bultourism.com Open in urlscan Pro
69.64.51.116 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%...
Submission Tags: falconsandbox
Submission: On December 14 via api (December 14th 2021, 2:05:05 am UTC) from US — Scanned from DE

Summary HTTP 62 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 15 IPs in 3 countries across 12 domains to perform 62 HTTP transactions. The main IP is 69.64.51.116, located in St Louis, United States and belongs to AS-30083-GO-DADDY-COM-LLC, US. The main domain is bultourism.com.

This is the only time bultourism.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
12	69.64.51.116 69.64.51.116	30083 (AS-30083-...) (AS-30083-GO-DADDY-COM-LLC)
8	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:82f::200e	15169 (GOOGLE) (GOOGLE)
1	70.59.126.236 70.59.126.236	209 (CENTURYLI...) (CENTURYLINK-US-LEGACY-QWEST)
11	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0c::9b	15169 (GOOGLE) (GOOGLE)
1	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
2	142.250.184.227 142.250.184.227	15169 (GOOGLE) (GOOGLE)
2 2	2a00:1450:400... 2a00:1450:4001:801::2004	15169 (GOOGLE) (GOOGLE)
1	142.250.185.82 142.250.185.82	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:801::2012	15169 (GOOGLE) (GOOGLE)
62	15

12 69.64.51.116 (St Louis, United States)

ASN30083 (AS-30083-GO-DADDY-COM-LLC, US)
PTR: vilya.kafence.com

bultourism.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 70.59.126.236 (Fargo, United States)

ASN209 (CENTURYLINK-US-LEGACY-QWEST, US)

counter.search.bg	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.227 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f3.1e100.net

p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-if-v6exp3-v4.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.82 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f18.1e100.net

p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-253745-i1-v6exp3.v4.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2012 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-253745-i2-v6exp3.ds.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	361 KB
12	doubleclick.net googleads.g.doubleclick.net stats.g.doubleclick.net	67 KB
12	bultourism.com bultourism.com img.us2.bultourism.com Failed	69 KB
4	gstatic.com p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-if-v6exp3-v4.metric.gstatic.com p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-253745-i1-v6exp3.v4.metric.gstatic.com p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-253745-i2-v6exp3.ds.metric.gstatic.com	4 KB
3	google.com 2 redirects adservice.google.com www.google.com	894 B
2	googletagservices.com www.googletagservices.com	73 KB
2	google-analytics.com 1 redirects www.google-analytics.com	17 KB
1	google.de adservice.google.de	792 B
1	googleadservices.com partner.googleadservices.com	648 B
1	search.bg counter.search.bg	539 B
1	googleapis.com ajax.googleapis.com	33 KB
0	fbcdn.net Failed b.static.ak.fbcdn.net Failed
62	12

	Domain	Requested by
12	bultourism.com	bultourism.com
11	tpc.googlesyndication.com	googleads.g.doubleclick.net
11	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
6	pagead2.googlesyndication.com	bultourism.com pagead2.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
2	www.google.com	2 redirects
2	p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-if-v6exp3-v4.metric.gstatic.com	googleads.g.doubleclick.net p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-if-v6exp3-v4.metric.gstatic.com
2	www.googletagservices.com	googleads.g.doubleclick.net
2	www.google-analytics.com	1 redirects bultourism.com
1	p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-253745-i2-v6exp3.ds.metric.gstatic.com	bultourism.com
1	p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-253745-i1-v6exp3.v4.metric.gstatic.com	bultourism.com
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	stats.g.doubleclick.net	bultourism.com
1	counter.search.bg	bultourism.com
1	ajax.googleapis.com	bultourism.com
0	b.static.ak.fbcdn.net Failed	bultourism.com
0	img.us2.bultourism.com Failed	bultourism.com
62	18

This site contains links to these domains. Also see Links.

Domain
rilamonastery.pmg-blg.com
img.us2.bultourism.com
www.facebook.com
bgcounter.com

Subject Issuer	Validity	Valid
*.g.doubleclick.net GTS CA 1C3	`2021-11-08` - `2022-01-31`	3 months	crt.sh
bultourism.com R3	`2021-10-25` - `2022-01-23`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-08` - `2022-01-31`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-11-08` - `2022-01-31`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-11-08` - `2022-01-31`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-11-08` - `2022-01-31`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.v4.metric.gstatic.com GTS CA 1C3	`2021-11-08` - `2022-01-31`	3 months	crt.sh
*.ds.metric.gstatic.com GTS CA 1C3	`2021-11-08` - `2022-01-31`	3 months	crt.sh

This page contains 11 frames:

Primary Page: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
Frame ID: 21B22140EBDBE46D7E3D37110EF8DE1C
Requests: 32 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211207/r20190131/zrt_lookup.html
Frame ID: FC8C4B86D8EB89FFA50C55477F85600A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2513374550279225&output=html&adk=1812271804&adf=3025194257&lmt=1639447475&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fbultourism.com%2F%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580%25D0%25B8%2F%25D0%259F%25D0%25B0%25D1%2581%25D1%2582%25D1%2580%25D0%25B0%2F%25D0%259C%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-%25D0%25A0%25D0%25B8%25D0%25BB%25D1%2581%25D0%25BA%25D0%25B8-%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-0-7474.html&ea=0&flash=0&pra=5&wgl=1&dt=1639447474906&bpp=3&bdt=448&idt=91&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1532713821147&frm=20&pv=2&ga_vid=117416962.1639447475&ga_sid=1639447475&ga_hid=1299184952&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3923495919702997&pem=788&tmod=66&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=1&uci=a!1&fsb=1&dtd=115
Frame ID: B10D5CA3DEAA2562020C454AF5680844
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1366875918644128&output=html&h=90&slotname=4782041684&adk=643570460&adf=1638469296&pi=t.ma~as.4782041684&w=923&fwrn=4&fwrnh=100&lmt=1639447475&rafmt=2&psa=0&format=923x90&url=http%3A%2F%2Fbultourism.com%2F%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580%25D0%25B8%2F%25D0%259F%25D0%25B0%25D1%2581%25D1%2582%25D1%2580%25D0%25B0%2F%25D0%259C%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-%25D0%25A0%25D0%25B8%25D0%25BB%25D1%2581%25D0%25BA%25D0%25B8-%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-0-7474.html&flash=0&fwr=0&rpe=1&resp_fmts=2&wgl=1&dt=1639447474909&bpp=2&bdt=452&idt=121&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1532713821147&frm=20&pv=2&ga_vid=117416962.1639447475&ga_sid=1639447475&ga_hid=1299184952&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=141&ady=29&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3923495919702997&pem=788&tmod=66&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEe%7Cnp&abl=XS&pfx=0&fu=128&bc=23&ifi=2&uci=a!2&fsb=1&xpc=wqj9da0pLw&p=http%3A//bultourism.com&dtd=128
Frame ID: 4C2AC2A771F6BFFA57E296E9FD8390B6
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1366875918644128&output=html&h=15&slotname=2072505252&adk=1399546693&adf=316507209&pi=t.ma~as.2072505252&w=468&lmt=1639447475&psa=0&url=http%3A%2F%2Fbultourism.com%2F%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580%25D0%25B8%2F%25D0%259F%25D0%25B0%25D1%2581%25D1%2582%25D1%2580%25D0%25B0%2F%25D0%259C%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-%25D0%25A0%25D0%25B8%25D0%25BB%25D1%2581%25D0%25BA%25D0%25B8-%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-0-7474.html&flash=0&wgl=1&dt=1639447474911&bpp=1&bdt=454&idt=130&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C923x90&nras=1&correlator=1532713821147&frm=20&pv=1&ga_vid=117416962.1639447475&ga_sid=1639447475&ga_hid=1299184952&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=408&ady=669&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3923495919702997&pem=788&tmod=66&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEe%7Cn&abl=XS&pfx=0&fu=0&bc=23&ifi=3&uci=a!3&fsb=1&xpc=bgS8FMlzVS&p=http%3A//bultourism.com&dtd=133
Frame ID: 20832CC937BDC2F5EF2A933C352E9C30
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1366875918644128&output=html&h=280&slotname=9910245285&adk=2401919896&adf=2602987202&pi=t.ma~as.9910245285&w=740&fwrn=4&fwrnh=100&lmt=1639447475&rafmt=1&psa=0&format=740x280&url=http%3A%2F%2Fbultourism.com%2F%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580%25D0%25B8%2F%25D0%259F%25D0%25B0%25D1%2581%25D1%2582%25D1%2580%25D0%25B0%2F%25D0%259C%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-%25D0%25A0%25D0%25B8%25D0%25BB%25D1%2581%25D0%25BA%25D0%25B8-%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-0-7474.html&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&dt=1639447474912&bpp=1&bdt=455&idt=139&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C923x90&prev_slotnames=2072505252&nras=1&correlator=1532713821147&frm=20&pv=1&ga_vid=117416962.1639447475&ga_sid=1639447475&ga_hid=1299184952&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=557&ady=2040&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3923495919702997&pem=788&tmod=66&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEebr%7Cn&abl=XS&pfx=0&fu=128&bc=23&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=H3Q3O8DMna&p=http%3A//bultourism.com&dtd=145
Frame ID: BD548DB3FB72307A2CD12810E7946FF1
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: E07330BD34302C8649DB7BE7C90DEB24
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 7522C04CDF9081878DC541AD6E4F4E3E
Requests: 2 HTTP requests in this frame

Frame: https://p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html
Frame ID: 7C3F6567CDEB369FA7166997BF70C57B
Requests: 4 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/U_DPXy_vflqTjVU_YutWJm0axOJE633NQGMGFEhf2s0.js
Frame ID: 4E1AA36599AD93C3B0E084CAEA53AD2D
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/U_DPXy_vflqTjVU_YutWJm0axOJE633NQGMGFEhf2s0.js
Frame ID: 399A4A7A308A743D240094AD0DD7F186
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Манастир Рилски манастир в Пастра

Page Statistics

62
Requests

63 %
HTTPS

67 %
IPv6

12
Domains

18
Subdomains

15
IPs

3
Countries

626 kB
Transfer

1692 kB
Size

10
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: http://rilamonastery.pmg-blg.com/
Title: rilamonastery.pmg-blg.com/

Search URL Search Domain Scan URL

URL: http://img.us2.bultourism.com/pictures/7474/7474_main_medium.jpg

Search URL Search Domain Scan URL

URL: http://www.facebook.com/share.php?u=%3Curl%3E
Title: Facebook

Search URL Search Domain Scan URL

URL: http://img.us2.bultourism.com/pictures/7474/pix/1_medium.jpg

Search URL Search Domain Scan URL

URL: http://img.us2.bultourism.com/pictures/7474/pix/2_medium.jpg

Search URL Search Domain Scan URL

URL: http://img.us2.bultourism.com/pictures/7474/pix/3_medium.jpg

Search URL Search Domain Scan URL

URL: http://img.us2.bultourism.com/pictures/7474/pix/4_medium.jpg

Search URL Search Domain Scan URL

URL: http://img.us2.bultourism.com/pictures/7474/pix/5_medium.jpg

Search URL Search Domain Scan URL

URL: http://img.us2.bultourism.com/pictures/7474/pix/6_medium.jpg

Search URL Search Domain Scan URL

URL: http://bgcounter.com/?_id=btrsm
Title: <img width="70" height="15" border="0" alt="" src="http://bgcounter.com/c?_id=btrsm&_z=2" />

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 16

http://www.google-analytics.com/ga.js HTTP 307
https://www.google-analytics.com/ga.js

Request Chain 22

http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1729361182&utmhn=bultourism.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%20%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8%20%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%20%D0%B2%20%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0&utmhid=1299184952&utmr=-&utmp=%2F%2525D0%2525BC%2525D0%2525B0%2525D0%2525BD%2525D0%2525B0%2525D1%252581%2525D1%252582%2525D0%2525B8%2525D1%252580%2525D0%2525B8%2F%2525D0%25259F%2525D0%2525B0%2525D1%252581%2525D1%252582%2525D1%252580%2525D0%2525B0%2F%2525D0%25259C%2525D0%2525B0%2525D0%2525BD%2525D0%2525B0%2525D1%252581%2525D1%252582%2525D0%2525B8%2525D1%252580-%2525D0%2525A0%2525D0%2525B8%2525D0%2525BB%2525D1%252581%2525D0%2525BA%2525D0%2525B8-%2525D0%2525BC%2525D0%2525B0%2525D0%2525BD%2525D0%2525B0%2525D1%252581%2525D1%252582%2525D0%2525B8%2525D1%252580-0-7474.html&utmht=1639447474959&utmac=UA-749284-4&utmcc=__utma%3D164549804.117416962.1639447475.1639447475.1639447475.1%3B%2B__utmz%3D164549804.1639447475.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=635556038&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAAAAAAE~ HTTP 307
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1729361182&utmhn=bultourism.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%20%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8%20%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%20%D0%B2%20%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0&utmhid=1299184952&utmr=-&utmp=%2F%2525D0%2525BC%2525D0%2525B0%2525D0%2525BD%2525D0%2525B0%2525D1%252581%2525D1%252582%2525D0%2525B8%2525D1%252580%2525D0%2525B8%2F%2525D0%25259F%2525D0%2525B0%2525D1%252581%2525D1%252582%2525D1%252580%2525D0%2525B0%2F%2525D0%25259C%2525D0%2525B0%2525D0%2525BD%2525D0%2525B0%2525D1%252581%2525D1%252582%2525D0%2525B8%2525D1%252580-%2525D0%2525A0%2525D0%2525B8%2525D0%2525BB%2525D1%252581%2525D0%2525BA%2525D0%2525B8-%2525D0%2525BC%2525D0%2525B0%2525D0%2525BD%2525D0%2525B0%2525D1%252581%2525D1%252582%2525D0%2525B8%2525D1%252580-0-7474.html&utmht=1639447474959&utmac=UA-749284-4&utmcc=__utma%3D164549804.117416962.1639447475.1639447475.1639447475.1%3B%2B__utmz%3D164549804.1639447475.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=635556038&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-749284-4&cid=117416962.1639447475&jid=635556038&_v=5.7.2&z=1729361182

Request Chain 49

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 52

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

62 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request %D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html Show response
bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/ 41 KB
10 KB 977ms
296ms Document
text/html 69.64.51.116
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
Protocol: HTTP/1.1
Server: 69.64.51.116 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: vilya.kafence.com
Software: Apache/2 /
Resource Hash: 3f90c1f2ddff44509c13c19150f9f9ca3b39e8c88f95f0d2b68ed9cef21f0ab5

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Tue, 14 Dec 2021 02:04:38 GMT
Server: Apache/2
Vary: User-Agent,Accept-Encoding
Content-Encoding: gzip
Content-Length: 10238
Keep-Alive: timeout=60, max=80
Connection: Keep-Alive
Content-Type: text/html; Content-Language: bg; charset=utf-8

GET
H/1.1 200
OK bootstrap.css
bultourism.com/ 139 KB
21 KB 250ms
243ms Stylesheet
text/css 69.64.51.116
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://bultourism.com/bootstrap.css
Requested by: Host: bultourism.com
URL: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
Protocol: HTTP/1.1
Server: 69.64.51.116 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: vilya.kafence.com
Software: Apache/2 /
Resource Hash: 98a1a73b3955af8bca553440fd751c80f6007bed3294803d935bd6c4597c50e6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Tue, 14 Dec 2021 02:04:38 GMT
Content-Encoding: gzip
Last-Modified: Sun, 03 Apr 2016 23:25:39 GMT
Server: Apache/2
ETag: "f5aefa-22abe-52f9cee1f35e1"
Vary: User-Agent,Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=60, max=80
Content-Length: 20972
Expires: Tue, 21 Dec 2021 02:04:38 GMT

GET
H/1.1 200
OK bultourism.css
bultourism.com/ 36 KB
6 KB 247ms
240ms Stylesheet
text/css 69.64.51.116
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://bultourism.com/bultourism.css
Requested by: Host: bultourism.com
URL: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
Protocol: HTTP/1.1
Server: 69.64.51.116 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: vilya.kafence.com
Software: Apache/2 /
Resource Hash: a3dd8543865b42e183cbb20fcb9a4606868a3a9cc805ae4b6bd67884e9465986

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Tue, 14 Dec 2021 02:04:38 GMT
Content-Encoding: gzip
Last-Modified: Tue, 26 May 2020 10:11:00 GMT
Server: Apache/2
ETag: "a62c66-8f36-5a68a4fef73ab"
Vary: User-Agent,Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=60, max=80
Content-Length: 5408
Expires: Tue, 21 Dec 2021 02:04:38 GMT

GET
H/1.1 200
OK adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 145 KB
51 KB 32ms
25ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: bultourism.com
URL: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

23316b3ca68aed8b195c37949b807ce7e21192c1a0bf7e9d5c273f0aaad172ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Timing-Allow-Origin: *
Date: Tue, 14 Dec 2021 02:04:34 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 14201416544724854238
Vary: Accept-Encoding, Origin
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Content-Type: text/javascript; charset=UTF-8
Content-Length: 51891
X-XSS-Protection: 0
Expires: Tue, 14 Dec 2021 02:04:34 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 145 KB
51 KB 54ms
28ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0949fcf9acd60c6cb4e59ca30a2aae56d7c7f12ee45386dce0a8cb0cf37e6737

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 02:04:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51890
x-xss-protection: 0
server: cafe
etag: 12276679681795439666
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 14 Dec 2021 02:04:34 GMT

GET
H/1.1 200
OK logo2.png
bultourism.com/ 11 KB
11 KB 152ms
125ms Image
image/png 69.64.51.116
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://bultourism.com/logo2.png
Requested by: Host: bultourism.com
URL: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
Protocol: HTTP/1.1
Server: 69.64.51.116 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: vilya.kafence.com
Software: Apache/2 /
Resource Hash: 500ee9963630dac458fbf05c87bb3ec924e25481a4974163ab22c208899b01e7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Tue, 14 Dec 2021 02:04:39 GMT
Last-Modified: Wed, 06 Mar 2013 15:43:25 GMT
Server: Apache/2
ETag: "a62c02-2b78-4d743735b8140"
Vary: User-Agent
Content-Type: image/png
Cache-Control: max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=60, max=78
Content-Length: 11128
Expires: Tue, 21 Dec 2021 02:04:39 GMT

GET
H/1.1 200
OK magnifier_small.gif
bultourism.com/img/ 1023 B
1 KB 506ms
128ms Image
image/gif 69.64.51.116
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bultourism.com/img/magnifier_small.gif
Requested by: Host: bultourism.com
URL: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.64.51.116 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: vilya.kafence.com
Software: Apache/2 /
Resource Hash: 9f8d9c9035014e10335fc19170efa4e3cffa9967e83ae3eef6389e75b2a2ea0d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Tue, 14 Dec 2021 02:04:39 GMT
Last-Modified: Fri, 09 Nov 2007 09:26:07 GMT
Server: Apache/2
ETag: "1c3c001-3ff-43e7b928609c0"
Vary: User-Agent
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=60, max=80
Content-Length: 1023

GET 7474_main.jpg
img.us2.bultourism.com/pictures/7474/ 0
0

GET
H/1.1 200
OK de.gif
bultourism.com/flags2/ 1003 B
1 KB 516ms
142ms Image
image/gif 69.64.51.116
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bultourism.com/flags2/de.gif
Requested by: Host: bultourism.com
URL: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 69.64.51.116 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: vilya.kafence.com
Software: Apache/2 /
Resource Hash: 66671616f880ade1bee6a9afbced9011f1fe1b179ff9860766f700825e8bc9ae

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Tue, 14 Dec 2021 02:04:39 GMT
Last-Modified: Sat, 21 Jan 2006 10:54:18 GMT
Server: Apache/2
ETag: "1c36035-3eb-40adc3826ea80"
Vary: User-Agent
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=60, max=80
Content-Length: 1003

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.9.1/ 90 KB
33 KB 33ms
8ms Script
text/javascript 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 14:23:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42081
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33018
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 13 Dec 2022 14:23:13 GMT

GET
H/1.1 200
OK bootstrap.min.js Show response
bultourism.com/demo/components/bootstrap/dist/js/ 15 KB
5 KB 125ms
124ms Script
text/javascript 69.64.51.116
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://bultourism.com/demo/components/bootstrap/dist/js/bootstrap.min.js
Requested by: Host: bultourism.com
URL: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
Protocol: HTTP/1.1
Server: 69.64.51.116 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: vilya.kafence.com
Software: Apache/2 /
Resource Hash: 29faaa7d39edcba28dd6253f6dbe2637931e6a758bc59601747718ab4990a465

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Tue, 14 Dec 2021 02:04:38 GMT
Content-Encoding: gzip
Last-Modified: Mon, 14 Mar 2016 05:24:50 GMT
Server: Apache/2
ETag: "fd4830-11ed-52dfb7fef8c80"
Content-Type: text/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=60, max=79
Content-Length: 4589

GET
H/1.1 200
OK jquery.autocomplete.min.js Show response
bultourism.com/js/ 13 KB
5 KB 125ms
124ms Script
text/javascript 69.64.51.116
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://bultourism.com/js/jquery.autocomplete.min.js
Requested by: Host: bultourism.com
URL: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
Protocol: HTTP/1.1
Server: 69.64.51.116 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: vilya.kafence.com
Software: Apache/2 /
Resource Hash: d302fe121caf68995981332fa772943329f87c0d6077d86d4ca5d317e3df830d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Tue, 14 Dec 2021 02:04:38 GMT
Content-Encoding: gzip
Last-Modified: Mon, 01 Jun 2015 20:59:22 GMT
Server: Apache/2
ETag: "1c3e070-10e7-5177b19a1be80"
Content-Type: text/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=60, max=79
Content-Length: 4327

GET
H/1.1 200
OK jquery.textfill.js Show response
bultourism.com/js/ 10 KB
3 KB 131ms
130ms Script
application/javascript 69.64.51.116
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://bultourism.com/js/jquery.textfill.js
Requested by: Host: bultourism.com
URL: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
Protocol: HTTP/1.1
Server: 69.64.51.116 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: vilya.kafence.com
Software: Apache/2 /
Resource Hash: e96bf90e8eb906c08e51be90e00226f66881a6da5afb330fd39b995a7f4abdf2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Tue, 14 Dec 2021 02:04:38 GMT
Content-Encoding: gzip
Last-Modified: Thu, 08 Mar 2018 11:46:26 GMT
Server: Apache/2
ETag: "1c3e085-2641-566e539c95fe8"
Vary: User-Agent,Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=60, max=79
Content-Length: 3068
Expires: Tue, 21 Dec 2021 02:04:38 GMT

GET
H/1.1 200
OK cookieconsent.latest.min.js Show response
bultourism.com/ 4 KB
2 KB 245ms
238ms Script
text/javascript 69.64.51.116
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://bultourism.com/cookieconsent.latest.min.js
Requested by: Host: bultourism.com
URL: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
Protocol: HTTP/1.1
Server: 69.64.51.116 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: vilya.kafence.com
Software: Apache/2 /
Resource Hash: 6b0bca91c1ac0c2a574d02424bab957d02bd19890474d30acf7a17a85b17566d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Tue, 14 Dec 2021 02:04:39 GMT
Content-Encoding: gzip
Last-Modified: Mon, 14 Mar 2016 05:11:08 GMT
Server: Apache/2
ETag: "f5afa1-774-52dfb4ef0d300"
Content-Type: text/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=60, max=80
Content-Length: 1908

GET
H/1.1 200
OK jquery.unveil.js Show response
bultourism.com/ 1 KB
935 B 251ms
244ms Script
text/javascript 69.64.51.116
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://bultourism.com/jquery.unveil.js
Requested by: Host: bultourism.com
URL: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
Protocol: HTTP/1.1
Server: 69.64.51.116 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: vilya.kafence.com
Software: Apache/2 /
Resource Hash: 89a13956be67527dd669a271539cd5a0aaf6ebe90e81dc25156fe002f18cd0f3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Tue, 14 Dec 2021 02:04:39 GMT
Content-Encoding: gzip
Last-Modified: Mon, 14 Mar 2016 05:07:28 GMT
Server: Apache/2
ETag: "f5afab-273-52dfb41d3e400"
Content-Type: text/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=60, max=80
Content-Length: 627

GET lightbox.css
img.us2.bultourism.com/css/ 0
0

GET
H/1.1 200
OK lightbox.min.js Show response
bultourism.com/js/ 8 KB
3 KB 257ms
251ms Script
text/javascript 69.64.51.116
AS-30083-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://bultourism.com/js/lightbox.min.js
Requested by: Host: bultourism.com
URL: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
Protocol: HTTP/1.1
Server: 69.64.51.116 St Louis, United States, ASN30083 (AS-30083-GO-DADDY-COM-LLC, US),
Reverse DNS: vilya.kafence.com
Software: Apache/2 /
Resource Hash: 6c8abd074d9c4f8b738945503c713ca0f39eefd42421b7902cc3b6ac83d954c2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Tue, 14 Dec 2021 02:04:39 GMT
Content-Encoding: gzip
Last-Modified: Sun, 30 Mar 2014 16:45:09 GMT
Server: Apache/2
ETag: "1c3e072-93a-4f5d5a866ef40"
Content-Type: text/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=60, max=80
Content-Length: 2362

GET
H2

200

ga.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/ga.js
https://www.google-analytics.com/ga.js

45 KB
17 KB

32ms
7ms

Script
text/javascript

2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/ga.js

Requested by

Protocol

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 2473
date: Tue, 14 Dec 2021 01:23:21 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Tue, 14 Dec 2021 03:23:21 GMT

Redirect headers

Location: https://www.google-analytics.com/ga.js
Non-Authoritative-Reason: HSTS

GET
DATA 200
OK truncated
/ 26 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.0 200
OK c
counter.search.bg/cgi-bin/ 194 B
539 B 290ms
264ms Image
image/gif 70.59.126.236
CENTURYLINK-US-LE...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://counter.search.bg/cgi-bin/c?_id=btrsm&_z=2&_r=1600&_c=24&_j=N&_t=0&_k=Y&_l=
Requested by: Host: bultourism.com
URL: http://bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0/%D0%9C%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-%D0%A0%D0%B8%D0%BB%D1%81%D0%BA%D0%B8-%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80-0-7474.html
Protocol: HTTP/1.0
Server: 70.59.126.236 Fargo, United States, ASN209 (CENTURYLINK-US-LEGACY-QWEST, US),
Reverse DNS
Software: Apache /
Resource Hash: 53231e1637873ed889b18ff1e4ae5cc1a11824a625182bd3e55c52dea1ecf78c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 14 Dec 2021 02:04:35 GMT
Last-Modified: Monday, 31 Dec 2020 05:00:00 GMT
Server: Apache
Content-Type: image/gif
Cache-Control: no-cache, must-revalidate
Connection: close
Content-Length: 194
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET facebook_share_icon.gif
b.static.ak.fbcdn.net/images/share/ 0
0

GET
H2 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/ 276 KB
100 KB 32ms
31ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2513374550279225&plah=bultourism.com

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00db1163ca6054f2a8496a8613addd64991e27eedc8a136ca3e1f9dc04e894f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 02:04:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 101734
x-xss-protection: 0
server: cafe
etag: 4507154694380913909
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 14 Dec 2021 02:04:34 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211207/r20190131/ Frame FC8C 11 KB
5 KB 36ms
13ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211207/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d853164105815c3ea423a95f095ee531f547ff1e12fba56a80be0f712c62929e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 13 Dec 2021 18:37:20 GMT
expires: Mon, 27 Dec 2021 18:37:20 GMT
content-type: text/html; charset=UTF-8
etag: 17731914101004188133
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4884
x-xss-protection: 0
age: 26834
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2

200

collect
stats.g.doubleclick.net/r/
Redirect Chain

http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1729361182&utmhn=bultourism.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=%D0%9C...
https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1729361182&utmhn=bultourism.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=%D0%9...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-749284-4&cid=117416962.1639447475&jid=635556038&_v=5.7.2&z=1729361182

35 B
430 B

82ms
20ms

Image
image/gif

2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-749284-4&cid=117416962.1639447475&jid=635556038&_v=5.7.2&z=1729361182

Requested by

Protocol

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 14 Dec 2021 02:04:35 GMT
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 14 Dec 2021 02:04:35 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
location: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-749284-4&cid=117416962.1639447475&jid=635556038&_v=5.7.2&z=1729361182
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 367
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 218 B
648 B 55ms
24ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=bultourism.com&callback=_gfp_s_&client=ca-pub-2513374550279225

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2513374550279225&plah=bultourism.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

09fa84e6cf8bf23b47940a5d5dd64cab8df4ec8888caf9251c07747b0ef7c00b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 02:04:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 204
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 54ms
20ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=bultourism.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 14 Dec 2021 02:04:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 75ms
33ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=bultourism.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 14 Dec 2021 02:04:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 403 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B10D 603 B
67 B 66ms
25ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2513374550279225&output=html&adk=1812271804&adf=3025194257&lmt=1639447475&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fbultourism.com%2F%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580%25D0%25B8%2F%25D0%259F%25D0%25B0%25D1%2581%25D1%2582%25D1%2580%25D0%25B0%2F%25D0%259C%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-%25D0%25A0%25D0%25B8%25D0%25BB%25D1%2581%25D0%25BA%25D0%25B8-%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-0-7474.html&ea=0&flash=0&pra=5&wgl=1&dt=1639447474906&bpp=3&bdt=448&idt=91&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1532713821147&frm=20&pv=2&ga_vid=117416962.1639447475&ga_sid=1639447475&ga_hid=1299184952&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3923495919702997&pem=788&tmod=66&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=1&uci=a!1&fsb=1&dtd=115

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 14 Dec 2021 02:04:35 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4C2A 80 KB
30 KB 580ms
555ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1366875918644128&output=html&h=90&slotname=4782041684&adk=643570460&adf=1638469296&pi=t.ma~as.4782041684&w=923&fwrn=4&fwrnh=100&lmt=1639447475&rafmt=2&psa=0&format=923x90&url=http%3A%2F%2Fbultourism.com%2F%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580%25D0%25B8%2F%25D0%259F%25D0%25B0%25D1%2581%25D1%2582%25D1%2580%25D0%25B0%2F%25D0%259C%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-%25D0%25A0%25D0%25B8%25D0%25BB%25D1%2581%25D0%25BA%25D0%25B8-%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-0-7474.html&flash=0&fwr=0&rpe=1&resp_fmts=2&wgl=1&dt=1639447474909&bpp=2&bdt=452&idt=121&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1532713821147&frm=20&pv=2&ga_vid=117416962.1639447475&ga_sid=1639447475&ga_hid=1299184952&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=141&ady=29&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3923495919702997&pem=788&tmod=66&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEe%7Cnp&abl=XS&pfx=0&fu=128&bc=23&ifi=2&uci=a!2&fsb=1&xpc=wqj9da0pLw&p=http%3A//bultourism.com&dtd=128

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5de8471ac24ba5edd169809f2b48c8e9e880d3340cd17a84ea7fd5b19bead479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 14 Dec 2021 02:04:35 GMT
server: cafe
content-length: 30193
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 14 Dec 2021 02:04:35 GMT
cache-control: private

GET
H3 400 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2083 603 B
67 B 41ms
27ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1366875918644128&output=html&h=15&slotname=2072505252&adk=1399546693&adf=316507209&pi=t.ma~as.2072505252&w=468&lmt=1639447475&psa=0&url=http%3A%2F%2Fbultourism.com%2F%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580%25D0%25B8%2F%25D0%259F%25D0%25B0%25D1%2581%25D1%2582%25D1%2580%25D0%25B0%2F%25D0%259C%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-%25D0%25A0%25D0%25B8%25D0%25BB%25D1%2581%25D0%25BA%25D0%25B8-%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-0-7474.html&flash=0&wgl=1&dt=1639447474911&bpp=1&bdt=454&idt=130&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C923x90&nras=1&correlator=1532713821147&frm=20&pv=1&ga_vid=117416962.1639447475&ga_sid=1639447475&ga_hid=1299184952&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=408&ady=669&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3923495919702997&pem=788&tmod=66&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEe%7Cn&abl=XS&pfx=0&fu=0&bc=23&ifi=3&uci=a!3&fsb=1&xpc=bgS8FMlzVS&p=http%3A//bultourism.com&dtd=133

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 14 Dec 2021 02:04:35 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame BD54 101 KB
31 KB 532ms
528ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1366875918644128&output=html&h=280&slotname=9910245285&adk=2401919896&adf=2602987202&pi=t.ma~as.9910245285&w=740&fwrn=4&fwrnh=100&lmt=1639447475&rafmt=1&psa=0&format=740x280&url=http%3A%2F%2Fbultourism.com%2F%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580%25D0%25B8%2F%25D0%259F%25D0%25B0%25D1%2581%25D1%2582%25D1%2580%25D0%25B0%2F%25D0%259C%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-%25D0%25A0%25D0%25B8%25D0%25BB%25D1%2581%25D0%25BA%25D0%25B8-%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-0-7474.html&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&dt=1639447474912&bpp=1&bdt=455&idt=139&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C923x90&prev_slotnames=2072505252&nras=1&correlator=1532713821147&frm=20&pv=1&ga_vid=117416962.1639447475&ga_sid=1639447475&ga_hid=1299184952&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=557&ady=2040&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3923495919702997&pem=788&tmod=66&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEebr%7Cn&abl=XS&pfx=0&fu=128&bc=23&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=H3Q3O8DMna&p=http%3A//bultourism.com&dtd=145

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ad3e7fd578de33d060c15faf9b4b58c492dd241486cdb2ac6aa455677b4421f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://bultourism.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 14 Dec 2021 02:04:35 GMT
server: cafe
content-length: 31756
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 14 Dec 2021 02:04:35 GMT
cache-control: private

GET
H2 200 2042005888378972192
tpc.googlesyndication.com/daca_images/simgad/ Frame BD54 28 KB
28 KB 49ms
20ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/2042005888378972192

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1366875918644128&output=html&h=280&slotname=9910245285&adk=2401919896&adf=2602987202&pi=t.ma~as.9910245285&w=740&fwrn=4&fwrnh=100&lmt=1639447475&rafmt=1&psa=0&format=740x280&url=http%3A%2F%2Fbultourism.com%2F%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580%25D0%25B8%2F%25D0%259F%25D0%25B0%25D1%2581%25D1%2582%25D1%2580%25D0%25B0%2F%25D0%259C%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-%25D0%25A0%25D0%25B8%25D0%25BB%25D1%2581%25D0%25BA%25D0%25B8-%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-0-7474.html&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&dt=1639447474912&bpp=1&bdt=455&idt=139&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C923x90&prev_slotnames=2072505252&nras=1&correlator=1532713821147&frm=20&pv=1&ga_vid=117416962.1639447475&ga_sid=1639447475&ga_hid=1299184952&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=557&ady=2040&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3923495919702997&pem=788&tmod=66&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEebr%7Cn&abl=XS&pfx=0&fu=128&bc=23&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=H3Q3O8DMna&p=http%3A//bultourism.com&dtd=145

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80ee8408166f3bf44a5c62f537bbbd46e5ffa28e2751ea799e643337a06d03a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 11 Dec 2021 03:01:00 GMT
x-content-type-options: nosniff
age: 255815
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28657
x-xss-protection: 0
last-modified: Thu, 10 Jun 2021 15:44:02 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 11 Dec 2022 03:01:00 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame BD54 19 KB
8 KB 36ms
8ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d9955b485ec10339d863941175c02572657bf9d4f6c5fa2e5603e7d803c1b8cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 01:39:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1476
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7876
x-xss-protection: 0
server: cafe
etag: 5333878705136318229
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 28 Dec 2021 01:39:59 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame BD54 0
0 65ms
64ms Fetch
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cvnbcs_u3YbyDBb6DjuwPn8KN8Aavk7mJZ9yCi_XXDc6Snr9EEAEgubP6DWCV-vCBjAegAfDRhewDyAECqQICncC1f-6yPqgDAcgDyQSqBLkDT9Dvbie_b3ttXTBj_6GqwI2h8s5IhECHGCWl6jiFyobXRrWiGLbA2UoalHAx8txXYHO5hKQwHkBxYCBpu4f4ulz5B7yrZpr_KZSB_Ri0Kh8CNFhUaeSVrYTxVz84BG_gydaOylmXD1UFvcztkINnR0cHhM3nyygx9lpQtKHFqL5WRKERMxYPR2h-GM9ACVlMKr746Y9iDj1vw8eDr9mrsmTL8At3ouwDukNwAOmk9E8Ca-4CLzOteS06h7QQ89GfgZNzCeNXiQyIoGlGYeZkElhU4tGeE9WrgsYRrjoN1ZJLQKbP_x324qgHFxWdFLFrpcIxAW3QkeFvA95wUc1u_6l0Qjj88P8vYxpcm7MKuxeMqs285-8CMZIy8hOX9aMdqk4S-c9rEodyDuCGiG30A9LBUK4_3Lg0BRr_kAhseJGDsRKrRwf8i1iXEPacGabXVdReKozmq0hBVxM5KOhFAwKZ7deNBipIhxAG6TuiYkAiYSL6gaH2E3pR8qFsh_465UGLXxa9P_5HS8bkziUFL-ch16bdohSXSvazlyohAjFY0fYyQixt8XwYp6DXvpxARMJHItY-GyaZwASmosLNzAOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGAoAH-K36E6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEOHQENIICQiA4YBwEAEYH4AKAcgLAdgTDdAVAZgWAYAXAbIXHAoaCAASFHB1Yi0xMzY2ODc1OTE4NjQ0MTI4GAA&sigh=QfBVMoNYQsw&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1366875918644128&output=html&h=280&slotname=9910245285&adk=2401919896&adf=2602987202&pi=t.ma~as.9910245285&w=740&fwrn=4&fwrnh=100&lmt=1639447475&rafmt=1&psa=0&format=740x280&url=http%3A%2F%2Fbultourism.com%2F%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580%25D0%25B8%2F%25D0%259F%25D0%25B0%25D1%2581%25D1%2582%25D1%2580%25D0%25B0%2F%25D0%259C%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-%25D0%25A0%25D0%25B8%25D0%25BB%25D1%2581%25D0%25BA%25D0%25B8-%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-0-7474.html&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&dt=1639447474912&bpp=1&bdt=455&idt=139&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C923x90&prev_slotnames=2072505252&nras=1&correlator=1532713821147&frm=20&pv=1&ga_vid=117416962.1639447475&ga_sid=1639447475&ga_hid=1299184952&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=557&ady=2040&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3923495919702997&pem=788&tmod=66&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEebr%7Cn&abl=XS&pfx=0&fu=128&bc=23&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=H3Q3O8DMna&p=http%3A//bultourism.com&dtd=145
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 14 Dec 2021 02:04:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 14 Dec 2021 02:04:35 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame BD54 2 KB
1 KB 32ms
11ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 01:37:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1604
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 28 Dec 2021 01:37:51 GMT

GET
H2 200 transparent.png
tpc.googlesyndication.com/pagead/images/ Frame BD54 67 B
196 B 23ms
11ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/transparent.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 13 Dec 2021 05:32:01 GMT
x-content-type-options: nosniff
server: cafe
age: 73954
etag: 2462972746714251406
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67
x-xss-protection: 0
expires: Tue, 14 Dec 2021 05:32:01 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame BD54 119 KB
37 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 02:04:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 14 Dec 2021 02:04:35 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame BD54 15 KB
6 KB 21ms
9ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ffb89f1f1fa54e822805cddf1f6ec0492cd8b806b36a921eda855241d1eee914

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 01:46:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1069
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6464
x-xss-protection: 0
server: cafe
etag: 15715955993838318253
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 28 Dec 2021 01:46:46 GMT

GET
H2 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame BD54 27 KB
11 KB 23ms
11ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2cc36b7e19b912c6d09739d2c3edbbb05a272be96736ae9fb0b0a70c2a331d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 16:23:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34867
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11415
x-xss-protection: 0
server: cafe
etag: 3382072337847676073
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 27 Dec 2021 16:23:28 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E073 143 B
163 B 23ms
23ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1366875918644128&output=html&h=280&slotname=9910245285&adk=2401919896&adf=2602987202&pi=t.ma~as.9910245285&w=740&fwrn=4&fwrnh=100&lmt=1639447475&rafmt=1&psa=0&format=740x280&url=http%3A%2F%2Fbultourism.com%2F%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580%25D0%25B8%2F%25D0%259F%25D0%25B0%25D1%2581%25D1%2582%25D1%2580%25D0%25B0%2F%25D0%259C%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-%25D0%25A0%25D0%25B8%25D0%25BB%25D1%2581%25D0%25BA%25D0%25B8-%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-0-7474.html&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&dt=1639447474912&bpp=1&bdt=455&idt=139&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C923x90&prev_slotnames=2072505252&nras=1&correlator=1532713821147&frm=20&pv=1&ga_vid=117416962.1639447475&ga_sid=1639447475&ga_hid=1299184952&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=557&ady=2040&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3923495919702997&pem=788&tmod=66&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEebr%7Cn&abl=XS&pfx=0&fu=128&bc=23&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=H3Q3O8DMna&p=http%3A//bultourism.com&dtd=145

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 14 Dec 2021 02:02:20 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 135
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 4080593668177658951
tpc.googlesyndication.com/simgad/ Frame 4C2A 50 KB
50 KB 39ms
18ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4080593668177658951?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qm1syAljcExmjz0RO7ED_Qz42CRbA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1366875918644128&output=html&h=90&slotname=4782041684&adk=643570460&adf=1638469296&pi=t.ma~as.4782041684&w=923&fwrn=4&fwrnh=100&lmt=1639447475&rafmt=2&psa=0&format=923x90&url=http%3A%2F%2Fbultourism.com%2F%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580%25D0%25B8%2F%25D0%259F%25D0%25B0%25D1%2581%25D1%2582%25D1%2580%25D0%25B0%2F%25D0%259C%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-%25D0%25A0%25D0%25B8%25D0%25BB%25D1%2581%25D0%25BA%25D0%25B8-%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-0-7474.html&flash=0&fwr=0&rpe=1&resp_fmts=2&wgl=1&dt=1639447474909&bpp=2&bdt=452&idt=121&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1532713821147&frm=20&pv=2&ga_vid=117416962.1639447475&ga_sid=1639447475&ga_hid=1299184952&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=141&ady=29&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3923495919702997&pem=788&tmod=66&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEe%7Cnp&abl=XS&pfx=0&fu=128&bc=23&ifi=2&uci=a!2&fsb=1&xpc=wqj9da0pLw&p=http%3A//bultourism.com&dtd=128

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f0976ee3bb1b02f1be0270288179969f55b84ed19563f08b02d6b3064ee9cb7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 16:31:56 GMT
x-content-type-options: nosniff
age: 466359
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50759
x-xss-protection: 0
last-modified: Tue, 31 Aug 2021 21:01:18 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 08 Dec 2022 16:31:56 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame 4C2A 19 KB
8 KB 34ms
17ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d9955b485ec10339d863941175c02572657bf9d4f6c5fa2e5603e7d803c1b8cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 01:39:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1476
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7876
x-xss-protection: 0
server: cafe
etag: 5333878705136318229
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 28 Dec 2021 01:39:59 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 4C2A 2 KB
1 KB 34ms
17ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 01:37:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1604
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 28 Dec 2021 01:37:51 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4C2A 119 KB
36 KB 20ms
17ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 02:04:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37305
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1638461285297402"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 14 Dec 2021 02:04:35 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 4C2A 15 KB
6 KB 33ms
17ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ffb89f1f1fa54e822805cddf1f6ec0492cd8b806b36a921eda855241d1eee914

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 01:46:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1069
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6464
x-xss-protection: 0
server: cafe
etag: 15715955993838318253
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 28 Dec 2021 01:46:46 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4C2A 0
0 52ms
50ms Fetch
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C1XWOs_u3YYfkBMyDjuwPy_SjsAjRx_ndZYuS8fW7Ds3B0NKKKRABILmz-g1glfrwgYwHoAGUx5u9A8gBAqgDAcgDyQSqBLkDT9D-RZKgSt32nRtk5nAH_OfpYK8zAtWencMuHYIkTTB7Tv1QH-PJVnG3L4_VKMTp8PpjB3teYDDQm8e66tzN9N6GL1GuO_CoW2bwbTSnr-2O2hXBL4h0hpg9Gk5Oo_ZijhRSSi7bwRgWYti_3Yz9wLhO__AD1RsSwypV18gXGNg-f6M4tVVMKdRqCnATT8zu_WNNEbn09reK2uBtNPqt76Jfv-DfgMq2bm0kzTQscEQBsnFY9utuvATvESXYAnInsUrdOY1UxEXM77L75UN6d2MHJUDsEvLVh36UUl40oLcrrRPwnHqE3t-CzU6Qt2OmVgkpsPBH20O4ohoFj0Trtsh-gAyt5Fyfkh5kgtg5qPs3dNjH_0wuvhCSIJbqqw9KOKiH3fhJ7bMwW1cG1XZ6Si5qvban939RCZlFNLa15S7bQO_Vy0ROkZ1DEHdzXS2kGC_ykxVt0CxHrRnSq5y74lBTz33VgBucmZaIR01DxH_qzzbtXFpuU1KGzBVFy9Zt5dX9BsO4rmTtxOF4PEtf3RlnMARkwXEL2Zu0Htc6qYrZkU5GIlZpup5wb52twWOXb7FIkqtVO9oNwASNl5Tw1wOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGAoAHnbvjugKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBDB1gjSCAkIgOGAcBABGB-ACgHICwHYEw3QFQGAFwGyFxwKGggAEhRwdWItMTM2Njg3NTkxODY0NDEyOBgA&sigh=T2wV0wk5IW4&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1366875918644128&output=html&h=90&slotname=4782041684&adk=643570460&adf=1638469296&pi=t.ma~as.4782041684&w=923&fwrn=4&fwrnh=100&lmt=1639447475&rafmt=2&psa=0&format=923x90&url=http%3A%2F%2Fbultourism.com%2F%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580%25D0%25B8%2F%25D0%259F%25D0%25B0%25D1%2581%25D1%2582%25D1%2580%25D0%25B0%2F%25D0%259C%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-%25D0%25A0%25D0%25B8%25D0%25BB%25D1%2581%25D0%25BA%25D0%25B8-%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-0-7474.html&flash=0&fwr=0&rpe=1&resp_fmts=2&wgl=1&dt=1639447474909&bpp=2&bdt=452&idt=121&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1532713821147&frm=20&pv=2&ga_vid=117416962.1639447475&ga_sid=1639447475&ga_hid=1299184952&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=141&ady=29&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3923495919702997&pem=788&tmod=66&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEe%7Cnp&abl=XS&pfx=0&fu=128&bc=23&ifi=2&uci=a!2&fsb=1&xpc=wqj9da0pLw&p=http%3A//bultourism.com&dtd=128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 14 Dec 2021 02:04:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame BD54 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 454cb8ef60e34dfb79c4632b96b3da005a1334923b602327ed31d787ed2e0966

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 4C2A 27 KB
11 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2cc36b7e19b912c6d09739d2c3edbbb05a272be96736ae9fb0b0a70c2a331d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 16:23:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34867
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11415
x-xss-protection: 0
server: cafe
etag: 3382072337847676073
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 27 Dec 2021 16:23:28 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 7522 143 B
163 B 8ms
6ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1366875918644128&output=html&h=90&slotname=4782041684&adk=643570460&adf=1638469296&pi=t.ma~as.4782041684&w=923&fwrn=4&fwrnh=100&lmt=1639447475&rafmt=2&psa=0&format=923x90&url=http%3A%2F%2Fbultourism.com%2F%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580%25D0%25B8%2F%25D0%259F%25D0%25B0%25D1%2581%25D1%2582%25D1%2580%25D0%25B0%2F%25D0%259C%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-%25D0%25A0%25D0%25B8%25D0%25BB%25D1%2581%25D0%25BA%25D0%25B8-%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-0-7474.html&flash=0&fwr=0&rpe=1&resp_fmts=2&wgl=1&dt=1639447474909&bpp=2&bdt=452&idt=121&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=1532713821147&frm=20&pv=2&ga_vid=117416962.1639447475&ga_sid=1639447475&ga_hid=1299184952&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=141&ady=29&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3923495919702997&pem=788&tmod=66&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEe%7Cnp&abl=XS&pfx=0&fu=128&bc=23&ifi=2&uci=a!2&fsb=1&xpc=wqj9da0pLw&p=http%3A//bultourism.com&dtd=128

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 14 Dec 2021 02:02:20 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 135
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 redir.html Show response
p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 7C3F 247 B
964 B 55ms
15ms Document
text/html 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

fe3aa0b558d063a93f2beab5e7eed74f6c64c5e1f76a54de4f7627c36c7a8ddd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-VQrRw6oBCjW5wVvXE9I8fw' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 205
date: Tue, 14 Dec 2021 02:04:35 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Mon, 02 Dec 2019 20:15:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E073
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

27ms
26ms

Document
text/html

2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 14 Dec 2021 02:04:35 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 14 Dec 2021 02:04:35 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 14 Dec 2021 02:04:35 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 4C2A 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b518600e612a81086bf7236739e7155cc38e8a25c0318e4f83b88d422373af26

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 U_DPXy_vflqTjVU_YutWJm0axOJE633NQGMGFEhf2s0.js Show response
pagead2.googlesyndication.com/bg/ Frame 4E1A 35 KB
13 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/U_DPXy_vflqTjVU_YutWJm0axOJE633NQGMGFEhf2s0.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

53f0cf5f2fef7e5a938d553f62eb56266d1ac4e244eb7dcd40630614485fdacd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sun, 12 Dec 2021 23:33:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 95483
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13577
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 12 Dec 2022 23:33:12 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 7522
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

37ms
36ms

Document
text/html

2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 14 Dec 2021 02:04:35 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 14 Dec 2021 02:04:35 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 14 Dec 2021 02:04:35 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 iframe.html Show response
p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 7C3F 4 KB
2 KB 31ms
15ms Document
text/html 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html

Requested by

Host: p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-if-v6exp3-v4.metric.gstatic.com
URL: https://p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

028f053e66e706b65600d53e2628417ebf064dbd8e45928cb719f36200c5fde4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-l_6XEpCOcM0IxADLP1C_Xg' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 1862
date: Tue, 14 Dec 2021 02:04:35 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Thu, 29 Apr 2021 21:38:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 U_DPXy_vflqTjVU_YutWJm0axOJE633NQGMGFEhf2s0.js Show response
pagead2.googlesyndication.com/bg/ Frame 399A 35 KB
13 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/U_DPXy_vflqTjVU_YutWJm0axOJE633NQGMGFEhf2s0.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

53f0cf5f2fef7e5a938d553f62eb56266d1ac4e244eb7dcd40630614485fdacd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sun, 12 Dec 2021 23:33:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 95483
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13577
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 19:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 12 Dec 2022 23:33:12 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4C2A 42 B
64 B 57ms
42ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvL3nP516VulX6b65XmgBOrFneICTPzKEvW6v0w6819daZfg7hC_freeLoSTsn4BqwhHEJDx8O11usVynHS-izIOO2dDUoq53Gq20cIOWGJ4ppwPYFW2g&sai=AMfl-YTXsr0T5EK4TVeEbEm-VmMA9YEbiA09wAfgQx1yoXHQnnofchLYPW9Q28-ppDQaO3BanmNCBDuSLaCT&sig=Cg0ArKJSzL1GLZ-CwdxpEAE&id=lidar2&mcvt=1000&p=0,98,90,826&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211202&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=4&adk=643570460&rs=2&la=0&cr=0&vs=4&r=v&rst=1639447475038&rpt=731&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Dec 2021 02:04:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 6.gif
p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-253745-i1-v6exp3.v4.metric.gstatic.com/v6exp3/ Frame 7C3F 35 B
583 B 68ms
16ms Image
image/gif 142.250.185.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-253745-i1-v6exp3.v4.metric.gstatic.com/v6exp3/6.gif

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.82 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f18.1e100.net

Software

sffe /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-if-v6exp3-v4.metric.gstatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Dec 2021 02:04:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 6.gif
p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-253745-i2-v6exp3.ds.metric.gstatic.com/v6exp3/ Frame 7C3F 35 B
583 B 78ms
16ms Image
image/gif 2a00:1450:4001:801::2012
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-253745-i2-v6exp3.ds.metric.gstatic.com/v6exp3/6.gif

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2012 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-if-v6exp3-v4.metric.gstatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Dec 2021 02:04:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET 1_small.jpg
img.us2.bultourism.com/pictures/7474/pix/ 0
0

GET 2_small.jpg
img.us2.bultourism.com/pictures/7474/pix/ 0
0

GET 3_small.jpg
img.us2.bultourism.com/pictures/7474/pix/ 0
0

GET 4_small.jpg
img.us2.bultourism.com/pictures/7474/pix/ 0
0

GET 5_small.jpg
img.us2.bultourism.com/pictures/7474/pix/ 0
0

GET 6_small.jpg
img.us2.bultourism.com/pictures/7474/pix/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: img.us2.bultourism.com
URL: http://img.us2.bultourism.com/pictures/7474/7474_main.jpg

Domain: img.us2.bultourism.com
URL: http://img.us2.bultourism.com/css/lightbox.css

Domain: b.static.ak.fbcdn.net
URL: https://b.static.ak.fbcdn.net/images/share/facebook_share_icon.gif?8:26981

Domain: img.us2.bultourism.com
URL: http://img.us2.bultourism.com/pictures/7474/pix/1_small.jpg

Domain: img.us2.bultourism.com
URL: http://img.us2.bultourism.com/pictures/7474/pix/2_small.jpg

Domain: img.us2.bultourism.com
URL: http://img.us2.bultourism.com/pictures/7474/pix/3_small.jpg

Domain: img.us2.bultourism.com
URL: http://img.us2.bultourism.com/pictures/7474/pix/4_small.jpg

Domain: img.us2.bultourism.com
URL: http://img.us2.bultourism.com/pictures/7474/pix/5_small.jpg

Domain: img.us2.bultourism.com
URL: http://img.us2.bultourism.com/pictures/7474/pix/6_small.jpg

Verdicts & Comments Add Verdict or Comment

55 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
bultourism.com/%D0%BC%D0%B0%D0%BD%D0%B0%D1%81%D1%82%D0%B8%D1%80%D0%B8/%D0%9F%D0%B0%D1%81%D1%82%D1%80%D0%B0	1969-12-31 23:59:59	Name: _c Value: y
bultourism.com/	1970-01-19 23:24:08	Name: keywords Value:
.bultourism.com/	1970-01-20 16:55:19	Name: __utma Value: 164549804.117416962.1639447475.1639447475.1639447475.1
.bultourism.com/	1969-12-31 23:59:59	Name: __utmc Value: 164549804
.bultourism.com/	1970-01-20 03:46:55	Name: __utmz Value: 164549804.1639447475.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.bultourism.com/	1970-01-19 23:24:08	Name: __utmt Value: 1
.bultourism.com/	1970-01-19 23:24:09	Name: __utmb Value: 164549804.1.10.1639447475
.bultourism.com/	1970-01-20 08:45:43	Name: __gads Value: ID=ea5986c87481249b-229d270e07cd00ed:T=1639447475:RT=1639447475:S=ALNI_MaAX0_EuJqCneyHBuCMqIO4PbSIkg
.doubleclick.net/	1970-01-20 08:45:43	Name: IDE Value: AHWqTUkU6MrQ4AHwruGuvzemjRLkjVLcJ-wKXF7goklpBkcwhWyIVhHniPedigG2Lto
.doubleclick.net/	1970-01-19 23:24:11	Name: DSID Value: NO_DATA

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://b.static.ak.fbcdn.net/images/share/facebook_share_icon.gif?8:26981 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2513374550279225&output=html&adk=1812271804&adf=3025194257&lmt=1639447475&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fbultourism.com%2F%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580%25D0%25B8%2F%25D0%259F%25D0%25B0%25D1%2581%25D1%2582%25D1%2580%25D0%25B0%2F%25D0%259C%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-%25D0%25A0%25D0%25B8%25D0%25BB%25D1%2581%25D0%25BA%25D0%25B8-%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-0-7474.html&ea=0&flash=0&pra=5&wgl=1&dt=1639447474906&bpp=3&bdt=448&idt=91&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1532713821147&frm=20&pv=2&ga_vid=117416962.1639447475&ga_sid=1639447475&ga_hid=1299184952&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3923495919702997&pem=788&tmod=66&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=1&uci=a!1&fsb=1&dtd=115 Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1366875918644128&output=html&h=15&slotname=2072505252&adk=1399546693&adf=316507209&pi=t.ma~as.2072505252&w=468&lmt=1639447475&psa=0&url=http%3A%2F%2Fbultourism.com%2F%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580%25D0%25B8%2F%25D0%259F%25D0%25B0%25D1%2581%25D1%2582%25D1%2580%25D0%25B0%2F%25D0%259C%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-%25D0%25A0%25D0%25B8%25D0%25BB%25D1%2581%25D0%25BA%25D0%25B8-%25D0%25BC%25D0%25B0%25D0%25BD%25D0%25B0%25D1%2581%25D1%2582%25D0%25B8%25D1%2580-0-7474.html&flash=0&wgl=1&dt=1639447474911&bpp=1&bdt=454&idt=130&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C923x90&nras=1&correlator=1532713821147&frm=20&pv=1&ga_vid=117416962.1639447475&ga_sid=1639447475&ga_hid=1299184952&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=408&ady=669&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3923495919702997&pem=788&tmod=66&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEe%7Cn&abl=XS&pfx=0&fu=0&bc=23&ifi=3&uci=a!3&fsb=1&xpc=bgS8FMlzVS&p=http%3A//bultourism.com&dtd=133 Message: Failed to load resource: the server responded with a status of 400 ()
network	error	URL: http://img.us2.bultourism.com/pictures/7474/7474_main.jpg Message: Failed to load resource: net::ERR_CONNECTION_RESET
network	error	URL: http://img.us2.bultourism.com/css/lightbox.css Message: Failed to load resource: net::ERR_CONNECTION_RESET

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
ajax.googleapis.com
b.static.ak.fbcdn.net
bultourism.com
counter.search.bg
googleads.g.doubleclick.net
img.us2.bultourism.com
p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-253745-i1-v6exp3.v4.metric.gstatic.com
p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-253745-i2-v6exp3.ds.metric.gstatic.com
p4-cs5jevpw2cs4k-24k2e7humrlfqa2w-if-v6exp3-v4.metric.gstatic.com
pagead2.googlesyndication.com
partner.googleadservices.com
stats.g.doubleclick.net
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.googletagservices.com
b.static.ak.fbcdn.net
img.us2.bultourism.com
142.250.184.227
142.250.185.66
142.250.185.82
2a00:1450:4001:801::2004
2a00:1450:4001:801::2012
2a00:1450:4001:803::2002
2a00:1450:4001:80f::2002
2a00:1450:4001:810::2002
2a00:1450:4001:813::2002
2a00:1450:4001:813::200a
2a00:1450:4001:82f::2001
2a00:1450:4001:82f::200e
2a00:1450:400c:c0c::9b
69.64.51.116
70.59.126.236
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
00db1163ca6054f2a8496a8613addd64991e27eedc8a136ca3e1f9dc04e894f8
028f053e66e706b65600d53e2628417ebf064dbd8e45928cb719f36200c5fde4
0949fcf9acd60c6cb4e59ca30a2aae56d7c7f12ee45386dce0a8cb0cf37e6737
09fa84e6cf8bf23b47940a5d5dd64cab8df4ec8888caf9251c07747b0ef7c00b
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
23316b3ca68aed8b195c37949b807ce7e21192c1a0bf7e9d5c273f0aaad172ab
29faaa7d39edcba28dd6253f6dbe2637931e6a758bc59601747718ab4990a465
2cc36b7e19b912c6d09739d2c3edbbb05a272be96736ae9fb0b0a70c2a331d48
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3f90c1f2ddff44509c13c19150f9f9ca3b39e8c88f95f0d2b68ed9cef21f0ab5
454cb8ef60e34dfb79c4632b96b3da005a1334923b602327ed31d787ed2e0966
4f0976ee3bb1b02f1be0270288179969f55b84ed19563f08b02d6b3064ee9cb7
500ee9963630dac458fbf05c87bb3ec924e25481a4974163ab22c208899b01e7
53231e1637873ed889b18ff1e4ae5cc1a11824a625182bd3e55c52dea1ecf78c
53f0cf5f2fef7e5a938d553f62eb56266d1ac4e244eb7dcd40630614485fdacd
5de8471ac24ba5edd169809f2b48c8e9e880d3340cd17a84ea7fd5b19bead479
66671616f880ade1bee6a9afbced9011f1fe1b179ff9860766f700825e8bc9ae
6b0bca91c1ac0c2a574d02424bab957d02bd19890474d30acf7a17a85b17566d
6c8abd074d9c4f8b738945503c713ca0f39eefd42421b7902cc3b6ac83d954c2
80ee8408166f3bf44a5c62f537bbbd46e5ffa28e2751ea799e643337a06d03a2
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48
89a13956be67527dd669a271539cd5a0aaf6ebe90e81dc25156fe002f18cd0f3
98a1a73b3955af8bca553440fd751c80f6007bed3294803d935bd6c4597c50e6
9f8d9c9035014e10335fc19170efa4e3cffa9967e83ae3eef6389e75b2a2ea0d
a3dd8543865b42e183cbb20fcb9a4606868a3a9cc805ae4b6bd67884e9465986
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
ad3e7fd578de33d060c15faf9b4b58c492dd241486cdb2ac6aa455677b4421f1
b518600e612a81086bf7236739e7155cc38e8a25c0318e4f83b88d422373af26
bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
d302fe121caf68995981332fa772943329f87c0d6077d86d4ca5d317e3df830d
d853164105815c3ea423a95f095ee531f547ff1e12fba56a80be0f712c62929e
d9955b485ec10339d863941175c02572657bf9d4f6c5fa2e5603e7d803c1b8cf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e96bf90e8eb906c08e51be90e00226f66881a6da5afb330fd39b995a7f4abdf2
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fe3aa0b558d063a93f2beab5e7eed74f6c64c5e1f76a54de4f7627c36c7a8ddd
ffb89f1f1fa54e822805cddf1f6ec0492cd8b806b36a921eda855241d1eee914

bultourism.com Open in urlscan Pro 69.64.51.116 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

62 Requests

63 %HTTPS

67 %IPv6

12 Domains

18 Subdomains

15 IPs

3 Countries

626 kBTransfer

1692 kBSize

10 Cookies

10 Outgoing links

Redirected requests

62 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

bultourism.com Open in urlscan Pro
69.64.51.116 Public Scan

Screenshot
Live screenshot

Full Image

62
Requests

63 %
HTTPS

67 %
IPv6

12
Domains

18
Subdomains

15
IPs

3
Countries

626 kB
Transfer

1692 kB
Size

10
Cookies

62 HTTP transactions
3 data transactions