u0heLGJfi2lkTk8R_eprLUZQXanQ6GWjbZzx0iSYmx1wf90kQjvG6W8Cs7eR42r09lmkUBWsvo1ltlli5F5lm6L0YXIRXhocII6ZMBovotQ2K-k_CoQPyCC_NDgxxAab4Arh7EhGQSuQChRqr6IG8mbKjzUpEFRvBaORMtoa0ghUNWuoV5ZtiDrv5cgvC-g12DBzRRriH04FzfGC-ew6bfH4y3EesQnKfsk9pbj5dcKPCyjlf7QpYJtjwmhthasJgViy1WnaxtpkVByYY3tcdGfB1VR8I4ZUiUbOu5JFLAeT9B-SISa8WSiGwRfq8TyaEJXqPL8ZIk4_PgxFzbwVcFVwx4faC5IBW6D7NWJljFfEybO41h57tjPjfQJgRapIF3X_zFsoNFXidtiRgOUqW3xolv__G4QuVBt3d7yZcOpHfJnkMU8XvkthHLIoeWufKLxx9lAfTWsglApoJ_xRhh8Qu9sVxEn4aCOzNop9HYqNuZvOzd3h61Ten9zeST_Hv6DKJCf5E_FOSA8ChCaXGffZbU0Z7ZKZRrT0DfnEMbJTQjQMjmgaAlCGw58o5L1SFQ-0eLrXY0lRJvyUXqXLSnGhcc8v3BtRnNrEc9PDNOQpM7MoWgIBW69R7tec1ZmfS7Xz4qVmL79pFSlF8ATDFpuHsTVlNXiY5XR52GOMCADHCSxvT_4ilGi1t7sIqbgs62elxxJWtCd60ue6f3Ni_W5jRZrrBSdYJdSX3ZGoFr7BRN0gXXLnKpMxouVL_CBaO3YcfZQxY237_r80mC539XGL8k4iilCEuqFrBYVSFBA5SwXT5EI0tvls8CY-_bmWiFjvtqI6CUTuuxq0JZnGhPuOaZe6xKc89yHlGBTeKe-X2ztXzoqV9yOzHZ5qqW2V1Y7crJ2SiO8W8rQDgzjhWLKTle8EvhbsnSoEo5pq_rCcKU_0SoBwGV-thvs8XIWHDtDuVrpkKfToqF1Do7G_tltmPz6dyW8pmpNYjZprAtahI7GKkY--m2ACERy_BCbCpdMSWFFn1XLIVdB0xFveCjx6WEXryFZkFYoZde6eahDlw6CoC8xddxiNlWCq4ftsE7EzSzblhlO6SqQTn3u-6U-k9U76XHPQJdnl9Y1KKCLnUTTd0VAt7RFIJBfES3tocKrhucb6zab3oUqsa3b6_VSqapK4wayoFMl3PaOHwFRJC-VpjjPKAfwdfpCbUkW9vIHKOEGE290z1P3hgtBgHuVRmzg-mMzsHevgrg-Vy5tP6d0vXs462yywIUOcCGQ0MfH657CbL40Arw5uMXurhwmB7s38ljGHIuTzKS9ZZlPLbVQQjgG7W8kKBA4bGtHSgsa2Y6rjIFN_y17jELYWVHejv2-yOse1JC17_2Q9R4Iwhhj5wS6X2fmjFzu_hMSMSPRuD1DBDyJNITHsIwSqvyT6Aqm7IkBPvw3GO9TuZTCc_xyQusQe_eDKfVVYL3Mf-cEpHfi30bbW3UI-Zbdq5TwCYqA9wDEITHpstoCcCQlrl4C0rpse0WDu2kamZEtdR7yto37-jwQboTbJzkVUH9RF9YrnHfDZjrMD_muYHvT7StqXpLyC34h2M13nLUzByYCvW7clsQriG18NndvCoNEqfAe8m8exZQkMBf2JlFNrvJs69gaBasbYGjUwQu0sCbh6f2ef8Lc-l4sYY-etQdwY8aYcEljOtRbPzgr547RCRnIOI59fe4YhzSKzh740l2nEf8th2LhDJ3WPcQA5rC0v_lo2-Luu46jTIZYm-u7ctGRtm5tJJlap_LiUkHdQn32cXTEt4OaSaFlPlhjikIJIpqmiqV-aMiYV3ULhSzO-ibMlRihYTUZrRVvIO6A_Y9WubEeVHfCsZtXPn2odcTcSjdyaun_ddF5AZlgKXwWqLwE4ZoTQ2BA2izvCe8iEUuKMuHSwe62jhLS6ZfOwf3vi5r9uBYPRPqwfS90XgxeCqwp-rFE4Fhmj3AIf-5dRk5bRzT3Hnu1ffxW1jrc1Aezh77AbQQh_7GGwEvbomEOxYrs0Od2vUGXNvqGXuKmx92tqOJGfcpB8Yi0UUGEoqh8-aLs_ytF6_d-8Gwq2I7tiiURlaP78gPRgdHHmYs4fBOl9rSHFri7zyidQP0Oc4OloAn_ajz2kqr9aMx8ebDTr9qIGaD4C2K1X041GxDRiho0AShajclDg9jTkfDRAWr-xUvN-d-d9IhSePOqSxoeGEVfZ1JYEfC-midNMbE9NjYlvj-lPjcmGXDOlGwA_MDLWnkhZBJeDTt63zk3PtH19rdQZUtYc--Ntz5TqSIrZpIf_WD4-h5Ys-jp7G4cQdDwnTKvt4y3dNDCUxITMA6734uDZq__Cbe5o9oO-pXNNr1kZqG7co9MwpC6SoVX2EGpoWsQ2uUpMTmK1Q2vPiIMfEjLHr66WC1RZ5JWhqFFM8k0YpC7ChEO4-7ewSl18g5KW2JUc354iERPxfT8aXkN9Ai-0dXnqZW_gT6_Dkq0pjlztAFM4wod_B1w0xYhJN5ysVfKcQMKwTtV24hrVxbRkNWEJp_qfwDM0wO8z9T-IA9GCunnoF0QaEgd2w02xvka1s-LmMPTt24xmK-fkTjGb88kMYN8jsRsu7cwsvOpcdNWllZfBDro4feXQMZD6H3qERWihz2kRR_U8Mon46Nq8lUwl7sma1ZaZwNe768bLX-DbKzh4ulH8wrSySsx0Yr8If9rRBG6zRKPPxb-cqrMImqphLz6wtvdzqNr1sLXCnNt0kRcuQzhEjVO-2-pcqGnUP8-FEFsSjfdQGot0kZ2gzT_8gSyG8Mwy0aDcNfwNALwbwL54gX2cCzfzNX6wA9hSaPSi0kMh9Xe7RwCxI9HmOzUG7km17GUGshkmZPguObmYl_Eiu8wek2kfV9dLeKc6uByd-yLTkhPmYWTryrlY-R7OUZBuMQUf1SgjLd9nxX5gdnVE4aD8ARJ0dn2o8KHO0r-fD4Z6KdV9jtxq57gY-XgZgXrBboqQWk8a6npRNGypSlo3Q7JxW4zh4IW87fV7ZJoTfY7RUDlEzWwmaH0HwSFv-amsJZ0lR4RvzyNe1oQbMYC6Ct5wxFW52Y5ZsAlv5QIUkR9JJBlyx_0ySw0craT3xif6T_Zi__8Kc2ybDXqh4aj9eUR27cLm3v_j-Uyh7M3H9oC001VdWtC9SI00OiCJh4W_AkUZQ8IgACGV7og9yfYeF197fG0hyYKGbZhEKPuAXN9fsk5Y8kAX3z-UG6Vh2tijM-6cMOBq5TwzZpuS378PW26iMG1U1U2pCRrrc4cEoUo2VFLpdBzFLhdR0NVH0irNVK0qoP9Dx-LS3YK5mWVqBRN7Vs9En2OxOV98CMskUDhGtb7cFZDnNSRePSceJ_mImou45_96j-VAugPJt6YqUPQov17PXEJCazUAzV0YD0sTIUkoWDeWHNL5umamkwUWfd2zr8RpuswkNHU5y_5hkKMFreQuxgRy-Ob1Ovw2Zp&cid=CAQSTgDICaaNTJNlkAUutW19NarzJNOKJdmFgjiMTYPwE75NgdlRQ9v3xOT1P0qCmo1oG4MWZ5WctLypqQKP0PTJwhxAcqL4mvk5SE8YZdrCHxgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fgeocult.ru%2F&ds=l&xdt=1&iif=1&cor=6760921527256195000&adk=1761367584&idt=76&cac=0&dtd=17

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

176fe1d31f02da4ed371825af61b52029d2bb696b580e74bc1b0c7a016227c24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=4347476252&adk=504672438&adf=3417920651&pi=t.ma~as.4347476252&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403292&bpp=1&bdt=200&idt=339&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=342
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42188
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 LufthansaHeadWeb-Bold.woff2
s0.2mdn.net/creatives/assets/4714589/ Frame 9D6A 50 KB
50 KB 39ms
39ms Font
font/woff2 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4714589/LufthansaHeadWeb-Bold.woff2

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a43c20863b324fe2bec355b5ebdc6566861742f92018f12be1b38fa2c8b7767

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/15415463092317913147/index.html?e=69&leftOffset=0&topOffset=0&c=J4FK7qRkCH&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:43:55 GMT
x-content-type-options: nosniff
age: 569
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51548
x-xss-protection: 0
last-modified: Fri, 18 Nov 2022 11:46:13 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Dec 2023 08:58:55 GMT

GET
H3 200 13190571059041383400
tpc.googlesyndication.com/simgad/ Frame 8959 85 KB
85 KB 22ms
22ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13190571059041383400?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qnuuJXnnT94Qa_nq0AdC8NtFGzwaQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=371214980&pi=t.aa~a.542385254~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1252&idt=-M&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280&nras=2&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=776&ady=1268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=10

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a00800835154d7b59f7e30db1a3575b0066dd81b1617fdef9a1a34284c81013

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 05:24:45 GMT
x-content-type-options: nosniff
age: 12519
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86609
x-xss-protection: 0
last-modified: Sat, 11 Aug 2018 14:43:13 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 04 Dec 2024 05:24:45 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231130/r20110914/ Frame 8959 24 KB
9 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231130/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50a7b1c8d19c1d74836d2aaaaaf1fb2bde2a42708f6d4bb4c9168d7609503fbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 22:02:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39083
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9313
x-xss-protection: 0
server: cafe
etag: 8709779397046830652
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 22:02:01 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/ Frame 8959 3 KB
1 KB 19ms
15ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 22:00:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39177
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 22:00:27 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/ Frame 8959 20 KB
8 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

240ed2cf95df9fa682cc2a820a6681e8faa474dcd678ffbe844351ccbda9bb6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:51:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 139
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8549
x-xss-protection: 0
server: cafe
etag: 755982428571291914
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 08:51:05 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 8959 0
0 28ms
23ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQhaIR3JJkn4fHzaVuqTZqBv4DDdWU03FrJukyRhWslnv761N3A8StC81bzNFX5OrWdGCIbm5o6cdg6u7nqLu2UN5PFnQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=371214980&pi=t.aa~a.542385254~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1252&idt=-M&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280&nras=2&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=776&ady=1268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8959 202 KB
64 KB 36ms
32ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Dec 2023 08:53:24 GMT

GET
H3 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/ Frame 8959 36 KB
14 KB 19ms
16ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f0661b34bdd99c850e7c1c3fb40188743848c2353682e600dc0fa009ced29f9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 20:21:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 45092
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14794
x-xss-protection: 0
server: cafe
etag: 15882346334465922746
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 20:21:52 GMT

GET
H/1.1 200
OK viewability Show response
hal90007.redintelligence.net/ Frame 6B76 0
150 B 38ms
13ms Script
text/html 138.201.63.157
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90007.redintelligence.net/viewability?s=36847600040911104444994012529007&a=d56d6464&vb=m
Requested by: Host: hal90007.redintelligence.net
URL: https://hal90007.redintelligence.net/request_content.php?s=36847600040911104444994012529007&a=9f0734ff
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.157 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.157.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90007.redintelligence.net/request_content.php?s=36847600040911104444994012529007&a=9f0734ff
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 08:53:24 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK viewability Show response
hal90009.redintelligence.net/ Frame 5CDC 0
150 B 46ms
18ms Script
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90009.redintelligence.net/viewability?s=96583300048368004444556012529009&a=36d926e2&vb=m
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request_content.php?s=96583300048368004444556012529009&a=429de8bd
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90009.redintelligence.net/request_content.php?s=96583300048368004444556012529009&a=429de8bd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 08:53:24 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0627 466 B
235 B 54ms
54ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPWB9LgEEPPdwM0EGKXp5PoBMAE&v=APEucNU3i8gpnDmB9pbC06fDXBwNEPbPL0Qs8SCzZsBupizGGLGueL6G0-mTj8QfNbwpkpDTWXKp-TNlTeOwVbteGZq2fYZq33K8yoZyWkzk6PTU9m7nwdZjpynZxMW57IkhQ6WR46E__WX9_MPWiyGYhJAxekQX98XG0VNO0f0XMMqp-b6wBks

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37ab5c060ae53ccda75b8bd212d874a17650f7954b11c4e31f568990ab40196b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 08:53:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame A8FB 89 KB
31 KB 101ms
100ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 08:53:24 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/ Frame A8FB 3 KB
1 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 22:00:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39177
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 22:00:27 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/ Frame A8FB 20 KB
8 KB 20ms
18ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231130/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

240ed2cf95df9fa682cc2a820a6681e8faa474dcd678ffbe844351ccbda9bb6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:51:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 139
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8549
x-xss-protection: 0
server: cafe
etag: 755982428571291914
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 08:51:05 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame A8FB 0
0 23ms
21ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRskljzvzkfgrOk7PG40QLTAOu1m7z8OjOyC-JQgYVOOg2w_ihGDnf2L2g3SH67zX6pRASr4v_ac1Wz6DbMfhaOc8tyLA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame A8FB 202 KB
64 KB 31ms
31ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Dec 2023 08:53:24 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A8FB 42 B
63 B 48ms
48ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D7C3eErJ0UBjTpAVDa6gvFT0fDbx-lsiopNjs4u8wQyOl-xxwbRRL28oQXcTg2KovabgWub8ENMdMigGq_X4wcvt7-rkq8ytz0GYvB5fp1OmwrNxs

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame FAE3 143 B
166 B 15ms
13ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=371214980&pi=t.aa~a.542385254~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1252&idt=-M&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280&nras=2&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=776&ady=1268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2944
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 08:04:20 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame FC13 1 KB
643 B 19ms
17ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59714
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 16:18:10 GMT
etag: 48472445140208031
expires: Tue, 05 Dec 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 372F 274 KB
91 KB 23ms
22ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6f880f901353179e9f589ff59a59e0e4db493b841cc41fdbf01fe0dfb027e572

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:24 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93139
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Dec 2023 08:53:24 GMT

GET
H2 200 dc_pre=CMrSs_D194IDFaHHOwIdYT4Fyw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1320501837867.7158
adservice.google.com/ddm/fls/z/ Frame 2484 42 B
401 B 86ms
51ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CMrSs_D194IDFaHHOwIdYT4Fyw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1320501837867.7158

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CMrSs_D194IDFaHHOwIdYT4Fyw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1320501837867.7158?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CK_es_D194IDFePMOwIdchgETw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7421131836471.022
adservice.google.com/ddm/fls/z/ Frame A9FE 42 B
107 B 83ms
51ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CK_es_D194IDFePMOwIdchgETw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7421131836471.022

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CK_es_D194IDFePMOwIdchgETw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7421131836471.022?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 6B76 14 KB
15 KB 60ms
30ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90007.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:41:12 GMT
x-content-type-options: nosniff
age: 65532
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 03 Dec 2024 14:41:12 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 6B76 15 KB
15 KB 54ms
25ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90007.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 15:10:56 GMT
x-content-type-options: nosniff
age: 63748
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 03 Dec 2024 15:10:56 GMT

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 5CDC 14 KB
15 KB 47ms
18ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90009.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 14:41:12 GMT
x-content-type-options: nosniff
age: 65532
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 03 Dec 2024 14:41:12 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 5CDC 15 KB
15 KB 45ms
16ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90009.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 15:10:56 GMT
x-content-type-options: nosniff
age: 63748
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 03 Dec 2024 15:10:56 GMT

GET

partner
sync.search.spotxchange.com/ Frame 0627
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEMdnyjz5eCUkrGg3c1D_5zg&google_cver=1

0
0

GET partner
sync.search.spotxchange.com/ Frame 0627 0
0

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58269/ Frame 0627 0
125 B 78ms
17ms Image
text/plain 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPWB9LgEEPPdwM0EGKXp5PoBMAE&v=APEucNU3i8gpnDmB9pbC06fDXBwNEPbPL0Qs8SCzZsBupizGGLGueL6G0-mTj8QfNbwpkpDTWXKp-TNlTeOwVbteGZq2fYZq33K8yoZyWkzk6PTU9m7nwdZjpynZxMW57IkhQ6WR46E__WX9_MPWiyGYhJAxekQX98XG0VNO0f0XMMqp-b6wBks

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.87 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:25 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
DATA 200
OK truncated
/ Frame 8959 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2cc58310f0b259e6a2c717bf7cf7fabe7f4bd201119e1d8459ec36c35e4a9ef2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1627455/73523879/ Frame C771 255 KB
77 KB 119ms
34ms Script
application/javascript 108.129.52.148
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1627455/73523879/skeleton.js?ias_dspID=3&ias_campId=1013910218&ias_pubId=pub-2920555573584698&ias_chanId=1&ias_placementId=20492283353&bidurl=https://geocult.ru/&ias_dealId=&xsId=ABAjH0gT1oJPmccVRksN9eHKNF7Q&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0gT1oJPmccVRksN9eHKNF7Q
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.129.52.148 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-108-129-52-148.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 642fc615b2ac4436ef8cc0c9ea9a9add160737e96cca1608118e6ba8acf1539d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame C771 111 KB
39 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:51:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46919
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Dec 2023 19:51:26 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231130/r20110914/elements/html/ Frame C771 11 KB
4 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231130/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DK09jNzP3pBz0QAex-lUgI9UEA-3FET-kJWEsxRRGJSSTsIAFVWd4DlG9P67dcltGPIybp7PovDt4mo5_K-J01HGdTQ0gG_bm_Ur7XoKJHYKRBIKZlBV6-6g42PAkvqabmvFXky2CiAff0kTkydv66vYvdzmQB8dEZCQdR0cMsU_RfoOc&dbm_d=AKAmf-AKoh78JMO5X5-ljHI_Pk1ypX9ioPT4M0HXFY9Bl68ZtgGa8q1u1HV1JV_TH5V5d_56KDs01r4FN8DmxbmlJEtsPd2ujLUTH578gZeXZ2xGImh6cUZh8oM2lxmWzFtSfMwQmEHJY0YdWwThGA2nqcMzf3t2r2xr6W59qsO214Cl67VZImN7wGNVcu1j7T-8L3HJDmz4qtEN8OXMMWO2Db3tGb9B2v7NSiQ5LxzheeGKDpGM-ZUQ6P2lrP0IQYdjGwg-Z1oyNvL03Z-V7v-qeOCr625FwsL_0ujm3HUE5S4hLuAdwChCKguOK-2iR7zy4OF0S0IfaZdGeZxlNA4j66Ms3Z4H5tqvaXw5Ax-ItnpaBH1LZjP3nX3TI01-mUyOp1rorHcvTxZVt4MnnlR_AZHJBtbqQ2UeNaPgpyLyfmxo5tTentdLicJvVfFeclXLuSWbLDIw38Cg3oaPSj6Ri7zHwZotgt6GL81-zRbT16u0heLGJfi2lkTk8R_eprLUZQXanQ6GWjbZzx0iSYmx1wf90kQjvG6W8Cs7eR42r09lmkUBWsvo1ltlli5F5lm6L0YXIRXhocII6ZMBovotQ2K-k_CoQPyCC_NDgxxAab4Arh7EhGQSuQChRqr6IG8mbKjzUpEFRvBaORMtoa0ghUNWuoV5ZtiDrv5cgvC-g12DBzRRriH04FzfGC-ew6bfH4y3EesQnKfsk9pbj5dcKPCyjlf7QpYJtjwmhthasJgViy1WnaxtpkVByYY3tcdGfB1VR8I4ZUiUbOu5JFLAeT9B-SISa8WSiGwRfq8TyaEJXqPL8ZIk4_PgxFzbwVcFVwx4faC5IBW6D7NWJljFfEybO41h57tjPjfQJgRapIF3X_zFsoNFXidtiRgOUqW3xolv__G4QuVBt3d7yZcOpHfJnkMU8XvkthHLIoeWufKLxx9lAfTWsglApoJ_xRhh8Qu9sVxEn4aCOzNop9HYqNuZvOzd3h61Ten9zeST_Hv6DKJCf5E_FOSA8ChCaXGffZbU0Z7ZKZRrT0DfnEMbJTQjQMjmgaAlCGw58o5L1SFQ-0eLrXY0lRJvyUXqXLSnGhcc8v3BtRnNrEc9PDNOQpM7MoWgIBW69R7tec1ZmfS7Xz4qVmL79pFSlF8ATDFpuHsTVlNXiY5XR52GOMCADHCSxvT_4ilGi1t7sIqbgs62elxxJWtCd60ue6f3Ni_W5jRZrrBSdYJdSX3ZGoFr7BRN0gXXLnKpMxouVL_CBaO3YcfZQxY237_r80mC539XGL8k4iilCEuqFrBYVSFBA5SwXT5EI0tvls8CY-_bmWiFjvtqI6CUTuuxq0JZnGhPuOaZe6xKc89yHlGBTeKe-X2ztXzoqV9yOzHZ5qqW2V1Y7crJ2SiO8W8rQDgzjhWLKTle8EvhbsnSoEo5pq_rCcKU_0SoBwGV-thvs8XIWHDtDuVrpkKfToqF1Do7G_tltmPz6dyW8pmpNYjZprAtahI7GKkY--m2ACERy_BCbCpdMSWFFn1XLIVdB0xFveCjx6WEXryFZkFYoZde6eahDlw6CoC8xddxiNlWCq4ftsE7EzSzblhlO6SqQTn3u-6U-k9U76XHPQJdnl9Y1KKCLnUTTd0VAt7RFIJBfES3tocKrhucb6zab3oUqsa3b6_VSqapK4wayoFMl3PaOHwFRJC-VpjjPKAfwdfpCbUkW9vIHKOEGE290z1P3hgtBgHuVRmzg-mMzsHevgrg-Vy5tP6d0vXs462yywIUOcCGQ0MfH657CbL40Arw5uMXurhwmB7s38ljGHIuTzKS9ZZlPLbVQQjgG7W8kKBA4bGtHSgsa2Y6rjIFN_y17jELYWVHejv2-yOse1JC17_2Q9R4Iwhhj5wS6X2fmjFzu_hMSMSPRuD1DBDyJNITHsIwSqvyT6Aqm7IkBPvw3GO9TuZTCc_xyQusQe_eDKfVVYL3Mf-cEpHfi30bbW3UI-Zbdq5TwCYqA9wDEITHpstoCcCQlrl4C0rpse0WDu2kamZEtdR7yto37-jwQboTbJzkVUH9RF9YrnHfDZjrMD_muYHvT7StqXpLyC34h2M13nLUzByYCvW7clsQriG18NndvCoNEqfAe8m8exZQkMBf2JlFNrvJs69gaBasbYGjUwQu0sCbh6f2ef8Lc-l4sYY-etQdwY8aYcEljOtRbPzgr547RCRnIOI59fe4YhzSKzh740l2nEf8th2LhDJ3WPcQA5rC0v_lo2-Luu46jTIZYm-u7ctGRtm5tJJlap_LiUkHdQn32cXTEt4OaSaFlPlhjikIJIpqmiqV-aMiYV3ULhSzO-ibMlRihYTUZrRVvIO6A_Y9WubEeVHfCsZtXPn2odcTcSjdyaun_ddF5AZlgKXwWqLwE4ZoTQ2BA2izvCe8iEUuKMuHSwe62jhLS6ZfOwf3vi5r9uBYPRPqwfS90XgxeCqwp-rFE4Fhmj3AIf-5dRk5bRzT3Hnu1ffxW1jrc1Aezh77AbQQh_7GGwEvbomEOxYrs0Od2vUGXNvqGXuKmx92tqOJGfcpB8Yi0UUGEoqh8-aLs_ytF6_d-8Gwq2I7tiiURlaP78gPRgdHHmYs4fBOl9rSHFri7zyidQP0Oc4OloAn_ajz2kqr9aMx8ebDTr9qIGaD4C2K1X041GxDRiho0AShajclDg9jTkfDRAWr-xUvN-d-d9IhSePOqSxoeGEVfZ1JYEfC-midNMbE9NjYlvj-lPjcmGXDOlGwA_MDLWnkhZBJeDTt63zk3PtH19rdQZUtYc--Ntz5TqSIrZpIf_WD4-h5Ys-jp7G4cQdDwnTKvt4y3dNDCUxITMA6734uDZq__Cbe5o9oO-pXNNr1kZqG7co9MwpC6SoVX2EGpoWsQ2uUpMTmK1Q2vPiIMfEjLHr66WC1RZ5JWhqFFM8k0YpC7ChEO4-7ewSl18g5KW2JUc354iERPxfT8aXkN9Ai-0dXnqZW_gT6_Dkq0pjlztAFM4wod_B1w0xYhJN5ysVfKcQMKwTtV24hrVxbRkNWEJp_qfwDM0wO8z9T-IA9GCunnoF0QaEgd2w02xvka1s-LmMPTt24xmK-fkTjGb88kMYN8jsRsu7cwsvOpcdNWllZfBDro4feXQMZD6H3qERWihz2kRR_U8Mon46Nq8lUwl7sma1ZaZwNe768bLX-DbKzh4ulH8wrSySsx0Yr8If9rRBG6zRKPPxb-cqrMImqphLz6wtvdzqNr1sLXCnNt0kRcuQzhEjVO-2-pcqGnUP8-FEFsSjfdQGot0kZ2gzT_8gSyG8Mwy0aDcNfwNALwbwL54gX2cCzfzNX6wA9hSaPSi0kMh9Xe7RwCxI9HmOzUG7km17GUGshkmZPguObmYl_Eiu8wek2kfV9dLeKc6uByd-yLTkhPmYWTryrlY-R7OUZBuMQUf1SgjLd9nxX5gdnVE4aD8ARJ0dn2o8KHO0r-fD4Z6KdV9jtxq57gY-XgZgXrBboqQWk8a6npRNGypSlo3Q7JxW4zh4IW87fV7ZJoTfY7RUDlEzWwmaH0HwSFv-amsJZ0lR4RvzyNe1oQbMYC6Ct5wxFW52Y5ZsAlv5QIUkR9JJBlyx_0ySw0craT3xif6T_Zi__8Kc2ybDXqh4aj9eUR27cLm3v_j-Uyh7M3H9oC001VdWtC9SI00OiCJh4W_AkUZQ8IgACGV7og9yfYeF197fG0hyYKGbZhEKPuAXN9fsk5Y8kAX3z-UG6Vh2tijM-6cMOBq5TwzZpuS378PW26iMG1U1U2pCRrrc4cEoUo2VFLpdBzFLhdR0NVH0irNVK0qoP9Dx-LS3YK5mWVqBRN7Vs9En2OxOV98CMskUDhGtb7cFZDnNSRePSceJ_mImou45_96j-VAugPJt6YqUPQov17PXEJCazUAzV0YD0sTIUkoWDeWHNL5umamkwUWfd2zr8RpuswkNHU5y_5hkKMFreQuxgRy-Ob1Ovw2Zp&cid=CAQSTgDICaaNTJNlkAUutW19NarzJNOKJdmFgjiMTYPwE75NgdlRQ9v3xOT1P0qCmo1oG4MWZ5WctLypqQKP0PTJwhxAcqL4mvk5SE8YZdrCHxgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fgeocult.ru%2F&ds=l&xdt=1&iif=1&cor=6760921527256195000&adk=1761367584&idt=76&cac=0&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:05:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49693
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 19:05:12 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231130/r20110914/ Frame C771 31 KB
12 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231130/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f84f4f65c00630a8dd0f354e652293a2cf51e95722f447fb2ea869bbbe664446

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 12:07:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74745
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11937
x-xss-protection: 0
server: cafe
etag: 9249472389583843189
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 12:07:40 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame C771 41 KB
14 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 312497
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Nov 2024 18:05:08 GMT

GET
DATA 200
OK truncated
/ Frame C771 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2fa71256e681e5a3ffe42dfbd6e14e8bd9dfdf39838a066ae68f2a04fc354968

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame FC13
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESELJowJuPQVYjvRADzT9qSBs&google_cver=1&google_push=AXcoOmSM5JK7PAvA196ooEBs8umd2C7eevQ7YkqWnEVQ80sWWgClXxQT1dbr5Ujr9wTxf_yG9zZK2A8WggMTJk0oegRgtOXJq6eV6...
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjU3MTkyMzQyODU2MzAyNjYyOA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELJowJuPQVYjvRADzT9qSBs&google_cver=1

43 B
398 B

54ms
14ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELJowJuPQVYjvRADzT9qSBs&google_cver=1
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELJowJuPQVYjvRADzT9qSBs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FC13
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEFREKmfEc-1f9QxyS25lWa4&google_cver=1&google_push=AXcoOmSVKxh6PggBywkEGdmlQbA9kC_QbOE0F7i7NSgJY03oIrEQTMPRdSBoPI7UZ4cHZoVNrjYEL5_GRsI7KRxJdZDJHP5Nhu25iP...
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=1BC62361594B4059907D01902A9704C4&google_push=AXcoOmSVKxh6PggBywkEGdmlQbA9kC_QbOE0F7i7NSgJY03oIrEQTMPRdSBoPI7UZ4cHZoVNrjYEL5_GRsI7KRx...

170 B
188 B

28ms
28ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=1BC62361594B4059907D01902A9704C4&google_push=AXcoOmSVKxh6PggBywkEGdmlQbA9kC_QbOE0F7i7NSgJY03oIrEQTMPRdSBoPI7UZ4cHZoVNrjYEL5_GRsI7KRxJdZDJHP5Nhu25iPNqKuRHNaIOu1SFvqWENxMDswqQuI0N4U-dkOUuMVLbO8nCdSWkb20aBf0

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 05 Dec 2023 08:53:25 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=1BC62361594B4059907D01902A9704C4&google_push=AXcoOmSVKxh6PggBywkEGdmlQbA9kC_QbOE0F7i7NSgJY03oIrEQTMPRdSBoPI7UZ4cHZoVNrjYEL5_GRsI7KRxJdZDJHP5Nhu25iPNqKuRHNaIOu1SFvqWENxMDswqQuI0N4U-dkOUuMVLbO8nCdSWkb20aBf0
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Mon, 04 Dec 2023 08:53:25 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame FC13 70 B
149 B 114ms
34ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEFyEjFtHojZ84B9zH_9Iu4s&google_cver=1&google_push=AXcoOmS4cc0PF6w62rxUd6sL01Asc5f7FJK_Z0t55Jni8D6LW99pmwtOrpMDnwZX1zAqiBDbfUQQuK1a33aU_Ey8yZORTsoMeyCzfzeNxX_akM9YXun4o6JpU_NKpwPPT7UnbZV9wRgUotYfqZsnXwXBD-h-n08
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=371214980&pi=t.aa~a.542385254~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1252&idt=-M&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280&nras=2&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=776&ady=1268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=10
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:25 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FC13
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEHn8eINBaHc8k85nnVDfz7M&google_cver=1&google_push=AXcoOmT_rinBkE0F_pUrKAwTM3vg9eO1iZWrghFkNEECQFAqE2fqz7-62iUUKIT56fwbHykyYKrJeAid4D_cC1Wozzna4kn...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmT_rinBkE0F_pUrKAwTM3vg9eO1iZWrghFkNEECQFAqE2fqz7-62iUUKIT56fwbHykyYKrJeAid4D_cC1Wozzna4kn9jx_3XFeRNZb_m8m1-cYaEXoABWnWGrFzUWtJr...

170 B
188 B

28ms
27ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmT_rinBkE0F_pUrKAwTM3vg9eO1iZWrghFkNEECQFAqE2fqz7-62iUUKIT56fwbHykyYKrJeAid4D_cC1Wozzna4kn9jx_3XFeRNZb_m8m1-cYaEXoABWnWGrFzUWtJrwq7bIp4Md3Y7Qmrv5K3Yd_iInI&google_hm=eS1qcGp3N2doRTJwRVVaaHFDb25uVDE5cjFUeERKcEY3VH5B

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 05 Dec 2023 08:53:25 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmT_rinBkE0F_pUrKAwTM3vg9eO1iZWrghFkNEECQFAqE2fqz7-62iUUKIT56fwbHykyYKrJeAid4D_cC1Wozzna4kn9jx_3XFeRNZb_m8m1-cYaEXoABWnWGrFzUWtJrwq7bIp4Md3Y7Qmrv5K3Yd_iInI&google_hm=eS1qcGp3N2doRTJwRVVaaHFDb25uVDE5cjFUeERKcEY3VH5B
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame FC13 43 B
363 B 55ms
14ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQdElaTv4u3WDQrIpe7DWEwo4_2y8s15vTA7INh1_CPgE5eFETaTPBZ2PjLlzWyHH59tRnmWDoGPCxl7AbNWv5qY5SuhaQ0HQw5FxBIsi1_49L1lY9AOdpUK7ETjJ3PnTUlXenL30YtYD5X0rMl9U80WXk&google_gid=CAESEOJkB_FqkekRi0mcZVRXico&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 188854
expires: Tue, 05 Dec 2023 00:00:00 GMT

GET
H2 200 trk
ag.innovid.com/ Frame FC13 43 B
297 B 112ms
23ms Image
image/gif 2a05:d01c:1d8:8101:1f18:2983:dac6:b09
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESELsuc53CNsGQG17dxaEr7sI&google_cver=1&google_push=AXcoOmRsWM62ZVmRXK0Ka94I5I7z1eEyi5FkdwJqoD2ZRHKZhl5FpNUzBFYxUOSCAZ0jr2sCjIxq6VgT-AJeAd2QSbPX5RBSPePBLdRcWXMFWv-Vqbs7JxWlTKfBeCej_Z2crNe_x54swapiGC59Fm0SnFB_urE
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=371214980&pi=t.aa~a.542385254~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1252&idt=-M&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280&nras=2&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=776&ady=1268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=10
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8101:1f18:2983:dac6:b09 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
cache-control: no-cache
content-length: 43
request-time: 1
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FC13
Redirect Chain

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESEE_Ai0JIXXQh2Z3Clvmx8Os&google_cver=1&google_push=AXcoOmQ1ii2-I2Dlw8Yz65Jqb_bT6bzDHO4c-p8Qa8RgR_RQKE-JEltGJJ1jaeyOC5...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmQ1ii2-I2Dlw8Yz65Jqb_bT6bzDHO4c-p8Qa8RgR_RQKE-JEltGJJ1jaeyOC5d6jAQyk3N74po6cjr726OJMRVnxolFlNBMA2Qx8Dyu4yVtgr...

170 B
188 B

24ms
24ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmQ1ii2-I2Dlw8Yz65Jqb_bT6bzDHO4c-p8Qa8RgR_RQKE-JEltGJJ1jaeyOC5d6jAQyk3N74po6cjr726OJMRVnxolFlNBMA2Qx8Dyu4yVtgrKQQDMxAneVyrUPVqncH59ff-iGejaA9rDOFlbY7bBbmlqW&google_hm=j4vxivQxR2ed-jvn68QG4QQ

Requested by

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmQ1ii2-I2Dlw8Yz65Jqb_bT6bzDHO4c-p8Qa8RgR_RQKE-JEltGJJ1jaeyOC5d6jAQyk3N74po6cjr726OJMRVnxolFlNBMA2Qx8Dyu4yVtgrKQQDMxAneVyrUPVqncH59ff-iGejaA9rDOFlbY7bBbmlqW&google_hm=j4vxivQxR2ed-jvn68QG4QQ
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame FC13 0
12 B 33ms
32ms Image
text/html 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KFEsm21KRE3udFjzPsByC5GGs4shjT4j1ELdKWJxOX81uPpwr7KrL7vVSameWKvHpSjVCY7A

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:25 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame FAE3
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

23ms
22ms

Document
text/html

2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 08:53:25 GMT
expires: Tue, 05 Dec 2023 08:53:25 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 08:53:25 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A8FB 0
22 B 49ms
49ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=10905600317&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A8FB 0
22 B 48ms
48ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=10905600317&version=m202309260101&ct=119&x=1&cor=13486007983855550000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A8FB 89 KB
37 KB 186ms
186ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CMOG6cG5kVMw4mJKWO6jbleqZOi9VF5SoTDldpnyjCFfiWWVO9piT2a9e7bIEi2OFf8_nYjNHLdmcMwWyu3_bso0cPLdI6PEZA1oR0fW7uix2YRHrQzXqOwPExq3je-WDzCbRaTgTgBHnTTFkF_Iqw7RN8vgAhNHhKYuQHI_maFJxUzHvfsKGEJ63PzNAvIMh146e6&cry=1&dbm_d=AKAmf-DcDbqvtD_yAlPfQ9gc607nzhUgwC4jC8IFE7YjRqXArjbLuEQjl2q-2LkXsNedDJkUc_z_ydomjHz7WN3bfVkEXGE3oqLO9vqocE8vLqAV-jFULsNTTewi1bQqplHh2zrMvLKRG7fe7qkh7rHMbOj98kWhlAdfUFwL8Q7epWGyOqVKflYdyGYLx233lJZoPKIBGSi6J1HpzKK9UJmsJx7D0xWsyZiHDEvSpqwludqB4sVj-Ix6vc924ysJyFGVZahyWK_GTrPMWL7B7hwYvu1pxPYiMKZn4IhG5fyQorFG02Cvn7gulNtpziHbZAUasonONIdbJbfTDFN-ExUHqDtd7lQln-s1FvhbkP6mAYM6dCCR344tUTqEBrLxtJjQ1QnL9Fu1UPFDumXj-XCRmfaWItANMLd7M-i_WMgJQ0RN_dyQSGYZUjFZWOMaD29QaarLc9qWkX5uHznjOIRtv9sWsBe7VqHp7VBRg60KlBBaruNWdZNORVLjfxIO1OonMCbXgxlA-MyXew_wOGNOniWX6gUTXKeUjQRPCxhOkYLogQbRjR5gf8VVeDj6GSRvUtq-CNQGfqCfCZpub4FPv9OZLsho75iwkGEcymYBNUjHRx2OJrlLT5NGDuklS4IvwfVuDYlVrxOxuY9cbMqTytmwF7op_wT-3iKZ1PPqqvpk2_oArOJkCmZjuTqXCiP1xI_K6dZ8m_rfp0cCtOHeyOD8VNiTgVhf2Kz4ODKvZ6FuRqZsu1gKllk2KyJd2hAq-7poE0DFJZxi81yd26D75FBSaljjtWufEOil89AdZQ16tSgWzTZYgmd75t4qRIQgB_SKVIaQao1nlVMZ0mD6COdl45hN4HKJR9pMwfejwoLm8CN4bTMxjZtRB0gmmj6EM25aftgtGnCOtiGPPRjwA5na5nH3P6BjDd-pQx7pljKM1LPZIAZ3raMSXElFDQrMdg8OLBq_0e7ykS51gV8TjfU734J-heDuhXcVKXjXKCAuTHx4N46VBRysSEKHiTlKxP_Sz5QaW7-kkYKvYoKML0qvBOkhCEsGC34bpXXoPptqFzBEq2RCN_08kVadJeEPdaveZXYijIp0h8kMizbiK5IsDyjAuDaaspFa1TwedprRM8FDoTJlcmGDjKbR8oiFM2d9Qn7TGGdftpAFNI8_Qi2uoi_SRFFDr6cbw-CUuX6WZBJdkdLLFnUQSNnilSS-YUlLOOHn8wKGQ1Hz4s2P1YEuJJt7LpegHrs4KasIi-xg1KcurZvgD-hVSNm7egxb4qDEHptyK8sDKz1Jbf0GOmA6KjbXM2gyunPY1Ft3gKQNijZFJT0RRgAuxUu711JtiDmUyPAq4BrIBH5GGCgg_sMEb3L3t2gsr7Ewe0mNxeZZREaJD2pnJBbIEHll0r45s_MK5SDneJaheQNr1vk7dT_ceM0fX2UCJbgHCW88d4OinT1n9AUQ5yBHdD7udfNaIoSRhpwW50oYdqk5q23hVb3B5kqUiDt-LAGlbneQVZ6jHKBB5FdnvtmLmTUSsDOzSuYLOrsPG9d6hnI8v-bLSTvwF0S1uJ3psnTIitqx_fek3PmlpYCzh2gfausxJSutSpAg1Mg9wBgv_jTk6lq896QNiVdbJXrZycZGR2Wdgy-ricxc5pCDuxJgWzGiZ31-2g6w8gMa0Lh-WNC4fP5oQkvQ_qYqJMrPtZg_dNjkUmjQom3dmcsl0UY6R1AmX6WItSpza0qg6OKigFDa-6H1M2fut0xEt9UWy6W3bTfInOThUH-jnpnO1s5BFI8byaB6u9awtESaW0an0joaPzMUl18Ml2mKHi758-ZTekD_S0aZCUnEvugNMJi92RL1PApPEUuVflsprd5tvUyu6LDl4ReT_H_IGNGCltzTgjcTNldE7fx3EjCPyA_RTJwGKsklhZsxfrdPghzJGjjmeH7HiBIW10NqYEgVa72PUxA7jC9ifi9QVOfY4RXW0PNsGq82Tn-vhdO7nHxTgXu-VZhCjx61Atd5F0kEA92WM7Xvww31nunBtCvQ5twmyz2WJuoIkk-JL6HuVSx2mHieby1hWDxP3ddS6y6D3ht3oWskivlawby1Dcqe4h7o8TuAXArTZLNgVmCpt4B5_20WQlM5tO4DSifEjcNCVWWLaeVCHg2b817eINzgskEP3U1scbgLJZ1g0VQ5orZrjlo2IIDQ5BzN5gW84V4Fve5EUxGfN8Q6kGHMM22WFX3kqnoezNZFOIuRhzehPzhvMy-1wkSWWmXszlnIpcoUIwTzy3HtchFF28kLgznAun_YC9wYNifANnIxRf1tpbdP7ndaZPLCGwusEO4hcT7DdNPAbgk0wD3t-wkmIwy28kL6atYSEn-Qf7HqckiIfbZ-oe0UfnFkecv5J0wd-kmk5nVj03-TE83DdkO2IMPQVJt4j7RxaEgqO3JSaU0yOr0ZD1UhYYpgMFA2YOdjYpzOFWhl2lVsDPywkM3xai59ujRV-rD1wS32H_nlw6mEYBbLqzytz8oBpsvYPz6-688f65gSKZ-XNjut8Xse4DGD1jM8-IF4U5uUSp0x6ZGYeU5LX-aJydVhA3adnmBwL3sHAwzatvdZHjlaMfCOfsVpsQzHVwLydAJ_sWA4NKIaBKSJQhE4yvcC7PsyTJm7oXHAVWQeT4XIzPdrVUVgYlZJWTuWVaiTx6phvj__HqRS-ucdwTh95PXWgiYO4yP_WR5f1yfaLc2OI5RwY7d_eKL0hCjSog1n3a1ZQWNA-vRsYDLoX7sEHGiUWdqzDgC2bis_suSiXHnGzQ8FGUijF4-9VpsA86ux53VlQIEDFeh_5ZxBRPUdflYafMacUwglKPmYOqOZ8fIyOmm8k6iGUKjmy1OSR0BhRD-3nHRT5hnkjuNhDUkayJFIWZfLTy91FBz1f7GIY4FsyRunCJIkeeC7FqD5X8L8g6-hHUdjAtXU7TbHk5sjjacl6B5gxpL08RCvr3lr5sbgjvyuQL5XlpF4iAnIyjhr90Z8QaizqKejKHldOTro_cjwdwdFVObJEfVcPsRNYtzOeT04DT9MYo3pfyRrZtRUljZEbvpKYYOT4ss3Guwc_jd6nRRMecZvKa7iWAByiIREJZJEMPH4m8Q0wRYh03qtJnaUhtUjmdBxXQJ6irhduqXiLksKaJQMhcFVYYTx9WMfQKtiugja27d16Dxbf_M3VCl0efNGZ_bJDsWqYxoFAzJJIiMUNIB6mMTJiVSDeJe6-nzH-s_3lxYqwyZ0kVUwAcCjPQKcsDIGIrrn1TyJhtHFvedxl2W8zJOuRk_CD5_bdScWQvjLCHbulHyrB07wsCHY_FtT4SjoZYWOVWlpKyFM0Ho7zcdJvVa64l5ZZCNrTeT1qv6BenDzk6ysIE03bdvqlc6wTe_Uh7_7f5GtL0jIpAJ7NCfODGE14X0E72PNjLBk1422lKlEUKt6dUbC7bwn-azb0kUNvoqhLNWiSxf01L_GbjCa0G8DPd7hs0eNLueddrByoI4G2DBkO0WWzEYQS1-aR7V0fQsRBdb_UX1Ng81XI8VLuC5WnTB8iuxJ_XX0E0A2RzQOIitWQVA94wW4DWBNhhxoTtntzin8WjwQOMbuCA4ZNVeNGwkmx-6EGFOkbNFo97rEfzKJOAta4F0-xixPUfzR62H3VdvKqVUoU348dCU9lzeCfAaRl0LAQLvxaEVQeF1ELtZFsW66_3XnIwf1RZ-fQWZJrCj2lE4Wi1AUAWzp4p553jizIqxhSHgdfYX8ISRF4qpMqTfq1fNs0Snx6GGTIDcnpkrx3Y3NJu6raJ3u_Pe72q8fnYf1JdMCm3frOXq0tob90xXS9-nA47QVoqYt&cid=CAQSOwDICaaNRYrLZiYy_rz2VQ8M3ioO2iYWOY8j6-FCHJ5hSnXZjyWjhSeZNIaig7PrxEru3Or05a3Ga-m5GAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fgeocult.ru%2F&ds=l&xdt=1&iif=1&cor=13486007983855550000&adk=1877897942&idt=104&cac=0&dtd=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3cc9ff1199352176e596e64f382160be2373c31dca95674ea56413c006ee4172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38274
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 8959
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CXXzYBOVuZbuiG92PtOUPo8G_mAPj8ZClVvCOyMDTB67y9__8GhABINTHmpcBYJWCgICwB6AB96vt-gPIAQKpAi3MpCALMLI-qAMByAPJBKoEvAFP0MZqZTJBBUWuYCNAR8TQn84lW9p31sM...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2218414107922724700645%22,%22debug_reporting%22:true,%22destination%22:%22https://aktion-kig.eu%22,%22event_report_window%22...

0
0

82ms
51ms

Fetch
text/css

216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2218414107922724700645%22,%22debug_reporting%22:true,%22destination%22:%22https://aktion-kig.eu%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%221062950391%22],%224%22:[%2212-05%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%225013094701407171521%22}&andc=true

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:25 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"18414107922724700645","debug_reporting":true,"destination":"https://aktion-kig.eu","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["1062950391"],"4":["12-05"],"6":["true"]},"priority":"500","source_event_id":"5013094701407171521"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 05 Dec 2023 08:53:25 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 05 Dec 2023 08:53:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"18414107922724700645","debug_reporting":true,"destination":"https://aktion-kig.eu","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["1062950391"],"4":["12-05"],"6":["true"]},"priority":"500","source_event_id":"5013094701407171521"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 3C93 38 KB
13 KB 15ms
14ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 126289
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 03 Dec 2023 21:48:36 GMT
expires: Mon, 02 Dec 2024 21:48:36 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/12786977581332354964/ Frame 97CA 6 KB
2 KB 15ms
15ms Document
text/html 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36d2279d6bdfd42765a2b279a36a44b84a1d2d849d0872004fe8c6e3fee1b774

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 43986
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1918
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 20:40:19 GMT
expires: Tue, 03 Dec 2024 20:40:19 GMT
last-modified: Mon, 28 Aug 2023 18:29:11 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C771 0
0 115ms
59ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstWEMoqITVykXRorwCC6KdxZfndKPKsg0y2Uii9RQnuPPkX1tGypISzO5gd-jSOfYWY2OcpSX-NWo4cXM6xYE5F1g_b3k2pYtSzhGMt66UjVKdjLVPPibcWdclnAJQG-URveze7gjJfDS2C3CG1u29fbq9Vx13VN-WEGiAI-hBsFE0waY0Y-PSYBgfhayA2nL12C8PSfwM2Nhy09dXS4I4TFxx_bHkyoZ_riLYzurNB3gUumbYXm0IOCPo64EjGlqIm6dCSJJToUvAJwblndOb3fSrzVVo8o7c5bmS5JD6xVv1dMv7qqx-2ODNjdf9dRXclZtHLQCCustlBBJVHnMiDnMEGA2cffdl8MmX_ns23-jlkr0PdXxuHzlgx4DxATawESirIHfdDMNQxwq0ZhaaHcRZrxjs_irOw3EOM5H1vcKTX3srrN5O8YAXT76RNy7wOslJwprZJ_YbAXyY65XLunq4c8YbVeR-9grTMJVvj0qEVgbgoBu3UWC31w2lx3Y4caJzYPCRGDe4u8t839jgWojSUzP4CJLyYA5SB2RjY4RU724yuvj_cmKwCu0nP_tUfJ51VT8NccX-G8n_3jkbtIHl0ll-3uemiUFHUHd-bs1HvBU7a8qPWVOoLVMYeER00WRJQrTvsubi5ZdQ9smWOEEDUdPEwWelXa-FuR4uGZ0VbQ7v9CBkCxsxguFZXxe9wdfhx7pGzj0AO9XNaf6HY1BKxrT7g2apZVYutany6P999JFgNCnd9Y0zal1AhpE-XJ45yWxw1vleDD0JOjoW4dxp6vElajsFwGn8aDCC3c_5umHw1J9QO69_0MVG4rFzZq_MBQPjCdvTNWK-jG1mh_kOPR7EEgmRJX4f7COqOCSnQQWQvE7n1qqlC7S3H9Nfs_BF7NCTI7pwnpxG9BmjQA_d9NVyvLdCTTd5uWGG4_IlWsb5RUT4DP0E4H2ikH3a755mBHYbTQ7TxOIjeMF8BQH5df7wcnX4pFAHvPmC9St_0Av1Sv4TNjrY9qCJzwJnbmdGPV-nYnWSiYg8yStsfFxguHIt-5VlK56uB5pY46m5qWvJvZhyT9jgv8BV9HY9WRrGox5sfo-irofZay7ENP7fVquTHIaFRYX78Q2nZgsiJRpeWCvurP9eVKJz0NG2bsa4sN9h9HoOq7rGdYWERy1VzKXD3-w3dlABuEaTYRUNTwE8J07YqAdNR2iAPpY7XfvYdqbVGaTcM1ccSRaC-tCNxSVvjc6A7nOOe3Gojziq36OfoCm_AOx25Rw&sai=AMfl-YRoXB1Y_OfRAsu5b_9Xp7u1OB-mLtMOHjxpPTlLIQ-sK9UUQ1yil_jQInDZjEMLSZBRUC5-XgLy8xJrPKnbKys-1Sg_dCwMcBR_A_hk-7rNb2F0crSV7YP5XCLfWGLkAk-c458vetdpcUXV6CVoTAIJVVp-tFjfJ6hwWmDi8yoEiMN4EZ9QxN8-lGqUhHKF__t3Q6URUCJmvshCzHpvEWJQFBlIGazNkQtr2gF0zaGvay96ZgIxuQY_v4INAMC2En7YCxWGEHCOp667P4Qw3573d36gR97iQ_thgg&sig=Cg0ArKJSzBSKQ3iOUtevEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=109&cbvp=1&cstd=107&cisv=r20231130.65741&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 05 Dec 2023 08:53:25 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js Show response
pagead2.googlesyndication.com/bg/ Frame D38C 51 KB
19 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7fee07b08f21a5a9c385220b8e279007527e8bfb32434d53da04727600362ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:53:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68400
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19719
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 03 Dec 2024 13:53:25 GMT

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 3C93 39 KB
15 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 00:33:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29973
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Dec 2024 00:33:52 GMT

GET
H3 200 style.css
s0.2mdn.net/sadbundle/12786977581332354964/css/ Frame 97CA 6 KB
2 KB 15ms
15ms Stylesheet
text/css 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12786977581332354964/css/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

507a74eb21e9a16396d226f31f5e25345a8208db821d9fc5798284c38bec5e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 00:06:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31637
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2009
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 04 Dec 2024 00:06:08 GMT

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/ Frame 97CA 70 KB
25 KB 33ms
14ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce56080747fb3b762486b9ccc59bc01f871c9647d354a1c27b52cdb73fc1bfe1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:25 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2186320
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 25267
last-modified: Tue, 01 Aug 2023 16:38:45 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "64c93515-62b3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6K01ytHQBs%2F5%2BRwtCzJ9nbiWsV77zAFzrM7BwFW46lsZjsJZmIiUagr92wi2S4txSybBGxK3QTMRpDt4pdsdz5IaJQrOLy5qGPRFZqEnQo1aF6%2FZwFHcjlR9sViMRd%2FqDIOnibxlzAFVXD5k0sybScdq"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 830b0f002d271903-FRA
expires: Sun, 24 Nov 2024 08:53:25 GMT

GET
H2 200 CustomEase.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/ Frame 97CA 7 KB
4 KB 36ms
17ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/CustomEase.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c190eb38a3f491bcbf96b136cf4a4ab534ac1293d37d9047fd77db6365c86682

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:25 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1992120
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3299
last-modified: Tue, 01 Aug 2023 16:38:45 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "64c93515-ce3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JYcWYGnGmVYSinTJg2TXafHZWGv7ObetuTqUeuupmizzxMqEAC2p6toZqVq15vLhnc%2BCndgkmysoVUFT1sDGzg21jUVpi0BPadmrRV%2FDmi5SGA9wIjn8%2Fn1N7PL7IsMiKpGKbgp0AhKDTPjFQM4gBI7T"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 830b0f002d231903-FRA
expires: Sun, 24 Nov 2024 08:53:25 GMT

GET
H3 200 dyson.svg
s0.2mdn.net/sadbundle/12786977581332354964/assets/ Frame 97CA 2 KB
1 KB 17ms
17ms Image
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12786977581332354964/assets/dyson.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7b8d433b88d210c6aeb414da6fc440f45c471fad1b5aaae9f0b66c50122c62b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 05:34:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11945
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1076
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 04 Dec 2024 05:34:20 GMT

GET
H3 200 rtbIcon.svg
s0.2mdn.net/sadbundle/12786977581332354964/assets/ Frame 97CA 2 KB
807 B 16ms
16ms Image
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12786977581332354964/assets/rtbIcon.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5e166567ad908883ca1d769c38b6f65959bb067295e5ea3c2f850ec5fa2b8d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 22:16:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 38222
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 771
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Dec 2024 22:16:23 GMT

GET
H3 200 dyson-v15s-submarine-stack.svg
s0.2mdn.net/sadbundle/12786977581332354964/assets/ Frame 97CA 9 KB
3 KB 15ms
15ms Image
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12786977581332354964/assets/dyson-v15s-submarine-stack.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8bb76b6ed760de97f8a40e71c79ce9704e965bb287761bd81fb2fb021b8609c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 12:02:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75083
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2891
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Dec 2024 12:02:02 GMT

GET
H3 200 1-min.jpg
s0.2mdn.net/sadbundle/12786977581332354964/assets/ Frame 97CA 26 KB
26 KB 15ms
15ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12786977581332354964/assets/1-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8bb76af1be9c401ef3da16e31401b74f7cb0627154925d8c9fa308fba2e1413c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 21:37:26 GMT
x-content-type-options: nosniff
age: 40559
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26291
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Dec 2024 21:37:26 GMT

GET
H3 200 2-min.jpg
s0.2mdn.net/sadbundle/12786977581332354964/assets/ Frame 97CA 25 KB
25 KB 13ms
13ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12786977581332354964/assets/2-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

372360f6d3fa2133dfbf08ba93b3b55985785cb74106d75839618b7d273dd3c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 22:38:21 GMT
x-content-type-options: nosniff
age: 36904
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25258
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Dec 2024 22:38:21 GMT

GET
H3 200 3-min.jpg
s0.2mdn.net/sadbundle/12786977581332354964/assets/ Frame 97CA 20 KB
20 KB 16ms
16ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12786977581332354964/assets/3-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca4c3ad9639830e6f8f8e29775549fc24fcab33b4eeec7ae77da27c5c9e6bc80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:35:55 GMT
x-content-type-options: nosniff
age: 69450
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20858
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Dec 2024 13:35:55 GMT

GET
H3 200 gradient.png
s0.2mdn.net/sadbundle/12786977581332354964/assets/ Frame 97CA 4 KB
4 KB 25ms
25ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12786977581332354964/assets/gradient.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b67702d4e78a4b6d5981a50298b0989dea48fc7d95b5e593dfafbe96cdbb309

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 00:06:08 GMT
x-content-type-options: nosniff
age: 31637
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4218
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 04 Dec 2024 00:06:08 GMT

GET
H3 200 4-min.jpg
s0.2mdn.net/sadbundle/12786977581332354964/assets/ Frame 97CA 32 KB
32 KB 20ms
20ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12786977581332354964/assets/4-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

19dc5f765d51f715497f0eadd0dede8eaa5ee17447a22db60538f60ca7c0a01d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 22:38:22 GMT
x-content-type-options: nosniff
age: 36903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32615
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Dec 2024 22:38:22 GMT

GET
H3 200 overlay.png
s0.2mdn.net/sadbundle/12786977581332354964/assets/ Frame 97CA 14 KB
14 KB 24ms
24ms Image
image/png 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12786977581332354964/assets/overlay.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a72990ce8413aceedbfbf2f1d7ca2231c726b29a4ab1ddbca32b45ad685b4e26

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:22:09 GMT
x-content-type-options: nosniff
age: 55876
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14477
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Dec 2024 17:22:09 GMT

GET
H3 200 arrow.svg
s0.2mdn.net/sadbundle/12786977581332354964/assets/ Frame 97CA 192 B
198 B 19ms
19ms Image
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12786977581332354964/assets/arrow.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd99a285d81a12f549b741db9604416a669e2ee8accf00cd40c0b0344e9ba63f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 00:06:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31637
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 161
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 04 Dec 2024 00:06:08 GMT

GET
H3 200 script.js Show response
s0.2mdn.net/sadbundle/12786977581332354964/script/ Frame 97CA 4 KB
1019 B 14ms
14ms Script
application/x-javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12786977581332354964/script/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a55f386367cbcc30390435806075251b8ef4afb086409bc8e301558223398245

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12786977581332354964/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 22:38:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209697
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 982
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Dec 2024 22:38:28 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 125ms
61ms Preflight
text/html 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s46-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 05 Dec 2023 08:53:25 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dysonfutura-book.woff
s0.2mdn.net/sadbundle/12786977581332354964/assets/ Frame 97CA 8 KB
8 KB 23ms
23ms Font
font/woff 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12786977581332354964/assets/dysonfutura-book.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12786977581332354964/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c868679a384546d80661e6085c6a40e95de3be2ad0487c56e116703ffd1850bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/12786977581332354964/css/style.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 00:06:08 GMT
x-content-type-options: nosniff
age: 31637
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7928
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 04 Dec 2024 00:06:08 GMT

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame C771
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1627455/73523879/4.js?ias_dspID=3&ias_campId=1013910218&ias_pubId=pub-2920555573584698&ias_chanId=1&ias_placementId=20492283353&bidurl=https://geocult.ru/&ias_...
https://static.adsafeprotected.com/4.js?xsId=ABAjH0gT1oJPmccVRksN9eHKNF7Q&ias_xappb=&adContainerId=brand_safety_BOVuZZ2-N7Phx_APyfCNkAo&cbFunctionName=goog_wrapCb_BOVuZZ2-N7Phx_APyfCNkAo&true_pb=

1 KB
1 KB

18ms
18ms

Script
application/javascript

2600:9000:223f:4e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?xsId=ABAjH0gT1oJPmccVRksN9eHKNF7Q&ias_xappb=&adContainerId=brand_safety_BOVuZZ2-N7Phx_APyfCNkAo&cbFunctionName=goog_wrapCb_BOVuZZ2-N7Phx_APyfCNkAo&true_pb=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=4347476252&adk=504672438&adf=3417920651&pi=t.ma~as.4347476252&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403292&bpp=1&bdt=200&idt=339&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=342
Protocol: H2
Server: 2600:9000:223f:4e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:54:05 GMT
x-amz-version-id: 4Cmv1jyFRAmZ7XChlLsmb9GJS5ztjryA
content-encoding: gzip
via: 1.1 0162e02b2d0212054988a68716227daa.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 46761
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Mon, 04 Dec 2023 19:54:03 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: YUmIq8Bbdweh-IbH7SF_9HZX3FW3mo0ateqS60POnjMS_r4JAZcjpQ==

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
server: nginx
x-server-name: app13.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?xsId=ABAjH0gT1oJPmccVRksN9eHKNF7Q&ias_xappb=&adContainerId=brand_safety_BOVuZZ2-N7Phx_APyfCNkAo&cbFunctionName=goog_wrapCb_BOVuZZ2-N7Phx_APyfCNkAo&true_pb=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame B4F2 91 KB
23 KB 51ms
15ms Script
application/javascript 2600:9000:223f:4e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=4347476252&adk=504672438&adf=3417920651&pi=t.ma~as.4347476252&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403292&bpp=1&bdt=200&idt=339&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=342
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:4e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 21 Sep 2023 00:09:11 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 0162e02b2d0212054988a68716227daa.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 6511455
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: mE__zZYhHjS3_VHazZlJk3YB0CyZoNvzgvtiAXih2hY-wnjFmmDWTA==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame C771 43 B
215 B 317ms
104ms Image
image/gif 2600:1f18:1aca:4282:681e:bcdb:1ca2:a385
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=d5340f5b-3c1e-19ce-c42f-4b51ee1c0ac0&tv=%7Bc:vUL2US,pingTime:-3,time:38,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:13%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:38,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:13,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B33~0%5D,as:%5B33~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tXympna+11%7C12%7C13%7C141%7C142%7C143%7C144%7C145%7C146%7C151*.1627455-73523879%7C1511%7C15121%7C1513%7C161%7C162%7C163%7C164%7C165%7C166%7C171%7C172%7C173%7C1811%7C1911%7C1912%7C1913,idMap:151*,rmeas:1,rend:0,renddet:na,siq:14%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=4347476252&adk=504672438&adf=3417920651&pi=t.ma~as.4347476252&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403292&bpp=1&bdt=200&idt=339&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=342
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:681e:bcdb:1ca2:a385 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
server: nginx
x-server-name: dt01.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame C771 43 B
216 B 312ms
100ms Image
image/gif 2600:1f18:1aca:4282:681e:bcdb:1ca2:a385
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=d5340f5b-3c1e-19ce-c42f-4b51ee1c0ac0&tv=%7Bc:vUL2UT,pingTime:-6,time:39,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:39,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:13,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B34~0%5D,as:%5B34~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tXympna+11%7C12%7C13%7C141%7C142%7C143%7C144%7C145%7C146%7C151*.1627455-73523879%7C1511%7C15121%7C1513%7C161%7C162%7C163%7C164%7C165%7C166%7C171%7C172%7C173%7C1811%7C1911%7C1912%7C1913,idMap:151*,rmeas:1,rend:0,renddet:na,siq:14%7D&tpiLookup=ao:geocult.ru*%2Cgoogleads.g.doubleclick.net*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=4347476252&adk=504672438&adf=3417920651&pi=t.ma~as.4347476252&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403292&bpp=1&bdt=200&idt=339&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=342
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:681e:bcdb:1ca2:a385 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
server: nginx
x-server-name: dt15.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame C771 43 B
215 B 306ms
101ms Image
image/gif 2600:1f18:1aca:4282:681e:bcdb:1ca2:a385
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=d5340f5b-3c1e-19ce-c42f-4b51ee1c0ac0&tv=%7Bc:vUL2V1,pingTime:-2,time:47,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:432,beZ:433,mfA:435,cmA:436,inA:436,inZ:439,prA:439,prZ:443,si:446,poA:447,poZ:462,cmZ:462,mfZ:462,loA:471,loZ:473,ltA:479,ltZ:479%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:13%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:47,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:13,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B42~0%5D,as:%5B42~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tXympna+11%7C12%7C13%7C141%7C142%7C143%7C144%7C145%7C146%7C151*.1627455-73523879%7C1511%7C15121%7C1513%7C161%7C162%7C163%7C164%7C165%7C166%7C171%7C172%7C173%7C1811%7C1911%7C1912%7C1913,idMap:151*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:na,siq:14,sinceFw:32,readyFired:true%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=4347476252&adk=504672438&adf=3417920651&pi=t.ma~as.4347476252&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403292&bpp=1&bdt=200&idt=339&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=342
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:681e:bcdb:1ca2:a385 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
server: nginx
x-server-name: dt14.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C771 0
0 52ms
52ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstWEMoqITVykXRorwCC6KdxZfndKPKsg0y2Uii9RQnuPPkX1tGypISzO5gd-jSOfYWY2OcpSX-NWo4cXM6xYE5F1g_b3k2pYtSzhGMt66UjVKdjLVPPibcWdclnAJQG-URveze7gjJfDS2C3CG1u29fbq9Vx13VN-WEGiAI-hBsFE0waY0Y-PSYBgfhayA2nL12C8PSfwM2Nhy09dXS4I4TFxx_bHkyoZ_riLYzurNB3gUumbYXm0IOCPo64EjGlqIm6dCSJJToUvAJwblndOb3fSrzVVo8o7c5bmS5JD6xVv1dMv7qqx-2ODNjdf9dRXclZtHLQCCustlBBJVHnMiDnMEGA2cffdl8MmX_ns23-jlkr0PdXxuHzlgx4DxATawESirIHfdDMNQxwq0ZhaaHcRZrxjs_irOw3EOM5H1vcKTX3srrN5O8YAXT76RNy7wOslJwprZJ_YbAXyY65XLunq4c8YbVeR-9grTMJVvj0qEVgbgoBu3UWC31w2lx3Y4caJzYPCRGDe4u8t839jgWojSUzP4CJLyYA5SB2RjY4RU724yuvj_cmKwCu0nP_tUfJ51VT8NccX-G8n_3jkbtIHl0ll-3uemiUFHUHd-bs1HvBU7a8qPWVOoLVMYeER00WRJQrTvsubi5ZdQ9smWOEEDUdPEwWelXa-FuR4uGZ0VbQ7v9CBkCxsxguFZXxe9wdfhx7pGzj0AO9XNaf6HY1BKxrT7g2apZVYutany6P999JFgNCnd9Y0zal1AhpE-XJ45yWxw1vleDD0JOjoW4dxp6vElajsFwGn8aDCC3c_5umHw1J9QO69_0MVG4rFzZq_MBQPjCdvTNWK-jG1mh_kOPR7EEgmRJX4f7COqOCSnQQWQvE7n1qqlC7S3H9Nfs_BF7NCTI7pwnpxG9BmjQA_d9NVyvLdCTTd5uWGG4_IlWsb5RUT4DP0E4H2ikH3a755mBHYbTQ7TxOIjeMF8BQH5df7wcnX4pFAHvPmC9St_0Av1Sv4TNjrY9qCJzwJnbmdGPV-nYnWSiYg8yStsfFxguHIt-5VlK56uB5pY46m5qWvJvZhyT9jgv8BV9HY9WRrGox5sfo-irofZay7ENP7fVquTHIaFRYX78Q2nZgsiJRpeWCvurP9eVKJz0NG2bsa4sN9h9HoOq7rGdYWERy1VzKXD3-w3dlABuEaTYRUNTwE8J07YqAdNR2iAPpY7XfvYdqbVGaTcM1ccSRaC-tCNxSVvjc6A7nOOe3Gojziq36OfoCm_AOx25Rw&sai=AMfl-YRoXB1Y_OfRAsu5b_9Xp7u1OB-mLtMOHjxpPTlLIQ-sK9UUQ1yil_jQInDZjEMLSZBRUC5-XgLy8xJrPKnbKys-1Sg_dCwMcBR_A_hk-7rNb2F0crSV7YP5XCLfWGLkAk-c458vetdpcUXV6CVoTAIJVVp-tFjfJ6hwWmDi8yoEiMN4EZ9QxN8-lGqUhHKF__t3Q6URUCJmvshCzHpvEWJQFBlIGazNkQtr2gF0zaGvay96ZgIxuQY_v4INAMC2En7YCxWGEHCOp667P4Qw3573d36gR97iQ_thgg&sig=Cg0ArKJSzBSKQ3iOUtevEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=254&vt=11&dtpt=145&dett=3&cstd=107&cisv=r20231130.65741&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:25 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame A8FB 111 KB
39 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:51:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46919
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Dec 2023 19:51:26 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231130/r20110914/elements/html/ Frame A8FB 11 KB
4 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231130/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CMOG6cG5kVMw4mJKWO6jbleqZOi9VF5SoTDldpnyjCFfiWWVO9piT2a9e7bIEi2OFf8_nYjNHLdmcMwWyu3_bso0cPLdI6PEZA1oR0fW7uix2YRHrQzXqOwPExq3je-WDzCbRaTgTgBHnTTFkF_Iqw7RN8vgAhNHhKYuQHI_maFJxUzHvfsKGEJ63PzNAvIMh146e6&cry=1&dbm_d=AKAmf-DcDbqvtD_yAlPfQ9gc607nzhUgwC4jC8IFE7YjRqXArjbLuEQjl2q-2LkXsNedDJkUc_z_ydomjHz7WN3bfVkEXGE3oqLO9vqocE8vLqAV-jFULsNTTewi1bQqplHh2zrMvLKRG7fe7qkh7rHMbOj98kWhlAdfUFwL8Q7epWGyOqVKflYdyGYLx233lJZoPKIBGSi6J1HpzKK9UJmsJx7D0xWsyZiHDEvSpqwludqB4sVj-Ix6vc924ysJyFGVZahyWK_GTrPMWL7B7hwYvu1pxPYiMKZn4IhG5fyQorFG02Cvn7gulNtpziHbZAUasonONIdbJbfTDFN-ExUHqDtd7lQln-s1FvhbkP6mAYM6dCCR344tUTqEBrLxtJjQ1QnL9Fu1UPFDumXj-XCRmfaWItANMLd7M-i_WMgJQ0RN_dyQSGYZUjFZWOMaD29QaarLc9qWkX5uHznjOIRtv9sWsBe7VqHp7VBRg60KlBBaruNWdZNORVLjfxIO1OonMCbXgxlA-MyXew_wOGNOniWX6gUTXKeUjQRPCxhOkYLogQbRjR5gf8VVeDj6GSRvUtq-CNQGfqCfCZpub4FPv9OZLsho75iwkGEcymYBNUjHRx2OJrlLT5NGDuklS4IvwfVuDYlVrxOxuY9cbMqTytmwF7op_wT-3iKZ1PPqqvpk2_oArOJkCmZjuTqXCiP1xI_K6dZ8m_rfp0cCtOHeyOD8VNiTgVhf2Kz4ODKvZ6FuRqZsu1gKllk2KyJd2hAq-7poE0DFJZxi81yd26D75FBSaljjtWufEOil89AdZQ16tSgWzTZYgmd75t4qRIQgB_SKVIaQao1nlVMZ0mD6COdl45hN4HKJR9pMwfejwoLm8CN4bTMxjZtRB0gmmj6EM25aftgtGnCOtiGPPRjwA5na5nH3P6BjDd-pQx7pljKM1LPZIAZ3raMSXElFDQrMdg8OLBq_0e7ykS51gV8TjfU734J-heDuhXcVKXjXKCAuTHx4N46VBRysSEKHiTlKxP_Sz5QaW7-kkYKvYoKML0qvBOkhCEsGC34bpXXoPptqFzBEq2RCN_08kVadJeEPdaveZXYijIp0h8kMizbiK5IsDyjAuDaaspFa1TwedprRM8FDoTJlcmGDjKbR8oiFM2d9Qn7TGGdftpAFNI8_Qi2uoi_SRFFDr6cbw-CUuX6WZBJdkdLLFnUQSNnilSS-YUlLOOHn8wKGQ1Hz4s2P1YEuJJt7LpegHrs4KasIi-xg1KcurZvgD-hVSNm7egxb4qDEHptyK8sDKz1Jbf0GOmA6KjbXM2gyunPY1Ft3gKQNijZFJT0RRgAuxUu711JtiDmUyPAq4BrIBH5GGCgg_sMEb3L3t2gsr7Ewe0mNxeZZREaJD2pnJBbIEHll0r45s_MK5SDneJaheQNr1vk7dT_ceM0fX2UCJbgHCW88d4OinT1n9AUQ5yBHdD7udfNaIoSRhpwW50oYdqk5q23hVb3B5kqUiDt-LAGlbneQVZ6jHKBB5FdnvtmLmTUSsDOzSuYLOrsPG9d6hnI8v-bLSTvwF0S1uJ3psnTIitqx_fek3PmlpYCzh2gfausxJSutSpAg1Mg9wBgv_jTk6lq896QNiVdbJXrZycZGR2Wdgy-ricxc5pCDuxJgWzGiZ31-2g6w8gMa0Lh-WNC4fP5oQkvQ_qYqJMrPtZg_dNjkUmjQom3dmcsl0UY6R1AmX6WItSpza0qg6OKigFDa-6H1M2fut0xEt9UWy6W3bTfInOThUH-jnpnO1s5BFI8byaB6u9awtESaW0an0joaPzMUl18Ml2mKHi758-ZTekD_S0aZCUnEvugNMJi92RL1PApPEUuVflsprd5tvUyu6LDl4ReT_H_IGNGCltzTgjcTNldE7fx3EjCPyA_RTJwGKsklhZsxfrdPghzJGjjmeH7HiBIW10NqYEgVa72PUxA7jC9ifi9QVOfY4RXW0PNsGq82Tn-vhdO7nHxTgXu-VZhCjx61Atd5F0kEA92WM7Xvww31nunBtCvQ5twmyz2WJuoIkk-JL6HuVSx2mHieby1hWDxP3ddS6y6D3ht3oWskivlawby1Dcqe4h7o8TuAXArTZLNgVmCpt4B5_20WQlM5tO4DSifEjcNCVWWLaeVCHg2b817eINzgskEP3U1scbgLJZ1g0VQ5orZrjlo2IIDQ5BzN5gW84V4Fve5EUxGfN8Q6kGHMM22WFX3kqnoezNZFOIuRhzehPzhvMy-1wkSWWmXszlnIpcoUIwTzy3HtchFF28kLgznAun_YC9wYNifANnIxRf1tpbdP7ndaZPLCGwusEO4hcT7DdNPAbgk0wD3t-wkmIwy28kL6atYSEn-Qf7HqckiIfbZ-oe0UfnFkecv5J0wd-kmk5nVj03-TE83DdkO2IMPQVJt4j7RxaEgqO3JSaU0yOr0ZD1UhYYpgMFA2YOdjYpzOFWhl2lVsDPywkM3xai59ujRV-rD1wS32H_nlw6mEYBbLqzytz8oBpsvYPz6-688f65gSKZ-XNjut8Xse4DGD1jM8-IF4U5uUSp0x6ZGYeU5LX-aJydVhA3adnmBwL3sHAwzatvdZHjlaMfCOfsVpsQzHVwLydAJ_sWA4NKIaBKSJQhE4yvcC7PsyTJm7oXHAVWQeT4XIzPdrVUVgYlZJWTuWVaiTx6phvj__HqRS-ucdwTh95PXWgiYO4yP_WR5f1yfaLc2OI5RwY7d_eKL0hCjSog1n3a1ZQWNA-vRsYDLoX7sEHGiUWdqzDgC2bis_suSiXHnGzQ8FGUijF4-9VpsA86ux53VlQIEDFeh_5ZxBRPUdflYafMacUwglKPmYOqOZ8fIyOmm8k6iGUKjmy1OSR0BhRD-3nHRT5hnkjuNhDUkayJFIWZfLTy91FBz1f7GIY4FsyRunCJIkeeC7FqD5X8L8g6-hHUdjAtXU7TbHk5sjjacl6B5gxpL08RCvr3lr5sbgjvyuQL5XlpF4iAnIyjhr90Z8QaizqKejKHldOTro_cjwdwdFVObJEfVcPsRNYtzOeT04DT9MYo3pfyRrZtRUljZEbvpKYYOT4ss3Guwc_jd6nRRMecZvKa7iWAByiIREJZJEMPH4m8Q0wRYh03qtJnaUhtUjmdBxXQJ6irhduqXiLksKaJQMhcFVYYTx9WMfQKtiugja27d16Dxbf_M3VCl0efNGZ_bJDsWqYxoFAzJJIiMUNIB6mMTJiVSDeJe6-nzH-s_3lxYqwyZ0kVUwAcCjPQKcsDIGIrrn1TyJhtHFvedxl2W8zJOuRk_CD5_bdScWQvjLCHbulHyrB07wsCHY_FtT4SjoZYWOVWlpKyFM0Ho7zcdJvVa64l5ZZCNrTeT1qv6BenDzk6ysIE03bdvqlc6wTe_Uh7_7f5GtL0jIpAJ7NCfODGE14X0E72PNjLBk1422lKlEUKt6dUbC7bwn-azb0kUNvoqhLNWiSxf01L_GbjCa0G8DPd7hs0eNLueddrByoI4G2DBkO0WWzEYQS1-aR7V0fQsRBdb_UX1Ng81XI8VLuC5WnTB8iuxJ_XX0E0A2RzQOIitWQVA94wW4DWBNhhxoTtntzin8WjwQOMbuCA4ZNVeNGwkmx-6EGFOkbNFo97rEfzKJOAta4F0-xixPUfzR62H3VdvKqVUoU348dCU9lzeCfAaRl0LAQLvxaEVQeF1ELtZFsW66_3XnIwf1RZ-fQWZJrCj2lE4Wi1AUAWzp4p553jizIqxhSHgdfYX8ISRF4qpMqTfq1fNs0Snx6GGTIDcnpkrx3Y3NJu6raJ3u_Pe72q8fnYf1JdMCm3frOXq0tob90xXS9-nA47QVoqYt&cid=CAQSOwDICaaNRYrLZiYy_rz2VQ8M3ioO2iYWOY8j6-FCHJ5hSnXZjyWjhSeZNIaig7PrxEru3Or05a3Ga-m5GAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fgeocult.ru%2F&ds=l&xdt=1&iif=1&cor=13486007983855550000&adk=1877897942&idt=104&cac=0&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:05:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49693
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 19:05:12 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231130/r20110914/ Frame A8FB 31 KB
12 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231130/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f84f4f65c00630a8dd0f354e652293a2cf51e95722f447fb2ea869bbbe664446

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 12:07:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74745
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11937
x-xss-protection: 0
server: cafe
etag: 9249472389583843189
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Dec 2023 12:07:40 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame A8FB 41 KB
14 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 312497
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Nov 2024 18:05:08 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 98C8 1 KB
647 B 14ms
13ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 59715
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 16:18:10 GMT
etag: 48472445140208031
expires: Tue, 05 Dec 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame A8FB 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b73a33eabd8ab199370a5f95ae00933c2eeec872034038851beaccc06bd92f11

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3C93 0
22 B 51ms
51ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BK_sIBOVuZZ2-N7Phx_APyfCNkAoAAAAAOAHgBAI&bg=!7-yl7KPNAAY3kmNgF5I7ADQBe5WfOM8QIJVdpszmwxAjE00408B9EOePTDDBWMyHwa7BQygQ4ZpPAlwwEP7rfGMzbDkCAgAAAGJSAAAAAWgBB5kDDBT6pQu1eSqAJDdbj2qqF1c6U-eU0bNHzv9a4f5CPvutDKMGuSRAnCPE_LE1EyrABRoOkUt4MIFA44Z5gUJwHoQBAwyZfFG-c6JyYsqvCPHQ2XByaSqRESe2HCNs0De1j3by8QI1OGyg-G__sTCU8fsiRpGM3ElPNi1uJTBvRi3D2Y4XYI_9Wn0ZmaMzTKay9BjqDo2MNW3uS81i9b8OiXfonCSb3UyqYGM00BE87igFJ9Q8dnIS5DlZlY6Ove48ZcoOfQMkScRkbSKvww8-ZD4vcxbyC4y8kOePXC_gYBXzEWiBH6bPeHmkO_Nva20P3OjyDPo9fePpyKCV8nHvBeaViWmpvfwoe0uaSqOm9bDQrFLQR0_8I30MrkCQFoSwImSOSUkCdKJdiy7sfxZpEfAeAmQuCWpTxeW39iBJT3dALb9JVqrm3A0jwN3WSQTPryCoYPyT3ZH1DxVo9j5vALPQaOv377grkS8gW78mQhgxlG-m3xEQRtv_k5HiwLmGerkHJn7KxBDMH3R5bdXm8gb3bn9tzmyKbIlZ6N9Hy0sUyRbLLpD2EO-I5kkCjiQGQrN4JKVZG-KrhBA_7ybSgXs4XyOaHOrNupeqLASavx6xu2bgPHwckdciMtAN3NmcOOgRS-Y6uR95onjmUHpGG6za8Xn8CeHWhF3dviKQPbYN5M6mGulQds_qLY5eSDeswgFsuMmInEPi9-DHnqTV-jzW45AkNesWoB9ltWA6EbV3LBQZTzs9Da61LgV4-Yz0v5pgzbjxTzQN1Lt1Va5rIhlTLqVxYnKQxdAbvbtEh81jrgiww2jWSS_CGiS9QSHSkzqmn_lLJU_VEwiXrdLSbcFBtSs4Y7Gm-q_kfnb4Hy4jn4osvD10rlrPhMCDUD07INcspa8xC3drCmPd2UGFy70JxTSs6SeyQg_El-HbLKrvITW5vyyKfmExuElCmZxGtgfdUJ3nYGfIrWNz17O8FPLwiRpZvi80Kj_UzopqTc4NKr6d-D4dxDtiLDl6_2aDTXcTBugoUlcbg6WfGA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame C771 43 B
215 B 239ms
104ms Image
image/gif 2600:1f18:1aca:4282:681e:bcdb:1ca2:a385
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=d5340f5b-3c1e-19ce-c42f-4b51ee1c0ac0&tv=%7Bc:vUL2W9,time:117,type:e,im:%7Bpci:%7Btdr:45%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:117,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:13,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B112~0%5D,as:%5B112~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tXympna+11%7C12%7C13%7C141%7C142%7C143%7C144%7C145%7C146%7C151*.1627455-73523879%7C1511%7C15121%7C1513%7C161%7C162%7C163%7C164%7C165%7C166%7C171%7C172%7C173%7C1811%7C1911%7C1912%7C1913,idMap:151*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:14%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=4347476252&adk=504672438&adf=3417920651&pi=t.ma~as.4347476252&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766403292&bpp=1&bdt=200&idt=339&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=342
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:681e:bcdb:1ca2:a385 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
server: nginx
x-server-name: dt21.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 98C8
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESELJowJuPQVYjvRADzT9qSBs&google_cver=1&google_push=AXcoOmRRrfc7yC7IRaEvT2GoaBq1qklPm9RFCD1jSJBFA1l-EO6CF7WT1_ONgqJ6Qxgr3Ib8sKdfqWWPZrIEy6GsVenrxPEA9766-...
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjU3MTkyMzQyODU2MzAyNjYyOA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELJowJuPQVYjvRADzT9qSBs&google_cver=1

43 B
398 B

20ms
20ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELJowJuPQVYjvRADzT9qSBs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELJowJuPQVYjvRADzT9qSBs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 98C8 0
104 B 125ms
69ms Image
text/plain 2a02:fa8:8806:12::1370
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEJfpOT-4odPrj5Y3jLudojo&google_cver=1&google_push=AXcoOmS_s-WJJan_R9KIbVC75lUhbaooxvuuPQjxMh6cn9j1rz56tKEw3ws5f11_seSG2ZbWeOUZtMPP9PVzbSgRLnghUDsxpEGR3gjI9IobJ0P8MDz6c4RVoImsVMMefOi9OBRX1twN9WnDbwr8EuOP3RGaB1E
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1370 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 98C8
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEFvtDYxGnT_hgU4tcX810vw&google_push=AXcoOmSh1FAFOYCJbgj0DgpZur_bEaJtjnqSA0V0-GpxCvXpHL0VRyT_k7...

170 B
188 B

25ms
25ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEFvtDYxGnT_hgU4tcX810vw&google_push=AXcoOmSh1FAFOYCJbgj0DgpZur_bEaJtjnqSA0V0-GpxCvXpHL0VRyT_k7mftQekMhk1DS7Pkh6ebUNwmTiqRjujhxz7M48MqOpiPMUlTg9Lkgoq0UzD8WKPtxBuHrbeESgyweD5DPZrr_HKu0vBtVIGePQPbdI

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-etou8220076-FRA
pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1701766405.357161,VS0,VE89
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEFvtDYxGnT_hgU4tcX810vw&google_push=AXcoOmSh1FAFOYCJbgj0DgpZur_bEaJtjnqSA0V0-GpxCvXpHL0VRyT_k7mftQekMhk1DS7Pkh6ebUNwmTiqRjujhxz7M48MqOpiPMUlTg9Lkgoq0UzD8WKPtxBuHrbeESgyweD5DPZrr_HKu0vBtVIGePQPbdI
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 98C8 70 B
148 B 35ms
34ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEFyEjFtHojZ84B9zH_9Iu4s&google_cver=1&google_push=AXcoOmRnTPXF3TSaJBeD9gxJhS6-9zvK6kn5_ZEERm1sNVnYVpV0DU2KjlbLyGW5NMdFKFnVPllAhksqz2mAHfySl8UhnbDBAnHL1QKSU8cEKN-kgzWCzkx_vvZjd8jYbu8Y271lcS7hM-WwBqOnn-nLj7mcDD8
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:25 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H2 200 sync
x.bidswitch.net/ Frame 98C8 43 B
146 B 50ms
14ms Image
image/gif 3.67.231.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEKlutGrJeQ6v2r0bZVbz7S8&google_cver=1&google_push=AXcoOmRJ7EpFktvPb6O2kXuhxMW5wci4G8ZHTC_VewYoG3l9OTzPTZtwRR5CcL1UJ8mx04rHhJ31SQJwoH_VLxCXjiqRjoCMIyaHnfjVR55GDMuwKrdT4UdH-ASYLnUKw9mi3smS_Vj4qMqNyu3Csh5IoT3jBA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.67.231.56 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-67-231-56.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:25 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 98C8
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEHn8eINBaHc8k85nnVDfz7M&google_cver=1&google_push=AXcoOmR3GWQ6Ea2RnNE-hy82BzNSxcZ_goclzEi4bNJCzV7xhUqp0TwWxu8QTLYN57nAxek761jsL3ikeAeiLBijI7sfxsy...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmR3GWQ6Ea2RnNE-hy82BzNSxcZ_goclzEi4bNJCzV7xhUqp0TwWxu8QTLYN57nAxek761jsL3ikeAeiLBijI7sfxsy3c12ZGlw9s2CNHJUVexqNEgVTlHcc0M6hfVa8z...

170 B
188 B

27ms
27ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmR3GWQ6Ea2RnNE-hy82BzNSxcZ_goclzEi4bNJCzV7xhUqp0TwWxu8QTLYN57nAxek761jsL3ikeAeiLBijI7sfxsy3c12ZGlw9s2CNHJUVexqNEgVTlHcc0M6hfVa8zHloBy0BYLmd_NrhncjCKGCvTaM&google_hm=eS1qcGp3N2doRTJwRVVaaHFDb25uVDE5cjFUeERKcEY3VH5B

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 05 Dec 2023 08:53:25 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmR3GWQ6Ea2RnNE-hy82BzNSxcZ_goclzEi4bNJCzV7xhUqp0TwWxu8QTLYN57nAxek761jsL3ikeAeiLBijI7sfxsy3c12ZGlw9s2CNHJUVexqNEgVTlHcc0M6hfVa8zHloBy0BYLmd_NrhncjCKGCvTaM&google_hm=eS1qcGp3N2doRTJwRVVaaHFDb25uVDE5cjFUeERKcEY3VH5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 98C8
Redirect Chain

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESEE_Ai0JIXXQh2Z3Clvmx8Os&google_cver=1&google_push=AXcoOmTCjUmsdJmtbqr9AywsDAoges7M10jW5t01M05CC5RLVR-aW-V6WhGVYX9c3K...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmTCjUmsdJmtbqr9AywsDAoges7M10jW5t01M05CC5RLVR-aW-V6WhGVYX9c3K1nGpy2MuPLEBWuDrdv-lHRpc-R3q_kNyRNrJUSePkssfrWLl...

170 B
188 B

25ms
25ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmTCjUmsdJmtbqr9AywsDAoges7M10jW5t01M05CC5RLVR-aW-V6WhGVYX9c3K1nGpy2MuPLEBWuDrdv-lHRpc-R3q_kNyRNrJUSePkssfrWLlGS564ok8GpKKo_qnhPd8JkqgEY-TwHTpby7UiHaV3VWJZU&google_hm=j4vxivQxR2ed-jvn68QG4QQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:25 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 08:53:24 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmTCjUmsdJmtbqr9AywsDAoges7M10jW5t01M05CC5RLVR-aW-V6WhGVYX9c3K1nGpy2MuPLEBWuDrdv-lHRpc-R3q_kNyRNrJUSePkssfrWLlGS564ok8GpKKo_qnhPd8JkqgEY-TwHTpby7UiHaV3VWJZU&google_hm=j4vxivQxR2ed-jvn68QG4QQ
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 98C8 0
12 B 24ms
23ms Image
text/html 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I9oyvNtyG8qKIh60SJlkLvd1OkyV_Vei0A-45R_GDF9BPeBmG5n_rtRyXRKRpR_vGbxCMm-A

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:25 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/449926147639558759/women-160x600_de/ Frame 2DB5 8 KB
3 KB 14ms
14ms Document
text/html 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/449926147639558759/women-160x600_de/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc120407f385fdac1ac9b0525bb915f008309f39544a723b871266b0727b5014

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 264141
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2792
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 02 Dec 2023 07:31:04 GMT
expires: Sun, 01 Dec 2024 07:31:04 GMT
last-modified: Tue, 17 Oct 2023 13:28:51 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame A8FB 0
0 64ms
64ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstvnE7ROoIFpC2O0LF3_fIrBtvPhh30kFb5Di68Sj-z0DN4qSzLrMP-MKHhJJNq32m30pffs9vWH7JI95AvjfDMe8Ki_-6_fL1xzhJw-Uk6-_CFHTzKO6Ao5bt6a0qWIgD3yVsnqKMs27dvGbLeeKh5q-Jw2cFKGPZ2MHmpSFGxP7zh_S2_nBOd4Q5ZHfL9ukkB4__KkkgO-oYrPGiWRmCyHZGUpKDBZRg9O5W2fxIw0Dt6KnK-3048_2TTpzJC6r7HcC4xdedMcTVncktYZcoPLW2HgS-sff_JaGCtwmx88mpiUQ-j2-d559G5o2mJFKXdrcbGsnHK3pyxysCobNWQzaJc61-_GEFWZeIqeprs1K64tFhpBHVPyesKO9rJpgzSa5E5MoDEnt8JMyJzEPjLIHhC9KhMt8txIc-xjePioYhr1vUL-pLK5rJPP2U78Ad_E4EeEV67abtu8RplK-okZlXHqsqgKTxEmIvplDqNXqkf3yehjcfk8uu6vlIL7jmKWvA351cFLiGiMSgf9jOfLllcAyCFfgfUWVLy2xR_desYdlp5sOBR0GVhar_I2s5bq3MnRreyyuYquu7EgOvuerIZm_rgMKDInS_ukg6u7NmLujIlkfsHrR_W_jYe3fBvUiW3M7xrQE0rD8aIEOsDJGfcRDW-Rl7IElov8rA4E992BwHzX4F42DQG_jSXOGxI_JHQRZiMe0xEObF_yQPH1trFURRe8TY7h5NTI6K89KN8TJ4qmTcm0V1nELcd6RbxVytis3cIJUBP-GML-f6k1ubd6NWvWhZIfYaq38GttEeYxPcbjZdkLshuwOSgX1FAt_Icm1IVyYH0Ffg6CPyYXQxUyJ3l7IRKu7p-6lmHjpvTWalpeN01kMGGpa27wCh7vGK6Uo0Mmwiid3-Blgw6TZkhJN6NCp6XqcpYDWCNxJDIs4nHR0avclaGjCMU7KWbP2HDJ_cz5p9sVPzv_CBDCGeUXSTe57gMd4s2WQ_nJSQSxC6mzhIl0amh1bMyjXALCGVeq6CEb1-K-rd5-hDg4DSP-JaoUrKY3FSXTcjlQxtlNEICjvw4y46m5XQdo-Zjrl6KYEQQKUssVNy2pkTqDl99kas1QE5uREM8RuNxKOEGGLUCY6d3T6swjRTwM1-ASpsP0pqzh04PCxeO_Ok8-gV-w075IJIVrjxVriRctK7_2QVvr0Jg2Gw2L5OBOCIlFaYTojQ99pGkKo3g3bgKikHxYBF3IUTLIf00o4bECy67MYhS7GlgKNe0LjAJwSYCAm2cLyc&sai=AMfl-YRWdeT38RwZD5RfGEQL8JiA_o_gI-S-5pl21zLUyAtF_POY9Ec9nkz3_sWzmlipICwmF77U51M80McIoPEZivPiO9KYtLUE2nTyoY541_Tmluk6_iwvQKqMoJAkAvTSJ8awOMF-G_nGXuGdW4WVAUR2kUAleMPkuuWw2fpiZ46BRKOotC9SjrslISXgV3Zu8V8QHabSqmAPnij28RhKs730n0NB2fmOCKhDENYeiZHGngdjYBtzWNHOtV0P-sQxcfIy&sig=Cg0ArKJSzDzqnpP-0b25EAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=37&cbvp=1&cstd=36&cisv=r20231130.93307&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 05 Dec 2023 08:53:25 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 5665 38 KB
13 KB 14ms
14ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 126289
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 03 Dec 2023 21:48:36 GMT
expires: Mon, 02 Dec 2024 21:48:36 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 2DB5 236 KB
63 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/449926147639558759/women-160x600_de/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/449926147639558759/women-160x600_de/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Dec 2023 08:53:25 GMT

GET
H3 200 gsap_3.11.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 2DB5 69 KB
27 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.11.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/449926147639558759/women-160x600_de/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fbae080321632ad4ce06e9207ef9a534abd1d6488a96a0a4334fa768d1f93717

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/449926147639558759/women-160x600_de/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 08:53:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27635
x-xss-protection: 0
last-modified: Fri, 12 May 2023 16:03:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Dec 2023 08:53:25 GMT

GET
H3 200 index.js Show response
s0.2mdn.net/sadbundle/449926147639558759/women-160x600_de/ Frame 2DB5 21 KB
6 KB 14ms
14ms Script
application/x-javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/449926147639558759/women-160x600_de/index.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/449926147639558759/women-160x600_de/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81545cee8bac6db00d90fa3cde7840f893593de115204bd3737864f78c4df2d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/449926147639558759/women-160x600_de/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 10:57:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 510982
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6143
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 13:28:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Nov 2024 10:57:03 GMT

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 5665 39 KB
15 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 00:33:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29973
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Dec 2024 00:33:52 GMT

GET
H3 200 print.jpg
s0.2mdn.net/sadbundle/449926147639558759/women-160x600_de/images/ Frame 2DB5 62 KB
62 KB 15ms
15ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/449926147639558759/women-160x600_de/images/print.jpg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&daaos=1701753578449&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701766404345&bpp=1&bdt=1253&idt=0&shv=r20231130&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=8731344217390&frm=20&pv=1&ga_vid=308176690.1701766403&ga_sid=1701766404&ga_hid=1625040066&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C42532604%2C31079759%2C31079864%2C31079866%2C42531705%2C44795921%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072%2C21065725&oid=2&pvsid=382026428823841&tmod=285315023&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=4&fsb=1&dtd=12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b69db07ab1d6949428c29a1bc81213fbfa663b0d112719565e1b909ee210b5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/449926147639558759/women-160x600_de/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 23:05:12 GMT
x-content-type-options: nosniff
age: 294493
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63312
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 13:28:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 30 Nov 2024 23:05:12 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame A8FB 0
0 50ms
50ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstvnE7ROoIFpC2O0LF3_fIrBtvPhh30kFb5Di68Sj-z0DN4qSzLrMP-MKHhJJNq32m30pffs9vWH7JI95AvjfDMe8Ki_-6_fL1xzhJw-Uk6-_CFHTzKO6Ao5bt6a0qWIgD3yVsnqKMs27dvGbLeeKh5q-Jw2cFKGPZ2MHmpSFGxP7zh_S2_nBOd4Q5ZHfL9ukkB4__KkkgO-oYrPGiWRmCyHZGUpKDBZRg9O5W2fxIw0Dt6KnK-3048_2TTpzJC6r7HcC4xdedMcTVncktYZcoPLW2HgS-sff_JaGCtwmx88mpiUQ-j2-d559G5o2mJFKXdrcbGsnHK3pyxysCobNWQzaJc61-_GEFWZeIqeprs1K64tFhpBHVPyesKO9rJpgzSa5E5MoDEnt8JMyJzEPjLIHhC9KhMt8txIc-xjePioYhr1vUL-pLK5rJPP2U78Ad_E4EeEV67abtu8RplK-okZlXHqsqgKTxEmIvplDqNXqkf3yehjcfk8uu6vlIL7jmKWvA351cFLiGiMSgf9jOfLllcAyCFfgfUWVLy2xR_desYdlp5sOBR0GVhar_I2s5bq3MnRreyyuYquu7EgOvuerIZm_rgMKDInS_ukg6u7NmLujIlkfsHrR_W_jYe3fBvUiW3M7xrQE0rD8aIEOsDJGfcRDW-Rl7IElov8rA4E992BwHzX4F42DQG_jSXOGxI_JHQRZiMe0xEObF_yQPH1trFURRe8TY7h5NTI6K89KN8TJ4qmTcm0V1nELcd6RbxVytis3cIJUBP-GML-f6k1ubd6NWvWhZIfYaq38GttEeYxPcbjZdkLshuwOSgX1FAt_Icm1IVyYH0Ffg6CPyYXQxUyJ3l7IRKu7p-6lmHjpvTWalpeN01kMGGpa27wCh7vGK6Uo0Mmwiid3-Blgw6TZkhJN6NCp6XqcpYDWCNxJDIs4nHR0avclaGjCMU7KWbP2HDJ_cz5p9sVPzv_CBDCGeUXSTe57gMd4s2WQ_nJSQSxC6mzhIl0amh1bMyjXALCGVeq6CEb1-K-rd5-hDg4DSP-JaoUrKY3FSXTcjlQxtlNEICjvw4y46m5XQdo-Zjrl6KYEQQKUssVNy2pkTqDl99kas1QE5uREM8RuNxKOEGGLUCY6d3T6swjRTwM1-ASpsP0pqzh04PCxeO_Ok8-gV-w075IJIVrjxVriRctK7_2QVvr0Jg2Gw2L5OBOCIlFaYTojQ99pGkKo3g3bgKikHxYBF3IUTLIf00o4bECy67MYhS7GlgKNe0LjAJwSYCAm2cLyc&sai=AMfl-YRWdeT38RwZD5RfGEQL8JiA_o_gI-S-5pl21zLUyAtF_POY9Ec9nkz3_sWzmlipICwmF77U51M80McIoPEZivPiO9KYtLUE2nTyoY541_Tmluk6_iwvQKqMoJAkAvTSJ8awOMF-G_nGXuGdW4WVAUR2kUAleMPkuuWw2fpiZ46BRKOotC9SjrslISXgV3Zu8V8QHabSqmAPnij28RhKs730n0NB2fmOCKhDENYeiZHGngdjYBtzWNHOtV0P-sQxcfIy&sig=Cg0ArKJSzDzqnpP-0b25EAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=117&vt=11&dtpt=80&dett=3&cstd=36&cisv=r20231130.93307&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS