geocult.ru Open in urlscan Pro
185.182.111.117 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://geocult.ru/
Effective URL:
https://geocult.ru/
Submission: On December 09 via api (December 9th 2023, 9:40:52 am UTC) from US — Scanned from DE

Summary HTTP 306 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 47 IPs in 12 countries across 38 domains to perform 306 HTTP transactions. The main IP is 185.182.111.117, located in Russian Federation and belongs to AS-REG, RU. The main domain is geocult.ru.
TLS certificate: Issued by AlphaSSL CA - SHA256 - G4 on June 24th 2023. Valid for: a year.

This is the only time geocult.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 67	185.182.111.117 185.182.111.117	197695 (AS-REG) (AS-REG)
3 64	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
1 2	88.212.202.52 88.212.202.52	39134 (UNITEDNET) (UNITEDNET)
2	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
2 5	2a00:1450:400... 2a00:1450:4001:829::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
39	2a00:1450:400... 2a00:1450:4001:81c::2001	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
10 22	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
3 7	104.18.36.155 104.18.36.155	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 5	185.89.210.212 185.89.210.212	29990 (ASN-APPNEX) (ASN-APPNEX)
6	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
3	142.250.181.230 142.250.181.230	15169 (GOOGLE) (GOOGLE)
4	138.201.63.117 138.201.63.117	24940 (HETZNER-AS) (HETZNER-AS)
1 4	176.9.26.250 176.9.26.250	24940 (HETZNER-AS) (HETZNER-AS)
4	91.121.248.44 91.121.248.44	16276 (OVH) (OVH)
1	2a0b:4d07:102::1 2a0b:4d07:102::1	44239 (PROINITY ...) (PROINITY PROINITY)
1	13.42.211.181 13.42.211.181	16509 (AMAZON-02) (AMAZON-02)
1 2	216.58.206.38 216.58.206.38	15169 (GOOGLE) (GOOGLE)
1	108.157.4.50 108.157.4.50	16509 (AMAZON-02) (AMAZON-02)
1	18.154.63.19 18.154.63.19	16509 (AMAZON-02) (AMAZON-02)
1 2	99.81.155.134 99.81.155.134	16509 (AMAZON-02) (AMAZON-02)
26	2a00:1450:400... 2a00:1450:4001:808::2006	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
2	2600:9000:243... 2600:9000:243d:0:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
5	2600:1f13:800... 2600:1f13:800:7780:f920:6a9b:b4b:339a	16509 (AMAZON-02) (AMAZON-02)
2	172.217.16.194 172.217.16.194	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	35.176.121.206 35.176.121.206	16509 (AMAZON-02) (AMAZON-02)
2 4	2001:678:cb4:... 2001:678:cb4:bbbb::11	56396 (AMOBEE) (AMOBEE)
1 2	2620:116:800d... 2620:116:800d:21:ef75:8280:f209:5ba1	16509 (AMAZON-02) (AMAZON-02)
1 2	2606:4700::68... 2606:4700::6812:18ad	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	35.204.74.118 35.204.74.118	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	52.28.16.80 52.28.16.80	16509 (AMAZON-02) (AMAZON-02)
1	34.160.236.64 34.160.236.64	15169 (GOOGLE) (GOOGLE)
2 2	37.157.5.84 37.157.5.84	198622 (ADFORM) (ADFORM)
2	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
2	2.19.217.101 2.19.217.101	16625 (AKAMAI-AS) (AKAMAI-AS)
1	85.14.248.71 85.14.248.71	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
2 2	52.29.13.21 52.29.13.21	16509 (AMAZON-02) (AMAZON-02)
1 1	35.190.0.66 35.190.0.66	15169 (GOOGLE) (GOOGLE)
1 1	2a05:d018:d29... 2a05:d018:d29:3601:357b:9971:3f66:201	16509 (AMAZON-02) (AMAZON-02)
1	178.250.1.9 178.250.1.9	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 1	51.38.120.206 51.38.120.206	16276 (OVH) (OVH)
306	47

67 185.182.111.117 (Russian Federation) 1 redirects

ASN197695 (AS-REG, RU)
PTR: geocult.ru

geocult.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

64 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

translate.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

translate.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.212.202.52 (Russian Federation) 1 redirects

ASN39134 (UNITEDNET, RU)
PTR: host152.rax.ru

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:829::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 2a00:1450:4001:81c::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 142.250.181.226 (United States) 10 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.18.36.155 (None, ) 3 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.89.210.212 (Frankfurt am Main, Germany) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.181.230 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.63.117 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.117.63.201.138.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 176.9.26.250 (Berlin, Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.250.26.9.176.clients.your-server.de

hal900014.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 91.121.248.44 (France)

ASN16276 (OVH, FR)
PTR: ip44.ip-91-121-248.eu

pv.medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a0b:4d07:102::1 (Switzerland)

ASN44239 (PROINITY PROINITY, CH)

adv.office-partner.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.42.211.181 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-42-211-181.eu-west-2.compute.amazonaws.com

track.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.206.38 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: mil07s07-in-f6.1e100.net

5994599.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.157.4.50 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-4-50.dus51.r.cloudfront.net

analytics.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.154.63.19 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-154-63-19.dus51.r.cloudfront.net

cdn.track.production.webgains.team	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.81.155.134 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-99-81-155-134.eu-west-1.compute.amazonaws.com

fw.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 2a00:1450:4001:808::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:243d:0:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:1f13:800:7780:f920:6a9b:b4b:339a (Boardman, United States)

ASN16509 (AMAZON-02, US)

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f194.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.176.121.206 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-176-121-206.eu-west-2.compute.amazonaws.com

api.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2001:678:cb4:bbbb::11 (United Kingdom) 2 redirects

ASN56396 (AMOBEE, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:ef75:8280:f209:5ba1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:18ad (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.204.74.118 (Groningen, Netherlands) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 118.74.204.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.28.16.80 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-16-80.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.160.236.64 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 64.236.160.34.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.5.84 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.19.217.101 (Prague, Czech Republic)

ASN16625 (AKAMAI-AS, US)
PTR: a2-19-217-101.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.14.248.71 (Neukirchen-Vluyn, Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)

m.exactag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.29.13.21 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-29-13-21.eu-central-1.compute.amazonaws.com

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.0.66 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 66.0.190.35.bc.googleusercontent.com

ads.travelaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d018:d29:3601:357b:9971:3f66:201 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.1.9 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.38.120.206 (Hessen, Germany) 1 redirects

ASN16276 (OVH, FR)
PTR: ip206.ip-51-38-120.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
83	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 102 tpc.googlesyndication.com — Cisco Umbrella Rank: 148	1 MB
67	geocult.ru 1 redirects geocult.ru	263 KB
51	doubleclick.net 14 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 stats.g.doubleclick.net — Cisco Umbrella Rank: 75 cm.g.doubleclick.net — Cisco Umbrella Rank: 219 ad.doubleclick.net — Cisco Umbrella Rank: 139 5994599.fls.doubleclick.net — Cisco Umbrella Rank: 98422 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 515	272 KB
26	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 300	556 KB
18	gstatic.com www.gstatic.com fonts.gstatic.com	246 KB
9	adsafeprotected.com 1 redirects fw.adsafeprotected.com — Cisco Umbrella Rank: 900 static.adsafeprotected.com — Cisco Umbrella Rank: 602 dt.adsafeprotected.com — Cisco Umbrella Rank: 567	102 KB
8	redintelligence.net 1 redirects hal9000.redintelligence.net — Cisco Umbrella Rank: 37721 hal900014.redintelligence.net — Cisco Umbrella Rank: 199926	58 KB
8	google.com 2 redirects translate.google.com — Cisco Umbrella Rank: 1298 www.google.com — Cisco Umbrella Rank: 2 region1.analytics.google.com — Cisco Umbrella Rank: 2693 adservice.google.com — Cisco Umbrella Rank: 93	33 KB
7	casalemedia.com 3 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 578	5 KB
6	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 138
6	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 206	383 KB
5	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 229	4 KB
4	turn.com 2 redirects ad.turn.com — Cisco Umbrella Rank: 773 r.turn.com — Cisco Umbrella Rank: 3570	2 KB
4	medialead.de pv.medialead.de — Cisco Umbrella Rank: 47317	1 KB
4	googleapis.com translate.googleapis.com — Cisco Umbrella Rank: 947 fonts.googleapis.com — Cisco Umbrella Rank: 29	259 KB
3	webgains.io analytics.webgains.io — Cisco Umbrella Rank: 24395 api.webgains.io — Cisco Umbrella Rank: 59842	19 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 36	236 KB
2	w55c.net 2 redirects pm.w55c.net — Cisco Umbrella Rank: 818	2 KB
2	teads.tv sync.teads.tv — Cisco Umbrella Rank: 1299	326 B
2	openx.net us-u.openx.net — Cisco Umbrella Rank: 491	400 B
2	adform.net 2 redirects c1.adform.net — Cisco Umbrella Rank: 560	1 KB
2	tribalfusion.com 1 redirects a.tribalfusion.com — Cisco Umbrella Rank: 802 s.tribalfusion.com — Cisco Umbrella Rank: 2218	1 KB
2	quantserve.com 1 redirects cms.quantserve.com — Cisco Umbrella Rank: 749	843 B
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 204	29 KB
2	google.de www.google.de — Cisco Umbrella Rank: 6765	515 B
2	yadro.ru 1 redirects counter.yadro.ru — Cisco Umbrella Rank: 12199	1 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	21 KB
1	onetag-sys.com 1 redirects onetag-sys.com — Cisco Umbrella Rank: 714	444 B
1	criteo.com dis.criteo.com — Cisco Umbrella Rank: 550	363 B
1	yahoo.com 1 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 474	760 B
1	travelaudience.com 1 redirects ads.travelaudience.com — Cisco Umbrella Rank: 5555	600 B
1	exactag.com m.exactag.com — Cisco Umbrella Rank: 11353	60 B
1	mookie1.com odr.mookie1.com — Cisco Umbrella Rank: 1226	204 B
1	agkn.com 1 redirects d.agkn.com — Cisco Umbrella Rank: 686	787 B
1	simpli.fi 1 redirects um.simpli.fi — Cisco Umbrella Rank: 780	760 B
1	webgains.team cdn.track.production.webgains.team — Cisco Umbrella Rank: 61264	3 KB
1	webgains.com track.webgains.com — Cisco Umbrella Rank: 49821	2 KB
1	office-partner.de adv.office-partner.de — Cisco Umbrella Rank: 128498	923 B
306	38

	Domain	Requested by
67	geocult.ru	1 redirects geocult.ru
44	pagead2.googlesyndication.com	geocult.ru pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com s0.2mdn.net www.googletagservices.com
39	tpc.googlesyndication.com	googleads.g.doubleclick.net tpc.googlesyndication.com geocult.ru www.gstatic.com pagead2.googlesyndication.com s0.2mdn.net
26	s0.2mdn.net	geocult.ru s0.2mdn.net tpc.googlesyndication.com
22	cm.g.doubleclick.net	10 redirects googleads.g.doubleclick.net geocult.ru
20	googleads.g.doubleclick.net	3 redirects pagead2.googlesyndication.com googleads.g.doubleclick.net geocult.ru
11	www.gstatic.com	geocult.ru www.gstatic.com googleads.g.doubleclick.net
7	dsum-sec.casalemedia.com	3 redirects googleads.g.doubleclick.net
7	fonts.gstatic.com	geocult.ru fonts.googleapis.com
6	www.googleadservices.com	geocult.ru
6	www.googletagservices.com	googleads.g.doubleclick.net geocult.ru
5	dt.adsafeprotected.com	googleads.g.doubleclick.net geocult.ru
5	ib.adnxs.com	3 redirects googleads.g.doubleclick.net
5	www.google.com	2 redirects geocult.ru googleads.g.doubleclick.net tpc.googlesyndication.com
4	pv.medialead.de	hal900014.redintelligence.net
4	hal900014.redintelligence.net	1 redirects googleads.g.doubleclick.net hal900014.redintelligence.net
4	hal9000.redintelligence.net	googleads.g.doubleclick.net hal900014.redintelligence.net
3	ad.doubleclick.net	googleads.g.doubleclick.net geocult.ru
3	fonts.googleapis.com	googleads.g.doubleclick.net hal900014.redintelligence.net
3	www.googletagmanager.com	www.google-analytics.com adv.office-partner.de www.googletagmanager.com
2	pm.w55c.net	2 redirects
2	sync.teads.tv	googleads.g.doubleclick.net
2	us-u.openx.net	googleads.g.doubleclick.net
2	c1.adform.net	2 redirects
2	cms.quantserve.com	1 redirects googleads.g.doubleclick.net
2	r.turn.com	googleads.g.doubleclick.net
2	ad.turn.com	2 redirects
2	api.webgains.io	analytics.webgains.io
2	cdnjs.cloudflare.com	s0.2mdn.net
2	googleads4.g.doubleclick.net	geocult.ru
2	static.adsafeprotected.com	googleads.g.doubleclick.net
2	fw.adsafeprotected.com	1 redirects geocult.ru
2	5994599.fls.doubleclick.net	1 redirects googleads.g.doubleclick.net
2	www.google.de	geocult.ru
2	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
2	counter.yadro.ru	1 redirects geocult.ru
2	www.google-analytics.com	geocult.ru www.google-analytics.com
1	onetag-sys.com	1 redirects
1	dis.criteo.com	googleads.g.doubleclick.net
1	pr-bh.ybp.yahoo.com	1 redirects
1	ads.travelaudience.com	1 redirects
1	m.exactag.com	googleads.g.doubleclick.net
1	odr.mookie1.com	googleads.g.doubleclick.net
1	d.agkn.com	1 redirects
1	um.simpli.fi	1 redirects
1	s.tribalfusion.com	googleads.g.doubleclick.net
1	a.tribalfusion.com	1 redirects
1	adservice.google.com	5994599.fls.doubleclick.net
1	cdn.track.production.webgains.team	googleads.g.doubleclick.net
1	analytics.webgains.io	track.webgains.com
1	track.webgains.com	googleads.g.doubleclick.net
1	adv.office-partner.de	hal900014.redintelligence.net
1	region1.analytics.google.com	www.googletagmanager.com
1	translate.googleapis.com
1	translate.google.com	geocult.ru
306	55

This site contains links to these domains. Also see Links.

Domain
translate.google.com

Subject Issuer	Validity	Valid
geocult.ru AlphaSSL CA - SHA256 - G4	`2023-06-24` - `2024-07-25`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
redintelligence.net R3	`2023-10-10` - `2024-01-08`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
pv.medialead.de R3	`2023-12-04` - `2024-03-03`	3 months	crt.sh
adv.office-partner.de R3	`2023-10-28` - `2024-01-26`	3 months	crt.sh
*.webgains.com Amazon RSA 2048 M01	`2023-05-15` - `2024-06-13`	a year	crt.sh
*.webgains.io Amazon RSA 2048 M01	`2023-07-24` - `2024-08-22`	a year	crt.sh
cdn.track.production.webgains.team Amazon RSA 2048 M03	`2023-08-30` - `2024-09-27`	a year	crt.sh
fw.adsafeprotected.com Amazon RSA 2048 M02	`2023-03-29` - `2024-04-27`	a year	crt.sh
static.adsafeprotected.com Amazon RSA 2048 M02	`2023-07-07` - `2024-08-04`	a year	crt.sh
dt.adsafeprotected.com Amazon RSA 2048 M01	`2023-05-09` - `2024-06-06`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
quantserve.com R3	`2023-10-28` - `2024-01-26`	3 months	crt.sh
*.mookie1.com DigiCert TLS RSA SHA256 2020 CA1	`2023-02-27` - `2024-03-29`	a year	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2023-08-18` - `2024-08-18`	a year	crt.sh
teads.tv R3	`2023-11-03` - `2024-02-01`	3 months	crt.sh
*.exactag.com Sectigo ECC Domain Validation Secure Server CA	`2023-08-22` - `2024-09-15`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-01` - `2024-03-01`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh

This page contains 38 frames:

Primary Page: https://geocult.ru/
Frame ID: 2BBD039171C7DEB869B153AFD3FEAC0A
Requests: 94 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20190131/zrt_lookup_fy2021.html
Frame ID: 981CBD4CE6B7ADE080A798CA7E9B0B1C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&adk=1812271804&adf=3025194257&lmt=1693404896&plaf=2%3A2%2C7%3A2&plat=3%3A128%2C4%3A128%2C8%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=308x945_l%7C308x945_r&format=0x0&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~3~4~6&aslmct=0.8&asamct=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847105&bpp=4&bdt=321&idt=352&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=605185929340&frm=20&pv=2&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=378
Frame ID: 4C6877469207E7DC16362948F3004A98
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&slotname=6315164047&adk=1815116396&adf=2119670097&pi=t.ma~as.6315164047&w=160&lmt=1693404896&format=160x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847109&bpp=1&bdt=326&idt=377&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1080&ady=1897&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=380
Frame ID: 1BE9D4AE1CAC79C5B0ABD9F085BA32F4
Requests: 15 HTTP requests in this frame

Frame: data://truncated
Frame ID: EC0C9C6C6500F39E30420772B8DE7490
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=4347476252&adk=504672438&adf=3417920651&pi=t.ma~as.4347476252&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847110&bpp=1&bdt=327&idt=414&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=416
Frame ID: 0BF42B8C2DE46C6E48C5F1A8D0EF6399
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=6212002511&adk=1854347006&adf=3400082548&pi=t.ma~as.6212002511&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847111&bpp=1&bdt=328&idt=418&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=2725&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=420
Frame ID: 9B4C88964ECA5A73929F0B5860747774
Requests: 21 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNVsJGBuEup25riz2GGo5Us29d419LMfDUhOVkcZr605uw5OGJD2Tn3cDRejzcYykc-DrzzUaFC9dVwR1PRfSBsqi0ioOyiUMyz9Q8aeyB32QHwxjyGt2LfKW-vPuTBfrTcecoAymRcWX5A5qzzXSMWkX9IFglRNEfiulnwA40kyTjRshHw
Frame ID: C9781B5E017742D516DBA2FCBFDB8741
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 702C14351D5CD3230241F2033860AE6D
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js
Frame ID: 47BB259D742746A156A7A075596F1BE5
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=371214980&pi=t.aa~a.542385254~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280&nras=2&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=776&ady=1268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=3
Frame ID: F27FEEBFA8F22234C6CEB003832C99DE
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5
Frame ID: 003EBA6614ED839C235E2620A1A1BFE5
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 481964184980F8EE8247C7FD5FC9A58E
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: D2E4FB6E35ECC0B5F540B7807C50414E
Requests: 1 HTTP requests in this frame

Frame: https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=41541200036431004444994012533014&t=htlp&gdpr=1&consent=1&gdpr_consent=
Frame ID: 43CDF933A63B01C6986CCE619C9E3EFA
Requests: 1 HTTP requests in this frame

Frame: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Frame ID: 3FEE87DFA2642A6C3DD40941B2E7B3F7
Requests: 3 HTTP requests in this frame

Frame: https://pv.medialead.de/trck/epv/89f7480c0afa0150827cf163f8728151?subid=41541200036431004444994012533014&t=htlp&gdpr=1&consent=1&gdpr_consent=
Frame ID: 047FF3AA39DFF26A3F48CFB89F1F276C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNiL3_QBMAE&v=APEucNV4aKvJo7ONAahJdiHkKSx5PyQLmlLNFXr-oqzGOf5NU1slKr4zSZQX75aLNabPnxXRTxVIH3l3mwu3FmtnzJb23XUdXPhP9_-PrihP4kGSFiOZ1ElvqLdWAB6U96oV2hhC_4v8pQKTTmKVGb2T3nSoTIoGtlsQTU4ZXg4vBqF9387GhGI
Frame ID: 502D9372A627047E54A29DC775BAD30D
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: D52E4BDB50820B18B818CD19E21FBFCF
Requests: 26 HTTP requests in this frame

Frame: https://5994599.fls.doubleclick.net/activityi;dc_pre=CK6B0PeHgoMDFRDhOwIdxXEJKg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3233669781988.242
Frame ID: B69D09D728BD495A9701B73653BAFE54
Requests: 2 HTTP requests in this frame

Frame: https://hal900014.redintelligence.net/request_content.php?s=41541200036431004444994012533014&a=b89490a9
Frame ID: 909A64F1EFF86A67E2F19A3F1CBEA62B
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 2122B731B74C58053A5B29A16F00100C
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js
Frame ID: EE4876050A055F27524E346885DE760A
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 810CB92AE100BCD6953549C15F79148B
Requests: 3 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.6.2.js
Frame ID: 588228605FF8706894ABEBEA191C49F6
Requests: 1 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
Frame ID: 41B8D9DAA8DC2D4E1D49D565847A298C
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYlYro4gEwAQ&v=APEucNWOjYrB79wyDzqY4Vvs1A2yvxjpgXXKS81G_FC4yx8l0oyIwLSQ2XF1VVEHi_-2-Sb2LT618iLMgafGtEf7NtNm3UWHWcQGTGnn6SZz6RqezRo488pbijZc9MLk17Gdtpp6G1KgiNu1SzugXme2gx5wYfdNe1o3ryaXGCMGO41yQMDVaRQ
Frame ID: 700832D8EE7BF8275DEE474E25FC6725
Requests: 5 HTTP requests in this frame

Frame: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Frame ID: D7AEBB1886B21FF9FB938D201B5AB127
Requests: 12 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: C3C9A1F579612D1929965A8AE6B15324
Requests: 9 HTTP requests in this frame

Frame: https://www.gstatic.com/mysidia/e21910fd923a6283b5d44b2382eabc86.js?tag=client_fast_engine_2019
Frame ID: 554A2D3495CBD733F33E5B4E8120B148
Requests: 12 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: A730F3F81DB29336D50B67701691FEBD
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/Besparend%20300x600.html
Frame ID: EB18302008668F2323AE34D8FE6920DF
Requests: 12 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 35D5ABDE76B54EDE31C38A0D371A4D15
Requests: 9 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=54f46qHDx0&t=1&renderingType=2&ev=01_250
Frame ID: C9D48F2E797C3714CE9DEEEC0688B3DA
Requests: 12 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js
Frame ID: 9494A4B60DC7216B52284017944A2CDB
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 6CF0BA299366CCEB49AD364C53DA7CBE
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: D2E5901E0BE6BAF9FF094B8C9BDE9A41
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js
Frame ID: 0AC13999D1194DEF676DCA52C91986BE
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Geocult.ru - Астрологический дневник. Натальная карта, Лунный календарь, Астрология.

Page URL History Show full URLs

http://geocult.ru/ HTTP 301
https://geocult.ru/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

All in One SEO Pack (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- All in One SEO Pack ([\d.]+)

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Webgains (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

analytics\.webgains\.io

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

306
Requests

91 %
HTTPS

46 %
IPv6

38
Domains

55
Subdomains

47
IPs

12
Countries

3652 kB
Transfer

8051 kB
Size

36
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://translate.google.com/
Title: Google Übersetzer

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://geocult.ru/ HTTP 301
https://geocult.ru/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 70

https://counter.yadro.ru/hit?t44.6;r;s1600*1200*24;uhttps%3A//geocult.ru/;0.34109486101085595 HTTP 302
https://counter.yadro.ru/hit?q;t44.6;r;s1600*1200*24;uhttps%3A//geocult.ru/;0.34109486101085595

Request Chain 108

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 109

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9SLDbyR7uCnyIyDoaf-lo&google_cver=1

Request Chain 110

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZXQ2IIVndCUFQWlXDvJUwwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9SLDbyR7uCnyIyDoaf-lo&google_cver=1

Request Chain 111

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEL-BtaHp31leN40UteUQur4&google_cver=1

Request Chain 112

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMyMzkzNjc5ODA1MDM3MzQzNg%3D%3D

Request Chain 120

https://googleads.g.doubleclick.net/pagead/adview?ai=C9DvNHzZ0ZZqQMf_U5LcP5o62yAfZlYGtdNnvkfCrEuqf3KDUARABINTHmpcBYJXikIKgB6ABg6yNqirIAQGpAmItiH_3DrI-qAMByAPLBKoEzQFP0DEOdAeXeTsYchsS0J05Esp9obWrI-ioicYx2JK1nPdk11xP_q73myzLYpWTq2RvjeSnM67DHXhRFiFEpQaxyTOCHSCdXZi8BJB6wHubIHNVvloJjbVputpFYenPSWNpZYxZbUEqNULNn6BSbeYd49QfR9O9tYojAuUQHKBhz1SQ2uBAxwd_fsg90XrOqg-nKDpboOE1N7cLFtonq7umgANJm_uNQBfxmR6_dt7ZJpPARAljfXGdwXqDXPaXBlOjB1oH6kM7oY_ytalfwATH7f_QwwSIBfiu7p5NkgUECAQYAZIFBAgFGASAB4Pk3YkFqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQ1NAH0ggfCIDhgBAQARgfMgKqAjoCgEBIvf3BOliG1vb2h4KDA5oJGmh0dHBzOi8vbm92YXBvc3QuY29tL3VrLWRlgAoByAsBogwYKhYKFOS0sQLutbECtbixAqy6sQK7u7EC2BMCiBQC0BUBmBYBgBcBshccChoIABIUcHViLTI5MjA1NTU1NzM1ODQ2OTgYAA&sigh=U2GDbsL7chM&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTwDICaaN8EFEcOVdkbPmCJ7VrYr4ouiiTKerJMSy-TRs4BQ5yqz4Iit-EsORH7JZxPHgQHYg3fRImpw7zheuE1AYYdDP6txdiY448CDePXgYAQ&template_id=5001&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2213998669173743805051%22,%22debug_reporting%22:true,%22destination%22:%22https://novapost.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211362588163%22],%224%22:[%2212-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2211788369259742594849%22}&andc=true

Request Chain 128

https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=7e92e8dc5e&subid=&uid=2e9be88fbc7679ac&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrZTFHzZ0ZaiZMOHUxtYP7tOWkAWm5b2gab2TnKfJD_AuEAEg1MealwFgleKQgqAHyAEJqQJiLYh_9w6yPqgDAcgDmwSqBN4BT9AiVjVcv3pO5yZW6_3fSL4XIRkOCaqLceMH4yCoxQkrQYBn2wEAGLgbs5Zq82izRhILNhR0zeTyDTK78OUsjdP5FhmdPTU1SzslgcOzVqJwVT_2BDSYmmsYBYDaPu5vnMymKB3vchsgE56P2WxA9nnungybj6ET_rh1KM23KySrwb4WNJK_5jMuL_XnLU_PB1N2OxvUonoD3KGb7_TEGUL8AjYGWWtcbXJ_nSAfGP4rt26_jsPS0JXBqHRSlPW-PKHagj4LWweSRDky2NmgQTjcADNzYSuLbygV7TOTwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WM7u9vaHgoMDgAoBmAsByAsBgAwBogwgKh4KHOS0sQLutbECtbixAqy6sQLktLEC7rWxAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNXxo6vdRsOHbxSvBL1f3eEwKATbEJlqZ09lONmoK3S7tWpIP5rfg9DIouwOhx2V24Tmmu4TAnDON-R85r3PDxDQxmDuMTjv7uWBgB%26sig%3DAOD64_3ggfehLCfFjtBQ0NgjcvhvVxoI1A%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-BIZ5R7ZUDw_F_JZz1KqFn83mMRDnTDJ7gwEpcX_dlEFVZ5Ht_ZnPcoCZ0mbBpMkA0c4m7bEVpWZgijbSFOO3FJ9V2o5dUSJgYgr6vHGsKRzYc-RttHqAXg7SO_b6JcITRlJpJb16UobHIcDHDObOZN7wvLYzZPiysHXjk1o77-4salSfw%26cry%3D1%26dbm_d%3DAKAmf-CCgnAnmaqF1_uq3uHrajJwUGCxed43F_3YqoZnJku1UKPxHkrXEYxxD5axQLCpHdEakWKJ7HVrRb46nls5xH1MnoXLiXTRA95Z1_lf0Aj5zuGAXpgxasrynIATRvJG0KM-Xt6_KPmmrhcMcE8ylA2yOKPx09T-TPH3c4ZfdZVqGzYBC20XWJBR7k1gWGsm3qtzGTeFAKi8ZxpYUBGIZnnTdQjHf1VSHhGbz43El4GiQTifg2_-wDxJBClKz01g6lY8Kvdikwip7_fOU49_9J2J7wkwyLqxJLiy2-QLa69FPtCuHSsXC3wio9dX5eER8uSsPUIWlk5j4807yVTQG9F391OQbh3JCms61Y8BnDW0QFnkj5S5FW61wqTJa8COcMzRxsOjpR6d22Gl6L4pJEjSvag2iFj2LIrLJbmC7TVhNHOzTDPo8JHpeZFwJ56CMuVd-PPZraoDgk3BdzYgepmkoqA2UxdC0ozxe7PWj6BWP1MuFGYMkFZZRTLDgge70ZyXIlrmJl0wL2ikeFwMaIVBCnZh6SuERzjntstuUP4AXgXO3G0%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=7841007285590&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=7e92e8dc5e&subid=&uid=2e9be88fbc7679ac&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrZTFHzZ0ZaiZMOHUxtYP7tOWkAWm5b2gab2TnKfJD_AuEAEg1MealwFgleKQgqAHyAEJqQJiLYh_9w6yPqgDAcgDmwSqBN4BT9AiVjVcv3pO5yZW6_3fSL4XIRkOCaqLceMH4yCoxQkrQYBn2wEAGLgbs5Zq82izRhILNhR0zeTyDTK78OUsjdP5FhmdPTU1SzslgcOzVqJwVT_2BDSYmmsYBYDaPu5vnMymKB3vchsgE56P2WxA9nnungybj6ET_rh1KM23KySrwb4WNJK_5jMuL_XnLU_PB1N2OxvUonoD3KGb7_TEGUL8AjYGWWtcbXJ_nSAfGP4rt26_jsPS0JXBqHRSlPW-PKHagj4LWweSRDky2NmgQTjcADNzYSuLbygV7TOTwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WM7u9vaHgoMDgAoBmAsByAsBgAwBogwgKh4KHOS0sQLutbECtbixAqy6sQLktLEC7rWxAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNXxo6vdRsOHbxSvBL1f3eEwKATbEJlqZ09lONmoK3S7tWpIP5rfg9DIouwOhx2V24Tmmu4TAnDON-R85r3PDxDQxmDuMTjv7uWBgB%26sig%3DAOD64_3ggfehLCfFjtBQ0NgjcvhvVxoI1A%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-BIZ5R7ZUDw_F_JZz1KqFn83mMRDnTDJ7gwEpcX_dlEFVZ5Ht_ZnPcoCZ0mbBpMkA0c4m7bEVpWZgijbSFOO3FJ9V2o5dUSJgYgr6vHGsKRzYc-RttHqAXg7SO_b6JcITRlJpJb16UobHIcDHDObOZN7wvLYzZPiysHXjk1o77-4salSfw%26cry%3D1%26dbm_d%3DAKAmf-CCgnAnmaqF1_uq3uHrajJwUGCxed43F_3YqoZnJku1UKPxHkrXEYxxD5axQLCpHdEakWKJ7HVrRb46nls5xH1MnoXLiXTRA95Z1_lf0Aj5zuGAXpgxasrynIATRvJG0KM-Xt6_KPmmrhcMcE8ylA2yOKPx09T-TPH3c4ZfdZVqGzYBC20XWJBR7k1gWGsm3qtzGTeFAKi8ZxpYUBGIZnnTdQjHf1VSHhGbz43El4GiQTifg2_-wDxJBClKz01g6lY8Kvdikwip7_fOU49_9J2J7wkwyLqxJLiy2-QLa69FPtCuHSsXC3wio9dX5eER8uSsPUIWlk5j4807yVTQG9F391OQbh3JCms61Y8BnDW0QFnkj5S5FW61wqTJa8COcMzRxsOjpR6d22Gl6L4pJEjSvag2iFj2LIrLJbmC7TVhNHOzTDPo8JHpeZFwJ56CMuVd-PPZraoDgk3BdzYgepmkoqA2UxdC0ozxe7PWj6BWP1MuFGYMkFZZRTLDgge70ZyXIlrmJl0wL2ikeFwMaIVBCnZh6SuERzjntstuUP4AXgXO3G0%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=7841007285590&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 149

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3233669781988.242 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=CK6B0PeHgoMDFRDhOwIdxXEJKg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3233669781988.242

Request Chain 165

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 166

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9SLDbyR7uCnyIyDoaf-lo&google_cver=1

Request Chain 167

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZXQ2IIVndCUFQWlXDvJUwwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9SLDbyR7uCnyIyDoaf-lo&google_cver=1

Request Chain 168

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEL-BtaHp31leN40UteUQur4&google_cver=1

Request Chain 169

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMyMzkzNjc5ODA1MDM3MzQzNg%3D%3D

Request Chain 188

https://googleads.g.doubleclick.net/pagead/adview?ai=ChpFTHzZ0Zcj6L4ztvPIPydqvaNmVga102e-R8KsSsvncoYwOEAEg1MealwFgleKQgqAHoAGDrI2qKsgBAakCYi2If_cOsj6oAwHIA8sEqgTHAU_QCIBDripjsqbALLk4CiBYv-cYhzEXKlIJDcouOOL2_BL3yMw1ZSW1STHxX9LRptx0pGeWHIegM0iA81Xfm9bz2_AzdRKq_txehNSRUNCQrb60Ssb0hGvLqGYOkTkxSjoImEDx9P5vq6jbviBJTYEeIEjFNdxEUTZ34n4p9UstX_P5lhGg3Qd30IanMySpV8yYvkIYKflGkfK6ogP9WfSDOgi93brucAfOYngRNwqAdiN9TVlRkF_QeOUjy6QU33jSJBai_DrABMft_9DDBIgF-K7unk2SBQQIBBgBkgUECAUYBIAHg-TdiQWoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBDLkmTSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WKDZ9vaHgoMDmgkaaHR0cHM6Ly9ub3ZhcG9zdC5jb20vdWstZGWACgHICwGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQLYEwKIFALQFQGYFgGAFwGyFxwKGggAEhRwdWItMjkyMDU1NTU3MzU4NDY5OBgA&sigh=GtI4xjbBaOs&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTgDICaaNKpIzAMGuCa_Gg0tE0uCtOitDanF6wFnWySo1Mza6rhcjrdU3AWtvS0Swl9hWGEUa4O5O0Qzp_ImprkB0nPqQnv132XZKkheDUBgB&template_id=5028&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%221481199129478973342%22,%22debug_reporting%22:true,%22destination%22:%22https://novapost.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211362588163%22],%224%22:[%2212-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2211339834458605798113%22}&andc=true

Request Chain 195

https://fw.adsafeprotected.com/rfw/st/1627455/73523880/4.js?ias_dspID=3&ias_campId=1013910218&ias_pubId=pub-2920555573584698&ias_chanId=1&ias_placementId=20492286635&bidurl=https://geocult.ru/&ias_dealId=&xsId=ABAjH0gACYsuM8K9Rul4zJPbg26o&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0gACYsuM8K9Rul4zJPbg26o&adContainerId=brand_safety_ITZ0ZeCcCdSEjuwP5IqiqA8&cbFunctionName=goog_wrapCb_ITZ0ZeCcCdSEjuwP5IqiqA8&true_pb=&adsafe_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2F4a.js&adsafe_url=https%3A%2F%2Fgeocult.ru&adsafe_type=g&adsafe_url=https%3A%2F%2Fgeocult.ru%2F&adsafe_type=c&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231206%2Fr20110914%2Fzrt_lookup_fy2021.html%3Ffsb%3D1&adsafe_type=d&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231206%2Fr20110914%2Fzrt_lookup_fy2021.html%3Ffsb%3D1%23RS-0-%26adk%3D1812271801%26client%3Dca-pub-2920555573584698%26fa%3D1%26ifi%3D8%26uci%3Da!8%26btvi%3D5&adsafe_type=be&adsafe_jsinfo=,id:6a85da9e-a5eb-7561-4060-b389cfbf4de0,c:wil5aO,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-765b799994-jppxg,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,mu:10000,br:c,bru:c,an:n,oam:0,mtim:2,mot:0,app:0,maw:0,fm:tXVWrDt+11%7C12%7C131%7C132%7C14%7C151%7C152%7C161%7C162%7C163%7C164%7C165%7C166%7C167%7C17%7C18%7C191*.1627455-73523880%7C1911%7C1912,idMap:191*,ex:e2,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:svg.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:15,oid:09226e4d-9677-11ee-a82b-0ab58197ba71,v:19.8.464,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://static.adsafeprotected.com/4.js?xsId=ABAjH0gACYsuM8K9Rul4zJPbg26o&ias_xappb=&adContainerId=brand_safety_ITZ0ZeCcCdSEjuwP5IqiqA8&cbFunctionName=goog_wrapCb_ITZ0ZeCcCdSEjuwP5IqiqA8&true_pb=

Request Chain 242

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEDKebvKeBJl6DwyXkLgGpNI&google_cver=1&google_push=AXcoOmRmr85M40A7lXD7AbvXxffG2R103kz3_YQDI3KAt9FrtsMTGGFjOg5utHg-MQ3cQHhkVPoTwfFAi5gyzbrMsf70feIQ3t_eb13WpRVLG9r5gazNtqGnAYftiEXCk_Ma94n0sx9HgkRe7Cbfh4Y09XT1WA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODA1NTQ4ODYzNzQ4MjQ2NzQzNg==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDKebvKeBJl6DwyXkLgGpNI&google_cver=1

Request Chain 244

https://a.tribalfusion.com/i.match?p=b6&u=CAESENu7dKSsGn8LTs9FI4w2MdA&google_cver=1&google_push=AXcoOmT_PK9_Y0Ih5AhsAR8cJq5uq6fNkl3C9Jic5V50WXtZtUCEjzqfNFA8Ef1Jo1_nLffrXwYbcSx-HN8XQrk6qWBGZwB8e9ri-qu-ahFTlDSKFQSBidwrQsjQBM8cCrO-coCY6kYr30_bjUG8Pmy21KUGwXo&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmT_PK9_Y0Ih5AhsAR8cJq5uq6fNkl3C9Jic5V50WXtZtUCEjzqfNFA8Ef1Jo1_nLffrXwYbcSx-HN8XQrk6qWBGZwB8e9ri-qu-ahFTlDSKFQSBidwrQsjQBM8cCrO-coCY6kYr30_bjUG8Pmy21KUGwXo%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENu7dKSsGn8LTs9FI4w2MdA&google_cver=1&google_push=AXcoOmT_PK9_Y0Ih5AhsAR8cJq5uq6fNkl3C9Jic5V50WXtZtUCEjzqfNFA8Ef1Jo1_nLffrXwYbcSx-HN8XQrk6qWBGZwB8e9ri-qu-ahFTlDSKFQSBidwrQsjQBM8cCrO-coCY6kYr30_bjUG8Pmy21KUGwXo&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmT_PK9_Y0Ih5AhsAR8cJq5uq6fNkl3C9Jic5V50WXtZtUCEjzqfNFA8Ef1Jo1_nLffrXwYbcSx-HN8XQrk6qWBGZwB8e9ri-qu-ahFTlDSKFQSBidwrQsjQBM8cCrO-coCY6kYr30_bjUG8Pmy21KUGwXo%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 245

https://um.simpli.fi/gp_match?google_gid=CAESEM1PkyC9XpyUVb4j4yTiEj8&google_cver=1&google_push=AXcoOmQ7qd9ExmjYV7c3jb5VnMnCWE7csdnqmG6yfliwlacFndJLXgO5j2EroW3CGQcDhHTy-VGZ6HrGneKAxwYBzoDNs520FZkEvzH3h1fX3tctdJ-432zNgoZO8s0VXhqzzBOXDoyDbbIcydBKDX1yHDc_1uM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=AC173272D79C4D7B9CA43AFDC2186866&google_push=AXcoOmQ7qd9ExmjYV7c3jb5VnMnCWE7csdnqmG6yfliwlacFndJLXgO5j2EroW3CGQcDhHTy-VGZ6HrGneKAxwYBzoDNs520FZkEvzH3h1fX3tctdJ-432zNgoZO8s0VXhqzzBOXDoyDbbIcydBKDX1yHDc_1uM

Request Chain 246

https://d.agkn.com/pixel/2175/?google_gid=CAESEORmncC6CSXOC9LpdsweISk&google_cver=1&google_push=AXcoOmTBVd-iqqCeX6-ZasVf6ehgJRuKMdpWHAVS6I_HERJzZ1pB9hWZDdryr9xLDVjVoN4OOKxvGdDBsxLucW82oKLlFqEVqshWiU4KFjP6AyCbd1G3nwiu2-MDKn-QrwKdYilhdGZkuSefyNWy4QstkMuF9A HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AXcoOmTBVd-iqqCeX6-ZasVf6ehgJRuKMdpWHAVS6I_HERJzZ1pB9hWZDdryr9xLDVjVoN4OOKxvGdDBsxLucW82oKLlFqEVqshWiU4KFjP6AyCbd1G3nwiu2-MDKn-QrwKdYilhdGZkuSefyNWy4QstkMuF9A&google_hm=Q0FFU0VPUm1uY0M2Q1NYT0M5THBkc3dlSVNr

Request Chain 248

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEIVkL4sIU2rSJS2H1cVASKU&google_cver=1&google_push=AXcoOmR7z8Z-05TlhdaniIDBvMozeM-Rhl7bmu_OZopVPaxCunCeNPH-uzakMFDhaqInUkOhj_Esei3mHrc3uwzCD3m9f5XIpD3mvu-aK1tNxwdamiJ_FUSpjnrE3pBEoTNl7gjau1ZdSUMVxY4gDGNPyL4Bek0 HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEIVkL4sIU2rSJS2H1cVASKU&google_cver=1&google_push=AXcoOmR7z8Z-05TlhdaniIDBvMozeM-Rhl7bmu_OZopVPaxCunCeNPH-uzakMFDhaqInUkOhj_Esei3mHrc3uwzCD3m9f5XIpD3mvu-aK1tNxwdamiJ_FUSpjnrE3pBEoTNl7gjau1ZdSUMVxY4gDGNPyL4Bek0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTYzNzk0NjcwODA1MjM1MDAwNA&google_push=AXcoOmR7z8Z-05TlhdaniIDBvMozeM-Rhl7bmu_OZopVPaxCunCeNPH-uzakMFDhaqInUkOhj_Esei3mHrc3uwzCD3m9f5XIpD3mvu-aK1tNxwdamiJ_FUSpjnrE3pBEoTNl7gjau1ZdSUMVxY4gDGNPyL4Bek0

Request Chain 250

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGeoC6eW912iUJAnhZ6gk5w&google_cver=1

Request Chain 252

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEEQ7ob5yKcdhNoNett-bV50&google_cver=1

Request Chain 268

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEDKebvKeBJl6DwyXkLgGpNI&google_cver=1&google_push=AXcoOmQyjWgfT4BVsMWnFlb1WMDSmBa2jqONRttpjg_BQuECRbVUKHlxxJAIPV5lUsK90KYJfE2myFMEgfpHEzrdzniIngmRXk7J-m6-eiXvUgcRJz-TGce5mUmUcYHoWqJa0YKSeZxWWoTd4F69WYwXAerXEHk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODA1NTQ4ODYzNzQ4MjQ2NzQzNg==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDKebvKeBJl6DwyXkLgGpNI&google_cver=1

Request Chain 269

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEIfrr5J74PFvyJ17c673dGs&google_cver=1&google_push=AXcoOmQGaJXGpR9AfMsBpnO_KO4vIRuvDsIR9Grbk4BLPEQEicoZK5tvbRQxjrqXy1DjHXpXs8h7U14__IXP-IUdag0DtMRBIQZvAlE_7FF_dhKvPXha5YKKBQgTpYO1kPGEEDoqelVF5JdHOZgVbJt2TkuHQw HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQGaJXGpR9AfMsBpnO_KO4vIRuvDsIR9Grbk4BLPEQEicoZK5tvbRQxjrqXy1DjHXpXs8h7U14__IXP-IUdag0DtMRBIQZvAlE_7FF_dhKvPXha5YKKBQgTpYO1kPGEEDoqelVF5JdHOZgVbJt2TkuHQw&google_hm=uLNpgOM53g0yDcmvByYp0Q

Request Chain 270

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEOKYK0PeYXyoRoQE5yNrxec&google_cver=1&google_push=AXcoOmQwpGgZJdDYnbRxWW8iS-1_Rky--27fzV0ubZUCpAcEx4-UjFHE42PqUKfWpYbVh7WmKTe1p6XYvm6FVOT0PiwKs2M-6pniYSUnWrbW3jisw_OHYk7zGi-efslJPSVRyPp7uHUSCkFnFVu0dEBBk4H1pg HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEOKYK0PeYXyoRoQE5yNrxec&google_cver=1&google_push=AXcoOmQwpGgZJdDYnbRxWW8iS-1_Rky--27fzV0ubZUCpAcEx4-UjFHE42PqUKfWpYbVh7WmKTe1p6XYvm6FVOT0PiwKs2M-6pniYSUnWrbW3jisw_OHYk7zGi-efslJPSVRyPp7uHUSCkFnFVu0dEBBk4H1pg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Y0ZuS3NVNTcxUmJUUGs1&google_gid=CAESEOKYK0PeYXyoRoQE5yNrxec&google_cver=1&google_push=AXcoOmQwpGgZJdDYnbRxWW8iS-1_Rky--27fzV0ubZUCpAcEx4-UjFHE42PqUKfWpYbVh7WmKTe1p6XYvm6FVOT0PiwKs2M-6pniYSUnWrbW3jisw_OHYk7zGi-efslJPSVRyPp7uHUSCkFnFVu0dEBBk4H1pg

Request Chain 271

https://ads.travelaudience.com/google_pixel?google_gid=CAESEN7exTpvSMPQn0XGFv-DhTU&google_cver=1&google_push=AXcoOmS2L13OqyQXIsYtZyRmlvnVtjPBZ39Aej7mm97fiyMsr8O_jjS1EjgenYMRRPXGzrok1nC0TYJ8kBEF_kB8UdkBpAslNIwZgtYZU1k1aX1MI6nt4dzfcny6USSzJziBpC3GfAk9s4HXqvkD5vawt8v4Ww HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=okDD_2-SQLQlJj5bfz3Dew&google_push=AXcoOmS2L13OqyQXIsYtZyRmlvnVtjPBZ39Aej7mm97fiyMsr8O_jjS1EjgenYMRRPXGzrok1nC0TYJ8kBEF_kB8UdkBpAslNIwZgtYZU1k1aX1MI6nt4dzfcny6USSzJziBpC3GfAk9s4HXqvkD5vawt8v4Ww

Request Chain 272

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEFOB_5bbVPOEvuXxGFFPrxk&google_cver=1&google_push=AXcoOmSQV78f9Jr9k5pTtyfO6u-KUESi8YAhsPONE_fMhcDjk6iP4k8ZxfWPyfE0N8wVYZObQToNYQjMql70BYguD_WkrGKdIjMGNXtYZGSYmJ-mqEWfYfIjCkAw9EzZjyprW-UL3fOhaTj2EvEevX4kWymg8g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSQV78f9Jr9k5pTtyfO6u-KUESi8YAhsPONE_fMhcDjk6iP4k8ZxfWPyfE0N8wVYZObQToNYQjMql70BYguD_WkrGKdIjMGNXtYZGSYmJ-mqEWfYfIjCkAw9EzZjyprW-UL3fOhaTj2EvEevX4kWymg8g&google_hm=eS1fRWN2Z1M5RTJwRXBINHpCb2RaclVVdUlPd2dkZDhxaX5B

Request Chain 274

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEKKUa2WwZmIklxCxb19WH7A&google_cver=1&google_push=AXcoOmQwMbz09shVgKZia6bAWIomb14rvQgi1TqCn6lv2jYswOUZ_NomT76huGyZO4bdIYyGjFYeK9ZQFgpFRmnT4tB8E-Fr2gpMt3gu3Xd2jpt1LngvMq6XQ8V3f2nHqSSj62R7zH2T-2XMeOc31rwcuQg4mEA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQwMbz09shVgKZia6bAWIomb14rvQgi1TqCn6lv2jYswOUZ_NomT76huGyZO4bdIYyGjFYeK9ZQFgpFRmnT4tB8E-Fr2gpMt3gu3Xd2jpt1LngvMq6XQ8V3f2nHqSSj62R7zH2T-2XMeOc31rwcuQg4mEA

Request Chain 278

https://googleads.g.doubleclick.net/pagead/adview?ai=CQVITIDZ0ZfX-K7Kn5LcP29mYyAy_jamPdLHBq7WMEs_33Zi6ARABINTHmpcBYJXikIKgB6AB1ZDB2gLIAQmpAmItiH_3DrI-qAMByANIqgTCAU_QeaYS0Hr1R3GyH14qkBpmpEcy_EsOO8XZHJKpFyWtTpViy8gt4u6UvM54wQbiAptl0Hno6_dweBgVRKGL18Krazdm_gpyDxbjkWzHAgFcPVqPS4e27gfHq-MTDW8y2NbKKJP_dBcbnKElEj6o-f46OpJHleFYz2PtQYlkyLK15UX04UhJCGHElDleJUj5j5R3pL-n4J_nNVAfbBO7TdnaOKNXGvYg5rsCmNtNAadEwtiqt63HB7cO-aLjk4Spb57awAS27oivvgSIBf24xKhNkgUECAQYAZIFBAgFGASgBi6AB5GW8B-oB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAPIHBBD87AjSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WOnPrveHgoMDmgkwaHR0cHM6Ly93d3cuYWx2ZXJvLmRlL3NvLWZ1bmt0aW9uaWVydC1kYXMtbWlldGVugAoByAsBogwYKhYKFOS0sQLutbECtbixAqy6sQK7u7EC2BMNiBQB0BUBgBcBshccChoIABIUcHViLTI5MjA1NTU1NzM1ODQ2OTgYAA&sigh=xq4X_irtmA4&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSPADICaaNR9AT7Z9wGj9TMHkjd1JT58-FY-TDfr2lfAQOmVFYcOQc0uzZRgTH2IjMzWNHArNYYWyS0PIeARgB&template_id=419&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2217526831329460355889%22,%22debug_reporting%22:true,%22destination%22:%22https://alvero.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22726681685%22],%224%22:[%2212-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%225645130949869138513%22}&andc=true

306 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
geocult.ru/
Redirect Chain

http://geocult.ru/
https://geocult.ru/

99 KB
21 KB

347ms
260ms

Document
text/html

185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 8d674b28f8c316180a29763d4d735629198158a03a780fb691025830bae98b30

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=86400
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 09 Dec 2023 09:40:46 GMT
expires: Sun, 10 Dec 2023 09:40:46 GMT
last-modified: Wed, 30 Aug 2023 14:14:56 +0000
link: <https://geocult.ru/wp-json/>; rel="https://api.w.org/" <https://geocult.ru/>; rel=shortlink
server: nginx
x-cache-status: BYPASS

Redirect headers

Connection: keep-alive
Content-Length: 162
Content-Type: text/html
Date: Sat, 09 Dec 2023 09:40:46 GMT
Location: https://geocult.ru/
Server: nginx

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 152 KB
51 KB 223ms
105ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2920555573584698

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28ea7827bde65c9ef822efd6c349b43454cfb91ca7850452bdf3bf36ff5e0ab5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://geocult.ru/
Origin: https://geocult.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52252
x-xss-protection: 0
server: cafe
etag: 9795681652204134252
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 09 Dec 2023 09:40:46 GMT

GET
H2 200 stylev2.css
geocult.ru/wp-content/themes/evolve/ 68 KB
13 KB 48ms
48ms Stylesheet
text/css 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 04dff075b0c9befeaec0105bc4f7e21a284f402f0f3425896f90963c888d7f1d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
content-encoding: gzip
last-modified: Thu, 04 Mar 2021 08:40:06 GMT
server: nginx
etag: W/"60409ce6-1119a"
content-type: text/css
cache-control: max-age=691200
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 logo3.gif
geocult.ru/wp-content/uploads/2013/11/ 9 KB
9 KB 49ms
49ms Image
image/gif 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2013/11/logo3.gif
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: f97ff7af18b6fca33d99a223aaddee96afb3ddd73c2368a39acc15ff53b91c2b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Wed, 07 Jan 2015 17:02:04 GMT
server: nginx
etag: "54ad668c-22e8"
content-type: image/gif
cache-control: max-age=691200
accept-ranges: bytes
content-length: 8936
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 oven_knopka2f.png
geocult.ru/wp-content/uploads/2014/08/ 4 KB
4 KB 50ms
50ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2014/08/oven_knopka2f.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 528b3762e36893c9075ebbb38655afaa02aecbd106aefc59881bd879ffeba9c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Sat, 27 Feb 2016 09:28:00 GMT
server: nginx
etag: "56d16c20-113f"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 4415
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 telec_knopka1f.png
geocult.ru/wp-content/uploads/2014/08/ 5 KB
5 KB 72ms
67ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2014/08/telec_knopka1f.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: f69f24da425eac9ecd7ba5e9a956ee643849921ec5672a9a961e309c60a1feda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Sat, 27 Feb 2016 07:07:42 GMT
server: nginx
etag: "56d14b3e-123a"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 4666
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 blizneci_knopka1f.png
geocult.ru/wp-content/uploads/2014/08/ 5 KB
5 KB 73ms
68ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2014/08/blizneci_knopka1f.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 1a4b71acc013b49315ff300c03f7163618bb6f1cc0408d710e11f97b255f9255

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Sat, 27 Feb 2016 07:16:35 GMT
server: nginx
etag: "56d14d53-1216"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 4630
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 rak_knopka1f.png
geocult.ru/wp-content/uploads/2014/08/ 4 KB
4 KB 74ms
69ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2014/08/rak_knopka1f.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 914dcb400670688bb8de60c955cce8afce0838c2fa2ad297b4bd4b34ec908ed0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Sat, 27 Feb 2016 07:28:05 GMT
server: nginx
etag: "56d15005-1010"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 4112
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 lev_knopka1f.png
geocult.ru/wp-content/uploads/2014/08/ 5 KB
5 KB 108ms
104ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2014/08/lev_knopka1f.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: df5f8f98ec7bd0263bb4dabff07ecf507a535c2c39a5e391e03e7ea124baa321

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Sat, 27 Feb 2016 08:46:05 GMT
server: nginx
etag: "56d1624d-12ba"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 4794
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 deva_knopka1f.png
geocult.ru/wp-content/uploads/2014/08/ 5 KB
5 KB 108ms
104ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2014/08/deva_knopka1f.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 1162f2ec71eb82147a7e6a6f558b88982bb78ad2fa812c1c52020f5b7bd1bd85

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Sat, 27 Feb 2016 08:52:08 GMT
server: nginx
etag: "56d163b8-122e"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 4654
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 vesi_knopka1f.png
geocult.ru/wp-content/uploads/2014/08/ 5 KB
5 KB 108ms
104ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2014/08/vesi_knopka1f.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: daf927d970143656739c9b917412ba171dae6e997b8dfe53263effae772d1b69

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Sat, 27 Feb 2016 08:57:19 GMT
server: nginx
etag: "56d164ef-125c"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 4700
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 scorpion_knopka1f.png
geocult.ru/wp-content/uploads/2014/08/ 5 KB
5 KB 108ms
105ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2014/08/scorpion_knopka1f.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 462c848b90fb9d8f3599f4654813e4382222a6fd506a48158a01bc2eab95b357

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Sat, 27 Feb 2016 09:04:47 GMT
server: nginx
etag: "56d166af-13a6"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 5030
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 strelec_knopka1f.png
geocult.ru/wp-content/uploads/2014/08/ 5 KB
5 KB 108ms
105ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2014/08/strelec_knopka1f.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 1479783c7b49a2bbde9ea12d6b9abb4d552311fad5ea3d1194a866c82ddf7d54

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Sat, 27 Feb 2016 09:12:25 GMT
server: nginx
etag: "56d16879-1248"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 4680
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 kozerog_knopka1f.png
geocult.ru/wp-content/uploads/2014/08/ 4 KB
5 KB 108ms
105ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2014/08/kozerog_knopka1f.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: d04da184f20eec8ec53c73f71b04f6eb462b391c982ca722500bb5abfb31cd20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Sat, 27 Feb 2016 09:17:15 GMT
server: nginx
etag: "56d1699b-11fd"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 4605
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 vodoley_knopka1f.png
geocult.ru/wp-content/uploads/2014/08/ 5 KB
5 KB 108ms
105ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2014/08/vodoley_knopka1f.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: e74a84c9d52e2ef23512423d7e15031fc8644b0b800b89e82ad9abe3ad8b8912

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Sat, 27 Feb 2016 09:23:08 GMT
server: nginx
etag: "56d16afc-1383"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 4995
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 ribi_knopka1f.png
geocult.ru/wp-content/uploads/2014/08/ 4 KB
5 KB 109ms
105ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2014/08/ribi_knopka1f.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 01bd238ad9742675260d4d3a5fef5b988ff74439b26a18aa0f98a48a694b07ed

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Sat, 27 Feb 2016 09:27:59 GMT
server: nginx
etag: "56d16c1f-1173"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 4467
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 venera_scorpion_geocult-1f1-60x60.jpg
geocult.ru/wp-content/uploads/2015/09/ 2 KB
3 KB 109ms
106ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2015/09/venera_scorpion_geocult-1f1-60x60.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 72c786a14cc7a7c3831a33e49e63e54beddc81f6c50cc00149b29e0844aec2af

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Wed, 27 Jan 2016 03:45:09 GMT
server: nginx
etag: "56a83d45-9e6"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 2534
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 sharer.js Show response
geocult.ru/scripts/social_button/ 15 KB
3 KB 75ms
70ms Script
application/javascript 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://geocult.ru/scripts/social_button/sharer.js
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 1537d4a7693f4840ad5484b03df34b08d0ed049696dd470ef07b55e1668d90a5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
content-encoding: gzip
last-modified: Thu, 02 Apr 2020 23:01:12 GMT
server: nginx
etag: W/"5e866eb8-3a1e"
content-type: application/javascript
cache-control: max-age=691200
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 venera_scorpion_geocult-1f1.jpg
geocult.ru/wp-content/uploads/2015/09/ 3 KB
3 KB 109ms
106ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2015/09/venera_scorpion_geocult-1f1.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: f9b2b62632d02dd438da5c717fcedbe7babf3420940398db1778d5b19d342f5b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Thu, 17 Sep 2015 12:21:01 GMT
server: nginx
etag: "55fab02d-a4e"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 2638
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 grande_trine1f-60-60.jpg
geocult.ru/wp-content/uploads/2020/07/ 1 KB
1 KB 109ms
106ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2020/07/grande_trine1f-60-60.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: e3df018cd61d671d60bd4a1cae119f8fcf1e58e47a62a4ae80c6b8100d868dbc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Thu, 17 Dec 2020 08:31:08 GMT
server: nginx
etag: "5fdb174c-431"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 1073
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 neptun-v1.jpg
geocult.ru/wp-content/uploads/2019/01/ 2 KB
2 KB 109ms
106ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2019/01/neptun-v1.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 815c4d0cf5937e27877ee3d17fb373dabb5b4cfa45a87636ad24f71bf59345db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Fri, 03 May 2019 09:17:47 GMT
server: nginx
etag: "5ccc073b-781"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 1921
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 venus_v_3_home-60x60.jpg
geocult.ru/wp-content/uploads/2018/07/ 3 KB
3 KB 109ms
107ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2018/07/venus_v_3_home-60x60.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 178d21ba92f7134c1b38490946eadd0bddbf07248aa9e132d1ff30ddf735a62a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Fri, 20 Jul 2018 07:49:59 GMT
server: nginx
etag: "5b519427-c0c"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 3084
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 moon-neptun-soedinenie-1-60x60.jpg
geocult.ru/wp-content/uploads/2017/10/ 3 KB
3 KB 109ms
107ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2017/10/moon-neptun-soedinenie-1-60x60.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 17389d2b816cd42930191c00df09c08669c18038ce38085452fc224228bfd2ab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Tue, 17 Oct 2017 06:19:10 GMT
server: nginx
etag: "59e5a0de-a74"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 2676
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 mars_uran_geocult-1f1.jpg
geocult.ru/wp-content/uploads/2015/10/ 2 KB
3 KB 110ms
107ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2015/10/mars_uran_geocult-1f1.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: d9b90d582c960458aef7a61a894bffb8c326910023e6be747b954cc8737986ff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Mon, 05 Oct 2015 07:00:33 GMT
server: nginx
etag: "56122011-9b1"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 2481
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 tranziti_online1f1.jpg
geocult.ru/wp-content/uploads/2016/10/ 3 KB
4 KB 110ms
107ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2016/10/tranziti_online1f1.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 8e483f5b5ac1b2ef3a28ccc7f8f7ab82cd8a56cb1e9c06294bf90b3020ccfe47

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Wed, 19 Oct 2016 08:33:07 GMT
server: nginx
etag: "58072fc3-dce"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 3534
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 moon_blizneci-1f-60x60.jpg
geocult.ru/wp-content/uploads/2019/03/ 2 KB
2 KB 110ms
107ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2019/03/moon_blizneci-1f-60x60.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: c76762b6b5695ab0c2c3688f5f0b4932911daa89e9a905ad866e853dd00020ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Sat, 23 Mar 2019 14:32:00 GMT
server: nginx
etag: "5c964360-713"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 1811
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 mercury-v-2-dome-60x60.jpg
geocult.ru/wp-content/uploads/2018/06/ 3 KB
3 KB 110ms
108ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2018/06/mercury-v-2-dome-60x60.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 36c7b56d7df17e27614b04230c5fc1793653b20a1fd66fb9311f5df573c0f617

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Tue, 26 Jun 2018 07:10:54 GMT
server: nginx
etag: "5b31e6fe-ab3"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 2739
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 goroscop_earth-1f1.jpg
geocult.ru/wp-content/uploads/2018/11/ 2 KB
2 KB 110ms
108ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2018/11/goroscop_earth-1f1.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 5e7ef5ef8582671b083278bf8f81e640b0f839f3ed0c336c4a96eb7e8b6c4aca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Thu, 29 Nov 2018 15:25:13 GMT
server: nginx
etag: "5c0004d9-849"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 2121
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 planets-1280-1-60x60.jpg
geocult.ru/wp-content/uploads/2018/03/ 3 KB
3 KB 110ms
108ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2018/03/planets-1280-1-60x60.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 668252abb09b70642638a85544b62098dad1e03b79f534ee177e6d1ebb08c295

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Sat, 03 Mar 2018 17:16:40 GMT
server: nginx
etag: "5a9ad878-bf6"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 3062
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 bioritm-icon-geocult-1f.jpg
geocult.ru/wp-content/uploads/2014/09/ 6 KB
6 KB 110ms
108ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2014/09/bioritm-icon-geocult-1f.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: eafb3e8e7ff731d4419a9683e280433e06a513e872f309333c0909890156bcdf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Wed, 07 Jan 2015 17:39:32 GMT
server: nginx
etag: "54ad6f54-1884"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 6276
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 lun1.jpg
geocult.ru/wp-content/uploads/2013/09/ 3 KB
3 KB 110ms
108ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2013/09/lun1.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 57fa232a003b023f9ee9ab9ca6f9d33569fc7cca884bf9b1ba464cc42df6ed79

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Wed, 07 Jan 2015 16:55:15 GMT
server: nginx
etag: "54ad64f3-a1b"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 2587
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 lun4.jpg
geocult.ru/wp-content/uploads/2013/09/ 5 KB
5 KB 111ms
108ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2013/09/lun4.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: ceae381ecbf5ea0d6e5f6977b195b7eae7d9167dd575f1983b07829838e20632

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Wed, 07 Jan 2015 16:55:22 GMT
server: nginx
etag: "54ad64fa-1200"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 4608
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 lunniy_den_rojdeniya.jpg
geocult.ru/wp-content/uploads/2013/09/ 3 KB
3 KB 111ms
109ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2013/09/lunniy_den_rojdeniya.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: e86c41aba2a70f6e263fbe0c13257e5b4d36b0ba6ae34d86098013f7087441ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Wed, 07 Jan 2015 16:55:35 GMT
server: nginx
etag: "54ad6507-a50"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 2640
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 lun3.jpg
geocult.ru/wp-content/uploads/2013/09/ 4 KB
4 KB 111ms
109ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2013/09/lun3.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: f2d27ec07598049af75b5252143a57fd29957203c5293b6f2321ac38efb629c5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Wed, 07 Jan 2015 16:55:21 GMT
server: nginx
etag: "54ad64f9-1048"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 4168
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 lun5.jpg
geocult.ru/wp-content/uploads/2013/09/ 3 KB
3 KB 111ms
109ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2013/09/lun5.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 50b78ad8578885f34aa7fa589dcd10075c466504e11467dd8a3ceed303ef4cb8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Wed, 07 Jan 2015 16:55:27 GMT
server: nginx
etag: "54ad64ff-ab2"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 2738
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 voc_moon-60x60.jpg
geocult.ru/wp-content/uploads/2018/12/ 2 KB
2 KB 111ms
109ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2018/12/voc_moon-60x60.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: ec4840b5e373feeae1a57fd926d937285246bd4437db4b08e0b99ccf611f1775

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Fri, 14 Dec 2018 12:53:35 GMT
server: nginx
etag: "5c13a7cf-81a"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 2074
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 clfrkfgb00001jv0898897s3d_1-60x60.jpg
geocult.ru/wp-content/uploads/2023/04/ 2 KB
2 KB 111ms
109ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2023/04/clfrkfgb00001jv0898897s3d_1-60x60.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 5070152299c3d5a3ed255352b18e10649460f1e436363d4394e0f7d0acdb48de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Mon, 03 Apr 2023 15:17:18 GMT
server: nginx
etag: "642aedfe-771"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 1905
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 lun7.jpg
geocult.ru/wp-content/uploads/2013/09/ 7 KB
7 KB 111ms
110ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2013/09/lun7.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: d1feb54f2339859c3595bd26343b468bad05a7a11c0a5a9d86084c56e3a885ed

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Wed, 07 Jan 2015 16:55:34 GMT
server: nginx
etag: "54ad6506-1bdb"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 7131
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 lun61.jpg
geocult.ru/wp-content/uploads/2013/09/ 3 KB
3 KB 111ms
110ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2013/09/lun61.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 8b05625742e37f242707bde42df16ce7b828cc94f93238332f02624415d6c01f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Wed, 07 Jan 2015 16:55:29 GMT
server: nginx
etag: "54ad6501-c49"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 3145
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 natalkarta-1f-60x60.jpg
geocult.ru/wp-content/uploads/2016/04/ 3 KB
3 KB 111ms
110ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2016/04/natalkarta-1f-60x60.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: be91c72c97adfae4e70b223c2f23ffd07eaf26d315a53bb66134b11dc40bb661

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Sun, 10 Apr 2016 10:52:42 GMT
server: nginx
etag: "570a307a-a3c"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 2620
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 sun_lev_geocult-1-60x60.jpg
geocult.ru/wp-content/uploads/2015/09/ 2 KB
3 KB 111ms
110ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2015/09/sun_lev_geocult-1-60x60.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: c9092cfaa24952291b22481bfa4e399483260fc6fb162a6b942fed3ff42d76f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Wed, 27 Jan 2016 03:45:50 GMT
server: nginx
etag: "56a83d6e-9d8"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 2520
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 fon_sovmestimost_geocult-1-60x60.jpg
geocult.ru/wp-content/uploads/2014/08/ 3 KB
3 KB 111ms
110ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2014/08/fon_sovmestimost_geocult-1-60x60.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 21f14e408c57d0c0c9a833c314df5ff7f7695f054253d9eb2ce123ba0f2ac049

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Wed, 27 Jan 2016 03:43:46 GMT
server: nginx
etag: "56a83cf2-af2"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 2802
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 sun_6dome_geocult-1f-60x60.jpg
geocult.ru/wp-content/uploads/2015/10/ 2 KB
3 KB 112ms
110ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2015/10/sun_6dome_geocult-1f-60x60.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: aad870057003cbb9958374f555a06fb47dab183a03018ac1d1e88bffd1ded096

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Wed, 27 Jan 2016 03:43:51 GMT
server: nginx
etag: "56a83cf7-9f5"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 2549
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 natal_wheel_geocult-2f-60x60.jpg
geocult.ru/wp-content/uploads/2016/03/ 3 KB
4 KB 112ms
110ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2016/03/natal_wheel_geocult-2f-60x60.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: e6e4ae30d0e1fe5bfda2cdf9a430e4d2da17e5706b0011bf909b312814bcbd1e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Fri, 11 Mar 2016 10:29:39 GMT
server: nginx
etag: "56e29e13-df6"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 3574
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 lunniy_uzel-2f-60x60.jpg
geocult.ru/wp-content/uploads/2018/04/ 2 KB
2 KB 112ms
111ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/uploads/2018/04/lunniy_uzel-2f-60x60.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 41e8f29b28c908a3e09da0cdfc54be6adeef57c3ac6dbf393416e84e4d2c420b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Tue, 10 Apr 2018 12:55:02 GMT
server: nginx
etag: "5accb426-8a8"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 2216
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 avatar1-min.png
geocult.ru/wp-content/themes/evolve/images/ 500 B
673 B 112ms
111ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/themes/evolve/images/avatar1-min.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: b87216debe85ffb5d5f3f938c1c2cfed568d6736fd9bd06d64d85711ea5c8802

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Tue, 31 Jul 2018 08:02:32 GMT
server: nginx
etag: "5b601798-1f4"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 500
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 jquery.js Show response
geocult.ru/wp-includes/js/jquery/ 95 KB
33 KB 76ms
71ms Script
application/javascript 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://geocult.ru/wp-includes/js/jquery/jquery.js?ver=1.10.2
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
content-encoding: gzip
last-modified: Mon, 23 May 2016 09:00:29 GMT
server: nginx
etag: W/"5742c6ad-17ba0"
content-type: application/javascript
cache-control: max-age=691200
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 element.js Show response
translate.google.com/translate_a/ 89 KB
31 KB 207ms
75ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fbf65629db3825873b2e2b456b8b0dbb1724ff0bed8fc9cb158c26f15495e3d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 jquery.fancybox.css
geocult.ru/swetest/fancybox21/source/ 5 KB
2 KB 107ms
103ms Stylesheet
text/css 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://geocult.ru/swetest/fancybox21/source/jquery.fancybox.css?v=2.1.5
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 968a8e56e4adaf8c135199ebd7f6cc065424ca45974d4dfbeb5607e69fe72fcd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
content-encoding: gzip
last-modified: Sat, 03 Dec 2016 23:46:32 GMT
server: nginx
etag: W/"58435958-131f"
content-type: text/css
cache-control: max-age=691200
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 jquery.fancybox.pack.js Show response
geocult.ru/swetest/fancybox21/source/ 23 KB
9 KB 108ms
103ms Script
application/javascript 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://geocult.ru/swetest/fancybox21/source/jquery.fancybox.pack.js?v=2.1.5
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: bc50bf49cbe79ee49b4ee8b56f26ff4877bc4945c16f260b1481ba2355c96347

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
content-encoding: gzip
last-modified: Sat, 03 Dec 2016 23:46:34 GMT
server: nginx
etag: W/"5843595a-5a5f"
content-type: application/javascript
cache-control: max-age=691200
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 new-tab.min.js Show response
geocult.ru/wp-content/plugins/page-links-to/js/ 911 B
688 B 108ms
104ms Script
application/javascript 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://geocult.ru/wp-content/plugins/page-links-to/js/new-tab.min.js?ver=2.10.4
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 2baa2ebe463ced52f500118a25caa59f75536f3a49a36ae911ff5c37e1265669

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
content-encoding: gzip
last-modified: Sun, 10 Jun 2018 09:40:17 GMT
server: nginx
etag: W/"5b1cf201-38f"
content-type: application/javascript
cache-control: max-age=691200
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 comment-reply.min.js Show response
geocult.ru/wp-includes/js/ 1 KB
768 B 108ms
104ms Script
application/javascript 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://geocult.ru/wp-includes/js/comment-reply.min.js?ver=4.9.8
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 1b1ca0f15010e0124bd4ca481404643c88f7eda1b276e9554d0ed83fb45b7e30

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
content-encoding: gzip
last-modified: Wed, 18 Nov 2015 19:15:28 GMT
server: nginx
etag: W/"564cce50-436"
content-type: application/javascript
cache-control: max-age=691200
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 main-bg.jpg
geocult.ru/wp-content/themes/evolve/library/media/images/ 968 B
1 KB 110ms
109ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/themes/evolve/library/media/images/main-bg.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: d0a7940c5739597d973e2bb019d3e3cc8b5e8747e607982ebdbd4890f4288f3c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Fri, 19 May 2017 18:30:04 GMT
server: nginx
etag: "591f39ac-3c8"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 968
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 green-back.jpg
geocult.ru/wp-content/themes/evolve/library/media/images/header-two/ 4 KB
4 KB 110ms
110ms Image
image/jpeg 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/themes/evolve/library/media/images/header-two/green-back.jpg
Requested by: Host: geocult.ru
URL: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 3b3c66d6f6711dcb00f5ca69f10cc2e996c38c6c90facc8da13bbc88827433ca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Fri, 19 May 2017 19:18:17 GMT
server: nginx
etag: "591f44f9-fc8"
content-type: image/jpeg
cache-control: max-age=691200
accept-ranges: bytes
content-length: 4040
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 trans.png
geocult.ru/wp-content/themes/evolve/library/media/images/dark/ 97 B
268 B 110ms
110ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/themes/evolve/library/media/images/dark/trans.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 5942cf3294f46a9640870809b055e78887d7b48cc1e31a153d9c3b5dd7ef674b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Fri, 19 May 2017 18:30:27 GMT
server: nginx
etag: "591f39c3-61"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 97
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 shadow-before.png
geocult.ru/wp-content/themes/evolve/library/media/images/ 8 KB
8 KB 110ms
110ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/themes/evolve/library/media/images/shadow-before.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 0d43d9f15c54f63334de8305be7fabb614396c5e190a0756a417483ba9c61631

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Fri, 19 May 2017 18:30:09 GMT
server: nginx
etag: "591f39b1-1fb1"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 8113
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 shadow-after.png
geocult.ru/wp-content/themes/evolve/library/media/images/ 8 KB
8 KB 110ms
110ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/themes/evolve/library/media/images/shadow-after.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 9da58863c2d4a7e1f3c71a9a498588e7b74c3bf65fb97ddd126f1564fa7f9f02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Fri, 19 May 2017 18:30:09 GMT
server: nginx
etag: "591f39b1-1f66"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 8038
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 divider.png
geocult.ru/wp-content/themes/evolve/library/media/images/ 226 B
398 B 110ms
110ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/themes/evolve/library/media/images/divider.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: c4f459274e378b71dae7cd9514f4c3020545081e0de18560311a5aabf98f85b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Fri, 19 May 2017 18:29:53 GMT
server: nginx
etag: "591f39a1-e2"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 226
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 search.png
geocult.ru/wp-content/themes/evolve/library/media/images/ 788 B
961 B 110ms
110ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/themes/evolve/library/media/images/search.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 281bdb69ef6f2abc92abda9b18117ebbf50e9add63b183b2d9bc3fe3afbb3011

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Fri, 19 May 2017 18:30:08 GMT
server: nginx
etag: "591f39b0-314"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 788
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 list-style.png
geocult.ru/wp-content/themes/evolve/library/media/images/ 192 B
364 B 110ms
110ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/themes/evolve/library/media/images/list-style.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 83fef62511d4754a257551bd24d92efdeeb31c2886d07de22e9e947942233f6f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Fri, 19 May 2017 18:30:01 GMT
server: nginx
etag: "591f39a9-c0"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 192
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 divider-tile.png
geocult.ru/wp-content/themes/evolve/library/media/images/ 88 B
259 B 110ms
110ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/themes/evolve/library/media/images/divider-tile.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 992f94f905118b8960ff39ecea7dcec52afbb5b2a484b14cd817844ba03d7eab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Fri, 19 May 2017 18:29:53 GMT
server: nginx
etag: "591f39a1-58"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 88
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 facebook.png
geocult.ru/scripts/social_button/ 427 B
599 B 72ms
71ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/scripts/social_button/facebook.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: ec29871f7a6e470e699f7eb7a722c49ceffe8ebb682308c7279053da037d71d5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Tue, 10 Sep 2019 22:48:34 GMT
server: nginx
etag: "5d782842-1ab"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 427
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 twitter.png
geocult.ru/scripts/social_button/ 654 B
826 B 73ms
72ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/scripts/social_button/twitter.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 24d3f7c545ffb8d31d407b24b2c130774fae929ec9a92d6fe92f42608c858372

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Tue, 10 Sep 2019 22:48:34 GMT
server: nginx
etag: "5d782842-28e"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 654
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 mail-ru2.png
geocult.ru/scripts/social_button/ 900 B
1 KB 73ms
73ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/scripts/social_button/mail-ru2.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: a84f5718bcfaa18fbf0bc06b2fb8989141e7ef299b1a4793bd1082b48ce74cc2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Tue, 10 Sep 2019 20:04:44 GMT
server: nginx
etag: "5d7801dc-384"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 900
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 odnoklassniki.png
geocult.ru/scripts/social_button/ 664 B
837 B 74ms
73ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/scripts/social_button/odnoklassniki.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 608c7e96914ee8dea1cc0bbd2eee01f5f6d0b03521cebbc6116a7ba5940043cb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Tue, 10 Sep 2019 22:48:32 GMT
server: nginx
etag: "5d782840-298"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 664
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 vk.png
geocult.ru/scripts/social_button/ 610 B
782 B 74ms
74ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/scripts/social_button/vk.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: d3d89aa5cc7dbbdea39f3111b7460d064d7663ea92b04e79df0b39ef2e63b196

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Tue, 10 Sep 2019 22:48:32 GMT
server: nginx
etag: "5d782840-262"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 610
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 pinterest.png
geocult.ru/scripts/social_button/ 817 B
990 B 75ms
75ms Image
image/png 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/scripts/social_button/pinterest.png
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: d371219cab55549df0dc40dfb5a92d8d4be8b8ed24ab44d4c003fdb8b580cd56

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Tue, 10 Sep 2019 22:48:32 GMT
server: nginx
etag: "5d782840-331"
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
content-length: 817
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 reply.gif
geocult.ru/wp-content/themes/evolve/library/media/images/ 603 B
775 B 75ms
74ms Image
image/gif 185.182.111.117
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://geocult.ru/wp-content/themes/evolve/library/media/images/reply.gif
Requested by: Host: geocult.ru
URL: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.182.111.117 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: geocult.ru
Software: nginx /
Resource Hash: 436d9fdefdf3800e7aa8d543d79138dafd6a5fa95340a6d9df9515a99d6a243f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/wp-content/themes/evolve/stylev2.css?ver=3.6.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:46 GMT
last-modified: Fri, 19 May 2017 18:30:06 GMT
server: nginx
etag: "591f39ae-25b"
content-type: image/gif
cache-control: max-age=691200
accept-ranges: bytes
content-length: 603
expires: Sun, 17 Dec 2023 09:40:46 GMT

GET
H2 200 m=el_main_css
www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.qhDXWpKopYk.L.W.O/am=AAM/d=0/rs=AN8SPfoZVDB5be-TudnAO_y4l2LFY_GHyA/ 22 KB
5 KB 165ms
56ms Stylesheet
text/css 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.qhDXWpKopYk.L.W.O/am=AAM/d=0/rs=AN8SPfoZVDB5be-TudnAO_y4l2LFY_GHyA/m=el_main_css

Requested by

Host:
URL: /_/translate_http/_/js/k=translate_http.tr.de.GuXS6-6P8w8.O/am=AAM/d=1/rs=AN8SPfrY35p5UgdPn4TtdEjc1Lh8oviZKQ/m=el_conf

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 01:39:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28871
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4144
x-xss-protection: 0
last-modified: Sat, 15 Jul 2023 01:09:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="rosetta"
vary: Accept-Encoding
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 08 Dec 2024 01:39:36 GMT

GET
H2 200 m=el_main Show response
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.de.GuXS6-6P8w8.O/d=1/exm=el_conf/ed=1/rs=AN8SPfr3ZbhSsrYwMtac70GwiQJkP35SJw/ 255 KB
256 KB 172ms
59ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.de.GuXS6-6P8w8.O/d=1/exm=el_conf/ed=1/rs=AN8SPfr3ZbhSsrYwMtac70GwiQJkP35SJw/m=el_main

Requested by

Host:
URL: /_/translate_http/_/js/k=translate_http.tr.de.GuXS6-6P8w8.O/am=AAM/d=1/rs=AN8SPfrY35p5UgdPn4TtdEjc1Lh8oviZKQ/m=el_conf

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8abe56f67c72b6b5ba0f7e27e49d42791f1b687f45b7e370f2f78bf50ec9ae55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:21:59 GMT
x-content-type-options: nosniff
age: 40728
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 261444
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 14:12:04 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="rosetta"
vary: Accept-Encoding
report-to: {"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 22:21:59 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 168ms
54ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 09 Dec 2023 07:41:46 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 7141
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sat, 09 Dec 2023 09:41:46 GMT

GET
H/1.1

200
OK

hit
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit?t44.6;r;s1600*1200*24;uhttps%3A//geocult.ru/;0.34109486101085595
https://counter.yadro.ru/hit?q;t44.6;r;s1600*1200*24;uhttps%3A//geocult.ru/;0.34109486101085595

132 B
618 B

43ms
43ms

Image
image/gif

88.212.202.52
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit?q;t44.6;r;s1600*1200*24;uhttps%3A//geocult.ru/;0.34109486101085595

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

HTTP/1.1

Server

88.212.202.52 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host152.rax.ru

Software

nginx/1.17.9 /

Resource Hash

fa523f248a332cb89ae3ad8cf51d840153e0f96bcc2a4c8db736e02a340dab48

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 09 Dec 2023 09:40:47 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: image/gif
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin: *
Cache-control: no-cache
Connection: keep-alive
Content-Length: 132
Expires: Thu, 08 Dec 2022 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 09 Dec 2023 09:40:47 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: text/html
Location: https://counter.yadro.ru/hit?q;t44.6;r;s1600*1200*24;uhttps%3A//geocult.ru/;0.34109486101085595
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Cache-control: no-cache
Connection: keep-alive
Content-Length: 32
Expires: Thu, 08 Dec 2022 21:00:00 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312050101/ 398 KB
135 KB 226ms
118ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312050101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-2920555573584698&plah=geocult.ru&bust=31080036

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2920555573584698

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b34be8844746dad264cb241d51d31529f766aec0ea6fdc6251ba2a296226fe47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:47 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137722
x-xss-protection: 0
server: cafe
etag: 14614399634578301866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 09 Dec 2023 09:40:47 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231206/r20190131/ Frame 981C 9 KB
4 KB 175ms
56ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231206/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2920555573584698

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://geocult.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 51903
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 19:15:44 GMT
etag: 5585625838579639069
expires: Fri, 22 Dec 2023 19:15:44 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 90ms
90ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2920555573584698
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://geocult.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

POST
H2 200 collect Show response
www.google-analytics.com/j/ 16 B
218 B 62ms
61ms XHR
text/plain 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1968024731&t=pageview&_s=1&dl=https%3A%2F%2Fgeocult.ru%2F&ul=en-us&de=UTF-8&dt=Geocult.ru%20-%20%D0%90%D1%81%D1%82%D1%80%D0%BE%D0%BB%D0%BE%D0%B3%D0%B8%D1%87%D0%B5%D1%81%D0%BA%D0%B8%D0%B9%20%D0%B4%D0%BD%D0%B5%D0%B2%D0%BD%D0%B8%D0%BA.%20%D0%9D%D0%B0%D1%82%D0%B0%D0%BB%D1%8C%D0%BD%D0%B0%D1%8F%20%D0%BA%D0%B0%D1%80%D1%82%D0%B0%2C%20%D0%9B%D1%83%D0%BD%D0%BD%D1%8B%D0%B9%20%D0%BA%D0%B0%D0%BB%D0%B5%D0%BD%D0%B4%D0%B0%D1%80%D1%8C%2C%20%D0%90%D1%81%D1%82%D1%80%D0%BE%D0%BB%D0%BE%D0%B3%D0%B8%D1%8F.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=1017075823&gjid=1011338475&cid=1264822235.1702114847&tid=UA-55395314-1&_gid=1883080722.1702114847&_r=1&_slc=1&z=950393624

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

d752f92d971a6a3afd2a903855c7726ba385cf2ec11757e1fd694dbd661c45ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://geocult.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:47 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://geocult.ru
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
345 B 158ms
53ms XHR
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-55395314-1&cid=1264822235.1702114847&jid=1017075823&gjid=1011338475&_gid=1883080722.1702114847&_u=IEBAAEAAAAAAACAAI~&z=183387156

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://geocult.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sat, 09 Dec 2023 09:40:47 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://geocult.ru
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 230 KB
82 KB 174ms
64ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-DHBZR6TRD0&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6de5c919517958977650a2e58760508d731c5bc036fbbe1e8b2390d6c34dd14d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:47 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 83515
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 09 Dec 2023 09:40:47 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4C68 44 KB
15 KB 882ms
882ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&adk=1812271804&adf=3025194257&lmt=1693404896&plaf=2%3A2%2C7%3A2&plat=3%3A128%2C4%3A128%2C8%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=308x945_l%7C308x945_r&format=0x0&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~3~4~6&aslmct=0.8&asamct=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847105&bpp=4&bdt=321&idt=352&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=605185929340&frm=20&pv=2&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=378

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312050101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-2920555573584698&plah=geocult.ru&bust=31080036

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f05983b0651db23774b0ac51cc128eef55b1008c48d08c2b31fdf4cd9674b71e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://geocult.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 15806
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:48 GMT
expires: Sat, 09 Dec 2023 09:40:48 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1BE9 133 KB
44 KB 509ms
508ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&slotname=6315164047&adk=1815116396&adf=2119670097&pi=t.ma~as.6315164047&w=160&lmt=1693404896&format=160x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847109&bpp=1&bdt=326&idt=377&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1080&ady=1897&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=380

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

248143672c547e6928595867a5c2c7f127265619aa765588910435f1bc341fe4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://geocult.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 44550
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:48 GMT
expires: Sat, 09 Dec 2023 09:40:48 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated Show response
/ Frame EC0C 1 KB
1 KB Document
text/html

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 31f4e4abd5d8e145d6bd5505ae3ee469f66e6aba53fcc6cf04741d0a802ebc3d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Type: text/html;charset=UTF-8

GET
H2 200 24px.svg
fonts.gstatic.com/s/i/productlogos/translate/v14/ 6 KB
4 KB 219ms
53ms Image
image/svg+xml 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:31:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 554
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3340
x-xss-protection: 0
last-modified: Wed, 20 Apr 2022 14:24:23 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
vary: Accept-Encoding
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 08 Dec 2024 09:31:33 GMT

GET
H2 200 googlelogo_color_42x16dp.png
www.gstatic.com/images/branding/googlelogo/1x/ 910 B
1 KB 54ms
54ms Image
image/png 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_42x16dp.png

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 08:58:29 GMT
x-content-type-options: nosniff
age: 88938
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 910
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 07 Dec 2024 08:58:29 GMT

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 2 KB
2 KB 55ms
55ms Image
image/png 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/2x/translate_24dp.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.qhDXWpKopYk.L.W.O/am=AAM/d=0/rs=AN8SPfoZVDB5be-TudnAO_y4l2LFY_GHyA/m=el_main_css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.qhDXWpKopYk.L.W.O/am=AAM/d=0/rs=AN8SPfoZVDB5be-TudnAO_y4l2LFY_GHyA/m=el_main_css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 22:15:52 GMT
x-content-type-options: nosniff
age: 386695
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1842
x-xss-protection: 0
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 03 Dec 2024 22:15:52 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0BF4 120 KB
41 KB 1247ms
1246ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=4347476252&adk=504672438&adf=3417920651&pi=t.ma~as.4347476252&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847110&bpp=1&bdt=327&idt=414&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=416

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f65a77cba4ced3c364ceac29d4093ecf8c1a8510286b05a7094a9cbe2023945

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://geocult.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 41830
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:48 GMT
expires: Sat, 09 Dec 2023 09:40:48 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 243ms
82ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-55395314-1&cid=1264822235.1702114847&jid=1017075823&_u=IEBAAEAAAAAAACAAI~&z=56720748

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 263ms
102ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-55395314-1&cid=1264822235.1702114847&jid=1017075823&_u=IEBAAEAAAAAAACAAI~&z=56720748

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9B4C 25 KB
11 KB 544ms
544ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=6212002511&adk=1854347006&adf=3400082548&pi=t.ma~as.6212002511&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847111&bpp=1&bdt=328&idt=418&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=2725&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=420

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84b833327b6a970273fe2d1db07531c22996780a441e6072ac8f03844a4fcf25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://geocult.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11405
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:48 GMT
expires: Sat, 09 Dec 2023 09:40:48 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 91ms
91ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312050101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-2920555573584698&plah=geocult.ru&bust=31080036
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://geocult.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

POST
H2 204 collect
region1.analytics.google.com/g/ 0
250 B 102ms
37ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-DHBZR6TRD0&_ono=1&gtm=45je3bt0v9135369224&_p=1702114847338&_gaz=1&gcd=11l1l1l1l2&dma_cps=sypham&dma=1&ul=en-us&sr=1600x1200&cid=1264822235.1702114847&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EBAI&_s=1&dl=https%3A%2F%2Fgeocult.ru%2F&dt=Geocult.ru%20-%20%D0%90%D1%81%D1%82%D1%80%D0%BE%D0%BB%D0%BE%D0%B3%D0%B8%D1%87%D0%B5%D1%81%D0%BA%D0%B8%D0%B9%20%D0%B4%D0%BD%D0%B5%D0%B2%D0%BD%D0%B8%D0%BA.%20%D0%9D%D0%B0%D1%82%D0%B0%D0%BB%D1%8C%D0%BD%D0%B0%D1%8F%20%D0%BA%D0%B0%D1%80%D1%82%D0%B0%2C%20%D0%9B%D1%83%D0%BD%D0%BD%D1%8B%D0%B9%20%D0%BA%D0%B0%D0%BB%D0%B5%D0%BD%D0%B4%D0%B0%D1%80%D1%8C%2C%20%D0%90%D1%81%D1%82%D1%80%D0%BE%D0%BB%D0%BE%D0%B3%D0%B8%D1%8F.&sid=1702114847&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1357
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DHBZR6TRD0&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:47 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://geocult.ru
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 53ms
53ms Ping
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&_ono=1&tid=G-DHBZR6TRD0&cid=1264822235.1702114847&gtm=45je3bt0v9135369224&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DHBZR6TRD0&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:47 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://geocult.ru
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 127ms
81ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&_ono=1&tid=G-DHBZR6TRD0&cid=1264822235.1702114847&gtm=45je3bt0v9135369224&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l2&z=1942336115

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 e21910fd923a6283b5d44b2382eabc86.js Show response
www.gstatic.com/mysidia/ Frame 1BE9 9 KB
4 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/e21910fd923a6283b5d44b2382eabc86.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&slotname=6315164047&adk=1815116396&adf=2119670097&pi=t.ma~as.6315164047&w=160&lmt=1693404896&format=160x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847109&bpp=1&bdt=326&idt=377&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1080&ady=1897&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=380

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

27d5ba2175dc395614adb2c69fe9f4bff9abddef3a7c6e3e30a68587f428a37b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 03:13:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23249
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4064
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 22:13:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 08 Mar 2024 03:13:19 GMT

GET
H3 200 eca8f43f04ace2cb887c6c133446ca43.js Show response
www.gstatic.com/mysidia/ Frame 1BE9 11 KB
5 KB 56ms
55ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/eca8f43f04ace2cb887c6c133446ca43.js?tag=text/vanilla_highlight_ms

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a2366f8ceefa49f15dbf946bb02a4cf52b6d2999f71712d3f52e8bd5f56e1988

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 03:19:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22895
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4745
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 22:13:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 08 Mar 2024 03:19:13 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 1BE9 14 KB
2 KB 184ms
66ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 09 Dec 2023 09:40:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 09 Dec 2023 09:36:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 09 Dec 2023 09:40:48 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 1BE9 2 KB
903 B 134ms
73ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:55:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53136
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:55:12 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame 1BE9 24 KB
9 KB 167ms
106ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:54:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53165
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:54:43 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 1BE9 3 KB
1 KB 134ms
74ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41930
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 22:01:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 1BE9 20 KB
9 KB 170ms
55ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46717
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:42:11 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1BE9 202 KB
64 KB 227ms
93ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 09:40:48 GMT

GET
H3 200 f9d9b65dbd646119ce96bad0f484d579.js Show response
www.gstatic.com/mysidia/ Frame 1BE9 37 KB
15 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f9d9b65dbd646119ce96bad0f484d579.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 04:32:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 277689
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15460
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 04:10:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 05 Mar 2024 04:32:39 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9B4C 42 B
63 B 89ms
89ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CtZQkZizKk6Z_dhqdl0JBjne2Sm1f94r4B_CRdHxMvjTvVQ402BLVEp0_9LJBuNuaLUHsmgW6YmboMbr_BUUpJMDH1tzHCHNG3yWPubo3ml-rlZOk

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=6212002511&adk=1854347006&adf=3400082548&pi=t.ma~as.6212002511&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847111&bpp=1&bdt=328&idt=418&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=2725&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=420

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 9B4C 89 KB
31 KB 108ms
107ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sat, 09 Dec 2023 09:40:48 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 9B4C 3 KB
1 KB 150ms
70ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41930
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 22:01:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 9B4C 20 KB
8 KB 146ms
63ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46717
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:42:11 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C978 624 B
246 B 96ms
96ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNVsJGBuEup25riz2GGo5Us29d419LMfDUhOVkcZr605uw5OGJD2Tn3cDRejzcYykc-DrzzUaFC9dVwR1PRfSBsqi0ioOyiUMyz9Q8aeyB32QHwxjyGt2LfKW-vPuTBfrTcecoAymRcWX5A5qzzXSMWkX9IFglRNEfiulnwA40kyTjRshHw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=6212002511&adk=1854347006&adf=3400082548&pi=t.ma~as.6212002511&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847111&bpp=1&bdt=328&idt=418&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=2725&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=420
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:48 GMT
expires: Sat, 09 Dec 2023 09:40:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9B4C 202 KB
64 KB 283ms
185ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 09:40:48 GMT

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/4502247047325849301/ Frame 1BE9 3 KB
3 KB 173ms
115ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4502247047325849301/14763004658117789537?w=100&h=100&tw=1&q=75

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf86d359d1531aee2e46233f03df7649a5ef3041f9550ff063ba329d25103229

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 23:00:40 GMT
x-content-type-options: nosniff
age: 38408
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3085
x-xss-protection: 0
last-modified: Wed, 18 Oct 2023 22:30:22 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 07 Dec 2024 23:00:40 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 702C 143 B
166 B 54ms
54ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&slotname=6315164047&adk=1815116396&adf=2119670097&pi=t.ma~as.6315164047&w=160&lmt=1693404896&format=160x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847109&bpp=1&bdt=326&idt=377&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1080&ady=1897&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=380
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 142
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:38:26 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 702C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

63ms
63ms

Document
text/html

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:48 GMT
expires: Sat, 09 Dec 2023 09:40:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:48 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C978
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9SLDbyR7uCnyIyDoaf-lo&google_cver=1

43 B
773 B

22ms
21ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9SLDbyR7uCnyIyDoaf-lo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNVsJGBuEup25riz2GGo5Us29d419LMfDUhOVkcZr605uw5OGJD2Tn3cDRejzcYykc-DrzzUaFC9dVwR1PRfSBsqi0ioOyiUMyz9Q8aeyB32QHwxjyGt2LfKW-vPuTBfrTcecoAymRcWX5A5qzzXSMWkX9IFglRNEfiulnwA40kyTjRshHw
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ILnFdDmrhEmkXwgkEWL3SjEQ7NsShT1wRi7q4R98y%2FFZ37fzq4lcpRI0DTXbpO2TnMSp6057kzxziahP2bZHe7%2FgDAJbKE6pCDhpa1XNh35i0YIW3FV8%2Fk4Rj%2FachAY2tReiPW%2B8UXELKQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 832c49eafb053734-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9SLDbyR7uCnyIyDoaf-lo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C978
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZXQ2IIVndCUFQWlXDvJUwwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9SLDbyR7uCnyIyDoaf-lo&google_cver=1

43 B
743 B

19ms
19ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9SLDbyR7uCnyIyDoaf-lo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNVsJGBuEup25riz2GGo5Us29d419LMfDUhOVkcZr605uw5OGJD2Tn3cDRejzcYykc-DrzzUaFC9dVwR1PRfSBsqi0ioOyiUMyz9Q8aeyB32QHwxjyGt2LfKW-vPuTBfrTcecoAymRcWX5A5qzzXSMWkX9IFglRNEfiulnwA40kyTjRshHw
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hQVeQ6ofNogEZvnR05xT9RVsvTtZ3LOy4AXymAbBqzlXGWRMiqy4vA8Mpx8L0M9%2B8U4RUCXbg%2FYOpwm%2FQXr26dh%2BIzudK7Da%2FrpdXBmSLTRtH159jM6OEfd7LG%2BP%2Bq%2BITS70nIuPVnDITQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 832c49eafb123734-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9SLDbyR7uCnyIyDoaf-lo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame C978
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEL-BtaHp31leN40UteUQur4&google_cver=1

43 B
847 B

25ms
25ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEL-BtaHp31leN40UteUQur4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNVsJGBuEup25riz2GGo5Us29d419LMfDUhOVkcZr605uw5OGJD2Tn3cDRejzcYykc-DrzzUaFC9dVwR1PRfSBsqi0ioOyiUMyz9Q8aeyB32QHwxjyGt2LfKW-vPuTBfrTcecoAymRcWX5A5qzzXSMWkX9IFglRNEfiulnwA40kyTjRshHw

Protocol

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:48 GMT
an-x-request-uuid: 39bc5ee9-fe6a-4f1c-9721-f8aeca98a934
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 185.213.155.187; 185.213.155.187; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEL-BtaHp31leN40UteUQur4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame C978
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMyMzkzNjc5ODA1MDM3MzQzNg%3D%3D

170 B
243 B

73ms
46ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMyMzkzNjc5ODA1MDM3MzQzNg%3D%3D

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:48 GMT
an-x-request-uuid: cceabf45-be28-4415-b551-3f7066c4e414
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMyMzkzNjc5ODA1MDM3MzQzNg%3D%3D
x-proxy-origin: 185.213.155.187; 185.213.155.187; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9B4C 0
20 B 89ms
89ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=475640551548&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9B4C 0
20 B 88ms
88ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=475640551548&version=m202309260101&ct=77&x=1&cor=10934541215935863000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9B4C 20 KB
13 KB 190ms
189ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C-RvJk3dbTGZkkAQu4OBL5ZLkabRH4n_nqbdw2qDtjO8am5bLnl_f51Dafe82O4YA4uxWRmHWyvCyK3DzcxowU2qYY9NmGgXOmOIgQ64iIJlCdMOCqRklB_s8PZUY7zJSvxuuwcJUbWz8GI0_7oaIZdQs2dvf9Xh0r8gXux-Tn6hceIBs&cry=1&dbm_d=AKAmf-AUWfUeHfkcvUPMfVuigRMAWxGs36BI2nYnrQMip-7yhSH2n4Sbdt9ZE_1wsJIRsK0cvzypuRaw8yKOpyIaNG46dWerHpulHTd835S6dKVpNeP074FJvUGfolBQkuC6s9f689Sph7ujGHWZlimLs-R4eiMahjSqaJ5YZas_3i14Ku0ofCukIh1xs7Wh32USAm8OJgBE4po49AMHf5C4_F6d3DbDldUtj9j3QN6Fp_6igcvpfLj_2h4XlHKBUN9PUXH-RkHDwxrFFJ5UmczRGigZ6gi-1_N3grSmq6lBayiJ29m7ktR4dlxaC0ABt7jx8T1fnXa5AxjO7Jvt561Nriu3FqDaKYoAtdNACqK_JVimD6-RYsqPqjUP4D6892aBdaxfh10DrpISHF0n9p4RQDDhLJVhlvk7d_tCsmGRPbDdKWkJflsjcfqVTwubIGhq_A9ibv96FVZ2F90O7c4_YfLUglRE3ZgE51UHe_dKfmBqxH9Q1axb2-PyhhOzmRMCiAEfPgwYAR4e43SMEZIm3c1muE_HG1fHZwvAYlzSpPIV8DT_7egxVHPcToJajGUYxcOuivm9UUkYmV0OE-hEmqglvdOAMdzZYcxloRglF_dzOsZQCQ_xbXBhvPINZUWGlKyTgt_ERE7v2WBCVCPectSdoxgGa5iwcCOsPVXLGuiROnTHa0V9_DtzK9XZbWXL1BRPQm1o2ITXD40taBpuJ097FbCuXSglfhOXcNuNAuTKLMo6kMjz-8MX8b0_N3EbRVVchKR8pzwBayLouP7qvtxwg5OBy9hIZPhgmjcoZ_IEQvEwXakNHb9EbpTHcE2gv6e3XTMLXpHzmRdaNZ7lBpc1UJJcND07UZYBRevIaErPkxTy4WCkEuV8_6d6dhqQ2XputbQFZYrv_mqetPUjgnLg4ZRUo_BJGW5wPdI9JeUPGkuGnV-v_mk0XxZuaUOot5RE9PMi97poWIkqKzW1_6NsiDdVxqClZmJvfwZxPhlkQVSqsbkLyASbC7MRNP_RaoeOZatVyJfVspUJ0b3qyfhpW176lUe-j_-RXU_tH6xJGh7mkvYNwJiKT4H9mE1uowq8hLtghmhPHfYTsqtnkSVsCIaC1IakQ-7zSKwbUBNZKrU5-PyFtyoRZJj7IiYJ-yrV-9T6Kyslm6yXMz_IgdHxcJtWTjO232WSJZa_fFpaqZaFOqQk7WvYSVTNFa8I3inQWcSkaExwJ33dRaMzOVWM2yV-MPhayxu_YCblJed_ib_zcjFQjW5ccnPSNjemFRbV4gu_tEZ5iCERduSvu29o5QISeZKI5Un4LFCT0zCWSuR3R32WQ8n1knPHg7uhZUxpoeAvj31Xl9EmwuBeIfQnlX8isnT9bIyuZDQo7Zn8XCJPWXYxlIFobgubqHD7R5uXIacTg_WtaPlRiAz6xhV5wS-I644JATYh3gg7UIxl6bQKGqt5ob_N4P3ImS-wrcBqaVlZ4jzPrFkYyPDJ85YMzKNQh-7KaRHqqaZ4qMpIwP8uRydTUHQTubaIHr_la8IkOsRFx9Tk-gaJKyoqI3lMaWZDpBd1wFUbbPEDbchOyrhJ3jY29XdV-5KE8w_QnQ98xKO2JUy4JdoXutdDS7GVkXGORLTJDncZHcwV58tDMYcKy1aESuV4R8UKR5HKlORbxcqYNPjY4033SbXuBdh0zJcbOaSZ7JcLUYX9p4Obf81oDGOy3bNKdtaTSheiLtJyT3Y9OWTZimdNkLjWuOyiu6v89ilONu6YWnonf4uFH_aITxQ1E58b-22a8qNb-NbrCUrKkkj2OInAO7KzLx-2qhhB0fPGWmeNM0v4HNxDAfFAcQdlLG29v-5z1gi7AjFQCvfchNRCq4JWRGVDoKt9XN-_TWus-UuJEfMPd74Pkxg4YEiYW8CbZBgY1nzFwBJMhrh1LtIFbB7vC3W7vjVQ1CPvuXOfgxQ27OZIpvDisBPL_7OXNDoHmTPt04zAclMafkAjZUXVLGvxMRNxfX__5oglkoPCiuLrpa9Iwf4karSqRTSUJ0qQ6BA4-ZeK8w2DU2LUlusiqWLptf6-YHWUmSnbQ5hQYg9TAbWGvtBhFLnMlyqo6c_qFIRMcS1VA2QKHObNI66KUi1KZkYVXYIxuyALgXnmAdLK1nfPSOvm0Z_s5WpfLqTwsF7O75_5LhxKlqDfDUrGtcuqdrFPUVEflIManFSqZZZ_sH1JATup1GvI9BVZkfV7_2qQHNJ5DcypanIFEHViXGKyKbRN82HP2W1wrd2gxnVHdm1fNHKmCxsEEDJpuDcx2xPolWds7BW-FO-uW7GnmUam1KelOkJKluL-g1taO0Q19VoQhq-QOJcTE7h_ZktxSXPQAD-aU7Nsnu3282QhuZ9Mg_dmiy30GM_vXtNdyoA9vaBqWhSf2n1_WSWeS9i0pfenD1PXVSEKoK7oebTLojxbGU96YZF-7ACqZZJGdOU41eG9V9bjqDyPhW07U87CCr5oQ-e6qT29rYsJeuXIKatry7A-RRLTKNrV5qnbFEuGfSOnOVwHfvKGeKn_OhtEobOxP_ojyQpA-0G_MOVNddU8SF16ExldKYxqb2BKXRX-v4ju2aPqcRPA2reDYg4LZihK2_ye5qEfLLos50MPgxtaD38OPxUjXzaXB3UmVfmlI7Qgwru9C0msMHRs0iFakeEwzWxPbxonrNfTDm0GTyRaxTAU7MrBPr4yPqbKGxU8NYjAQrH_zoJp_JkrSg_Ucyw6PTHCb4VGiDbzSTRNmVPVomN4ycdMMMpcD24Kt4FUnRfkEcetfX86w1UpsWYCcaq7IziVAGbd8bkEfrggdYs9FDM8wTLrF5xlgKHxDiFEzUfBV8zGm1VoNUX1i_XJJnNzX2kJ-svu8wYuUM6UhbZmLZRd6ImBEYt2cDA7dXaQfi8jWZPX18XCHsLgf1j4MELtJKYF802yH5HwCXE1zwU24_dSZJHvdO95frL6tKYz_dnah8wAIRdbdOxxlHFn73lwQRozb_DPPL3hwr09nUKIJ9jb5mwnC_LSdKGdsKi4EVZBEs8qdh01pLeKKoxnNfc59Qi4M4vDUvtanICOo19qXQ_-6kbDrcOOY316C0x4NbKQo2Ym1dNr4xJTjUR3S1-OVZPWigz7FSczpRr53DvssL3wqfiUO-NCvdQJy0MTBvP708MkyjihkgcBIjAcIM4zhQgR9F4Yp77R-nMIPpU2S98wDZLY7rDS6YDkvq-ZNqhhdhXEVCvbA-b0-b6gfa9ymmdz3lFZ1gba2myf8UGRRzvf_XVzq0d7iDv6W6nFUOiIHpH6oYUNeO-d9C-nhv18k7GmyaX4JYACmqq-f76WkDnn_YZyxrXpCD0Ebsdn9taY_uYHLtv50K9qmpXuLWUZeaRiWIueOVaN9AKnf_K1rgGS6dG5HiytkNFvaFQknLPcUFshmOZI1InyciRlSOdKkzDolpWDi971G_QXVSVSODhtvQft06SaA4xe5jSUwljWmFdw2MZuiaNHcbeHGBmvdWa-PDmWGQWYLa_YLOexFNIGfdxP3qhKFCghB1OPXwCsJl2s3Ic-sU5qTLB8H8UIRSTf19lLE-lFTQxPeDHKjs2sMhAsyGXR1bkwHFaGaz4-FtHXekltRs5dEddUnaPtK2GkeNK90YaA0jP6GquR5WLWVGz6eAmeR3bEJP1mEGomB9bttb71G844WKGpPqHJdP6MPAciNNPP6EDcK5kftNQz6ViAM-H_4yw326VQGL_9vvZY8F_YOmdJL6Zc7z9EecZ3XDrahI0JdPnnqrLuSjwcOlSm9lpxMggOxbCSIH_a7jhczChKQIZcJzUx9UfxWV0z1vR1Kpvab02BINqk5j921TEwTRVBVbyWjmew_LBwFa9SMjkEBk4Qwu2MqXrHLFVak0T4iWWd9OAP2ifCDt_e2_TQTzyFQEcWE7_SBABp-PmNqzQ6tX0Qj4w-q82zxJYpnr2VkfNNjZvM5HG_4ZmkZnrh7FUju8_8G6KwPk5Xi3XIMaP0OvGYz-NUaTTmhrZx9qJBB-pGEfUEtEXJcA9W7Q30FPuTUaimkWVVxXNQc_ObLLu9YSyYEk4GZzq18EK9fn-THVsC&cid=CAQSTgDICaaNXxo6vdRsOHbxSvBL1f3eEwKATbEJlqZ09lONmoK3S7tWpIP5rfg9DIouwOhx2V24Tmmu4TAnDON-R85r3PDxDQxmDuMTjv7uWBgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fgeocult.ru%2F&ds=l&xdt=1&iif=1&cor=10934541215935863000&adk=2228999114&idt=116&cac=0&dtd=13

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

942001ceddf42da68272e8b1c9a215259faf7a3246d8aa095b08319f7f79a17d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=6212002511&adk=1854347006&adf=3400082548&pi=t.ma~as.6212002511&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847111&bpp=1&bdt=328&idt=418&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=2725&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=420
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13784
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 1BE9 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 25e40b307b4564d30d2b76065ee77f4792328e947e8c0c5397e25bdbc7dd092f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 90ms
90ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312050101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-2920555573584698&plah=geocult.ru&bust=31080036
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://geocult.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 1BE9 33 KB
33 KB 171ms
57ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 21:01:51 GMT
x-content-type-options: nosniff
age: 218337
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 05 Dec 2024 21:01:51 GMT

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjYUvaYr.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 1BE9 15 KB
15 KB 175ms
61ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjYUvaYr.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5825c88b68a498c8b3d8d34f0090a625f063a366c8f3cbebf51e7657623fb13b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 16:45:44 GMT
x-content-type-options: nosniff
age: 60904
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15352
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:34:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 16:45:44 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 1BE9
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=C9DvNHzZ0ZZqQMf_U5LcP5o62yAfZlYGtdNnvkfCrEuqf3KDUARABINTHmpcBYJXikIKgB6ABg6yNqirIAQGpAmItiH_3DrI-qAMByAPLBKoEzQFP0DEOdAeXeTsYchsS0J05Esp9obWrI-i...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2213998669173743805051%22,%22debug_reporting%22:true,%22destination%22:%22https://novapost.com%22,%22event_report_window%22:...

0
0

143ms
71ms

Fetch
text/css

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2213998669173743805051%22,%22debug_reporting%22:true,%22destination%22:%22https://novapost.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211362588163%22],%224%22:[%2212-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2211788369259742594849%22}&andc=true

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:49 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"13998669173743805051","debug_reporting":true,"destination":"https://novapost.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11362588163"],"4":["12-09"],"6":["true"]},"priority":"500","source_event_id":"11788369259742594849"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 09 Dec 2023 09:40:49 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 09 Dec 2023 09:40:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"13998669173743805051","debug_reporting":true,"destination":"https://novapost.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11362588163"],"4":["12-09"],"6":["true"]},"priority":"500","source_event_id":"11788369259742594849"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js Show response
pagead2.googlesyndication.com/bg/ Frame 47BB 50 KB
19 KB 58ms
58ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 13:55:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71142
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19601
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 13:55:06 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 9B4C 41 KB
14 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C-RvJk3dbTGZkkAQu4OBL5ZLkabRH4n_nqbdw2qDtjO8am5bLnl_f51Dafe82O4YA4uxWRmHWyvCyK3DzcxowU2qYY9NmGgXOmOIgQ64iIJlCdMOCqRklB_s8PZUY7zJSvxuuwcJUbWz8GI0_7oaIZdQs2dvf9Xh0r8gXux-Tn6hceIBs&cry=1&dbm_d=AKAmf-AUWfUeHfkcvUPMfVuigRMAWxGs36BI2nYnrQMip-7yhSH2n4Sbdt9ZE_1wsJIRsK0cvzypuRaw8yKOpyIaNG46dWerHpulHTd835S6dKVpNeP074FJvUGfolBQkuC6s9f689Sph7ujGHWZlimLs-R4eiMahjSqaJ5YZas_3i14Ku0ofCukIh1xs7Wh32USAm8OJgBE4po49AMHf5C4_F6d3DbDldUtj9j3QN6Fp_6igcvpfLj_2h4XlHKBUN9PUXH-RkHDwxrFFJ5UmczRGigZ6gi-1_N3grSmq6lBayiJ29m7ktR4dlxaC0ABt7jx8T1fnXa5AxjO7Jvt561Nriu3FqDaKYoAtdNACqK_JVimD6-RYsqPqjUP4D6892aBdaxfh10DrpISHF0n9p4RQDDhLJVhlvk7d_tCsmGRPbDdKWkJflsjcfqVTwubIGhq_A9ibv96FVZ2F90O7c4_YfLUglRE3ZgE51UHe_dKfmBqxH9Q1axb2-PyhhOzmRMCiAEfPgwYAR4e43SMEZIm3c1muE_HG1fHZwvAYlzSpPIV8DT_7egxVHPcToJajGUYxcOuivm9UUkYmV0OE-hEmqglvdOAMdzZYcxloRglF_dzOsZQCQ_xbXBhvPINZUWGlKyTgt_ERE7v2WBCVCPectSdoxgGa5iwcCOsPVXLGuiROnTHa0V9_DtzK9XZbWXL1BRPQm1o2ITXD40taBpuJ097FbCuXSglfhOXcNuNAuTKLMo6kMjz-8MX8b0_N3EbRVVchKR8pzwBayLouP7qvtxwg5OBy9hIZPhgmjcoZ_IEQvEwXakNHb9EbpTHcE2gv6e3XTMLXpHzmRdaNZ7lBpc1UJJcND07UZYBRevIaErPkxTy4WCkEuV8_6d6dhqQ2XputbQFZYrv_mqetPUjgnLg4ZRUo_BJGW5wPdI9JeUPGkuGnV-v_mk0XxZuaUOot5RE9PMi97poWIkqKzW1_6NsiDdVxqClZmJvfwZxPhlkQVSqsbkLyASbC7MRNP_RaoeOZatVyJfVspUJ0b3qyfhpW176lUe-j_-RXU_tH6xJGh7mkvYNwJiKT4H9mE1uowq8hLtghmhPHfYTsqtnkSVsCIaC1IakQ-7zSKwbUBNZKrU5-PyFtyoRZJj7IiYJ-yrV-9T6Kyslm6yXMz_IgdHxcJtWTjO232WSJZa_fFpaqZaFOqQk7WvYSVTNFa8I3inQWcSkaExwJ33dRaMzOVWM2yV-MPhayxu_YCblJed_ib_zcjFQjW5ccnPSNjemFRbV4gu_tEZ5iCERduSvu29o5QISeZKI5Un4LFCT0zCWSuR3R32WQ8n1knPHg7uhZUxpoeAvj31Xl9EmwuBeIfQnlX8isnT9bIyuZDQo7Zn8XCJPWXYxlIFobgubqHD7R5uXIacTg_WtaPlRiAz6xhV5wS-I644JATYh3gg7UIxl6bQKGqt5ob_N4P3ImS-wrcBqaVlZ4jzPrFkYyPDJ85YMzKNQh-7KaRHqqaZ4qMpIwP8uRydTUHQTubaIHr_la8IkOsRFx9Tk-gaJKyoqI3lMaWZDpBd1wFUbbPEDbchOyrhJ3jY29XdV-5KE8w_QnQ98xKO2JUy4JdoXutdDS7GVkXGORLTJDncZHcwV58tDMYcKy1aESuV4R8UKR5HKlORbxcqYNPjY4033SbXuBdh0zJcbOaSZ7JcLUYX9p4Obf81oDGOy3bNKdtaTSheiLtJyT3Y9OWTZimdNkLjWuOyiu6v89ilONu6YWnonf4uFH_aITxQ1E58b-22a8qNb-NbrCUrKkkj2OInAO7KzLx-2qhhB0fPGWmeNM0v4HNxDAfFAcQdlLG29v-5z1gi7AjFQCvfchNRCq4JWRGVDoKt9XN-_TWus-UuJEfMPd74Pkxg4YEiYW8CbZBgY1nzFwBJMhrh1LtIFbB7vC3W7vjVQ1CPvuXOfgxQ27OZIpvDisBPL_7OXNDoHmTPt04zAclMafkAjZUXVLGvxMRNxfX__5oglkoPCiuLrpa9Iwf4karSqRTSUJ0qQ6BA4-ZeK8w2DU2LUlusiqWLptf6-YHWUmSnbQ5hQYg9TAbWGvtBhFLnMlyqo6c_qFIRMcS1VA2QKHObNI66KUi1KZkYVXYIxuyALgXnmAdLK1nfPSOvm0Z_s5WpfLqTwsF7O75_5LhxKlqDfDUrGtcuqdrFPUVEflIManFSqZZZ_sH1JATup1GvI9BVZkfV7_2qQHNJ5DcypanIFEHViXGKyKbRN82HP2W1wrd2gxnVHdm1fNHKmCxsEEDJpuDcx2xPolWds7BW-FO-uW7GnmUam1KelOkJKluL-g1taO0Q19VoQhq-QOJcTE7h_ZktxSXPQAD-aU7Nsnu3282QhuZ9Mg_dmiy30GM_vXtNdyoA9vaBqWhSf2n1_WSWeS9i0pfenD1PXVSEKoK7oebTLojxbGU96YZF-7ACqZZJGdOU41eG9V9bjqDyPhW07U87CCr5oQ-e6qT29rYsJeuXIKatry7A-RRLTKNrV5qnbFEuGfSOnOVwHfvKGeKn_OhtEobOxP_ojyQpA-0G_MOVNddU8SF16ExldKYxqb2BKXRX-v4ju2aPqcRPA2reDYg4LZihK2_ye5qEfLLos50MPgxtaD38OPxUjXzaXB3UmVfmlI7Qgwru9C0msMHRs0iFakeEwzWxPbxonrNfTDm0GTyRaxTAU7MrBPr4yPqbKGxU8NYjAQrH_zoJp_JkrSg_Ucyw6PTHCb4VGiDbzSTRNmVPVomN4ycdMMMpcD24Kt4FUnRfkEcetfX86w1UpsWYCcaq7IziVAGbd8bkEfrggdYs9FDM8wTLrF5xlgKHxDiFEzUfBV8zGm1VoNUX1i_XJJnNzX2kJ-svu8wYuUM6UhbZmLZRd6ImBEYt2cDA7dXaQfi8jWZPX18XCHsLgf1j4MELtJKYF802yH5HwCXE1zwU24_dSZJHvdO95frL6tKYz_dnah8wAIRdbdOxxlHFn73lwQRozb_DPPL3hwr09nUKIJ9jb5mwnC_LSdKGdsKi4EVZBEs8qdh01pLeKKoxnNfc59Qi4M4vDUvtanICOo19qXQ_-6kbDrcOOY316C0x4NbKQo2Ym1dNr4xJTjUR3S1-OVZPWigz7FSczpRr53DvssL3wqfiUO-NCvdQJy0MTBvP708MkyjihkgcBIjAcIM4zhQgR9F4Yp77R-nMIPpU2S98wDZLY7rDS6YDkvq-ZNqhhdhXEVCvbA-b0-b6gfa9ymmdz3lFZ1gba2myf8UGRRzvf_XVzq0d7iDv6W6nFUOiIHpH6oYUNeO-d9C-nhv18k7GmyaX4JYACmqq-f76WkDnn_YZyxrXpCD0Ebsdn9taY_uYHLtv50K9qmpXuLWUZeaRiWIueOVaN9AKnf_K1rgGS6dG5HiytkNFvaFQknLPcUFshmOZI1InyciRlSOdKkzDolpWDi971G_QXVSVSODhtvQft06SaA4xe5jSUwljWmFdw2MZuiaNHcbeHGBmvdWa-PDmWGQWYLa_YLOexFNIGfdxP3qhKFCghB1OPXwCsJl2s3Ic-sU5qTLB8H8UIRSTf19lLE-lFTQxPeDHKjs2sMhAsyGXR1bkwHFaGaz4-FtHXekltRs5dEddUnaPtK2GkeNK90YaA0jP6GquR5WLWVGz6eAmeR3bEJP1mEGomB9bttb71G844WKGpPqHJdP6MPAciNNPP6EDcK5kftNQz6ViAM-H_4yw326VQGL_9vvZY8F_YOmdJL6Zc7z9EecZ3XDrahI0JdPnnqrLuSjwcOlSm9lpxMggOxbCSIH_a7jhczChKQIZcJzUx9UfxWV0z1vR1Kpvab02BINqk5j921TEwTRVBVbyWjmew_LBwFa9SMjkEBk4Qwu2MqXrHLFVak0T4iWWd9OAP2ifCDt_e2_TQTzyFQEcWE7_SBABp-PmNqzQ6tX0Qj4w-q82zxJYpnr2VkfNNjZvM5HG_4ZmkZnrh7FUju8_8G6KwPk5Xi3XIMaP0OvGYz-NUaTTmhrZx9qJBB-pGEfUEtEXJcA9W7Q30FPuTUaimkWVVxXNQc_ObLLu9YSyYEk4GZzq18EK9fn-THVsC&cid=CAQSTgDICaaNXxo6vdRsOHbxSvBL1f3eEwKATbEJlqZ09lONmoK3S7tWpIP5rfg9DIouwOhx2V24Tmmu4TAnDON-R85r3PDxDQxmDuMTjv7uWBgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fgeocult.ru%2F&ds=l&xdt=1&iif=1&cor=10934541215935863000&adk=2228999114&idt=116&cac=0&dtd=13

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56140
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 18:05:08 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMjExNDg0ODQwNzgzOQogIHNlcnZlcl9pcDogMTQ2NTI5OTUyCiAgcHJvY2Vzc19pZDogMzkyNjA3MzkyMwp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame 9B4C 0
866 B 175ms
78ms Image
image/png 142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMjExNDg0ODQwNzgzOQogIHNlcnZlcl9pcDogMTQ2NTI5OTUyCiAgcHJvY2Vzc19pZDogMzkyNjA3MzkyMwp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxMzI4NTYwMjQxMjAxNTE2NzI2MgpkZWJ1Z19rZXk6IDc5NDgzMTIzNDc4MTI0MDkwMTAKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDIzLTEyLTA5IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIyNTk3NDEKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIxMjMyMAogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vYWQtc3J2Lm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2tsaWNrLXdlbHQuZGUiCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3MzgxOTc1MDQK

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x3c7edb9b0b5989490000000000000000","13":"0x8aee6954da046a1a0000000000000000","14":"0x7c31c841f080dc7f0000000000000000","15":"0xac3f8137c6e736a90000000000000000"},"debug_key":"7948312347812409010","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"13285602412015167262"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK wmoiqux43uzw Show response
hal9000.redintelligence.net/zone/ Frame 9B4C 11 KB
4 KB 40ms
12ms Script
text/html 138.201.63.117
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1702114847789672&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrZTFHzZ0ZaiZMOHUxtYP7tOWkAWm5b2gab2TnKfJD_AuEAEg1MealwFgleKQgqAHyAEJqQJiLYh_9w6yPqgDAcgDmwSqBN4BT9AiVjVcv3pO5yZW6_3fSL4XIRkOCaqLceMH4yCoxQkrQYBn2wEAGLgbs5Zq82izRhILNhR0zeTyDTK78OUsjdP5FhmdPTU1SzslgcOzVqJwVT_2BDSYmmsYBYDaPu5vnMymKB3vchsgE56P2WxA9nnungybj6ET_rh1KM23KySrwb4WNJK_5jMuL_XnLU_PB1N2OxvUonoD3KGb7_TEGUL8AjYGWWtcbXJ_nSAfGP4rt26_jsPS0JXBqHRSlPW-PKHagj4LWweSRDky2NmgQTjcADNzYSuLbygV7TOTwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WM7u9vaHgoMDgAoBmAsByAsBgAwBogwgKh4KHOS0sQLutbECtbixAqy6sQLktLEC7rWxAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNXxo6vdRsOHbxSvBL1f3eEwKATbEJlqZ09lONmoK3S7tWpIP5rfg9DIouwOhx2V24Tmmu4TAnDON-R85r3PDxDQxmDuMTjv7uWBgB%26sig%3DAOD64_3ggfehLCfFjtBQ0NgjcvhvVxoI1A%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-BIZ5R7ZUDw_F_JZz1KqFn83mMRDnTDJ7gwEpcX_dlEFVZ5Ht_ZnPcoCZ0mbBpMkA0c4m7bEVpWZgijbSFOO3FJ9V2o5dUSJgYgr6vHGsKRzYc-RttHqAXg7SO_b6JcITRlJpJb16UobHIcDHDObOZN7wvLYzZPiysHXjk1o77-4salSfw%26cry%3D1%26dbm_d%3DAKAmf-CCgnAnmaqF1_uq3uHrajJwUGCxed43F_3YqoZnJku1UKPxHkrXEYxxD5axQLCpHdEakWKJ7HVrRb46nls5xH1MnoXLiXTRA95Z1_lf0Aj5zuGAXpgxasrynIATRvJG0KM-Xt6_KPmmrhcMcE8ylA2yOKPx09T-TPH3c4ZfdZVqGzYBC20XWJBR7k1gWGsm3qtzGTeFAKi8ZxpYUBGIZnnTdQjHf1VSHhGbz43El4GiQTifg2_-wDxJBClKz01g6lY8Kvdikwip7_fOU49_9J2J7wkwyLqxJLiy2-QLa69FPtCuHSsXC3wio9dX5eER8uSsPUIWlk5j4807yVTQG9F391OQbh3JCms61Y8BnDW0QFnkj5S5FW61wqTJa8COcMzRxsOjpR6d22Gl6L4pJEjSvag2iFj2LIrLJbmC7TVhNHOzTDPo8JHpeZFwJ56CMuVd-PPZraoDgk3BdzYgepmkoqA2UxdC0ozxe7PWj6BWP1MuFGYMkFZZRTLDgge70ZyXIlrmJl0wL2ikeFwMaIVBCnZh6SuERzjntstuUP4AXgXO3G0%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=6212002511&adk=1854347006&adf=3400082548&pi=t.ma~as.6212002511&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847111&bpp=1&bdt=328&idt=418&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=2725&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=420
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.117 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.117.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 48e3d1297ef373788e541f3e44bddae2cd83ec5b4f0bfdc62dcb229473f6d845

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Sat, 09 Dec 2023 09:40:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4172
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312050101/ 160 KB
55 KB 104ms
103ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312050101/reactive_library_fy2021.js?bust=31080036

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

60871d8328ce5f869ebb561d6d1a4a86e8253bdcb15534bc84dc7a2ce8f36d04

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55997
x-xss-protection: 0
server: cafe
etag: 1488551009764438209
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 09 Dec 2023 09:40:48 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F27F 129 KB
47 KB 1099ms
1099ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=371214980&pi=t.aa~a.542385254~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280&nras=2&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=776&ady=1268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6754c346274b01e1bb0147a62e28f2fec1b10f06e9e5baaf4df67f04d5a71357

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://geocult.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 48511
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:49 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 003E 154 KB
45 KB 1137ms
1137ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ea7a3c479bb36c24f92b9d21be2f9c231b8e5af90d96e4741a0351666e44134c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://geocult.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 45826
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:49 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

request.php Show response
hal900014.redintelligence.net/ Frame 9B4C
Redirect Chain

https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=7e92e8dc5e&subid=&uid=2e9be88fbc7679ac&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=7e92e8dc5e&subid=&uid=2e9be88fbc7679ac&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

97ms
74ms

Script
application/x-javascript

176.9.26.250
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=7e92e8dc5e&subid=&uid=2e9be88fbc7679ac&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrZTFHzZ0ZaiZMOHUxtYP7tOWkAWm5b2gab2TnKfJD_AuEAEg1MealwFgleKQgqAHyAEJqQJiLYh_9w6yPqgDAcgDmwSqBN4BT9AiVjVcv3pO5yZW6_3fSL4XIRkOCaqLceMH4yCoxQkrQYBn2wEAGLgbs5Zq82izRhILNhR0zeTyDTK78OUsjdP5FhmdPTU1SzslgcOzVqJwVT_2BDSYmmsYBYDaPu5vnMymKB3vchsgE56P2WxA9nnungybj6ET_rh1KM23KySrwb4WNJK_5jMuL_XnLU_PB1N2OxvUonoD3KGb7_TEGUL8AjYGWWtcbXJ_nSAfGP4rt26_jsPS0JXBqHRSlPW-PKHagj4LWweSRDky2NmgQTjcADNzYSuLbygV7TOTwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WM7u9vaHgoMDgAoBmAsByAsBgAwBogwgKh4KHOS0sQLutbECtbixAqy6sQLktLEC7rWxAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNXxo6vdRsOHbxSvBL1f3eEwKATbEJlqZ09lONmoK3S7tWpIP5rfg9DIouwOhx2V24Tmmu4TAnDON-R85r3PDxDQxmDuMTjv7uWBgB%26sig%3DAOD64_3ggfehLCfFjtBQ0NgjcvhvVxoI1A%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-BIZ5R7ZUDw_F_JZz1KqFn83mMRDnTDJ7gwEpcX_dlEFVZ5Ht_ZnPcoCZ0mbBpMkA0c4m7bEVpWZgijbSFOO3FJ9V2o5dUSJgYgr6vHGsKRzYc-RttHqAXg7SO_b6JcITRlJpJb16UobHIcDHDObOZN7wvLYzZPiysHXjk1o77-4salSfw%26cry%3D1%26dbm_d%3DAKAmf-CCgnAnmaqF1_uq3uHrajJwUGCxed43F_3YqoZnJku1UKPxHkrXEYxxD5axQLCpHdEakWKJ7HVrRb46nls5xH1MnoXLiXTRA95Z1_lf0Aj5zuGAXpgxasrynIATRvJG0KM-Xt6_KPmmrhcMcE8ylA2yOKPx09T-TPH3c4ZfdZVqGzYBC20XWJBR7k1gWGsm3qtzGTeFAKi8ZxpYUBGIZnnTdQjHf1VSHhGbz43El4GiQTifg2_-wDxJBClKz01g6lY8Kvdikwip7_fOU49_9J2J7wkwyLqxJLiy2-QLa69FPtCuHSsXC3wio9dX5eER8uSsPUIWlk5j4807yVTQG9F391OQbh3JCms61Y8BnDW0QFnkj5S5FW61wqTJa8COcMzRxsOjpR6d22Gl6L4pJEjSvag2iFj2LIrLJbmC7TVhNHOzTDPo8JHpeZFwJ56CMuVd-PPZraoDgk3BdzYgepmkoqA2UxdC0ozxe7PWj6BWP1MuFGYMkFZZRTLDgge70ZyXIlrmJl0wL2ikeFwMaIVBCnZh6SuERzjntstuUP4AXgXO3G0%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=7841007285590&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=6212002511&adk=1854347006&adf=3400082548&pi=t.ma~as.6212002511&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847111&bpp=1&bdt=328&idt=418&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=2725&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=420
Protocol: HTTP/1.1
Server: 176.9.26.250 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.250.26.9.176.clients.your-server.de
Software: Apache /
Resource Hash: 42f08af6b63da4900374a960df1387e8a07bb1571b20b65dbc347d06c06e60a1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 09 Dec 2023 09:40:48 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 41541200036431004444994012533014
Connection: close
Content-Length: 1340
Expires: Sat, 09 Dec 2023 09:40:48 +0100

Redirect headers

Pragma: no-cache
Date: Sat, 09 Dec 2023 09:40:48 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=7e92e8dc5e&subid=&uid=2e9be88fbc7679ac&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrZTFHzZ0ZaiZMOHUxtYP7tOWkAWm5b2gab2TnKfJD_AuEAEg1MealwFgleKQgqAHyAEJqQJiLYh_9w6yPqgDAcgDmwSqBN4BT9AiVjVcv3pO5yZW6_3fSL4XIRkOCaqLceMH4yCoxQkrQYBn2wEAGLgbs5Zq82izRhILNhR0zeTyDTK78OUsjdP5FhmdPTU1SzslgcOzVqJwVT_2BDSYmmsYBYDaPu5vnMymKB3vchsgE56P2WxA9nnungybj6ET_rh1KM23KySrwb4WNJK_5jMuL_XnLU_PB1N2OxvUonoD3KGb7_TEGUL8AjYGWWtcbXJ_nSAfGP4rt26_jsPS0JXBqHRSlPW-PKHagj4LWweSRDky2NmgQTjcADNzYSuLbygV7TOTwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WM7u9vaHgoMDgAoBmAsByAsBgAwBogwgKh4KHOS0sQLutbECtbixAqy6sQLktLEC7rWxAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNXxo6vdRsOHbxSvBL1f3eEwKATbEJlqZ09lONmoK3S7tWpIP5rfg9DIouwOhx2V24Tmmu4TAnDON-R85r3PDxDQxmDuMTjv7uWBgB%26sig%3DAOD64_3ggfehLCfFjtBQ0NgjcvhvVxoI1A%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-BIZ5R7ZUDw_F_JZz1KqFn83mMRDnTDJ7gwEpcX_dlEFVZ5Ht_ZnPcoCZ0mbBpMkA0c4m7bEVpWZgijbSFOO3FJ9V2o5dUSJgYgr6vHGsKRzYc-RttHqAXg7SO_b6JcITRlJpJb16UobHIcDHDObOZN7wvLYzZPiysHXjk1o77-4salSfw%26cry%3D1%26dbm_d%3DAKAmf-CCgnAnmaqF1_uq3uHrajJwUGCxed43F_3YqoZnJku1UKPxHkrXEYxxD5axQLCpHdEakWKJ7HVrRb46nls5xH1MnoXLiXTRA95Z1_lf0Aj5zuGAXpgxasrynIATRvJG0KM-Xt6_KPmmrhcMcE8ylA2yOKPx09T-TPH3c4ZfdZVqGzYBC20XWJBR7k1gWGsm3qtzGTeFAKi8ZxpYUBGIZnnTdQjHf1VSHhGbz43El4GiQTifg2_-wDxJBClKz01g6lY8Kvdikwip7_fOU49_9J2J7wkwyLqxJLiy2-QLa69FPtCuHSsXC3wio9dX5eER8uSsPUIWlk5j4807yVTQG9F391OQbh3JCms61Y8BnDW0QFnkj5S5FW61wqTJa8COcMzRxsOjpR6d22Gl6L4pJEjSvag2iFj2LIrLJbmC7TVhNHOzTDPo8JHpeZFwJ56CMuVd-PPZraoDgk3BdzYgepmkoqA2UxdC0ozxe7PWj6BWP1MuFGYMkFZZRTLDgge70ZyXIlrmJl0wL2ikeFwMaIVBCnZh6SuERzjntstuUP4AXgXO3G0%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=7841007285590&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Sat, 09 Dec 2023 09:40:48 +0100

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 4819 38 KB
13 KB 54ms
53ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 21300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 03:45:48 GMT
expires: Sun, 08 Dec 2024 03:45:48 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 255ms
74ms Preflight
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 09 Dec 2023 09:40:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 4819 39 KB
15 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:50:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53423
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 18:50:25 GMT

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 91ms
91ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312050101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-2920555573584698&plah=geocult.ru&bust=31080036
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://geocult.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/ Frame D2E4 9 KB
4 KB 54ms
54ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://geocult.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 65930
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 15:21:58 GMT
etag: 5585625838579639069
expires: Fri, 22 Dec 2023 15:21:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame 43CD 0
327 B 69ms
52ms Document
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=41541200036431004444994012533014&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=7e92e8dc5e&subid=&uid=2e9be88fbc7679ac&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrZTFHzZ0ZaiZMOHUxtYP7tOWkAWm5b2gab2TnKfJD_AuEAEg1MealwFgleKQgqAHyAEJqQJiLYh_9w6yPqgDAcgDmwSqBN4BT9AiVjVcv3pO5yZW6_3fSL4XIRkOCaqLceMH4yCoxQkrQYBn2wEAGLgbs5Zq82izRhILNhR0zeTyDTK78OUsjdP5FhmdPTU1SzslgcOzVqJwVT_2BDSYmmsYBYDaPu5vnMymKB3vchsgE56P2WxA9nnungybj6ET_rh1KM23KySrwb4WNJK_5jMuL_XnLU_PB1N2OxvUonoD3KGb7_TEGUL8AjYGWWtcbXJ_nSAfGP4rt26_jsPS0JXBqHRSlPW-PKHagj4LWweSRDky2NmgQTjcADNzYSuLbygV7TOTwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WM7u9vaHgoMDgAoBmAsByAsBgAwBogwgKh4KHOS0sQLutbECtbixAqy6sQLktLEC7rWxAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNXxo6vdRsOHbxSvBL1f3eEwKATbEJlqZ09lONmoK3S7tWpIP5rfg9DIouwOhx2V24Tmmu4TAnDON-R85r3PDxDQxmDuMTjv7uWBgB%26sig%3DAOD64_3ggfehLCfFjtBQ0NgjcvhvVxoI1A%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-BIZ5R7ZUDw_F_JZz1KqFn83mMRDnTDJ7gwEpcX_dlEFVZ5Ht_ZnPcoCZ0mbBpMkA0c4m7bEVpWZgijbSFOO3FJ9V2o5dUSJgYgr6vHGsKRzYc-RttHqAXg7SO_b6JcITRlJpJb16UobHIcDHDObOZN7wvLYzZPiysHXjk1o77-4salSfw%26cry%3D1%26dbm_d%3DAKAmf-CCgnAnmaqF1_uq3uHrajJwUGCxed43F_3YqoZnJku1UKPxHkrXEYxxD5axQLCpHdEakWKJ7HVrRb46nls5xH1MnoXLiXTRA95Z1_lf0Aj5zuGAXpgxasrynIATRvJG0KM-Xt6_KPmmrhcMcE8ylA2yOKPx09T-TPH3c4ZfdZVqGzYBC20XWJBR7k1gWGsm3qtzGTeFAKi8ZxpYUBGIZnnTdQjHf1VSHhGbz43El4GiQTifg2_-wDxJBClKz01g6lY8Kvdikwip7_fOU49_9J2J7wkwyLqxJLiy2-QLa69FPtCuHSsXC3wio9dX5eER8uSsPUIWlk5j4807yVTQG9F391OQbh3JCms61Y8BnDW0QFnkj5S5FW61wqTJa8COcMzRxsOjpR6d22Gl6L4pJEjSvag2iFj2LIrLJbmC7TVhNHOzTDPo8JHpeZFwJ56CMuVd-PPZraoDgk3BdzYgepmkoqA2UxdC0ozxe7PWj6BWP1MuFGYMkFZZRTLDgge70ZyXIlrmJl0wL2ikeFwMaIVBCnZh6SuERzjntstuUP4AXgXO3G0%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=7841007285590&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript; charset=utf-8
date: Sat, 09 Dec 2023 09:40:48 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
vary: Origin

GET
H2 200 / Show response
adv.office-partner.de/ Frame 3FEE 930 B
923 B 40ms
6ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=7e92e8dc5e&subid=&uid=2e9be88fbc7679ac&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrZTFHzZ0ZaiZMOHUxtYP7tOWkAWm5b2gab2TnKfJD_AuEAEg1MealwFgleKQgqAHyAEJqQJiLYh_9w6yPqgDAcgDmwSqBN4BT9AiVjVcv3pO5yZW6_3fSL4XIRkOCaqLceMH4yCoxQkrQYBn2wEAGLgbs5Zq82izRhILNhR0zeTyDTK78OUsjdP5FhmdPTU1SzslgcOzVqJwVT_2BDSYmmsYBYDaPu5vnMymKB3vchsgE56P2WxA9nnungybj6ET_rh1KM23KySrwb4WNJK_5jMuL_XnLU_PB1N2OxvUonoD3KGb7_TEGUL8AjYGWWtcbXJ_nSAfGP4rt26_jsPS0JXBqHRSlPW-PKHagj4LWweSRDky2NmgQTjcADNzYSuLbygV7TOTwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WM7u9vaHgoMDgAoBmAsByAsBgAwBogwgKh4KHOS0sQLutbECtbixAqy6sQLktLEC7rWxAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNXxo6vdRsOHbxSvBL1f3eEwKATbEJlqZ09lONmoK3S7tWpIP5rfg9DIouwOhx2V24Tmmu4TAnDON-R85r3PDxDQxmDuMTjv7uWBgB%26sig%3DAOD64_3ggfehLCfFjtBQ0NgjcvhvVxoI1A%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-BIZ5R7ZUDw_F_JZz1KqFn83mMRDnTDJ7gwEpcX_dlEFVZ5Ht_ZnPcoCZ0mbBpMkA0c4m7bEVpWZgijbSFOO3FJ9V2o5dUSJgYgr6vHGsKRzYc-RttHqAXg7SO_b6JcITRlJpJb16UobHIcDHDObOZN7wvLYzZPiysHXjk1o77-4salSfw%26cry%3D1%26dbm_d%3DAKAmf-CCgnAnmaqF1_uq3uHrajJwUGCxed43F_3YqoZnJku1UKPxHkrXEYxxD5axQLCpHdEakWKJ7HVrRb46nls5xH1MnoXLiXTRA95Z1_lf0Aj5zuGAXpgxasrynIATRvJG0KM-Xt6_KPmmrhcMcE8ylA2yOKPx09T-TPH3c4ZfdZVqGzYBC20XWJBR7k1gWGsm3qtzGTeFAKi8ZxpYUBGIZnnTdQjHf1VSHhGbz43El4GiQTifg2_-wDxJBClKz01g6lY8Kvdikwip7_fOU49_9J2J7wkwyLqxJLiy2-QLa69FPtCuHSsXC3wio9dX5eER8uSsPUIWlk5j4807yVTQG9F391OQbh3JCms61Y8BnDW0QFnkj5S5FW61wqTJa8COcMzRxsOjpR6d22Gl6L4pJEjSvag2iFj2LIrLJbmC7TVhNHOzTDPo8JHpeZFwJ56CMuVd-PPZraoDgk3BdzYgepmkoqA2UxdC0ozxe7PWj6BWP1MuFGYMkFZZRTLDgge70ZyXIlrmJl0wL2ikeFwMaIVBCnZh6SuERzjntstuUP4AXgXO3G0%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=7841007285590&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Sat, 09 Dec 2023 09:40:48 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Sat, 16 Dec 2023 09:40:48 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 89f7480c0afa0150827cf163f8728151 Show response
pv.medialead.de/trck/epv/ Frame 047F 0
326 B 68ms
53ms Document
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/89f7480c0afa0150827cf163f8728151?subid=41541200036431004444994012533014&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=7e92e8dc5e&subid=&uid=2e9be88fbc7679ac&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrZTFHzZ0ZaiZMOHUxtYP7tOWkAWm5b2gab2TnKfJD_AuEAEg1MealwFgleKQgqAHyAEJqQJiLYh_9w6yPqgDAcgDmwSqBN4BT9AiVjVcv3pO5yZW6_3fSL4XIRkOCaqLceMH4yCoxQkrQYBn2wEAGLgbs5Zq82izRhILNhR0zeTyDTK78OUsjdP5FhmdPTU1SzslgcOzVqJwVT_2BDSYmmsYBYDaPu5vnMymKB3vchsgE56P2WxA9nnungybj6ET_rh1KM23KySrwb4WNJK_5jMuL_XnLU_PB1N2OxvUonoD3KGb7_TEGUL8AjYGWWtcbXJ_nSAfGP4rt26_jsPS0JXBqHRSlPW-PKHagj4LWweSRDky2NmgQTjcADNzYSuLbygV7TOTwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WM7u9vaHgoMDgAoBmAsByAsBgAwBogwgKh4KHOS0sQLutbECtbixAqy6sQLktLEC7rWxAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNXxo6vdRsOHbxSvBL1f3eEwKATbEJlqZ09lONmoK3S7tWpIP5rfg9DIouwOhx2V24Tmmu4TAnDON-R85r3PDxDQxmDuMTjv7uWBgB%26sig%3DAOD64_3ggfehLCfFjtBQ0NgjcvhvVxoI1A%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-BIZ5R7ZUDw_F_JZz1KqFn83mMRDnTDJ7gwEpcX_dlEFVZ5Ht_ZnPcoCZ0mbBpMkA0c4m7bEVpWZgijbSFOO3FJ9V2o5dUSJgYgr6vHGsKRzYc-RttHqAXg7SO_b6JcITRlJpJb16UobHIcDHDObOZN7wvLYzZPiysHXjk1o77-4salSfw%26cry%3D1%26dbm_d%3DAKAmf-CCgnAnmaqF1_uq3uHrajJwUGCxed43F_3YqoZnJku1UKPxHkrXEYxxD5axQLCpHdEakWKJ7HVrRb46nls5xH1MnoXLiXTRA95Z1_lf0Aj5zuGAXpgxasrynIATRvJG0KM-Xt6_KPmmrhcMcE8ylA2yOKPx09T-TPH3c4ZfdZVqGzYBC20XWJBR7k1gWGsm3qtzGTeFAKi8ZxpYUBGIZnnTdQjHf1VSHhGbz43El4GiQTifg2_-wDxJBClKz01g6lY8Kvdikwip7_fOU49_9J2J7wkwyLqxJLiy2-QLa69FPtCuHSsXC3wio9dX5eER8uSsPUIWlk5j4807yVTQG9F391OQbh3JCms61Y8BnDW0QFnkj5S5FW61wqTJa8COcMzRxsOjpR6d22Gl6L4pJEjSvag2iFj2LIrLJbmC7TVhNHOzTDPo8JHpeZFwJ56CMuVd-PPZraoDgk3BdzYgepmkoqA2UxdC0ozxe7PWj6BWP1MuFGYMkFZZRTLDgge70ZyXIlrmJl0wL2ikeFwMaIVBCnZh6SuERzjntstuUP4AXgXO3G0%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=7841007285590&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"25200521800103636","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript; charset=utf-8
date: Sat, 09 Dec 2023 09:40:48 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
vary: Origin

GET
H2 200 e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame 9B4C 0
326 B 147ms
54ms Script
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=41541200036431004444994012533014&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=7e92e8dc5e&subid=&uid=2e9be88fbc7679ac&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrZTFHzZ0ZaiZMOHUxtYP7tOWkAWm5b2gab2TnKfJD_AuEAEg1MealwFgleKQgqAHyAEJqQJiLYh_9w6yPqgDAcgDmwSqBN4BT9AiVjVcv3pO5yZW6_3fSL4XIRkOCaqLceMH4yCoxQkrQYBn2wEAGLgbs5Zq82izRhILNhR0zeTyDTK78OUsjdP5FhmdPTU1SzslgcOzVqJwVT_2BDSYmmsYBYDaPu5vnMymKB3vchsgE56P2WxA9nnungybj6ET_rh1KM23KySrwb4WNJK_5jMuL_XnLU_PB1N2OxvUonoD3KGb7_TEGUL8AjYGWWtcbXJ_nSAfGP4rt26_jsPS0JXBqHRSlPW-PKHagj4LWweSRDky2NmgQTjcADNzYSuLbygV7TOTwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WM7u9vaHgoMDgAoBmAsByAsBgAwBogwgKh4KHOS0sQLutbECtbixAqy6sQLktLEC7rWxAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNXxo6vdRsOHbxSvBL1f3eEwKATbEJlqZ09lONmoK3S7tWpIP5rfg9DIouwOhx2V24Tmmu4TAnDON-R85r3PDxDQxmDuMTjv7uWBgB%26sig%3DAOD64_3ggfehLCfFjtBQ0NgjcvhvVxoI1A%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-BIZ5R7ZUDw_F_JZz1KqFn83mMRDnTDJ7gwEpcX_dlEFVZ5Ht_ZnPcoCZ0mbBpMkA0c4m7bEVpWZgijbSFOO3FJ9V2o5dUSJgYgr6vHGsKRzYc-RttHqAXg7SO_b6JcITRlJpJb16UobHIcDHDObOZN7wvLYzZPiysHXjk1o77-4salSfw%26cry%3D1%26dbm_d%3DAKAmf-CCgnAnmaqF1_uq3uHrajJwUGCxed43F_3YqoZnJku1UKPxHkrXEYxxD5axQLCpHdEakWKJ7HVrRb46nls5xH1MnoXLiXTRA95Z1_lf0Aj5zuGAXpgxasrynIATRvJG0KM-Xt6_KPmmrhcMcE8ylA2yOKPx09T-TPH3c4ZfdZVqGzYBC20XWJBR7k1gWGsm3qtzGTeFAKi8ZxpYUBGIZnnTdQjHf1VSHhGbz43El4GiQTifg2_-wDxJBClKz01g6lY8Kvdikwip7_fOU49_9J2J7wkwyLqxJLiy2-QLa69FPtCuHSsXC3wio9dX5eER8uSsPUIWlk5j4807yVTQG9F391OQbh3JCms61Y8BnDW0QFnkj5S5FW61wqTJa8COcMzRxsOjpR6d22Gl6L4pJEjSvag2iFj2LIrLJbmC7TVhNHOzTDPo8JHpeZFwJ56CMuVd-PPZraoDgk3BdzYgepmkoqA2UxdC0ozxe7PWj6BWP1MuFGYMkFZZRTLDgge70ZyXIlrmJl0wL2ikeFwMaIVBCnZh6SuERzjntstuUP4AXgXO3G0%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=7841007285590&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:48 GMT
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx
host: pv.medialead.de
vary: Origin
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 0
proxy-host: pv.medialead.de

GET
H2 200 e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame 9B4C 43 B
360 B 148ms
55ms Image
image/gif 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=41541200036431004444994012533014&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=7e92e8dc5e&subid=&uid=2e9be88fbc7679ac&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCrZTFHzZ0ZaiZMOHUxtYP7tOWkAWm5b2gab2TnKfJD_AuEAEg1MealwFgleKQgqAHyAEJqQJiLYh_9w6yPqgDAcgDmwSqBN4BT9AiVjVcv3pO5yZW6_3fSL4XIRkOCaqLceMH4yCoxQkrQYBn2wEAGLgbs5Zq82izRhILNhR0zeTyDTK78OUsjdP5FhmdPTU1SzslgcOzVqJwVT_2BDSYmmsYBYDaPu5vnMymKB3vchsgE56P2WxA9nnungybj6ET_rh1KM23KySrwb4WNJK_5jMuL_XnLU_PB1N2OxvUonoD3KGb7_TEGUL8AjYGWWtcbXJ_nSAfGP4rt26_jsPS0JXBqHRSlPW-PKHagj4LWweSRDky2NmgQTjcADNzYSuLbygV7TOTwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WM7u9vaHgoMDgAoBmAsByAsBgAwBogwgKh4KHOS0sQLutbECtbixAqy6sQLktLEC7rWxAru7sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNXxo6vdRsOHbxSvBL1f3eEwKATbEJlqZ09lONmoK3S7tWpIP5rfg9DIouwOhx2V24Tmmu4TAnDON-R85r3PDxDQxmDuMTjv7uWBgB%26sig%3DAOD64_3ggfehLCfFjtBQ0NgjcvhvVxoI1A%26client%3Dca-pub-2920555573584698%26dbm_c%3DAKAmf-BIZ5R7ZUDw_F_JZz1KqFn83mMRDnTDJ7gwEpcX_dlEFVZ5Ht_ZnPcoCZ0mbBpMkA0c4m7bEVpWZgijbSFOO3FJ9V2o5dUSJgYgr6vHGsKRzYc-RttHqAXg7SO_b6JcITRlJpJb16UobHIcDHDObOZN7wvLYzZPiysHXjk1o77-4salSfw%26cry%3D1%26dbm_d%3DAKAmf-CCgnAnmaqF1_uq3uHrajJwUGCxed43F_3YqoZnJku1UKPxHkrXEYxxD5axQLCpHdEakWKJ7HVrRb46nls5xH1MnoXLiXTRA95Z1_lf0Aj5zuGAXpgxasrynIATRvJG0KM-Xt6_KPmmrhcMcE8ylA2yOKPx09T-TPH3c4ZfdZVqGzYBC20XWJBR7k1gWGsm3qtzGTeFAKi8ZxpYUBGIZnnTdQjHf1VSHhGbz43El4GiQTifg2_-wDxJBClKz01g6lY8Kvdikwip7_fOU49_9J2J7wkwyLqxJLiy2-QLa69FPtCuHSsXC3wio9dX5eER8uSsPUIWlk5j4807yVTQG9F391OQbh3JCms61Y8BnDW0QFnkj5S5FW61wqTJa8COcMzRxsOjpR6d22Gl6L4pJEjSvag2iFj2LIrLJbmC7TVhNHOzTDPo8JHpeZFwJ56CMuVd-PPZraoDgk3BdzYgepmkoqA2UxdC0ozxe7PWj6BWP1MuFGYMkFZZRTLDgge70ZyXIlrmJl0wL2ikeFwMaIVBCnZh6SuERzjntstuUP4AXgXO3G0%26adurl%3D&documentReferer=https%3A%2F%2Fgeocult.ru%2F&ancestorOrigins=https%3A%2F%2Fgeocult.ru&random=7841007285590&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:48 GMT
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx
host: pv.medialead.de
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 43
proxy-host: pv.medialead.de

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4819 0
20 B 92ms
92ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BGEfxIDZ0ZZ_yGKC97_UPw8SM0A4AAAAAOAHgBAI&bg=!W1ilWBfNAAY3kmNgF5I7ADQBe5WfOIa0kvs9OixOmafxSWikuzXVhVpeb2FnG234gpIs0URgsBZQ6kv0HBIMzfvfAQtuAgAAAGpSAAAAAmgBBwoAZF91YwAx7ZQ__lZv8oiQ9DyZJ1-ce3b6pF06Rmr43afFxhqe3D--DSgtHksj7anoxhqx6JrJeZHnsPvafaA_Pm0yHzhJQrf-qVc27BmganrlRQr1wC43YhtBTgddXNyscKdqUPuZAw08mCv9t5WUI0wT8iNuGtiygIJK5kyPnv-15_WcBuEGIkIqUK_2JPYTsCLBGoXaoAm5aDpGksge17cptO30GBJ3pBgqeA6peEc9jzdoZuCPaSyD_Dewow5Fs2PIhMR0-LImruVL_274Rlo8fOyUXBnEwN4Q3bOiDCamqJ9LniOpxQ70x7FapJyRxIejKrbLRkmZpcphevMYO86gNpif6Uvon95FAMCOav1_lHLrN0QDWPEvn8rnWrrQ9Rxm8ccrQC8vAWkHc8lROFXCkzEkDKZkFgD60FowkxsRe_YUQAHSg1blcz3Qwqz8ctlG7ReZd1gaGuidkfu6v7mIN4QyLJfwi_irKiqCJO9zyffNz6c5MAQLwzFk0zOitvnAtDf24jeROWbUWSNwEW3Dyeu8mb5qPPz1i0h-lI4tILEQFO0ZlmHM_XJDI8nde1qCYCs40FNVXCv_82OrwsWjU0nYCl_9rJ4dYl1CkGpd3RPDOy5VR4GUx_L_mGiQrBAUbbXnPN4abAKb-c-uB4wAANBEIo7MvRqu0cHxU4g8S_Y4m3MBCoBCsAubJ4Vm6JPOezqT7wUWcRNT-dusXal7y33Gr4LwaWKr2_8Ed_5N5A352bst9OmFYPjf3jXhSw2W7WMuaQ_LJqIOXQXwVL08T3NPLALGk5oK32fgjPaq3wn_FyKN1W6c-7E3TAOCF3_1U9rh2KzElyqjCws-ksQlnCkSvH5Hl5ua6-4X1XJNegkgy3_v9e3S9Oo9JYPdk3LtkoPzwqFrSjiCdP8AkQzSri8nvEwlJ3uYOLIMIxN2gzB6WGdwtGBLb0tsSxQSk8iAmEltHtG4i5N8KZo7DMk8gwqF93nngDDg89fa8Nnk1uFp6iL3m0SE4BPAzzjt497fIJijDa5bGFbgvSgI_xXF7jMiBGS7bKwt2xGXCCiZzJWU-5G0EDSfqGAkacR5mBUtsfsGFJfOcTFNxbJyhf4smqxg8Ec2UGGzIPJCj7mB_X72zf_-_3D00BgR15WHRCW6s6k2r-FZhedbe8cZw8YEE9h8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame 3FEE 175 KB
63 KB 62ms
62ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dd97d75880df305f01f244538d61b6a29b73b5931dde717cafc438f3eb4fde20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64122
x-xss-protection: 0
last-modified: Sat, 09 Dec 2023 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 09 Dec 2023 09:40:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 502D 624 B
245 B 97ms
96ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNiL3_QBMAE&v=APEucNV4aKvJo7ONAahJdiHkKSx5PyQLmlLNFXr-oqzGOf5NU1slKr4zSZQX75aLNabPnxXRTxVIH3l3mwu3FmtnzJb23XUdXPhP9_-PrihP4kGSFiOZ1ElvqLdWAB6U96oV2hhC_4v8pQKTTmKVGb2T3nSoTIoGtlsQTU4ZXg4vBqF9387GhGI

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:48 GMT
expires: Sat, 09 Dec 2023 09:40:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame D52E 89 KB
31 KB 161ms
160ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sat, 09 Dec 2023 09:40:49 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame D52E 3 KB
1 KB 57ms
56ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41930
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 22:01:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame D52E 20 KB
8 KB 58ms
57ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46717
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:42:11 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame D52E 202 KB
64 KB 72ms
72ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 09:40:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D52E 42 B
63 B 88ms
88ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DO4Ngfr7kHon0HyTGffMGQ8JdPSNAQGof_El39T537ZRA60pmeTvJN6dti1IsYBjFMjYUyr6pktv2l61Ey25Wg6OCzsrerGZg8W2TngKclFCjQyz0

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 0BF4 8 KB
818 B 66ms
66ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open%20Sans%3A400%2C700%7COpen%20Sans%3A300%2C400

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=4347476252&adk=504672438&adf=3417920651&pi=t.ma~as.4347476252&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847110&bpp=1&bdt=327&idt=414&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=416

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

058d2488f4d26d53cf94a6739b9800ac2d9897baa61a920a66e758129fc7b0bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 09 Dec 2023 09:40:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 09 Dec 2023 09:36:01 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 09 Dec 2023 09:40:48 GMT

GET
H2 200 link.html Show response
track.webgains.com/ Frame 9B4C 2 KB
2 KB 127ms
69ms Script
text/html 13.42.211.181
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=41541200036431004444994012533014&nw=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=6212002511&adk=1854347006&adf=3400082548&pi=t.ma~as.6212002511&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847111&bpp=1&bdt=328&idt=418&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=2725&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=420
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.42.211.181 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-42-211-181.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 63fb13dd9df1b1c74e640bf15cc4fb8267554201148928703ab51eac439e3a6d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:49 GMT
last-modified: Sat, 09 Dec 2023 09:40:49 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Sat, 09 Dec 2023 09:41:49 GMT

GET
H2

200

activityi;dc_pre=CK6B0PeHgoMDFRDhOwIdxXEJKg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3233669781988.242 Show response
5994599.fls.doubleclick.net/ Frame B69D
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3233669781988.242?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CK6B0PeHgoMDFRDhOwIdxXEJKg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3233669781988.242?

391 B
326 B

79ms
79ms

Document
text/html

216.58.206.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CK6B0PeHgoMDFRDhOwIdxXEJKg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3233669781988.242?

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f6.1e100.net

Software

cafe /

Resource Hash

22346d290af69b1da56c0e33cd87a0176e385d97d077cb28d21633a7faac5a83

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 217
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:49 GMT
expires: Sat, 09 Dec 2023 09:40:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:49 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CK6B0PeHgoMDFRDhOwIdxXEJKg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3233669781988.242?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900014.redintelligence.net/ Frame 909A 7 KB
2 KB 33ms
11ms Document
text/html 176.9.26.250
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900014.redintelligence.net/request_content.php?s=41541200036431004444994012533014&a=b89490a9
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=6212002511&adk=1854347006&adf=3400082548&pi=t.ma~as.6212002511&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847111&bpp=1&bdt=328&idt=418&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=2725&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=420
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.9.26.250 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.250.26.9.176.clients.your-server.de
Software: Apache /
Resource Hash: f59801d52f497b4065fd46b5d5cffcb2c0fe2fd250474c668b517d4e287ebb56

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2127
Content-Type: text/html; charset=utf-8
Date: Sat, 09 Dec 2023 09:40:48 GMT
Expires: Sat, 09 Dec 2023 09:40:48 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame 9B4C 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ca99f4149c1e35b584569e9cc4180ea45f2861e19f271dc043c2d28f7bc120ba

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 0BF4 2 KB
822 B 58ms
58ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:55:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53136
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:55:12 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame 0BF4 24 KB
9 KB 58ms
58ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:54:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53165
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:54:43 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2122 143 B
166 B 55ms
55ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=4347476252&adk=504672438&adf=3417920651&pi=t.ma~as.4347476252&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847110&bpp=1&bdt=327&idt=414&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=294&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeE%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=416
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 142
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:38:26 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 0BF4 3 KB
1 KB 79ms
79ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41930
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 22:01:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 0BF4 20 KB
8 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46717
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:42:11 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0BF4 202 KB
64 KB 70ms
70ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 09:40:49 GMT

GET
H3 200 f9d9b65dbd646119ce96bad0f484d579.js Show response
www.gstatic.com/mysidia/ Frame 0BF4 37 KB
15 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f9d9b65dbd646119ce96bad0f484d579.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 04:32:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 277689
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15460
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 04:10:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 05 Mar 2024 04:32:39 GMT

GET
DATA 200
OK truncated
/ Frame 0BF4 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aaaf0b2c3bd11afe20e1902624db617c2131b3272fabebd1160cb2f53dfb3750

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 css
fonts.googleapis.com/ Frame 909A 5 KB
778 B 69ms
68ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=41541200036431004444994012533014&a=b89490a9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 09 Dec 2023 09:40:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 09 Dec 2023 09:38:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 09 Dec 2023 09:40:49 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 909A 17 KB
17 KB 40ms
17ms Image
image/png 138.201.63.117
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=41541200036431004444994012533014&a=b89490a9
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.117 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.117.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: cd4f7f8633e0416fb43ecb648e78e181cf9fbcd23bd6067e60bd4e61bd35b588

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Sat, 09 Dec 2023 09:40:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16982
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 909A 16 KB
16 KB 42ms
18ms Image
image/png 138.201.63.117
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=41541200036431004444994012533014&a=b89490a9
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.117 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.117.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 05da245d527bc9ab756912032b95ca27166597920920e29da7c3de7ec4263d1c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Sat, 09 Dec 2023 09:40:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16514
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 909A 13 KB
13 KB 42ms
19ms Image
image/png 138.201.63.117
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/50502/creativesup/Fyrst-1200x627.jpg
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=41541200036431004444994012533014&a=b89490a9
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.117 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.117.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 1fac880ba682ed66308e46aa35e746e85d8bc26b0d57d281cf19e2e21e561bd2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Sat, 09 Dec 2023 09:40:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 13287
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame 3FEE 274 KB
91 KB 65ms
65ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

652f7dffd6cfbde8e4965c47e8c2d5dd6f56988029465589a1e7db1c5b88449e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:49 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93095
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 09 Dec 2023 09:40:49 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2122
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
18 B

64ms
64ms

Document
text/html

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:49 GMT
expires: Sat, 09 Dec 2023 09:40:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:49 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 502D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9SLDbyR7uCnyIyDoaf-lo&google_cver=1

43 B
733 B

24ms
24ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9SLDbyR7uCnyIyDoaf-lo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNiL3_QBMAE&v=APEucNV4aKvJo7ONAahJdiHkKSx5PyQLmlLNFXr-oqzGOf5NU1slKr4zSZQX75aLNabPnxXRTxVIH3l3mwu3FmtnzJb23XUdXPhP9_-PrihP4kGSFiOZ1ElvqLdWAB6U96oV2hhC_4v8pQKTTmKVGb2T3nSoTIoGtlsQTU4ZXg4vBqF9387GhGI
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f8o7MuHvHJY3fmy3sxTVAKxedv9EPWzXKdw4Dsw6oPMPgcIrKFg1im8Nuvh4PXquMpEzwV0OKMuDhVO7oPdGtMQoMwTHy8GkivANGvCDtghKc8A9Sl%2FNSUKPzvc3boqBt3QIGLu%2FUf6X9w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 832c49eebf723734-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9SLDbyR7uCnyIyDoaf-lo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 502D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZXQ2IIVndCUFQWlXDvJUwwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9SLDbyR7uCnyIyDoaf-lo&google_cver=1

43 B
733 B

23ms
22ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9SLDbyR7uCnyIyDoaf-lo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNiL3_QBMAE&v=APEucNV4aKvJo7ONAahJdiHkKSx5PyQLmlLNFXr-oqzGOf5NU1slKr4zSZQX75aLNabPnxXRTxVIH3l3mwu3FmtnzJb23XUdXPhP9_-PrihP4kGSFiOZ1ElvqLdWAB6U96oV2hhC_4v8pQKTTmKVGb2T3nSoTIoGtlsQTU4ZXg4vBqF9387GhGI
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dQeqaHdMsM9mAPzbjfP0MPVVZmCE%2FlrCWa4CVggVWrc4UT9CW3JCWf6nFTnpa%2BS1CojFnQHi37ddrW94mbcOfV1c191nSdG0ofjJlokLM6%2F7L%2Bnj5gD1SIQFY5v2ocz0yP3fyT3EqyYotg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 832c49eedf963734-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM9SLDbyR7uCnyIyDoaf-lo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 502D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEL-BtaHp31leN40UteUQur4&google_cver=1

43 B
847 B

14ms
14ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEL-BtaHp31leN40UteUQur4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNiL3_QBMAE&v=APEucNV4aKvJo7ONAahJdiHkKSx5PyQLmlLNFXr-oqzGOf5NU1slKr4zSZQX75aLNabPnxXRTxVIH3l3mwu3FmtnzJb23XUdXPhP9_-PrihP4kGSFiOZ1ElvqLdWAB6U96oV2hhC_4v8pQKTTmKVGb2T3nSoTIoGtlsQTU4ZXg4vBqF9387GhGI

Protocol

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
an-x-request-uuid: 251c26ed-3ab9-4b3a-b57b-6da7f078d35e
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 185.213.155.187; 185.213.155.187; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEL-BtaHp31leN40UteUQur4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 502D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMyMzkzNjc5ODA1MDM3MzQzNg%3D%3D

170 B
232 B

46ms
46ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMyMzkzNjc5ODA1MDM3MzQzNg%3D%3D

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
an-x-request-uuid: 78e3f892-094f-4d39-9aea-a1598da7b02d
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMyMzkzNjc5ODA1MDM3MzQzNg%3D%3D
x-proxy-origin: 185.213.155.187; 185.213.155.187; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 0BF4 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5d93beb8e3ad2b9ac2f1fe45f48cdf2ffa7a20e1fa5a9010314de0e05bf719cf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 91ms
90ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312050101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-2920555573584698&plah=geocult.ru&bust=31080036
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://geocult.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H/1.1 200
OK viewability Show response
hal900014.redintelligence.net/ Frame 909A 0
150 B 36ms
12ms Script
text/html 176.9.26.250
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900014.redintelligence.net/viewability?s=41541200036431004444994012533014&a=45f21cf9&vb=m
Requested by: Host: hal900014.redintelligence.net
URL: https://hal900014.redintelligence.net/request_content.php?s=41541200036431004444994012533014&a=b89490a9
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.9.26.250 Berlin, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.250.26.9.176.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900014.redintelligence.net/request_content.php?s=41541200036431004444994012533014&a=b89490a9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Sat, 09 Dec 2023 09:40:49 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 909A 14 KB
15 KB 60ms
59ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900014.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:36:48 GMT
x-content-type-options: nosniff
age: 47041
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 20:36:48 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 909A 15 KB
15 KB 57ms
56ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900014.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 11:13:55 GMT
x-content-type-options: nosniff
age: 80814
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 11:13:55 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 9B4C 53 KB
19 KB 105ms
11ms Script
application/javascript 108.157.4.50
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=41541200036431004444994012533014&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.50 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-50.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fbc6bed540723f219a878e5735ae8cb1c05aa9f7012bf21870cd79e41af25bcd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 01:58:56 GMT
content-encoding: gzip
via: 1.1 3a42f75e219a9a44a54979112dcb25dc.cloudfront.net (CloudFront)
last-modified: Thu, 23 Nov 2023 16:26:10 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P2
age: 27722
x-amz-server-side-encryption: AES256
etag: W/"1180a1bfee0aad979766ecd6180b923e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: 09Rq0zHt2Wk_IclWi1m4THAbRaIEtfCY6Is25oSB2pB_PQv_29li7A==

GET
H2 200 1x1_0.png
cdn.track.production.webgains.team/7121/ Frame 9B4C 3 KB
3 KB 103ms
9ms Image
image/png 18.154.63.19
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1_0.png?Expires=1702115149&Signature=W-r5RrLNxgDIJE7xV0VHdC5wt021IquR8DLzCp0enQ8CO6stQaWjC3Ag8ghfEB9iMJQi6sU-u~GWWTgAHG-~SHTvE9m5r30rAdan41dMGDdGPLvLbM4jaJswuJ3XofN~nO7L1W7ssk7mLLtKAHG2TdFghDBqVJ37OHUS7c1Jssj-FECit7O3oBu4sCiJ6WbtMmMB7yQngOAYslRF0Bb-rxYIXiR63mnfmFQWCnEG7ItpIq2Az~bOc1sxr9XY~Z65fk3D-FoAI1MPHv3OTFOvvnKywDdFCqrzhblh4xEh9Pfv6sgG~JjIqi72bwdwStReo7hzmpNIytGh~rvLXblUHQ__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=280&slotname=6212002511&adk=1854347006&adf=3400082548&pi=t.ma~as.6212002511&w=336&lmt=1693404896&format=336x280&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114847111&bpp=1&bdt=328&idt=418&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C160x600%2C336x280&nras=1&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=604&ady=2725&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7Cm%7CpeEbr%7Cp&abl=XS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=420
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.63.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-154-63-19.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-amz-version-id: null
date: Sat, 09 Dec 2023 07:35:09 GMT
via: 1.1 47c4e8338b148239463956ff49af0736.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P4
age: 7540
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: cyD1jxgBJ7CRs_ajTGe7VfC-GfF5EWwxRt9hDy5NuKBXtwliEN1PfA==

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/ Frame 0BF4 47 KB
47 KB 58ms
58ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open%20Sans%3A400%2C700%7COpen%20Sans%3A300%2C400

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 13:08:30 GMT
x-content-type-options: nosniff
age: 73939
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48432
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 00:40:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 13:08:30 GMT

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2
fonts.gstatic.com/s/opensans/v36/ Frame 0BF4 26 KB
26 KB 68ms
68ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open%20Sans%3A400%2C700%7COpen%20Sans%3A300%2C400

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a1f50e52a7fda97827e6e3d2cd3bb2788a68a78296728fa2592be8e89d54b5b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:29:51 GMT
x-content-type-options: nosniff
age: 47458
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26640
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 01:00:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 20:29:51 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D52E 0
22 B 88ms
88ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4382013644448&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D52E 0
22 B 89ms
89ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4382013644448&version=m202309260101&ct=76&x=1&cor=18173771268566794000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D52E 109 KB
41 KB 100ms
100ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C5NQj1Pbb2CKQOpkBDDBeQWg7_TAaVeqaiCaNnNQ4zeAtWaVtYoMRtZoemuYvI8jSTZjr50tXCYHC5txcTj51dFTacCgIKPMUQs7IxdathMkKb8gxI_rYmpkJhSSz_KjwayiDPUAiP3kI1hZ5srFDzA0GIgzUoqMevhsK72SjZj1zQEEU&dbm_d=AKAmf-BQN1hBy7bn3xAoIc5sXmAEogbilsMHOj3_F7v3_L24toflGGY3syDqkDTTbZ6Uhz7a2ycXlA4sAD8cpTn4GAD2zKUKr0MWqqmHNnySsPgoqx2fdFTPniW-j8ISNOPJr9L-SgWwZH1MACR6DFeImc59IVV9SK3E17zkQ3ou0tb79m0cYpzAlwxAQs9iuSLySBclmvjlAFOXe2Hukg8MiuPdgQVQV0beoW_2Mwsgz92mQGgO8_OL_pDoQl0JAQS0hpBNsJZburNnqRs_WEC48yDkJtXtV9PKkZ3dElP_NSmsGVKPPG3QWk5szYtQNPhje_wao86w7j3pZSSWOSZBYsh2AdgXtD77G6i9BSE747JPMrjiCWV496rDEAYD5YQSMCYvoWr9L56MSw9XbW6PcwXxvwQIHWGau1mUC-QKb4-6HnJZ4PzACQ9jtt8u4b4vIYn1ThXIQnsKAaCpxhxRL7cEQ1Hz2iUHzWyIOJb0P5f49RjZQSmZ_rCu_gd4q1abWDYODbUlRrrsEruVZsT5gFWbzweJ801EcXE4Q5KDh1yIuu3eWC6H3zAljr3zNaSiyZkJhtzADR-Isea9GKluWR68006JBAWKRW7WnmlyN0Ambv-OWwazyFfG3NxIQ6tnQ6IpXMTIYJ1Jp8ag-6SS_X1hrDE91tB5_joz9B-0NvQm6BBgje0Ae1gKrUiY9FIbc-gAkGrOvrES5Oy5_WvZx5CcZQSNzDigc0SJe6g7_0BxLA7GMYMlmK0YIh_T5HCL7DHJJgmlZwXom2ACjUwK4z_BtLv7sYEkjVUqOJpvJ7KmuzwNq98zxix2f298-hDU5GKINrHGCVdS0YaU7Jp3TiCEgH8MC1oECqKWFENSoDRyFrYu_sb79qeKn9yY-6AcTrmNdANmo7bfzb-fI1w5KEpigdlcWbFfDDm4_cR8W1yLKfE6PjrOTmjbOrbxrR4Y2r6IKXowvNtiEDtzyvPUCdPxy-4Oa9FSzXbeIGgYRuZj1uwygpcYSVoWxoXVNF_36ecK4zpd3ifOq0zg1_Vcf2UQ2FvYlF9_kY1Q4jNvSCG2WOGo4NEeku7L7JgdDadeYLF4OPXPM7-noaqkXDcnic5R9k3j-uidzUYpyx3MsNcNOu7r4iAlRE7xu77fWYYD1n4L1cZrzg9BDISTgWd2AR8RRNqJdcHQD5Y--pdxJW1dS33sF1E6iIO2uC1VQrOBpv6MvQ8e56-VqeTN75ikfruV9GttxtXCyafTRI7_ZvkCwdEsxyBU4zlgtcm4plNPvTYTcuzlUtqQmsToMrna_lMaRTzi16CK6Wq9F1SfzAJG9k7zsTxzswtEEj8_cIbF_LFnxAC_5nMrnR-dNS-0Ju0-qVhxqOkqBDT_8pP8ZSYZIo5-rUiJcZnTciVgfLwBwyjWYNwgtNOWLPvz81ghUM3-_Tc6gLbhBCSm1XDVjtIWxHWJn9HoypWT_zPJhVYp72EWDv8eQlUAXQZAOFDtVX4fa77AhOH-VnHtlJpYCZ1s0bPUuvWmrRhWZwbPxYApuky79PhhCA_cdLA-sec7jccRfpFGYMfF3ZPHEpKHXzE0AL51ceT2txAnGLMYSAeZjbcbVy5QUeBn-vVXQip9zt1hXHeCbeYbgsLTDq8y4V2XrhWjgImLOWbTq5ZjDFaTwxHfjVHW6E1_EhkDPVVAOgqtDd_jWiISRytDVETmf6E1Udp_alBkECr6z0fLoRMy4nGhpxJE78QhEg62E-feQzn4rE9O_CCLHedB1D3jt0Cvt20Gj2WZedj4By4VJmVa18-0G9bbmgr5ZgzGAzUUDZil3BCI3osbvNwkmCEE4-oCoI3sPbiprFxlheSw4FuH3D32HQ8cuXJYXW43M6VJlrqSDN7f8uRMha9LV4wUwn79h6vKuiJq0zqqcUjWgZGt07mO8o_aYTQN2Jnkko-STZUKxlhXjgkqd58PE0aJLqVl_l313esxLaFT2d7FJEAq5gl8jVXppSgwV0N64i4YsOtiWr21OM1dN6jqniim1hZZqARjFbjRuMt-l-D74vL4C6tIoo_1hAT6K9OOY92z3WQUxRQvz7pRj_80jAV5cggPDQG3P77fhDJ4eV1zPbiBs4iyrAlkOxFhoPj4IBq77IJ1234R6lH4xfywMHgzar14QACneqTtUxT-krW3AOs-MNEy7H3NuU4R5aarcs92FPrFW-1dRmCRizSRg93mkqyJceq6z6fhBD92wLF15HtdBFvXfs6p7ensQjeCUE2Ib3HtGQn4QB9Z5FgDqDnXoCl4kaFlwN4CwmT5l-svnrfkETFjCn5WEM730VFLz38MeL8w2Dw2CrVu2KS2nBqIxCDNRTx7EW-FPr8XX4oSNOPp_zCbkeI-lj9libYLHfLK-q-nbgWfIkbZIGpXQPBiPSy8bZ-TA4iB6moZjH9aYQTZPmp66i6uwpOLSF8tnIfUlR3_xljKIHR3JdXbUQe0rD7_6F5YDhSEXWqoPgcW_lffGJIMW7ddOPtCFsWYbSH9NlXOaB24bhu3qawZabZ6Dk1VceHz7rOYBgF2cZ814HNDWgZb7vS_gUYtGz973f4JgKwbgVvn09z_I4D2tOBAP4FB77sfl7iK0a1MJC1BWsd9GN6PCy2u7T3Bn1Yaaatb49aVpo8YTG8RsQsXqRgDdFlBIjpkqKG6ABUyzV8P4Lnq8X8Wo7SvQqf6QF1cmJvJsMhS2p_lxg1br81tbZeKswVeE0o04ovPah14HtWgNSzjm-fbUbaQxXWTPcIOGgmyJNwzbSGEB8PK_rHdAbZu_3Q_xp5JXucKxKpSExiGAj4fcwGuD1-twRhQ3XgmqFqn66rL3lxCZa4B7_ZjZiRb0RdsFr9vda47R4Oz31MXZ3VYWuBPhg9Bk5R1V9gHUoZjkCClhX9tmP3Ng3wMnNDeu7YRp95KoGpvm5lT4hgo_lq68yY_IloWLVjyP-67_L2KOuSgz3A4gin0tkYm3f0ETdVIKWVL6rbpHhqNBZNSLL86jkgb9xuxrkUoQ0hIcOMpLYCLxBIHtS-rZoycD3PG-UJhFe65wrcn1Bl70ZwBXw73oZok9M_DOf6NF5XlsXNlrcUR90QtdzonBIgWLkzk289wAcO7x52bUV5jihQcNvk4MnAVxRrYSVN_LmtjMZx4r9HgOmhvUlQSS0ySc24B-CW5zA1_CgJ4gooPO3yBtlU-BfnZkB0UQNNYPEvK7d6tmoop2550iKaTk6qsOH_NlaNqMfAFRoi_MA5wmqHX_LPbqCOhBGS-VDNHXLfwLoSIo9fshAMhEIs6NYHbBQpAAfHk_2in2rd5nmAKJsPGUQloo5ZHbMKHnfvaKKOrphQwgl1NNJoKGlhwSnEA-vee9iyk_pJLlsTIPMeDg7PiAbKTtoA9Cl38PM-2bMqBi4BztDdSbCrPOxOFQO496tAbO29GdaHWcJDT5GXeZrO0fFa1q33Tpp-MOP6-AW1mjfSBUj5n8VxF3hHIx-nJhTIKnZyg6dHJK_nT8crcImLkMO66Nws8Yyo8emL0eVSffq-wkW24zTxH5S_jHVr7tnK4wf3JuubwnKkJZK_jhxBJH0FTotZ5wlh8Z8IBHmp4dwj32v6DWach4-vmPcFelF341c-lEd22X8DQE7aXDPPdGHXDiFGLWbtIK7prJuix3sdJEVSatog63iODfIMkqz1tl9RoYcxl5NZLCPqUGvEdEoTl9AUOmd7-wUURK3OSBuml_-JkWQxxE6vo6YAfJupfV9H6BPNWrzobg2hzkmC0x5Z9KmDomGCg6e0Z7RCxesz7kvRxxO8swYn2-kVoyEK_HgkLogmFzIYwLYGdnkptkbLA9fPzlJEf_VEBVZ0qtKx1DUaCMOmehPpHtR4HMtoQrfzegSA2auT5zgXDGpfgL0qDh_OLkZS8sFAJ9m2BDREBY6eSEB3ecZsXyreORUnE8V5Xw2Q9EEg&cid=CAQSTwDICaaN1I5S8umWz0386UuELnkhUyKmsSLUksTE9Sx6f7qBCuXDZ9Luf_MVoWMDNXSi2fQKzO9UxpXH6V0taN6gE3yvEM4lNE9k-uVa7DQYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fgeocult.ru%2F&ds=l&xdt=1&iif=1&cor=18173771268566794000&adk=929882888&idt=170&cac=0&dtd=6

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cf9c1e5799ab8b0002feafd6a0d62583e7f51e82c0fdd16486e1cc65e4b3d87f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42097
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1627455/73523880/ Frame D52E 255 KB
77 KB 151ms
32ms Script
application/javascript 99.81.155.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1627455/73523880/skeleton.js?ias_dspID=3&ias_campId=1013910218&ias_pubId=pub-2920555573584698&ias_chanId=1&ias_placementId=20492286635&bidurl=https://geocult.ru/&ias_dealId=&xsId=ABAjH0gACYsuM8K9Rul4zJPbg26o&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0gACYsuM8K9Rul4zJPbg26o
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.81.155.134 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-81-155-134.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 521f9f8f8e6568e42eaf00607a4f20642544eb7ad5cda07d65ee16a9c1aff3b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame D52E 111 KB
39 KB 175ms
56ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 19:51:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49763
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Dec 2023 19:51:26 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/ Frame D52E 11 KB
4 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C5NQj1Pbb2CKQOpkBDDBeQWg7_TAaVeqaiCaNnNQ4zeAtWaVtYoMRtZoemuYvI8jSTZjr50tXCYHC5txcTj51dFTacCgIKPMUQs7IxdathMkKb8gxI_rYmpkJhSSz_KjwayiDPUAiP3kI1hZ5srFDzA0GIgzUoqMevhsK72SjZj1zQEEU&dbm_d=AKAmf-BQN1hBy7bn3xAoIc5sXmAEogbilsMHOj3_F7v3_L24toflGGY3syDqkDTTbZ6Uhz7a2ycXlA4sAD8cpTn4GAD2zKUKr0MWqqmHNnySsPgoqx2fdFTPniW-j8ISNOPJr9L-SgWwZH1MACR6DFeImc59IVV9SK3E17zkQ3ou0tb79m0cYpzAlwxAQs9iuSLySBclmvjlAFOXe2Hukg8MiuPdgQVQV0beoW_2Mwsgz92mQGgO8_OL_pDoQl0JAQS0hpBNsJZburNnqRs_WEC48yDkJtXtV9PKkZ3dElP_NSmsGVKPPG3QWk5szYtQNPhje_wao86w7j3pZSSWOSZBYsh2AdgXtD77G6i9BSE747JPMrjiCWV496rDEAYD5YQSMCYvoWr9L56MSw9XbW6PcwXxvwQIHWGau1mUC-QKb4-6HnJZ4PzACQ9jtt8u4b4vIYn1ThXIQnsKAaCpxhxRL7cEQ1Hz2iUHzWyIOJb0P5f49RjZQSmZ_rCu_gd4q1abWDYODbUlRrrsEruVZsT5gFWbzweJ801EcXE4Q5KDh1yIuu3eWC6H3zAljr3zNaSiyZkJhtzADR-Isea9GKluWR68006JBAWKRW7WnmlyN0Ambv-OWwazyFfG3NxIQ6tnQ6IpXMTIYJ1Jp8ag-6SS_X1hrDE91tB5_joz9B-0NvQm6BBgje0Ae1gKrUiY9FIbc-gAkGrOvrES5Oy5_WvZx5CcZQSNzDigc0SJe6g7_0BxLA7GMYMlmK0YIh_T5HCL7DHJJgmlZwXom2ACjUwK4z_BtLv7sYEkjVUqOJpvJ7KmuzwNq98zxix2f298-hDU5GKINrHGCVdS0YaU7Jp3TiCEgH8MC1oECqKWFENSoDRyFrYu_sb79qeKn9yY-6AcTrmNdANmo7bfzb-fI1w5KEpigdlcWbFfDDm4_cR8W1yLKfE6PjrOTmjbOrbxrR4Y2r6IKXowvNtiEDtzyvPUCdPxy-4Oa9FSzXbeIGgYRuZj1uwygpcYSVoWxoXVNF_36ecK4zpd3ifOq0zg1_Vcf2UQ2FvYlF9_kY1Q4jNvSCG2WOGo4NEeku7L7JgdDadeYLF4OPXPM7-noaqkXDcnic5R9k3j-uidzUYpyx3MsNcNOu7r4iAlRE7xu77fWYYD1n4L1cZrzg9BDISTgWd2AR8RRNqJdcHQD5Y--pdxJW1dS33sF1E6iIO2uC1VQrOBpv6MvQ8e56-VqeTN75ikfruV9GttxtXCyafTRI7_ZvkCwdEsxyBU4zlgtcm4plNPvTYTcuzlUtqQmsToMrna_lMaRTzi16CK6Wq9F1SfzAJG9k7zsTxzswtEEj8_cIbF_LFnxAC_5nMrnR-dNS-0Ju0-qVhxqOkqBDT_8pP8ZSYZIo5-rUiJcZnTciVgfLwBwyjWYNwgtNOWLPvz81ghUM3-_Tc6gLbhBCSm1XDVjtIWxHWJn9HoypWT_zPJhVYp72EWDv8eQlUAXQZAOFDtVX4fa77AhOH-VnHtlJpYCZ1s0bPUuvWmrRhWZwbPxYApuky79PhhCA_cdLA-sec7jccRfpFGYMfF3ZPHEpKHXzE0AL51ceT2txAnGLMYSAeZjbcbVy5QUeBn-vVXQip9zt1hXHeCbeYbgsLTDq8y4V2XrhWjgImLOWbTq5ZjDFaTwxHfjVHW6E1_EhkDPVVAOgqtDd_jWiISRytDVETmf6E1Udp_alBkECr6z0fLoRMy4nGhpxJE78QhEg62E-feQzn4rE9O_CCLHedB1D3jt0Cvt20Gj2WZedj4By4VJmVa18-0G9bbmgr5ZgzGAzUUDZil3BCI3osbvNwkmCEE4-oCoI3sPbiprFxlheSw4FuH3D32HQ8cuXJYXW43M6VJlrqSDN7f8uRMha9LV4wUwn79h6vKuiJq0zqqcUjWgZGt07mO8o_aYTQN2Jnkko-STZUKxlhXjgkqd58PE0aJLqVl_l313esxLaFT2d7FJEAq5gl8jVXppSgwV0N64i4YsOtiWr21OM1dN6jqniim1hZZqARjFbjRuMt-l-D74vL4C6tIoo_1hAT6K9OOY92z3WQUxRQvz7pRj_80jAV5cggPDQG3P77fhDJ4eV1zPbiBs4iyrAlkOxFhoPj4IBq77IJ1234R6lH4xfywMHgzar14QACneqTtUxT-krW3AOs-MNEy7H3NuU4R5aarcs92FPrFW-1dRmCRizSRg93mkqyJceq6z6fhBD92wLF15HtdBFvXfs6p7ensQjeCUE2Ib3HtGQn4QB9Z5FgDqDnXoCl4kaFlwN4CwmT5l-svnrfkETFjCn5WEM730VFLz38MeL8w2Dw2CrVu2KS2nBqIxCDNRTx7EW-FPr8XX4oSNOPp_zCbkeI-lj9libYLHfLK-q-nbgWfIkbZIGpXQPBiPSy8bZ-TA4iB6moZjH9aYQTZPmp66i6uwpOLSF8tnIfUlR3_xljKIHR3JdXbUQe0rD7_6F5YDhSEXWqoPgcW_lffGJIMW7ddOPtCFsWYbSH9NlXOaB24bhu3qawZabZ6Dk1VceHz7rOYBgF2cZ814HNDWgZb7vS_gUYtGz973f4JgKwbgVvn09z_I4D2tOBAP4FB77sfl7iK0a1MJC1BWsd9GN6PCy2u7T3Bn1Yaaatb49aVpo8YTG8RsQsXqRgDdFlBIjpkqKG6ABUyzV8P4Lnq8X8Wo7SvQqf6QF1cmJvJsMhS2p_lxg1br81tbZeKswVeE0o04ovPah14HtWgNSzjm-fbUbaQxXWTPcIOGgmyJNwzbSGEB8PK_rHdAbZu_3Q_xp5JXucKxKpSExiGAj4fcwGuD1-twRhQ3XgmqFqn66rL3lxCZa4B7_ZjZiRb0RdsFr9vda47R4Oz31MXZ3VYWuBPhg9Bk5R1V9gHUoZjkCClhX9tmP3Ng3wMnNDeu7YRp95KoGpvm5lT4hgo_lq68yY_IloWLVjyP-67_L2KOuSgz3A4gin0tkYm3f0ETdVIKWVL6rbpHhqNBZNSLL86jkgb9xuxrkUoQ0hIcOMpLYCLxBIHtS-rZoycD3PG-UJhFe65wrcn1Bl70ZwBXw73oZok9M_DOf6NF5XlsXNlrcUR90QtdzonBIgWLkzk289wAcO7x52bUV5jihQcNvk4MnAVxRrYSVN_LmtjMZx4r9HgOmhvUlQSS0ySc24B-CW5zA1_CgJ4gooPO3yBtlU-BfnZkB0UQNNYPEvK7d6tmoop2550iKaTk6qsOH_NlaNqMfAFRoi_MA5wmqHX_LPbqCOhBGS-VDNHXLfwLoSIo9fshAMhEIs6NYHbBQpAAfHk_2in2rd5nmAKJsPGUQloo5ZHbMKHnfvaKKOrphQwgl1NNJoKGlhwSnEA-vee9iyk_pJLlsTIPMeDg7PiAbKTtoA9Cl38PM-2bMqBi4BztDdSbCrPOxOFQO496tAbO29GdaHWcJDT5GXeZrO0fFa1q33Tpp-MOP6-AW1mjfSBUj5n8VxF3hHIx-nJhTIKnZyg6dHJK_nT8crcImLkMO66Nws8Yyo8emL0eVSffq-wkW24zTxH5S_jHVr7tnK4wf3JuubwnKkJZK_jhxBJH0FTotZ5wlh8Z8IBHmp4dwj32v6DWach4-vmPcFelF341c-lEd22X8DQE7aXDPPdGHXDiFGLWbtIK7prJuix3sdJEVSatog63iODfIMkqz1tl9RoYcxl5NZLCPqUGvEdEoTl9AUOmd7-wUURK3OSBuml_-JkWQxxE6vo6YAfJupfV9H6BPNWrzobg2hzkmC0x5Z9KmDomGCg6e0Z7RCxesz7kvRxxO8swYn2-kVoyEK_HgkLogmFzIYwLYGdnkptkbLA9fPzlJEf_VEBVZ0qtKx1DUaCMOmehPpHtR4HMtoQrfzegSA2auT5zgXDGpfgL0qDh_OLkZS8sFAJ9m2BDREBY6eSEB3ecZsXyreORUnE8V5Xw2Q9EEg&cid=CAQSTwDICaaN1I5S8umWz0386UuELnkhUyKmsSLUksTE9Sx6f7qBCuXDZ9Luf_MVoWMDNXSi2fQKzO9UxpXH6V0taN6gE3yvEM4lNE9k-uVa7DQYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fgeocult.ru%2F&ds=l&xdt=1&iif=1&cor=18173771268566794000&adk=929882888&idt=170&cac=0&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 19:06:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52456
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 14415875674906819925
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 19:06:33 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame D52E 31 KB
12 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f6cbe31747c16c069d861a8ed01b15186eaee8c381f74ca1712087811c39f4d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 11:19:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80491
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11943
x-xss-protection: 0
server: cafe
etag: 4141415479739543000
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 11:19:18 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame D52E 41 KB
14 KB 56ms
56ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56141
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 18:05:08 GMT

GET
DATA 200
OK truncated
/ Frame D52E 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 78066b196420840a9db1e76add2e6ed77a637dfd6706d1100ae6001aaf93b7f8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 0BF4
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=ChpFTHzZ0Zcj6L4ztvPIPydqvaNmVga102e-R8KsSsvncoYwOEAEg1MealwFgleKQgqAHoAGDrI2qKsgBAakCYi2If_cOsj6oAwHIA8sEqgTHAU_QCIBDripjsqbALLk4CiBYv-cYhzEXKlI...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%221481199129478973342%22,%22debug_reporting%22:true,%22destination%22:%22https://novapost.com%22,%22event_report_window%22:%...

0
0

70ms
70ms

Fetch
text/css

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%221481199129478973342%22,%22debug_reporting%22:true,%22destination%22:%22https://novapost.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211362588163%22],%224%22:[%2212-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2211339834458605798113%22}&andc=true

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:49 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"1481199129478973342","debug_reporting":true,"destination":"https://novapost.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11362588163"],"4":["12-09"],"6":["true"]},"priority":"500","source_event_id":"11339834458605798113"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 09 Dec 2023 09:40:49 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 09 Dec 2023 09:40:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"1481199129478973342","debug_reporting":true,"destination":"https://novapost.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11362588163"],"4":["12-09"],"6":["true"]},"priority":"500","source_event_id":"11339834458605798113"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js Show response
pagead2.googlesyndication.com/bg/ Frame EE48 50 KB
19 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 13:55:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71143
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19601
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 13:55:06 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 810C 38 KB
13 KB 56ms
56ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 21301
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 03:45:48 GMT
expires: Sun, 08 Dec 2024 03:45:48 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dc_pre=CK6B0PeHgoMDFRDhOwIdxXEJKg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3233669781988.242
adservice.google.com/ddm/fls/z/ Frame B69D 42 B
401 B 218ms
98ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CK6B0PeHgoMDFRDhOwIdxXEJKg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3233669781988.242

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CK6B0PeHgoMDFRDhOwIdxXEJKg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3233669781988.242?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 90ms
90ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312050101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-2920555573584698&plah=geocult.ru&bust=31080036
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://geocult.ru/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 74ms
73ms Preflight
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 09 Dec 2023 09:40:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 810C 39 KB
15 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:50:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53424
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 18:50:25 GMT

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame D52E
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1627455/73523880/4.js?ias_dspID=3&ias_campId=1013910218&ias_pubId=pub-2920555573584698&ias_chanId=1&ias_placementId=20492286635&bidurl=https://geocult.ru/&ias_...
https://static.adsafeprotected.com/4.js?xsId=ABAjH0gACYsuM8K9Rul4zJPbg26o&ias_xappb=&adContainerId=brand_safety_ITZ0ZeCcCdSEjuwP5IqiqA8&cbFunctionName=goog_wrapCb_ITZ0ZeCcCdSEjuwP5IqiqA8&true_pb=

1 KB
1 KB

9ms
9ms

Script
application/javascript

2600:9000:243d:0:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?xsId=ABAjH0gACYsuM8K9Rul4zJPbg26o&ias_xappb=&adContainerId=brand_safety_ITZ0ZeCcCdSEjuwP5IqiqA8&cbFunctionName=goog_wrapCb_ITZ0ZeCcCdSEjuwP5IqiqA8&true_pb=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Server: 2600:9000:243d:0:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 18:45:50 GMT
x-amz-version-id: dZV1qYWLtZJQETG4KzZq1jUYDpTMrU_G
content-encoding: gzip
via: 1.1 c56940b696de15630f45de7e4da7bb32.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P4
age: 140100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Thu, 07 Dec 2023 18:45:48 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: os8qexUMn9mqHtv4958tB8BRQkFgpe-uAlAoF7AD5YZX8EI2UkaGIw==

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
server: nginx
x-server-name: app20.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?xsId=ABAjH0gACYsuM8K9Rul4zJPbg26o&ias_xappb=&adContainerId=brand_safety_ITZ0ZeCcCdSEjuwP5IqiqA8&cbFunctionName=goog_wrapCb_ITZ0ZeCcCdSEjuwP5IqiqA8&true_pb=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 5882 91 KB
23 KB 40ms
10ms Script
application/javascript 2600:9000:243d:0:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:243d:0:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 11 Jan 2023 08:50:00 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 c56940b696de15630f45de7e4da7bb32.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P4
age: 28687850
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: KCcd-qq4THms9QiRGgLJnQYuD7MOJ8kid3pnaUkUQFrQKC6nuwCB4g==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D52E 43 B
215 B 531ms
176ms Image
image/gif 2600:1f13:800:7780:f920:6a9b:b4b:339a
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=6a85da9e-a5eb-7561-4060-b389cfbf4de0&tv=%7Bc:wil5b6,pingTime:-3,time:33,type:v,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:15%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:33,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:15,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B29~0%5D,as:%5B29~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tXVWrDt+11%7C12%7C131%7C132%7C14%7C151%7C152%7C161%7C162%7C163%7C164%7C165%7C166%7C167%7C17%7C18%7C191*.1627455-73523880%7C1911%7C1912,idMap:191*,rmeas:1,rend:0,renddet:svg.us,siq:15%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:f920:6a9b:b4b:339a Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
server: nginx
x-server-name: dt11.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D52E 43 B
215 B 529ms
175ms Image
image/gif 2600:1f13:800:7780:f920:6a9b:b4b:339a
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=6a85da9e-a5eb-7561-4060-b389cfbf4de0&tv=%7Bc:wil5b6,pingTime:-6,time:33,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:33,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:15,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B29~0%5D,as:%5B29~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tXVWrDt+11%7C12%7C131%7C132%7C14%7C151%7C152%7C161%7C162%7C163%7C164%7C165%7C166%7C167%7C17%7C18%7C191*.1627455-73523880%7C1911%7C1912,idMap:191*,rmeas:1,rend:0,renddet:svg.us,siq:15%7D&tpiLookup=ao:geocult.ru*%2Cgoogleads.g.doubleclick.net*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:f920:6a9b:b4b:339a Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
server: nginx
x-server-name: dt22.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D52E 43 B
216 B 526ms
174ms Image
image/gif 2600:1f13:800:7780:f920:6a9b:b4b:339a
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=6a85da9e-a5eb-7561-4060-b389cfbf4de0&tv=%7Bc:wil5b9,pingTime:-2,time:36,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:517,beZ:518,mfA:520,cmA:520,inA:520,inZ:523,prA:523,prZ:529,si:532,poA:533,poZ:545,cmZ:545,mfZ:545,loA:550,loZ:552,ltA:553,ltZ:553%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:100.100,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:15%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:36,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:15,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B32~0%5D,as:%5B32~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tXVWrDt+11%7C12%7C131%7C132%7C14%7C151%7C152%7C161%7C162%7C163%7C164%7C165%7C166%7C167%7C17%7C18%7C191*.1627455-73523880%7C1911%7C1912,idMap:191*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:svg.us,siq:15,sinceFw:20,readyFired:true%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:f920:6a9b:b4b:339a Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
server: nginx
x-server-name: dt10.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/1064608057035189096/ Frame 41B8 6 KB
2 KB 164ms
54ms Document
text/html 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3477a72ef1db732762ffb13ba55d7df867b64c2abf5f88a1fdff29e6dbe374d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 26748
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1879
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 02:15:01 GMT
expires: Sun, 08 Dec 2024 02:15:01 GMT
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D52E 0
0 181ms
83ms Fetch
image/gif 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvs2DcyQlUNOuLMZlMkSJ65XU1kM28AWwuxXBbz9NfstqNi5soBb79IyDtYaoOmokXCJylcWwH3eTlNoH2DfTzRdq4YdcEfnrL9J5KztH1pjshIEVum3IlptnCysuuGU7m9BfApQdUvHdT25lVKzlwJslFYidvSrNiXQGIH9d1xaGtMvOyQESm9VSoUuQ9CEbJN3Zz4oPt6V9IrQkvdJfbsbNnSKP6akYOOcLBf2kqiwXhmvNZBZoQ48keuBmLbTI9k1AhZpt9OJiiUeClrwjOsu_m3ja4ResWPVs33l9CyU3p1eC7JtVKM18Jus-zBmEyJoK7xFSGocjv60eBjoQ49Daenqaw4lHB94pXJUXi62REkTHX_hA1Eakv8hH2oNpKxPdc8vpMcFueaE6f9zSCa3-XQS-jITxwDhzXG2TvBheUQbll3LRhtNs93w9LWXqKo1Q3idrbTxt0U2-_QJr9x4t_eWpfiR9P3DqfVT_5MQe-m6ukYnztVTDYsHoPSbC1wiPxEe8MnhLQveUd84wFFuotKhTm5Yx7V5PLQVRAVNY689z6OYY7RLVAZh6vhIdJE0RlD_BN72Lw06GJua9JuczIgtjbna_51-T8lnLRuwS-kRLl9ioYBypGhiQOEe0UkmYCPQjwA4VOgEBh9KiGjMTrpQB-y2s47w_z93jBNGNNAZD9hEuFHUbilitoJpY-khe8O1fCdf4pWTFyp_HFgrlhoEFimagbsOoUTgzr0HqWA_lojStInBNvWUw5X7ZmAO50KTRwzAeY_hl76z7A27yIdKncYFYNkVZFy_LIGagBVJb8x0rQ47pWAnGXOWE6J1l-PfLdajywTZ6G-RY8ffFSo7UJR1ID98TIAUdsbPdBXTyCdfZdcPGae0ZWgEmHvDmwr9mKUVqE9Wa3hkj-KU8xhNlcV5N5xytrrI_YFuvSFvdN-LAetP0VANZsASZqCjIglYrFEJApk6QFWmw2GoJY1WDhL10MjawuhWfWxM49VfLID3cnV6ekM4sWWOoOeaa-auuVctr-Qfcgur2ybPc6nm9oYlbI4tjmkwu7uvfIumP-bQEb7aKoFF6NXXBGphxW6qX7vBnlR5kB_r1i0-foQjMVh4SDtoAUbOFI-QvcWO9awBcArFNfAqL7FY45PdLuNJlCC-bUtLl9UBsMQayIrVGfXgDZ2sTT1LOPVNCG9OXTl3ianG2wembeW9tCcZ0r2u4qtSM58KYSzSrk7mB24_-y7ANMHLAItwI-Z55xc8E4&sai=AMfl-YQWi9vVETrQ9YtN7VV9XcOpEaP8RMkjC_g2SzD5KoPZAS5-C3f6OW7VyPxrB1pAgMZN0XfXCaYSWCGJHJqeRYxdaxs0bF958dL4BZyedyzDEdgsopTF7N32OYcrSSmEPesFJym6TAUeO4MZiEBmRVaYSzCuFs6ijOCLT0EFUL_-GNdsDlrDUoss9yY00U18lG4-aTn4Wxv1ED4O-CCjGrM_BkT5pqsyZnxmrcCpZmwWFsE2D1p86hYC6xDU0CunJGNNklkkAJTnOT2-2k5SHgIzv4MGH69cQrvy3m6oMw&sig=Cg0ArKJSzDBtS9PeS8w0EAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=251&cbvp=1&cstd=249&cisv=r20231206.44584&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 09 Dec 2023 09:40:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 810C 0
22 B 92ms
92ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BD9YXITZ0ZeCcCdSEjuwP5IqiqA8AAAAAOAHgBAI&bg=!WVqlWhXNAAY3kmNgF5I7ADQBe5WfOF6Irrc1xbsh5RhYnP2EvlBIZWxBrgdQuzaWktc1gdY-fnAvu9AgprSnwRSfUczvAgAAADRSAAAAAWgBB5kDRD1pZNCCh7g0p7XJzpcu9koan1xf60jvJ7Q8L4pbdDFPD5zgy65SBqrVSDTXZq9Mmd7lDwgfXrlOVFZt0K8Rvj_gOZsoR0kQUwuCt5DjFgty1tfrIslHf58SzeoCrHAJsF7Rkba4QidW8H08wkhxX8abbvx3fhnZTJH8puV3F-SySGlqqJW82GFnmwJuGbC2RX3Vuov7QpijDNv41o9DZtyJ82nGUmgVp-y5AkHfIkptcnd6lH8CPzhgKEFryZQDpP8aQ83yxsZCioDYIC2Wf76qvkoeC_b1GbIRHpjn1KFdl5JQCKtlr5Qr3KNQT7LWidBTExJFS0hVApMQ0lCLff-KmJWAV32yZbbAdQrhHbuTvlk9vVBXVgHqUMZMBWGIHdgVMNWDpoLZv_UAN1O56I668JmEasnfc5vfXypDikBwtkmSym32bXNzNuDM-EZLYIApRVNxgUjrdH4PGKehPvTgpMNjcpPM8L5TTIpnutAbiOK4_lEylOOBIhYGy4RviMzuf505HIy84ciAR5YBU_nNIJVd7xTYg8sU4bsy0PuStczSYFXN6nhbY3TO-fC9DGgr6sccCVhWZtaQbJmRuGKJNvYQq-jtxgfiwDE3e_dZbNlk_wNRoWu2FZRajqHPVt4moZ8Wtiwr7VTixpSoyRnn7WmjYFcFuV3LiQXmgiiJKt2xyadoj_KWYAwx3fyvkJtHUm2B0WJsY5ePTUKaVf2PlqANiWDDagAp4SCVxdA_Z-iZbjsaGL6bgLz8FgXt3Wha3xGkNlMczYZzaLy8O40ZBRMgiPcA6SGUCNNIvppK_KX9JLD7z03cYb1CCMh2GaIm2OY3Xzrb5MzwoLE8_ULIaKb20hD1HwgetiClz70IvhUlaf_dDKFaQhJsCyTVnOJnvMGWgufxsSod6KWqLqnK0eAcJ_9hpeD7CgyEdcbhRaxo_NihasN4Bub6ua6SpP2PMi4kz3tiKcePUo4UETSOoIPMyqpptl9AzKF-bpApr0ecJ8Vnr69iYudix5WYQBU97RGytl4tO7MIw9RGzxhjobNmRf3q_pDYHMSiQ5MXaU9UacfxJpHMjoSCv2e54RzLFlWx32d81MOoYKZL-4ntwi4b

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 style.css
s0.2mdn.net/sadbundle/1064608057035189096/css/ Frame 41B8 6 KB
2 KB 57ms
56ms Stylesheet
text/css 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/css/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce2b61e64a17f1488f20bafee5aa20a8d8ec897b990f709634f5bd1cc620e6b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 12:55:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 506729
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2000
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 02 Dec 2024 12:55:20 GMT

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/ Frame 41B8 70 KB
25 KB 62ms
23ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce56080747fb3b762486b9ccc59bc01f871c9647d354a1c27b52cdb73fc1bfe1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2534764
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 25267
last-modified: Tue, 01 Aug 2023 16:38:45 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "64c93515-62b3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MKlhkQfW7GOF%2BR66zVqDhWfnAdZ4igBJU92czNqK%2BaPA5T45R%2FUtA%2F0dyqUt4wSnO3I%2BO%2BpcUz78X4hFaYkPjJHmM%2BY%2FgIkGAGTKePltfvDj2cigGmHHUpg91p3Ekjw9uJKkR0s1oUlheIZyuNHCVMQG"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 832c49f28b95365c-FRA
expires: Thu, 28 Nov 2024 09:40:49 GMT

GET
H2 200 CustomEase.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/ Frame 41B8 7 KB
4 KB 60ms
21ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/CustomEase.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c190eb38a3f491bcbf96b136cf4a4ab534ac1293d37d9047fd77db6365c86682

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2340564
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3299
last-modified: Tue, 01 Aug 2023 16:38:45 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "64c93515-ce3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cyf6oynDixu%2Fj%2F%2FGtQrKfP2h7F6oTZx17REEsymD6RWy9Rc3Lq%2F%2FI%2Bb05wek%2B5qx2Txfu0NukQ%2F%2BaaZAGOFfj%2BUcbD6PPgf8JC0MQ7cDe2uC927V%2BM5t1Rv9OLLCNmRSQhnzFYRXOmEtU5SgkRIeVZ6a"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 832c49f28b93365c-FRA
expires: Thu, 28 Nov 2024 09:40:49 GMT

GET
H3 200 dyson.svg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 41B8 2 KB
1 KB 56ms
55ms Image
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/dyson.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7b8d433b88d210c6aeb414da6fc440f45c471fad1b5aaae9f0b66c50122c62b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 19:32:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 223677
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1076
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 05 Dec 2024 19:32:52 GMT

GET
H3 200 rtbIcon.svg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 41B8 2 KB
800 B 58ms
58ms Image
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/rtbIcon.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5e166567ad908883ca1d769c38b6f65959bb067295e5ea3c2f850ec5fa2b8d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 15:16:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 411859
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 771
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Dec 2024 15:16:30 GMT

GET
H3 200 arrow.svg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 41B8 429 B
349 B 55ms
55ms Image
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/arrow.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ace6c1d1cccc4686d29e81c0821be209d2e2d8b7ba44ee24649a698a5230f6ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 15:22:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65928
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 320
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 07 Dec 2024 15:22:01 GMT

GET
H3 200 dyson-v15s-submarine.svg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 41B8 25 KB
8 KB 55ms
55ms Image
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/dyson-v15s-submarine.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

69e1767c60e702480b7a4604f7a71a344e3e03caa6e21f6a352a9f63908dc500

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 12:55:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 506729
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8356
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 02 Dec 2024 12:55:20 GMT

GET
H3 200 1-min.jpg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 41B8 33 KB
33 KB 56ms
56ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/1-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

539cc993691ac34295a0b8e0b720aa3db63a2e80c78d49e1c4c4132bb4a5dc09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 01:40:15 GMT
x-content-type-options: nosniff
age: 28834
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33567
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 08 Dec 2024 01:40:15 GMT

GET
H3 200 2-min.jpg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 41B8 33 KB
33 KB 86ms
85ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/2-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8833293f6762feb57c976e996042e2dcf201b282c034504008e2bf0a98dd3527

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 17:17:43 GMT
x-content-type-options: nosniff
age: 318186
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33601
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 04 Dec 2024 17:17:43 GMT

GET
H3 200 3-min.jpg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 41B8 25 KB
25 KB 56ms
56ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/3-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2e3479d14727cf6b6581add352dad3c9fb8a89b1586d49dc0e606249e7abe437

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:31:46 GMT
x-content-type-options: nosniff
age: 47343
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25911
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 07 Dec 2024 20:31:46 GMT

GET
H3 200 4-min.jpg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 41B8 9 KB
9 KB 101ms
100ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/4-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f430ad6611692180cc5bfba88afb989ac5cde063c2e929a28026be4c2c3e9f45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 06:18:44 GMT
x-content-type-options: nosniff
age: 12125
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8971
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 08 Dec 2024 06:18:44 GMT

GET
H3 200 5-min.jpg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 41B8 12 KB
12 KB 108ms
107ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/5-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d60255211b63ebd7ab57221ffe52ae073eab1c1c3a93c48df42b224e7f7c527

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 06:18:44 GMT
x-content-type-options: nosniff
age: 12125
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12054
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 08 Dec 2024 06:18:44 GMT

GET
H3 200 script.js Show response
s0.2mdn.net/sadbundle/1064608057035189096/script/ Frame 41B8 4 KB
959 B 80ms
80ms Script
application/x-javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/script/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc757f9ba6603eb9913106a4cd83c7a7c0a8a4f845a0aceb1103606bc324ad00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:19:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 55267
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 930
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 07 Dec 2024 18:19:42 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 7008 640 B
268 B 95ms
95ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYlYro4gEwAQ&v=APEucNWOjYrB79wyDzqY4Vvs1A2yvxjpgXXKS81G_FC4yx8l0oyIwLSQ2XF1VVEHi_-2-Sb2LT618iLMgafGtEf7NtNm3UWHWcQGTGnn6SZz6RqezRo488pbijZc9MLk17Gdtpp6G1KgiNu1SzugXme2gx5wYfdNe1o3ryaXGCMGO41yQMDVaRQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=371214980&pi=t.aa~a.542385254~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280&nras=2&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=776&ady=1268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=371214980&pi=t.aa~a.542385254~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280&nras=2&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=776&ady=1268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame D7AE 172 KB
60 KB 53ms
53ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 19:32:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50878
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Dec 2023 19:32:51 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/ Frame D7AE 7 KB
3 KB 55ms
55ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53020
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:57:09 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame D7AE 24 KB
9 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite_fy2021.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53020
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:57:09 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame D7AE 41 KB
14 KB 56ms
56ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56141
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 18:05:08 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame D7AE 3 KB
1 KB 64ms
64ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41931
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 22:01:58 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C3C9 1 KB
650 B 58ms
57ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 62559
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 16:18:10 GMT
etag: 48472445140208031
expires: Sat, 09 Dec 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame D7AE 20 KB
8 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46718
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:42:11 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame D7AE 202 KB
64 KB 95ms
95ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 09:40:49 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D7AE 42 B
65 B 90ms
89ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D5UHjO-ehRnt4f8ptRSHN7TpD8g_xiCXWPXZJ1J8KJfwryY4dtMRmHWsEQbOWNXd9pqybsOz755QT0fUBbQKH1RCVxIKquzE8gK82ZpDo8TG0WYSA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 e21910fd923a6283b5d44b2382eabc86.js Show response
www.gstatic.com/mysidia/ Frame 554A 9 KB
4 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/e21910fd923a6283b5d44b2382eabc86.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

27d5ba2175dc395614adb2c69fe9f4bff9abddef3a7c6e3e30a68587f428a37b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 03:13:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 23250
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4064
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 22:13:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 08 Mar 2024 03:13:19 GMT

GET
H3 200 f3d12415f986ed3504122551351bc1d0.js Show response
www.gstatic.com/mysidia/ Frame 554A 42 KB
16 KB 57ms
57ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f3d12415f986ed3504122551351bc1d0.js?tag=html5_display_upload/html5_exit_api

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c5bcc597ce8a3ec0c0ef52ee8ece8f284ca9739c1bd1bbac380a3deb672d5446

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 05:53:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 272815
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16637
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 04:10:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 05 Mar 2024 05:53:54 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 554A 2 KB
822 B 59ms
58ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:55:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53137
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:55:12 GMT

GET
H3 200 50459845d1cbd526a76ea757de42d266.js Show response
www.gstatic.com/mysidia/ Frame 554A 23 KB
10 KB 68ms
66ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/50459845d1cbd526a76ea757de42d266.js?tag=exit_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9caffafcdae7b42e3d074103c18a33640d4edf81401c216e99dbb77a15dfa511

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 16:47:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60784
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9842
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 04:10:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 07 Mar 2024 16:47:45 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame 554A 24 KB
9 KB 60ms
59ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:54:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53166
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 18:54:43 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 554A 3 KB
1 KB 69ms
68ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41931
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 22:01:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 554A 20 KB
8 KB 60ms
59ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46718
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:42:11 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 554A 0
0 62ms
61ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS92uQlUeXxFiseBQHH3cdU90ISzTH11h_kKwu8GuhQ7qAVllT_gKau030_cHny2PDI-Ae5xhBHrf7eSzoLYg_kVYZsXg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 554A 202 KB
64 KB 148ms
148ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 09:40:49 GMT

GET
H3 200 f9d9b65dbd646119ce96bad0f484d579.js Show response
www.gstatic.com/mysidia/ Frame 554A 37 KB
15 KB 77ms
77ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f9d9b65dbd646119ce96bad0f484d579.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 04:32:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 277690
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15460
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 04:10:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 05 Mar 2024 04:32:39 GMT

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 9B4C 16 B
209 B 77ms
76ms Fetch
application/json 35.176.121.206
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.176.121.206 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-176-121-206.eu-west-2.compute.amazonaws.com

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 09 Dec 2023 09:40:49 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 82ms
19ms Preflight 35.176.121.206
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.176.121.206 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-176-121-206.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Sat, 09 Dec 2023 09:40:49 GMT
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D52E 43 B
215 B 175ms
175ms Image
image/gif 2600:1f13:800:7780:f920:6a9b:b4b:339a
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=6a85da9e-a5eb-7561-4060-b389cfbf4de0&tv=%7Bc:wil5gP,pingTime:-10,time:388,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtNjB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjAuMC42MDk5LjcxIFNhZmFyaS81MzcuMzZ8fDF8fDF8fEdvb2dsZSBJbmMufHxu,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1702114849823%7C%7C9ae1d76341917ab4952114fbf6f28ccb%7C%7C81fa84b75a8024ba76b34e57df459f31%7C%7Ce6baf0d11a3bfb511186c43029c2997d%7C%7C74ecde8e49cce8c0188e0896b735a637%7C%7C7fda85c9f2e207e4fabbf3e2f03cb74d%7C%7C412187d2956b1f3a3f6cb50f48606f53%7C%7Cfebb7568a786da67edeebf37e6fdebcc%7C%7C1663701684%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231206/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:f920:6a9b:b4b:339a Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
server: nginx
x-server-name: dt18.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 dysonfutura-book.woff
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 41B8 8 KB
8 KB 57ms
56ms Font
font/woff 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/dysonfutura-book.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c868679a384546d80661e6085c6a40e95de3be2ad0487c56e116703ffd1850bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/css/style.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 12:55:21 GMT
x-content-type-options: nosniff
age: 506728
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7928
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 02 Dec 2024 12:55:21 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame A730 38 KB
13 KB 58ms
56ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 21301
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 03:45:48 GMT
expires: Sun, 08 Dec 2024 03:45:48 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame D7AE 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1191ddd49747fc6fc178fde22e3c9c95d2c4ecb916797f52e3b6578e3bc5e6bd

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame C3C9
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEDKebvKeBJl6DwyXkLgGpNI&google_cver=1&google_push=AXcoOmRmr85M40A7lXD7AbvXxffG2R103kz3_YQDI3KAt9FrtsMTGGFjOg5utHg-MQ3cQHhkVPoTwfFAi5gyzbrMsf70feIQ3t_eb...
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODA1NTQ4ODYzNzQ4MjQ2NzQzNg==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDKebvKeBJl6DwyXkLgGpNI&google_cver=1

43 B
398 B

36ms
15ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDKebvKeBJl6DwyXkLgGpNI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=371214980&pi=t.aa~a.542385254~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280&nras=2&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=776&ady=1268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=3
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDKebvKeBJl6DwyXkLgGpNI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame C3C9 35 B
464 B 57ms
10ms Image
image/gif 2620:116:800d:21:ef75:8280:f209:5ba1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEIfrr5J74PFvyJ17c673dGs&google_cver=1&google_push=AXcoOmTFJGBDZMFdp_WEIPpylxMM1ZGQZIG8NqD2gY9tOEEA6I1eqxAehP-Xov6KjJAIHqSXWXS4bEYOMKMpy4DJ--GgNyLX5KotbS1hmEVynN5DOEdBYQ8-SHRHBQi6mHVwdysCQwrbdOQyShu-h5pBRXMvrw

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:ef75:8280:f209:5ba1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame C3C9
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESENu7dKSsGn8LTs9FI4w2MdA&google_cver=1&google_push=AXcoOmT_PK9_Y0Ih5AhsAR8cJq5uq6fNkl3C9Jic5V50WXtZtUCEjzqfNFA8Ef1Jo1_nLffrXwYbcSx-HN8XQrk6qWBGZwB8e9ri-...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENu7dKSsGn8LTs9FI4w2MdA&google_cver=1&google_push=AXcoOmT_PK9_Y0Ih5AhsAR8cJq5uq6fNkl3C9Jic5V50WXtZtUCEjzqfNFA8Ef1Jo1_nLffrXwYbcSx-HN8XQrk6qWBGZwB8e9r...

43 B
428 B

186ms
177ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENu7dKSsGn8LTs9FI4w2MdA&google_cver=1&google_push=AXcoOmT_PK9_Y0Ih5AhsAR8cJq5uq6fNkl3C9Jic5V50WXtZtUCEjzqfNFA8Ef1Jo1_nLffrXwYbcSx-HN8XQrk6qWBGZwB8e9ri-qu-ahFTlDSKFQSBidwrQsjQBM8cCrO-coCY6kYr30_bjUG8Pmy21KUGwXo&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmT_PK9_Y0Ih5AhsAR8cJq5uq6fNkl3C9Jic5V50WXtZtUCEjzqfNFA8Ef1Jo1_nLffrXwYbcSx-HN8XQrk6qWBGZwB8e9ri-qu-ahFTlDSKFQSBidwrQsjQBM8cCrO-coCY6kYr30_bjUG8Pmy21KUGwXo%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=371214980&pi=t.aa~a.542385254~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280&nras=2&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=776&ady=1268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=3
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:50 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 832c49f4ebe12bcf-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:50 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 7
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENu7dKSsGn8LTs9FI4w2MdA&google_cver=1&google_push=AXcoOmT_PK9_Y0Ih5AhsAR8cJq5uq6fNkl3C9Jic5V50WXtZtUCEjzqfNFA8Ef1Jo1_nLffrXwYbcSx-HN8XQrk6qWBGZwB8e9ri-qu-ahFTlDSKFQSBidwrQsjQBM8cCrO-coCY6kYr30_bjUG8Pmy21KUGwXo&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmT_PK9_Y0Ih5AhsAR8cJq5uq6fNkl3C9Jic5V50WXtZtUCEjzqfNFA8Ef1Jo1_nLffrXwYbcSx-HN8XQrk6qWBGZwB8e9ri-qu-ahFTlDSKFQSBidwrQsjQBM8cCrO-coCY6kYr30_bjUG8Pmy21KUGwXo%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 832c49f3ca6c2bcf-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C3C9
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEM1PkyC9XpyUVb4j4yTiEj8&google_cver=1&google_push=AXcoOmQ7qd9ExmjYV7c3jb5VnMnCWE7csdnqmG6yfliwlacFndJLXgO5j2EroW3CGQcDhHTy-VGZ6HrGneKAxwYBzoDNs520FZkEvz...
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=AC173272D79C4D7B9CA43AFDC2186866&google_push=AXcoOmQ7qd9ExmjYV7c3jb5VnMnCWE7csdnqmG6yfliwlacFndJLXgO5j2EroW3CGQcDhHTy-VGZ6HrGneKAxwY...

170 B
188 B

45ms
45ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=AC173272D79C4D7B9CA43AFDC2186866&google_push=AXcoOmQ7qd9ExmjYV7c3jb5VnMnCWE7csdnqmG6yfliwlacFndJLXgO5j2EroW3CGQcDhHTy-VGZ6HrGneKAxwYBzoDNs520FZkEvzH3h1fX3tctdJ-432zNgoZO8s0VXhqzzBOXDoyDbbIcydBKDX1yHDc_1uM

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 09 Dec 2023 09:40:49 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=AC173272D79C4D7B9CA43AFDC2186866&google_push=AXcoOmQ7qd9ExmjYV7c3jb5VnMnCWE7csdnqmG6yfliwlacFndJLXgO5j2EroW3CGQcDhHTy-VGZ6HrGneKAxwYBzoDNs520FZkEvzH3h1fX3tctdJ-432zNgoZO8s0VXhqzzBOXDoyDbbIcydBKDX1yHDc_1uM
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Fri, 08 Dec 2023 09:40:49 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C3C9
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEORmncC6CSXOC9LpdsweISk&google_cver=1&google_push=AXcoOmTBVd-iqqCeX6-ZasVf6ehgJRuKMdpWHAVS6I_HERJzZ1pB9hWZDdryr9xLDVjVoN4OOKxvGdDBsxLucW82oKLlFqEVqshWi...
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AXcoOmTBVd-iqqCeX6-ZasVf6ehgJRuKMdpWHAVS6I_HERJzZ1pB9hWZDdryr9xLDVjVoN4OOKxvGdDBsxLucW82oKLlFqEVqshWiU4KFjP6AyCbd1G3nwiu2-MDKn-QrwKd...

170 B
188 B

45ms
45ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AXcoOmTBVd-iqqCeX6-ZasVf6ehgJRuKMdpWHAVS6I_HERJzZ1pB9hWZDdryr9xLDVjVoN4OOKxvGdDBsxLucW82oKLlFqEVqshWiU4KFjP6AyCbd1G3nwiu2-MDKn-QrwKdYilhdGZkuSefyNWy4QstkMuF9A&google_hm=Q0FFU0VPUm1uY0M2Q1NYT0M5THBkc3dlSVNr

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 09 Dec 2023 09:40:49 GMT
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AXcoOmTBVd-iqqCeX6-ZasVf6ehgJRuKMdpWHAVS6I_HERJzZ1pB9hWZDdryr9xLDVjVoN4OOKxvGdDBsxLucW82oKLlFqEVqshWiU4KFjP6AyCbd1G3nwiu2-MDKn-QrwKdYilhdGZkuSefyNWy4QstkMuF9A&google_hm=Q0FFU0VPUm1uY0M2Q1NYT0M5THBkc3dlSVNr
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame C3C9 42 B
204 B 58ms
21ms Image
image/gif 34.160.236.64
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEDIlD0FGQ277MSgEet0NQ20&google_push=AXcoOmRVbv5pkm3m5Gr26fOGvo8alrNq0N5kNzF8081sK_EfB69UWwwlSIhbn_vS8jEdHz41GpwpUs2t_EVtqazYg7XqchksFgCGeaWS4fQ6n0Q8tdDbMmpfKSPJJ8LMrsbzKmUDcru4s6cT4ASw4WwrGjmOUns&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=371214980&pi=t.aa~a.542385254~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280&nras=2&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=776&ady=1268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.160.236.64 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 64.236.160.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:49 GMT
via: 1.1 google
last-modified: Thu, 19 Oct 2023 06:07:48 GMT
server: nginx
etag: "6530c7b4-2a"
content-type: image/gif
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C3C9
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEIVkL4sIU2rSJS2H1cVASKU&google_cver=1&google_push=AXcoOmR7z8Z-05TlhdaniIDBvMozeM-Rhl7bmu_OZopVPaxCunCeNPH-uzakMFDhaqInUkOhj_Esei3m...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEIVkL4sIU2rSJS2H1cVASKU&google_cver=1&google_push=AXcoOmR7z8Z-05TlhdaniIDBvMozeM-Rhl7bmu_OZopVPaxCunCeNPH-uzakMFDhaqInUkOhj_E...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTYzNzk0NjcwODA1MjM1MDAwNA&google_push=AXcoOmR7z8Z-05TlhdaniIDBvMozeM-Rhl7bmu_OZopVPaxCunCeNPH-uzakMFDhaqInUkOhj_Esei...

170 B
188 B

46ms
46ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTYzNzk0NjcwODA1MjM1MDAwNA&google_push=AXcoOmR7z8Z-05TlhdaniIDBvMozeM-Rhl7bmu_OZopVPaxCunCeNPH-uzakMFDhaqInUkOhj_Esei3mHrc3uwzCD3m9f5XIpD3mvu-aK1tNxwdamiJ_FUSpjnrE3pBEoTNl7gjau1ZdSUMVxY4gDGNPyL4Bek0

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTYzNzk0NjcwODA1MjM1MDAwNA&google_push=AXcoOmR7z8Z-05TlhdaniIDBvMozeM-Rhl7bmu_OZopVPaxCunCeNPH-uzakMFDhaqInUkOhj_Esei3mHrc3uwzCD3m9f5XIpD3mvu-aK1tNxwdamiJ_FUSpjnrE3pBEoTNl7gjau1ZdSUMVxY4gDGNPyL4Bek0
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C3C9 0
12 B 45ms
44ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Jqv52h1leuIIXkEg1Pc4fOAzLUFk_TKJ0hejkxmwNOkdDQ1tH2wCiBoTdOiW2znsECuQfL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 7008
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGeoC6eW912iUJAnhZ6gk5w&google_cver=1

43 B
105 B

19ms
19ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGeoC6eW912iUJAnhZ6gk5w&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYlYro4gEwAQ&v=APEucNWOjYrB79wyDzqY4Vvs1A2yvxjpgXXKS81G_FC4yx8l0oyIwLSQ2XF1VVEHi_-2-Sb2LT618iLMgafGtEf7NtNm3UWHWcQGTGnn6SZz6RqezRo488pbijZc9MLk17Gdtpp6G1KgiNu1SzugXme2gx5wYfdNe1o3ryaXGCMGO41yQMDVaRQ
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGeoC6eW912iUJAnhZ6gk5w&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 7008 43 B
295 B 61ms
22ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYlYro4gEwAQ&v=APEucNWOjYrB79wyDzqY4Vvs1A2yvxjpgXXKS81G_FC4yx8l0oyIwLSQ2XF1VVEHi_-2-Sb2LT618iLMgafGtEf7NtNm3UWHWcQGTGnn6SZz6RqezRo488pbijZc9MLk17Gdtpp6G1KgiNu1SzugXme2gx5wYfdNe1o3ryaXGCMGO41yQMDVaRQ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 7008
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEEQ7ob5yKcdhNoNett-bV50&google_cver=1

23 B
163 B

91ms
61ms

Image
image/gif

2.19.217.101
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEEQ7ob5yKcdhNoNett-bV50&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYlYro4gEwAQ&v=APEucNWOjYrB79wyDzqY4Vvs1A2yvxjpgXXKS81G_FC4yx8l0oyIwLSQ2XF1VVEHi_-2-Sb2LT618iLMgafGtEf7NtNm3UWHWcQGTGnn6SZz6RqezRo488pbijZc9MLk17Gdtpp6G1KgiNu1SzugXme2gx5wYfdNe1o3ryaXGCMGO41yQMDVaRQ
Protocol: H2
Server: 2.19.217.101 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-217-101.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

expires: Sat, 09 Dec 2023 09:40:50 GMT
pragma: no-cache
date: Sat, 09 Dec 2023 09:40:50 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEEQ7ob5yKcdhNoNett-bV50&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 7008 23 B
163 B 137ms
60ms Image
image/gif 2.19.217.101
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CL6Q0AIQ84-rhgMYlYro4gEwAQ&v=APEucNWOjYrB79wyDzqY4Vvs1A2yvxjpgXXKS81G_FC4yx8l0oyIwLSQ2XF1VVEHi_-2-Sb2LT618iLMgafGtEf7NtNm3UWHWcQGTGnn6SZz6RqezRo488pbijZc9MLk17Gdtpp6G1KgiNu1SzugXme2gx5wYfdNe1o3ryaXGCMGO41yQMDVaRQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.217.101 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-217-101.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

expires: Sat, 09 Dec 2023 09:40:50 GMT
pragma: no-cache
date: Sat, 09 Dec 2023 09:40:50 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
H3 200 Besparend%20300x600.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/ Frame EB18 3 KB
1 KB 58ms
57ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/Besparend%20300x600.html

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/f3d12415f986ed3504122551351bc1d0.js?tag=html5_display_upload/html5_exit_api

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94f2f98f4273b0962a8cc7027ca354903e5de47187d935c9b5f929054e2fef40

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 124695
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1335
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Thu, 07 Dec 2023 23:02:34 GMT
expires: Fri, 06 Dec 2024 23:02:34 GMT
last-modified: Thu, 09 Nov 2023 12:53:36 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 35D5 1 KB
650 B 54ms
54ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 62559
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 16:18:10 GMT
etag: 48472445140208031
expires: Sat, 09 Dec 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/12943809228921786815/ Frame C9D4 1 KB
767 B 63ms
63ms Document
text/html 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=54f46qHDx0&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68b34a28617137221b76b93546359bf577aea1d6b3aadbd65b40e8bbdae7dd0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 739
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:49 GMT
expires: Sun, 08 Dec 2024 09:40:49 GMT
last-modified: Thu, 27 Apr 2023 13:46:02 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame D7AE 0
0 82ms
79ms Fetch
image/gif 142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsv0Q2WnB3fWLArPxohWcfT6Mk7zVFw4opjW_CLZMmuM5idJO4RYDpIg2Yx0lieMDVVJhWU7FuayjrOus51sUFn_JsQTjl_fulSpY_N3cp4MwXmQdpgqNHBt_y_bQmbinOhJvLvg-nZJgGqSWvLe5QzwV-k7vkh5Mxc3Sx0LmfzZCN8fLjS1WxVF3xstiNLnxjyilmcwo9WzuPcOTnE_uLdEiueYDz3BipuRqTrikuP6GDzxWOmQ-sZ6gH-ABxVRQeyXJduIsWkmFc8nmCUWNWCQnXAHBD90EmdTeVUsVbSWk23WlnS2gF9LslOgc9sZ6eHshOMMfNypywBJoJ-YaLXo-dOoUHbLgBvEYalY75kD_1UdKEKFGDRaCAprkhDNDIzdh_mWrycVc9ewb1HQfSgasyQqs9bDV7XCy5rpGukMh6dAaN06ORFX-6jI4y60nZLiOvJJR7F4Cp7h0gfmVBc3aRlTjF8GUi8PNugF0yRoIUTeYIhtSrq_sj-nzM3croarWykkPdsXfl4nWqKCeLfDc9gtNaAnb0TZd0utNVCJ1mym4yILhQGgGE3xs4MppVvu5vF2OYaW5C5u1akxUd2VEW12KX6KW6v8-X_INAQ-0F6NvspEgYXc-PCTBdGXdgi_VJ4rU--b9qiBAmFP3nWb5QJQiV0t5MGmCT36DMYefi-KBbDE4YeZtnLNUv9pEpdy_H7STQNzq1EmYVqzjIR2r7XuRKnSzVTK03MuQoCoh0bHJESAHymDJQ3ecrThnYK-o80krluyLCTZUkd5Qr_xifGfgtmOIvxNXDgKXjtHJuvqbhqfzCFuzKVG-uqeUwinNh_CmKF6mN5Y9aVZXmBRUZcCRsVIiRZDK470w6rJ0mxyC2URDcszC1yWdqPiSxYMXgCIAvBMt3zhKnWZ6CYgoZ5lSIJHFCGsS0PO2Tx8bhz8ixZ98B2fBAUyUmnY-S4WoeE8k92KzyCxZ6jEaP8vRBxwiDR3_oAp3yROG-KodUeleOIIvBNWaXkrHziHGLOHD_lZ8Yedi3FjMCe6L3qUPVsbM_oMzSDsYuCq-ydEn-Qh3mhSsQv4aske3SUKp4wXrsAAc3-CRINEYdMueQTQvqHyNyIUQkgU2wRa4Ngo7pUHIsBS5xpcM8e6hV66c8MApg4gpzjfyoFW-N4EK3sHNSckInR8BqiRhzGKzAt8gzOFIR5lHZ-i4mU7Ge5LDdGlA0l8Qd4lEeSTuRPk2eC31qCokTeSW_7Abp6_Zr8Zq5f5U3wWBlDa-SFCC-wJmlcT_6_YyA034qdpHc6H5p5RWrT3NxNZi05wfIsiWE6_9HK6dmVWLbSxW0FcgOMRWo0k4aj9IE4QnjeDu1sX7mDUDk8a756ogkStL3WkeuANiUc6qN3PRHsjHaArlcthN-aC&sai=AMfl-YQAB34wD59g9RMrpcE-1Aw0B9v2bZiqMmjhh6RNYeRgKkmeWEBiEAn1ZiWSdjp71X_85S4ceC2tMFbKYnx6eIZJP9-mzLbCG_S0DSEgODfc0bNBFNBiW_HlANCbET5N0LQeArDv8UwV6q-_GVpJ7_jwCMr9OV3wUptPHfxGk1FZL727gRoyRZhrxBaVKNcAvkbuGv876U7hxsSCCdz1NlQs98n7FCPAelx2JL7Gbw5SBVI1FcKhX1qnY9CCbw4Xe0YsCkkhW70OwRGrCVUGmTL_O00H_fjhc90Kg6SliyxS1NeseUe0YjmfRksEwOt4yphBXl23sGcwxVl3rm_-UgcY2Lah39piyFuQsUDvCnvcSCk09N4NSoxaFeurPvefUsSwkpGkVLgfsFMPmQfthIGqcFbvq8GvyTMNvaQSG2Aa&sig=Cg0ArKJSzK5dTIjDBIr6EAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9sdWZ0aGFuc2EuY29tLGh0dHBzOi8vZXhhY3RhZy5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=125&cbvp=1&cstd=120&cisv=r20231206.34876&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 09 Dec 2023 09:40:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame D7AE 60 B
60 B 63ms
17ms Image
image/gif 85.14.248.71
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvId=63&extPu=lh-mindshare&extProvApi=lh_de&extLi=26915561&extCr=180662177&extPm=361198349&gdpr_consent=&gdpr=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

85.14.248.71 Neukirchen-Vluyn, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Sat, 09 Dec 2023 09:40:49 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Sa, 09 Dez 2023 09:40:50 GMT
X-ET-Code: 0
Content-Type: image/gif
Cache-Control: max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
X-ET-Camp: 1119
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 554A 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 82dae9ed70192fe3fa6b674ebd81954d52933c85e5d36718ea38c3ba3c77a86f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame A730 39 KB
15 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:50:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53424
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 18:50:25 GMT

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame EB18 6 KB
3 KB 59ms
57ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/Besparend%20300x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6f4813e4fe6dd891838e421479bf603f6d3f0d2a55b90517b875a77050471d4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/Besparend%20300x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:29:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47468
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2551
x-xss-protection: 0
server: cafe
etag: 4618035238173732404
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sat, 09 Dec 2023 20:29:41 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame EB18 34 KB
13 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/Besparend%20300x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/Besparend%20300x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 19:07:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52409
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sat, 09 Dec 2023 19:07:20 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame EB18 236 KB
63 KB 70ms
68ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/Besparend%20300x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Dec 2023 09:40:49 GMT

GET
H3 200 Besparend%20300x600.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/ Frame EB18 14 KB
3 KB 61ms
60ms Script
application/x-javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/Besparend%20300x600.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/Besparend%20300x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98dfc9cde1ec9d071e7bfab7115eaae8026d059c5828cb9e20453e7f536d0d89

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/Besparend%20300x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 08 Dec 2023 23:11:50 GMT
age: 37739
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3406
x-xss-protection: 0
last-modified: Thu, 09 Nov 2023 12:53:36 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 07 Dec 2024 23:11:50 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D52E 0
0 77ms
76ms Fetch
image/gif 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvs2DcyQlUNOuLMZlMkSJ65XU1kM28AWwuxXBbz9NfstqNi5soBb79IyDtYaoOmokXCJylcWwH3eTlNoH2DfTzRdq4YdcEfnrL9J5KztH1pjshIEVum3IlptnCysuuGU7m9BfApQdUvHdT25lVKzlwJslFYidvSrNiXQGIH9d1xaGtMvOyQESm9VSoUuQ9CEbJN3Zz4oPt6V9IrQkvdJfbsbNnSKP6akYOOcLBf2kqiwXhmvNZBZoQ48keuBmLbTI9k1AhZpt9OJiiUeClrwjOsu_m3ja4ResWPVs33l9CyU3p1eC7JtVKM18Jus-zBmEyJoK7xFSGocjv60eBjoQ49Daenqaw4lHB94pXJUXi62REkTHX_hA1Eakv8hH2oNpKxPdc8vpMcFueaE6f9zSCa3-XQS-jITxwDhzXG2TvBheUQbll3LRhtNs93w9LWXqKo1Q3idrbTxt0U2-_QJr9x4t_eWpfiR9P3DqfVT_5MQe-m6ukYnztVTDYsHoPSbC1wiPxEe8MnhLQveUd84wFFuotKhTm5Yx7V5PLQVRAVNY689z6OYY7RLVAZh6vhIdJE0RlD_BN72Lw06GJua9JuczIgtjbna_51-T8lnLRuwS-kRLl9ioYBypGhiQOEe0UkmYCPQjwA4VOgEBh9KiGjMTrpQB-y2s47w_z93jBNGNNAZD9hEuFHUbilitoJpY-khe8O1fCdf4pWTFyp_HFgrlhoEFimagbsOoUTgzr0HqWA_lojStInBNvWUw5X7ZmAO50KTRwzAeY_hl76z7A27yIdKncYFYNkVZFy_LIGagBVJb8x0rQ47pWAnGXOWE6J1l-PfLdajywTZ6G-RY8ffFSo7UJR1ID98TIAUdsbPdBXTyCdfZdcPGae0ZWgEmHvDmwr9mKUVqE9Wa3hkj-KU8xhNlcV5N5xytrrI_YFuvSFvdN-LAetP0VANZsASZqCjIglYrFEJApk6QFWmw2GoJY1WDhL10MjawuhWfWxM49VfLID3cnV6ekM4sWWOoOeaa-auuVctr-Qfcgur2ybPc6nm9oYlbI4tjmkwu7uvfIumP-bQEb7aKoFF6NXXBGphxW6qX7vBnlR5kB_r1i0-foQjMVh4SDtoAUbOFI-QvcWO9awBcArFNfAqL7FY45PdLuNJlCC-bUtLl9UBsMQayIrVGfXgDZ2sTT1LOPVNCG9OXTl3ianG2wembeW9tCcZ0r2u4qtSM58KYSzSrk7mB24_-y7ANMHLAItwI-Z55xc8E4&sai=AMfl-YQWi9vVETrQ9YtN7VV9XcOpEaP8RMkjC_g2SzD5KoPZAS5-C3f6OW7VyPxrB1pAgMZN0XfXCaYSWCGJHJqeRYxdaxs0bF958dL4BZyedyzDEdgsopTF7N32OYcrSSmEPesFJym6TAUeO4MZiEBmRVaYSzCuFs6ijOCLT0EFUL_-GNdsDlrDUoss9yY00U18lG4-aTn4Wxv1ED4O-CCjGrM_BkT5pqsyZnxmrcCpZmwWFsE2D1p86hYC6xDU0CunJGNNklkkAJTnOT2-2k5SHgIzv4MGH69cQrvy3m6oMw&sig=Cg0ArKJSzDBtS9PeS8w0EAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=734&vt=11&dtpt=483&dett=3&cstd=249&cisv=r20231206.44584&vwbs=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 tweenmax_2.0.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame C9D4 113 KB
38 KB 82ms
82ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_2.0.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=54f46qHDx0&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62afec092c21b138eeb1fc55859f60c19dd12ca3c02bdfeb336a820b016a547b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=54f46qHDx0&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38915
x-xss-protection: 0
last-modified: Tue, 19 Jun 2018 18:02:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Dec 2023 09:40:50 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame C9D4 118 KB
40 KB 55ms
55ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=54f46qHDx0&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=54f46qHDx0&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 04:12:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19696
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Dec 2023 04:12:33 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 35D5
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEDKebvKeBJl6DwyXkLgGpNI&google_cver=1&google_push=AXcoOmQyjWgfT4BVsMWnFlb1WMDSmBa2jqONRttpjg_BQuECRbVUKHlxxJAIPV5lUsK90KYJfE2myFMEgfpHEzrdzniIngmRXk7J-...
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODA1NTQ4ODYzNzQ4MjQ2NzQzNg==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDKebvKeBJl6DwyXkLgGpNI&google_cver=1

43 B
398 B

15ms
15ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDKebvKeBJl6DwyXkLgGpNI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDKebvKeBJl6DwyXkLgGpNI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 35D5
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEIfrr5J74PFvyJ17c673dGs&google_cver=1&google_push=AXcoOmQGaJXGpR9AfMsBpnO_KO4vIRuvDsIR9Grbk4BLPEQEicoZK5tvbR...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQGaJXGpR9AfMsBpnO_KO4vIRuvDsIR9Grbk4BLPEQEicoZK5tvbRQxjrqXy1DjHXpXs8h7U14__IXP-IUdag0DtMRBIQZvAlE_7FF_dhKvPXha5YKKBQg...

170 B
188 B

52ms
52ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQGaJXGpR9AfMsBpnO_KO4vIRuvDsIR9Grbk4BLPEQEicoZK5tvbRQxjrqXy1DjHXpXs8h7U14__IXP-IUdag0DtMRBIQZvAlE_7FF_dhKvPXha5YKKBQgTpYO1kPGEEDoqelVF5JdHOZgVbJt2TkuHQw&google_hm=uLNpgOM53g0yDcmvByYp0Q

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQGaJXGpR9AfMsBpnO_KO4vIRuvDsIR9Grbk4BLPEQEicoZK5tvbRQxjrqXy1DjHXpXs8h7U14__IXP-IUdag0DtMRBIQZvAlE_7FF_dhKvPXha5YKKBQgTpYO1kPGEEDoqelVF5JdHOZgVbJt2TkuHQw&google_hm=uLNpgOM53g0yDcmvByYp0Q
pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 35D5
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEOKYK0PeYXyoRoQE5yNrxec&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEOKYK0PeYXyoRoQE5yNrxec&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Y0ZuS3NVNTcxUmJUUGs1&google_gid=CAESEOKYK0PeYXyoRoQE5yNrxec&google_cver=1&google_push=AXcoOmQwpGgZJdDYnbRxWW8iS-1_Rky--27fzV0ubZUCpAc...

170 B
188 B

45ms
44ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Y0ZuS3NVNTcxUmJUUGs1&google_gid=CAESEOKYK0PeYXyoRoQE5yNrxec&google_cver=1&google_push=AXcoOmQwpGgZJdDYnbRxWW8iS-1_Rky--27fzV0ubZUCpAcEx4-UjFHE42PqUKfWpYbVh7WmKTe1p6XYvm6FVOT0PiwKs2M-6pniYSUnWrbW3jisw_OHYk7zGi-efslJPSVRyPp7uHUSCkFnFVu0dEBBk4H1pg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 09 Dec 2023 09:40:49 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-029f22d856dc4e10e@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=Y0ZuS3NVNTcxUmJUUGs1&google_gid=CAESEOKYK0PeYXyoRoQE5yNrxec&google_cver=1&google_push=AXcoOmQwpGgZJdDYnbRxWW8iS-1_Rky--27fzV0ubZUCpAcEx4-UjFHE42PqUKfWpYbVh7WmKTe1p6XYvm6FVOT0PiwKs2M-6pniYSUnWrbW3jisw_OHYk7zGi-efslJPSVRyPp7uHUSCkFnFVu0dEBBk4H1pg
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 35D5
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEN7exTpvSMPQn0XGFv-DhTU&google_cver=1&google_push=AXcoOmS2L13OqyQXIsYtZyRmlvnVtjPBZ39Aej7mm97fiyMsr8O_jjS1EjgenYMRRPXGzrok1nC0TYJ8kBEF_kB8...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=okDD_2-SQLQlJj5bfz3Dew&google_push=AXcoOmS2L13OqyQXIsYtZyRmlvnVtjPBZ39Aej7mm97fiyMsr8O_jjS1EjgenYMRRPXGzrok1nC0TYJ8kBEF_kB8UdkBpAslNIwZgtY...

170 B
188 B

46ms
46ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=okDD_2-SQLQlJj5bfz3Dew&google_push=AXcoOmS2L13OqyQXIsYtZyRmlvnVtjPBZ39Aej7mm97fiyMsr8O_jjS1EjgenYMRRPXGzrok1nC0TYJ8kBEF_kB8UdkBpAslNIwZgtYZU1k1aX1MI6nt4dzfcny6USSzJziBpC3GfAk9s4HXqvkD5vawt8v4Ww

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 09 Dec 2023 09:40:50 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=okDD_2-SQLQlJj5bfz3Dew&google_push=AXcoOmS2L13OqyQXIsYtZyRmlvnVtjPBZ39Aej7mm97fiyMsr8O_jjS1EjgenYMRRPXGzrok1nC0TYJ8kBEF_kB8UdkBpAslNIwZgtYZU1k1aX1MI6nt4dzfcny6USSzJziBpC3GfAk9s4HXqvkD5vawt8v4Ww
x-host: tde-deliveryengine-production-5989b845bf-wvhgr
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 35D5
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEFOB_5bbVPOEvuXxGFFPrxk&google_cver=1&google_push=AXcoOmSQV78f9Jr9k5pTtyfO6u-KUESi8YAhsPONE_fMhcDjk6iP4k8ZxfWPyfE0N8wVYZObQToNYQjMql70BYguD_WkrGK...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSQV78f9Jr9k5pTtyfO6u-KUESi8YAhsPONE_fMhcDjk6iP4k8ZxfWPyfE0N8wVYZObQToNYQjMql70BYguD_WkrGKdIjMGNXtYZGSYmJ-mqEWfYfIjCkAw9EzZjyprW...

170 B
188 B

45ms
45ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSQV78f9Jr9k5pTtyfO6u-KUESi8YAhsPONE_fMhcDjk6iP4k8ZxfWPyfE0N8wVYZObQToNYQjMql70BYguD_WkrGKdIjMGNXtYZGSYmJ-mqEWfYfIjCkAw9EzZjyprW-UL3fOhaTj2EvEevX4kWymg8g&google_hm=eS1fRWN2Z1M5RTJwRXBINHpCb2RaclVVdUlPd2dkZDhxaX5B

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 09 Dec 2023 09:40:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSQV78f9Jr9k5pTtyfO6u-KUESi8YAhsPONE_fMhcDjk6iP4k8ZxfWPyfE0N8wVYZObQToNYQjMql70BYguD_WkrGKdIjMGNXtYZGSYmJ-mqEWfYfIjCkAw9EzZjyprW-UL3fOhaTj2EvEevX4kWymg8g&google_hm=eS1fRWN2Z1M5RTJwRXBINHpCb2RaclVVdUlPd2dkZDhxaX5B
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 35D5 43 B
363 B 56ms
15ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmRiwLRT28H5y-J5V128S5fMEAqtDD3uUT96Fs-TLv5sXDmCtd-kSYrm6qHf_K5GWgowTDYfaVntJQW0qbVrd411vzY3qUQ8lSobCQzoAnUoxTDdV0B69JH-cHGLG9sHfB6alGs_deGCSR4tizirnRUFeTs&google_gid=CAESEF_SyP65bbJ7k_ztKsrxO4A&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:49 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 171642
expires: Sat, 09 Dec 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 35D5
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEKKUa2WwZmIklxCxb19WH7A&google_cver=1&google_push=AXcoOmQwMbz09shVgKZia6bAWIomb14rvQgi1TqCn6lv2jYswOUZ_NomT76huGyZO4bdIYyGjFYeK9ZQFgpF...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQwMbz09shVgKZia6bAWIomb14rvQgi1TqCn6lv2jYswOUZ_NomT76huGyZO4bdIYyGjFYeK9ZQFgpFRmnT4tB8E-Fr2gpMt3gu3Xd2jpt1LngvMq6X...

170 B
188 B

46ms
46ms

Image
image/png

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQwMbz09shVgKZia6bAWIomb14rvQgi1TqCn6lv2jYswOUZ_NomT76huGyZO4bdIYyGjFYeK9ZQFgpFRmnT4tB8E-Fr2gpMt3gu3Xd2jpt1LngvMq6XQ8V3f2nHqSSj62R7zH2T-2XMeOc31rwcuQg4mEA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQwMbz09shVgKZia6bAWIomb14rvQgi1TqCn6lv2jYswOUZ_NomT76huGyZO4bdIYyGjFYeK9ZQFgpFRmnT4tB8E-Fr2gpMt3gu3Xd2jpt1LngvMq6XQ8V3f2nHqSSj62R7zH2T-2XMeOc31rwcuQg4mEA
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 35D5 0
12 B 43ms
42ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KnNTx8U0t9vpJQTWWwRdM5xk2JmI-5cBkyTgrgQlRMlahenZAcOyS5oTW0o2ISf4y3nZVc

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D52E 43 B
215 B 175ms
175ms Image
image/gif 2600:1f13:800:7780:f920:6a9b:b4b:339a
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=6a85da9e-a5eb-7561-4060-b389cfbf4de0&tv=%7Bc:wil5kg,time:601,type:e,im:%7Bpci:%7Btdr:514%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:601,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B597~0%5D,as:%5B55~0.0,542~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:196,fm:tXVWrDt+11%7C12%7C131%7C132%7C14%7C151%7C152%7C161%7C162%7C163%7C164%7C165%7C166%7C167%7C17%7C18%7C191*.1627455-73523880%7C1911%7C1912,idMap:191*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:15,sis:82%7D&br=c
Requested by: Host: geocult.ru
URL: https://geocult.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:f920:6a9b:b4b:339a Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:50 GMT
server: nginx
x-server-name: dt01.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 CachedBmp_3.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/images/ Frame EB18 4 KB
4 KB 57ms
56ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/images/CachedBmp_3.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3614dd0f01132224e0415cb88381437783d2b6e764382b944877e34fc5af758

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/Besparend%20300x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Sat, 09 Dec 2023 06:46:29 GMT
x-content-type-options: nosniff
age: 10461
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3724
x-xss-protection: 0
last-modified: Thu, 09 Nov 2023 12:53:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 08 Dec 2024 06:46:29 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 554A
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CQVITIDZ0ZfX-K7Kn5LcP29mYyAy_jamPdLHBq7WMEs_33Zi6ARABINTHmpcBYJXikIKgB6AB1ZDB2gLIAQmpAmItiH_3DrI-qAMByANIqgTCAU_QeaYS0Hr1R3GyH14qkBpmpEcy_EsOO8X...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2217526831329460355889%22,%22debug_reporting%22:true,%22destination%22:%22https://alvero.de%22,%22event_report_window%22:%22...

0
0

70ms
70ms

Fetch
text/css

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2217526831329460355889%22,%22debug_reporting%22:true,%22destination%22:%22https://alvero.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22726681685%22],%224%22:[%2212-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%225645130949869138513%22}&andc=true

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:50 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"17526831329460355889","debug_reporting":true,"destination":"https://alvero.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["726681685"],"4":["12-09"],"6":["true"]},"priority":"500","source_event_id":"5645130949869138513"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 09 Dec 2023 09:40:50 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 09 Dec 2023 09:40:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"17526831329460355889","debug_reporting":true,"destination":"https://alvero.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["726681685"],"4":["12-09"],"6":["true"]},"priority":"500","source_event_id":"5645130949869138513"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js Show response
pagead2.googlesyndication.com/bg/ Frame 9494 50 KB
19 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2920555573584698&output=html&h=600&adk=1636830882&adf=2917673112&pi=t.aa~a.1663485022~i.5~rp.4&w=266&fwrn=4&fwrnh=100&lmt=1693404896&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=4703721224&ad_type=text_image&format=266x600&url=https%3A%2F%2Fgeocult.ru%2F&ea=0&fwr=0&pra=3&rh=222&rw=266&rpe=1&resp_fmts=4&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702114848588&bpp=1&bdt=1805&idt=0&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D89843ceb4d963719%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA&gpic=UID%3D00000ce48e1f4e0e%3AT%3D1702114847%3ART%3D1702114847%3AS%3DALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ&prev_fmts=0x0%2C160x600%2C336x280%2C336x280%2C266x600&nras=3&correlator=605185929340&frm=20&pv=1&ga_vid=1264822235.1702114847&ga_sid=1702114847&ga_hid=1968024731&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=490&ady=2274&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079864%2C31080036%2C44807751%2C95320885%2C95320893&oid=2&psts=AOrYGsk9JSRUV2ahQ9Q7htGKw0xELRRmHldGDr1OAHca_q-mk882xFvt4ljKTLrJOlyfMHXMmLT98bLJsgoppCS3Qb-cF003&pvsid=2543553950118929&tmod=1100941954&uas=0&nvt=1&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 13:55:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71144
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19601
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 13:55:06 GMT

GET
H3 200 a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js Show response
pagead2.googlesyndication.com/bg/ Frame EB18 50 KB
19 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 13:55:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71144
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19601
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 13:55:06 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A730 0
28 B 91ms
91ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BwS_ZIDZ0ZfCsK9Dc5LcP-vuw6AUAAAAAOAHgBAI&bg=!s7ClsP_NAAY3kmNgF5I7ADQBe5WfOGSmSQVMHd2mhDl2LIEIguEb5mzSoHvFmd46ZvzpaTLlGYOhIPmorr2NnZ7DdGRzAgAAAE9SAAAAAWgBB5kDXQS1LhD0o5WUZjk1Xi84mc7SqeTm_lKSB-2S1PTC-jgOLpUNoJFyGsQ2O_Eqrgy4YyPqAZUn1Lll_iTW_LVWbFwzVthf8gkS0RzlpWuX9JY5zIdNfm7UM6K9sc1wf4yKG9OWjJC-wEBvqNnBLMyATDogIed74VJfY3cLW14vlVWY2xWdKDcXLovUl2IdPr-aRW1Hpu07OxGLfxyLqqyia_Pif0Z7g7LKk7LZ054_2KF045eF6NTYkRKIPbw50cwCw_LXM92gkRMWSw1Zl7DImLsmltEdd1iciPNTxZ3AMX_kBL3jfzdK39Pd6wI_kfT6iKCgmZsrWf4z7Bw14NbAUxmQWLSwTShHne6-Ekht6gtS9K70PuRezM-Lm-3HPaKHIB7qi1gLJDjc67pJa1i2_6upuqnYuB22DogUBx1D652SCqKMdiJ3IAg_8kJOujBCFZ30xD60I2bzHpV3RYQoQJ7MBQ9cBec2Ym5PU8wHZx1O6AWDwTEBZcAiWO9ipJVORfTRATtM7zFY7IEcyrquuBEz-wfdJQmEzx0NGVv1K_QSqnOwl-1WtZrKJWLcpECMOY6Hj0emeG6M-Mc2X2VYp1kBbzpML91UZ-yRcLNn2BGDHfeWqQsu9XAD2KEEBNNGIaUp2TvppaNJ-fJKxABrlN7GG386ZzUHbUpdI7UYUAYL2L33N8FCihuOet29Xj93dBugFk7_H5tsM2WpmNmn-htykaUShUpacKhDz8JMf386AgrnM9sMi7V1dwgIhZBSMUt3_HBO78h4yxPo-083C-Nz-BpdmaWgKeK0vKJ_1BP2-VZLmrXSfK2PJDhpDg4Gpq4NfxL4qqx5cOeuYEXcBBa4Xujb4ZCag9ZEcArWNXZ7zg1zI8ihZH9D9e0VzfZE4OoUjCd6qVC5uMDtY7e7aN5Nta-A1dRK9juZx3O1nF5wZaXVtjnTGRu55-I3lpI5sn7tcn-9EHYPgAdo4VkerVdU1FabEHp7XntjmjMNL2rA0GVcZo0KOMS7cTqABOS1etD88xgYlr9sMeS-9BGx3zmwxp-_8d8pPoA3NcidpasknhNFyzqBXsu0oA19351onwIrzpn9UAV26mKjiAODCb0aIX51m9WJ4GFJvslOJvcieZPVOu-mCQ9y1vIrMw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame D7AE 0
0 73ms
73ms Fetch
image/gif 142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsv0Q2WnB3fWLArPxohWcfT6Mk7zVFw4opjW_CLZMmuM5idJO4RYDpIg2Yx0lieMDVVJhWU7FuayjrOus51sUFn_JsQTjl_fulSpY_N3cp4MwXmQdpgqNHBt_y_bQmbinOhJvLvg-nZJgGqSWvLe5QzwV-k7vkh5Mxc3Sx0LmfzZCN8fLjS1WxVF3xstiNLnxjyilmcwo9WzuPcOTnE_uLdEiueYDz3BipuRqTrikuP6GDzxWOmQ-sZ6gH-ABxVRQeyXJduIsWkmFc8nmCUWNWCQnXAHBD90EmdTeVUsVbSWk23WlnS2gF9LslOgc9sZ6eHshOMMfNypywBJoJ-YaLXo-dOoUHbLgBvEYalY75kD_1UdKEKFGDRaCAprkhDNDIzdh_mWrycVc9ewb1HQfSgasyQqs9bDV7XCy5rpGukMh6dAaN06ORFX-6jI4y60nZLiOvJJR7F4Cp7h0gfmVBc3aRlTjF8GUi8PNugF0yRoIUTeYIhtSrq_sj-nzM3croarWykkPdsXfl4nWqKCeLfDc9gtNaAnb0TZd0utNVCJ1mym4yILhQGgGE3xs4MppVvu5vF2OYaW5C5u1akxUd2VEW12KX6KW6v8-X_INAQ-0F6NvspEgYXc-PCTBdGXdgi_VJ4rU--b9qiBAmFP3nWb5QJQiV0t5MGmCT36DMYefi-KBbDE4YeZtnLNUv9pEpdy_H7STQNzq1EmYVqzjIR2r7XuRKnSzVTK03MuQoCoh0bHJESAHymDJQ3ecrThnYK-o80krluyLCTZUkd5Qr_xifGfgtmOIvxNXDgKXjtHJuvqbhqfzCFuzKVG-uqeUwinNh_CmKF6mN5Y9aVZXmBRUZcCRsVIiRZDK470w6rJ0mxyC2URDcszC1yWdqPiSxYMXgCIAvBMt3zhKnWZ6CYgoZ5lSIJHFCGsS0PO2Tx8bhz8ixZ98B2fBAUyUmnY-S4WoeE8k92KzyCxZ6jEaP8vRBxwiDR3_oAp3yROG-KodUeleOIIvBNWaXkrHziHGLOHD_lZ8Yedi3FjMCe6L3qUPVsbM_oMzSDsYuCq-ydEn-Qh3mhSsQv4aske3SUKp4wXrsAAc3-CRINEYdMueQTQvqHyNyIUQkgU2wRa4Ngo7pUHIsBS5xpcM8e6hV66c8MApg4gpzjfyoFW-N4EK3sHNSckInR8BqiRhzGKzAt8gzOFIR5lHZ-i4mU7Ge5LDdGlA0l8Qd4lEeSTuRPk2eC31qCokTeSW_7Abp6_Zr8Zq5f5U3wWBlDa-SFCC-wJmlcT_6_YyA034qdpHc6H5p5RWrT3NxNZi05wfIsiWE6_9HK6dmVWLbSxW0FcgOMRWo0k4aj9IE4QnjeDu1sX7mDUDk8a756ogkStL3WkeuANiUc6qN3PRHsjHaArlcthN-aC&sai=AMfl-YQAB34wD59g9RMrpcE-1Aw0B9v2bZiqMmjhh6RNYeRgKkmeWEBiEAn1ZiWSdjp71X_85S4ceC2tMFbKYnx6eIZJP9-mzLbCG_S0DSEgODfc0bNBFNBiW_HlANCbET5N0LQeArDv8UwV6q-_GVpJ7_jwCMr9OV3wUptPHfxGk1FZL727gRoyRZhrxBaVKNcAvkbuGv876U7hxsSCCdz1NlQs98n7FCPAelx2JL7Gbw5SBVI1FcKhX1qnY9CCbw4Xe0YsCkkhW70OwRGrCVUGmTL_O00H_fjhc90Kg6SliyxS1NeseUe0YjmfRksEwOt4yphBXl23sGcwxVl3rm_-UgcY2Lah39piyFuQsUDvCnvcSCk09N4NSoxaFeurPvefUsSwkpGkVLgfsFMPmQfthIGqcFbvq8GvyTMNvaQSG2Aa&sig=Cg0ArKJSzK5dTIjDBIr6EAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9sdWZ0aGFuc2EuY29tLGh0dHBzOi8vZXhhY3RhZy5jb20&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=312&vt=11&dtpt=187&dett=3&cstd=120&cisv=r20231206.34876&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: geocult.ru
URL: https://geocult.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 105ms
105ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231206&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ac6c9e9f8bb73a61a0b100bf01691403fb25117aba818c503dfd00f2f3cbdd19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12217
x-xss-protection: 0

GET
H3 200 main.js Show response
s0.2mdn.net/creatives/assets/4703545/ Frame C9D4 3 KB
1 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4703545/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=54f46qHDx0&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c1b2da575466eb30982e08c1020f55bcf2d9565f53bd64c3da87a1d774d75588

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=54f46qHDx0&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1100
x-xss-protection: 0
last-modified: Fri, 05 May 2023 10:07:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Dec 2023 09:55:30 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame C9D4 8 KB
6 KB 97ms
97ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f9fa3ec121bafd59afa290ad711d446878d6613677c85dba3716f6ab801c8bfb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5825
x-xss-protection: 0

GET
H3 200 CachedBmp_2.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/images/ Frame EB18 13 KB
13 KB 57ms
56ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/images/CachedBmp_2.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d5054d6ecc3759e1b4b45ca0e0d2eb145c422a61a0dd8d1c05f0374c90ec23c4

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/Besparend%20300x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Fri, 08 Dec 2023 23:11:51 GMT
x-content-type-options: nosniff
age: 37739
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13258
x-xss-protection: 0
last-modified: Thu, 09 Nov 2023 12:53:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 07 Dec 2024 23:11:51 GMT

OPTIONS
H3 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 70ms
70ms Preflight
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 09 Dec 2023 09:40:50 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 72ms
72ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 09 Dec 2023 09:40:50 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame C9D4 17 KB
6 KB 83ms
83ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 09 Dec 2023 09:40:50 GMT

GET
H3 200 CachedBmp_1.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/images/ Frame EB18 11 KB
12 KB 57ms
56ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/images/CachedBmp_1.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fccc0575472a30fd604539e50d3282a370aaeeb778520f53d5df2b111772fe87

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/Besparend%20300x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Fri, 08 Dec 2023 23:11:51 GMT
x-content-type-options: nosniff
age: 37739
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11757
x-xss-protection: 0
last-modified: Thu, 09 Nov 2023 12:53:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 07 Dec 2024 23:11:51 GMT

GET
H3 200 160x600_de-de_performance.js Show response
s0.2mdn.net/creatives/assets/4703545/ Frame C9D4 79 KB
19 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4703545/160x600_de-de_performance.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/creatives/assets/4703545/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc938f914a45d9704b821d83ed0ac1360240d3ac62d7c60878288c3c67279bc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=54f46qHDx0&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:33:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 460
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19231
x-xss-protection: 0
last-modified: Wed, 15 Nov 2023 12:31:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Dec 2023 09:48:10 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D52E 42 B
64 B 93ms
93ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssR5U2e1iRhUclhiNEqbpobzRgBUuMP43r2xSNsLCoQTvxybYUQ_7vODkiHBsrvHfYIPZTEt4X5mvIeE_-rtCPThWiRHXKsz7EEdYYTtzr-ICZXbIa2GghPRTDQA2IjTWULCjjsHcLnedqi&sai=AMfl-YRI7j6g-ScqdH5ytUDf7Nknpz2fYEuy1nvhtv66vIF81vQl8_kYt7M0aav_neuN_czLHUhGL8tV-wlphTKv9v6ih1E0-1dOsMhxj0TFY7dx-Pc2bzIUmlBYA4U16M4b0w3bKvKAoU0BJeGQzmtI9yt7rhzW1Br6wtro&sig=Cg0ArKJSzN-oTHmtRGpbEAE&cid=CAQSTwDICaaN1I5S8umWz0386UuELnkhUyKmsSLUksTE9Sx6f7qBCuXDZ9Luf_MVoWMDNXSi2fQKzO9UxpXH6V0taN6gE3yvEM4lNE9k-uVa7DQYAQ&id=lidar2&mcvt=1013&p=0,0,90,728&mtos=490,1003,1013,1013,1013&tos=490,513,10,0,0&v=20231206&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702114848918&rpt=319&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 0BF4 42 B
64 B 93ms
93ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvclu4j0Sv8lGfUZ8jzh4m8nvqFEmXB49LR2sTVhF-H4HtyrYIq2QV-qnLz1S5j5zwwquUJEgZoAbAxKVql8SjEjQoIFsBefkWxzJBI2SDgJden_Vfv5G9JmPWstPPzw_MTPPMI9WAerY5T&sai=AMfl-YRjtea3nvVaWdLlUOI37bxdGCXrvKFrP8w9gVDyfiAcfk0r1xfDE-ZnH-TWF9SUfyaHA_iXBxa9PpbhN-sbw4B-6Y-eCQtcLIxHTrK5lwoNzYy_pxK2Hp869afa4hrqqJQcl-gxYiWLds9CGLyrl9td83GlEqfCw5o&sig=Cg0ArKJSzCLltfxOtLhxEAE&cid=CAQSTgDICaaNKpIzAMGuCa_Gg0tE0uCtOitDanF6wFnWySo1Mza6rhcjrdU3AWtvS0Swl9hWGEUa4O5O0Qzp_ImprkB0nPqQnv132XZKkheDUBgB&id=lidar2&mcvt=1000&p=0,0,280,336&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231206&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=504672438&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1702114847527&rpt=1729&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 _3E7A6573.jpeg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/images/ Frame EB18 368 KB
368 KB 57ms
57ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/images/_3E7A6573.jpeg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

67061517d6a26dcd4d91f387cabb723dac0e7ac68889d2399fa232a71d6f3bd7

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/Besparend%20300x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Fri, 08 Dec 2023 23:11:52 GMT
x-content-type-options: nosniff
age: 37738
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 376498
x-xss-protection: 0
last-modified: Thu, 09 Nov 2023 12:53:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 07 Dec 2024 23:11:52 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 6CF0 13 KB
5 KB 56ms
56ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://geocult.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 37036
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 08 Dec 2023 23:23:34 GMT
expires: Sat, 07 Dec 2024 23:23:34 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame D2E5 829 B
561 B 65ms
64ms Document
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

6c5185562ea83b7ca74358e9a65685f1e742af561432f012e85d80e0b93cc133

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-jCeABLkNNa6U3mWTR6wdSQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://geocult.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-jCeABLkNNa6U3mWTR6wdSQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 09:40:50 GMT
expires: Sat, 09 Dec 2023 09:40:50 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 0AC1 39 KB
15 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:50:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53425
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 18:50:25 GMT

GET
H3 200 star_alliance.svg Show response
s0.2mdn.net/creatives/assets/4689654/ Frame C9D4 6 KB
2 KB 56ms
56ms Fetch
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4689654/star_alliance.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/creatives/assets/4703545/160x600_de-de_performance.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

563d8b655debf02dc76ee9cad7e2114692c770d009bfc9ed1f9153eb384593d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=54f46qHDx0&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:38:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 143
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2334
x-xss-protection: 0
last-modified: Thu, 29 Jun 2023 11:06:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Dec 2023 09:53:27 GMT

GET
H3 200 lh_logotype_single.svg Show response
s0.2mdn.net/creatives/assets/4689654/ Frame C9D4 5 KB
2 KB 66ms
65ms Fetch
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4689654/lh_logotype_single.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/creatives/assets/4703545/160x600_de-de_performance.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7502e785bdc8f7184cab7e278053c49be4458393085eb2fbddabf35b895c310

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=54f46qHDx0&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:26:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 865
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2151
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 09:41:58 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Dec 2023 09:41:25 GMT

GET
H3 200 lh_crane.svg Show response
s0.2mdn.net/creatives/assets/4689654/ Frame C9D4 2 KB
1 KB 67ms
66ms Fetch
image/svg+xml 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4689654/lh_crane.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/creatives/assets/4703545/160x600_de-de_performance.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d2067d4b9b5b9d3003ffa4dc17b44616dc00a543f59eea17df555e959f20b53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=54f46qHDx0&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:28:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 760
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1311
x-xss-protection: 0
last-modified: Tue, 18 Oct 2022 09:41:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Dec 2023 09:43:10 GMT

GET
H3 200 NH_D_LA_Wall-Flower_160x600.jpg
s0.2mdn.net/creatives/assets/4703548/ Frame C9D4 104 KB
104 KB 67ms
67ms Image
image/jpeg 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/creatives/assets/4703548/NH_D_LA_Wall-Flower_160x600.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c336d92df5a15ed71b50b12896ea0913fa25bda28e719e2065d9b13e4c21c76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=54f46qHDx0&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:27:28 GMT
x-content-type-options: nosniff
age: 802
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106508
x-xss-protection: 0
last-modified: Tue, 08 Nov 2022 09:37:38 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Dec 2023 09:42:28 GMT

GET
H3 200 LufthansaHeadWeb-Bold.woff2
s0.2mdn.net/creatives/assets/4714589/ Frame C9D4 50 KB
50 KB 56ms
56ms Font
font/woff2 2a00:1450:4001:808::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4714589/LufthansaHeadWeb-Bold.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a43c20863b324fe2bec355b5ebdc6566861742f92018f12be1b38fa2c8b7767

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/12943809228921786815/index.html?e=69&leftOffset=0&topOffset=0&c=54f46qHDx0&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:29:44 GMT
x-content-type-options: nosniff
age: 666
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51548
x-xss-protection: 0
last-modified: Fri, 18 Nov 2022 11:46:13 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Dec 2023 09:44:44 GMT

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 6CF0 39 KB
15 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:50:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 53425
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 18:50:25 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame D2E5 0
0 88ms
88ms Image
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231206&jk=2543553950118929&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 6CF0 0
12 B 57ms
57ms Image
text/plain 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?E-wt5w
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:40:50 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 DE2023witwitonline.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/images/ Frame EB18 58 KB
58 KB 57ms
56ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/images/DE2023witwitonline.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea232fa7c5b770b2cf38622815a9571929963c83db8a721557f35ceb826b8f86

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/Besparend%20300x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Fri, 08 Dec 2023 23:11:52 GMT
x-content-type-options: nosniff
age: 37738
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58898
x-xss-protection: 0
last-modified: Thu, 09 Nov 2023 12:53:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 07 Dec 2024 23:11:52 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9B4C 0
28 B 88ms
88ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=475640551548&version=m202309260101&ct=77&x=1&cor=10934541215935863000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Besparend%20300x600_atlas_1.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/images/ Frame EB18 499 B
531 B 57ms
57ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/images/Besparend%20300x600_atlas_1.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

11a99c7ae1f887149dcfd0549366f672124753cefa5daa6c4c10f4d69af040d0

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/6163042294917376744/Besparend%20300x600/Besparend%20300x600.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Sun, 03 Dec 2023 16:12:05 GMT
x-content-type-options: nosniff
age: 494925
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 499
x-xss-protection: 0
last-modified: Thu, 09 Nov 2023 12:53:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 02 Dec 2024 16:12:05 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 95ms
95ms Image
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231206&jk=2543553950118929&bg=!fX6lfjHNAAY3kmNgF5I7ADQBe5WfOIc5FzoWLDvkKrfTYWZSZzHWXzHLuP0ApDSHJ2rG0EqzoNTV4fLeO-kbsjoVfRiuAgAAAC9SAAAAAmgBB5kC-kMRkXu2xSTDdBAb0inNu09R4ULto8jIcEy8qxBR7OQAF3jnoqdMOs2L9yOmdJmuwK4bKpY9IJrev-SbjgYP8RNrzITjuHgIkrCzJGz2Y-mE-7mvVQwxnxrCx6sG-ZpXrdjpahL9V2vignbv4tCy-VKv8dWXVm8WPAAUpBu1g5_lv-A-pSexcDsx9HUvOMLfUdUZ4nUk4x8sufKIPVQvIEwUAk4zmAy4JK7C3ovcgsDz9S3gp8ZeHHLuMmNUZet5YwuDg75EmPtiwzADq4U6CM91FhvS64zolstNt-_P6gnikq_-cSPm9X8Udi3GkpuPy3CbN6CCsdZDx5PaI_j_MUJqXautpmbiNRjamTQj9PMLCGW8itd173f-Go3JiBvHJ7nqUZE4cCRudLDHuYwPtrx4KwMf1IsW-Mi8jayOHxYAr2OEseuszJWpWNf-6RUReK_lXGlqAcLrUmoHgF70nwJnfX3Nf5X6XfmYsJ9pm-9x3sxKqVmmUyqqS9kxTa_wRWUMS330d9Vy2MlDula3Mc9mh0vVTDCxndckorM2GBA7yp504TiA9BSgYkGzs_Q8jfQmxAW173q1fJ0TpyUkv7HC48ynZ21_dNfODImOQuTIaZy-QdO8bITNDWHyeMBZGFjnYkTfT2DDsmO7pElQ1o-UOwuzp1NiUTTZjHx7mTMOk6Atc5ijXtioOzkuLMVmu2dMc9QpIPzR27weqME1orjR5uTxbd4i_5nS0_dZS2WlOxRNbdzIa-Hygu6jM-rwq3-iwyWHs9F1ner69ZgVia4jiGcnLOVHNqGOL8HKHtsTVhR-qUyaIEp49LzIDeZQxgNZQZm8lq37Z0sa_FCBjspUna_byr_dhPSR5jr8qkcjiVQW8OPBl6LSDOgx1yddmHm1voWY1eketGzJEnGCeoyhXSstOlxjfL776tfyd1NbVFLw6ntx1HQ-1JitvaUqTynIiG0EPI_wwTzdWqMn9fu81NRsORcXWkzAjYIF9C9kqpAvK_VNvVNuqA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://geocult.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D52E 0
28 B 90ms
90ms Ping
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=4382013644448&version=m202309260101&ct=76&x=1&cor=18173771268566794000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 09:40:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET dt
dt.adsafeprotected.com/ Frame D52E 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: dt.adsafeprotected.com
URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=6a85da9e-a5eb-7561-4060-b389cfbf4de0&tv=%7Bc:wil5Nf,pingTime:1,time:2398,type:p,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:15%7D,%7Br:r,w:728,h:90,t:59%7D,%7Bpiv:100,vs:i,r:,t:1397%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1001,o:1397,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1393~0,1~100%5D,as:%5B55~0.0,1339~728.90%5D%7D%7D,%7Bsl:i,t:1397,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1000~100%5D,as:%5B1000~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:194,fm:tXVWrDt+11%7C12%7C131%7C132%7C14%7C151%7C152%7C161%7C162%7C163%7C164%7C165%7C166%7C167%7C17%7C18%7C191*.1627455-73523880%7C1911%7C1912,idMap:191*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:15,sis:82%7D&br=c

Domain: dt.adsafeprotected.com
URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=6a85da9e-a5eb-7561-4060-b389cfbf4de0&tv=%7Bc:wil5Ng,pingTime:1,time:2399,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:15%7D,%7Br:r,w:728,h:90,t:59%7D,%7Bpiv:100,vs:i,r:,t:1397%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1002,o:1397,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1393~0,1~100%5D,as:%5B55~0.0,1339~728.90%5D%7D%7D,%7Bsl:i,t:1397,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:194,fm:tXVWrDt+11%7C12%7C131%7C132%7C14%7C151%7C152%7C161%7C162%7C163%7C164%7C165%7C166%7C167%7C17%7C18%7C191*.1627455-73523880%7C1911%7C1912,idMap:191*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:15,sis:82%7D&br=c

Verdicts & Comments Add Verdict or Comment

113 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

36 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.yadro.ru/	1970-01-21 01:33:25	Name: FTID Value: 1bT3OV0ai6uh1bT3OV003Ssl
.yadro.ru/	1970-01-21 01:33:25	Name: VID Value: 0qEGKY1TrxOh1bT3OV003StJ
.geocult.ru/	1970-01-21 02:24:34	Name: _ga Value: GA1.2.1264822235.1702114847
.geocult.ru/	1970-01-20 16:50:01	Name: _gid Value: GA1.2.1883080722.1702114847
.geocult.ru/	1970-01-20 16:48:34	Name: _gat Value: 1
.geocult.ru/	1970-01-21 02:24:34	Name: _ga_DHBZR6TRD0 Value: GS1.2.1702114847.1.0.1702114847.60.0.0
.doubleclick.net/	1970-01-21 02:10:10	Name: IDE Value: AHWqTUnM_29g1ACUlvNP5eTeG4Um0LXYSTiLyWu7uwluRz_543Rr0WF7DPKkTAgy
.adnxs.com/	1970-01-20 18:58:10	Name: uuid2 Value: 5323936798050373436
.geocult.ru/	1970-01-21 02:10:10	Name: __gads Value: ID=89843ceb4d963719:T=1702114847:RT=1702114847:S=ALNI_MaiZzWmkmmit-hdoOg6pe7zINzMvA
.geocult.ru/	1970-01-21 02:10:10	Name: __gpi Value: UID=00000ce48e1f4e0e:T=1702114847:RT=1702114847:S=ALNI_ManOcanEtMf41lT7zlGTRnCe9NUZQ
.casalemedia.com/	1970-01-21 01:34:10	Name: CMID Value: ZXQ2IIVndCUFQWlXDvJUwwAA
.casalemedia.com/	1970-01-20 18:58:10	Name: CMPS Value: 3241
.casalemedia.com/	1970-01-20 18:58:10	Name: CMPRO Value: 3241
.doubleclick.net/	1970-01-20 16:48:38	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-20 21:07:46	Name: APC Value: AfxxVi7ePDqYrr2FOkLZGx6d9oc1t2OKttwyfP_mfHkSgHJ8Yx_uTw
.redintelligence.net/	1970-01-20 18:58:10	Name: 8lcfmzhxc8d6_uid Value: bd1314a913c79e77
.doubleclick.net/	1970-01-20 17:31:46	Name: ar_debug Value: 1
.office-partner.de/	1970-01-21 02:24:34	Name: source Value: {"webgains_webgains":{"timestamp":1702114848994,"clickCookie":false}}
.googleadservices.com/	1970-01-20 18:58:10	Name: ar_debug Value: 1
.adnxs.com/	1970-01-20 18:58:10	Name: anj Value: dTM7k!M41.D>6NRF']wIg2E?]epv'!]tbx8i_iqf!oN/@E'zz<Z0Q.)pj0:$vG_doo`o)<.^ujFq#_.vtRbHdE/)TD._*PlZ[C[-kX-:bM8=
.agkn.com/	1970-01-21 01:34:10	Name: ab Value: 0001%3AjIz5emszi5QD5921%2FiuIw9hy2HBEKMxr
.agkn.com/	1970-01-21 01:34:10	Name: u Value: C\|0CEAtBvKhLQbyoQAAAAAAAQ13AQCAAQpAAAAAAA
.quantserve.com/	1970-01-20 18:58:10	Name: d Value: EH0BCQHPKoEA
.quantserve.com/	1970-01-21 02:18:49	Name: mc Value: 65743621-dddf4-efcce-9e34d
.simpli.fi/	1970-01-21 01:35:37	Name: suid Value: AC173272D79C4D7B9CA43AFDC2186866
.turn.com/	1970-01-20 21:07:46	Name: uid Value: 8055488637482467436
.adform.net/	1970-01-20 17:33:13	Name: C Value: 1
m.exactag.com/	1970-01-20 18:58:10	Name: exactag_new_gk Value: 2e5b709cde644635a34f87c681c73bb8%7C07.02.2024%2009%3A40%3A50
m.exactag.com/	1970-01-20 21:07:46	Name: exactag_new_uk Value: be24a4b5b52949eea03c484950308aa9%7C
m.exactag.com/	1969-12-31 23:59:59	Name: session_session Value: 613e170ac60049b3b59990c4
.adform.net/	1970-01-20 18:14:58	Name: uid Value: 1637946708052350004
.travelaudience.com/	1970-01-21 02:20:15	Name: _tracker Value: %7B%22UUID%22%3A%22A240C3FF-6F92-40B4-2526-3E5B7F3DC37B%22%7D
.w55c.net/	1970-01-21 02:20:15	Name: wfivefivec Value: cFnKsU571RbTPk5
.w55c.net/	1970-01-20 17:31:46	Name: matchgoogle Value: 5
.yahoo.com/	1970-01-21 01:34:32	Name: A3 Value: d=AQABBCI2dGUCENO6TLqQhK_1H_dshO8TMb0FEgEBAQGHdWV-ZQAAAAAA_eMAAA&S=AQAAAgBrUaoiwzrTtzRb-7fD0pA
.tribalfusion.com/	1970-01-20 18:58:10	Name: ANON_ID Value: aJnt6Zap26Ua8e4OCaQoUue3HAdMCQw0pZaObNZdUWS7qDa7IU98Zdxr7J4SZd7nEnyT16sDue8Zbqa6x0AcYG8SOc0tAh8RdY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5994599.fls.doubleclick.net
a.tribalfusion.com
ad.doubleclick.net
ad.turn.com
ads.travelaudience.com
adservice.google.com
adv.office-partner.de
analytics.webgains.io
api.webgains.io
c1.adform.net
cdn.track.production.webgains.team
cdnjs.cloudflare.com
cm.g.doubleclick.net
cms.quantserve.com
counter.yadro.ru
d.agkn.com
dis.criteo.com
dsum-sec.casalemedia.com
dt.adsafeprotected.com
fonts.googleapis.com
fonts.gstatic.com
fw.adsafeprotected.com
geocult.ru
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
hal9000.redintelligence.net
hal900014.redintelligence.net
ib.adnxs.com
m.exactag.com
odr.mookie1.com
onetag-sys.com
pagead2.googlesyndication.com
pm.w55c.net
pr-bh.ybp.yahoo.com
pv.medialead.de
r.turn.com
region1.analytics.google.com
s.tribalfusion.com
s0.2mdn.net
static.adsafeprotected.com
stats.g.doubleclick.net
sync.teads.tv
tpc.googlesyndication.com
track.webgains.com
translate.google.com
translate.googleapis.com
um.simpli.fi
us-u.openx.net
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
dt.adsafeprotected.com
104.18.36.155
108.157.4.50
13.42.211.181
138.201.63.117
142.250.181.226
142.250.181.230
142.250.184.226
172.217.16.194
176.9.26.250
178.250.1.9
18.154.63.19
185.182.111.117
185.89.210.212
2.19.217.101
2001:4860:4802:34::36
2001:678:cb4:bbbb::11
216.58.206.38
2600:1f13:800:7780:f920:6a9b:b4b:339a
2600:9000:243d:0:8:48e:53c0:93a1
2606:4700::6811:190e
2606:4700::6812:18ad
2620:116:800d:21:ef75:8280:f209:5ba1
2a00:1450:4001:803::2003
2a00:1450:4001:808::2002
2a00:1450:4001:808::2006
2a00:1450:4001:808::200e
2a00:1450:4001:80f::2008
2a00:1450:4001:813::2003
2a00:1450:4001:81c::2001
2a00:1450:4001:829::2002
2a00:1450:4001:829::2004
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::200e
2a00:1450:4001:82f::200a
2a00:1450:4001:830::2003
2a00:1450:4001:830::200a
2a00:1450:400c:c00::9b
2a05:d018:d29:3601:357b:9971:3f66:201
2a0b:4d07:102::1
34.160.236.64
35.176.121.206
35.190.0.66
35.204.74.118
35.244.159.8
37.157.5.84
51.38.120.206
52.28.16.80
52.29.13.21
85.14.248.71
88.212.202.52
91.121.248.44
99.81.155.134
01bd238ad9742675260d4d3a5fef5b988ff74439b26a18aa0f98a48a694b07ed
01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd
04dff075b0c9befeaec0105bc4f7e21a284f402f0f3425896f90963c888d7f1d
058d2488f4d26d53cf94a6739b9800ac2d9897baa61a920a66e758129fc7b0bb
05da245d527bc9ab756912032b95ca27166597920920e29da7c3de7ec4263d1c
0a43c20863b324fe2bec355b5ebdc6566861742f92018f12be1b38fa2c8b7767
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0d43d9f15c54f63334de8305be7fabb614396c5e190a0756a417483ba9c61631
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
1162f2ec71eb82147a7e6a6f558b88982bb78ad2fa812c1c52020f5b7bd1bd85
1191ddd49747fc6fc178fde22e3c9c95d2c4ecb916797f52e3b6578e3bc5e6bd
11a99c7ae1f887149dcfd0549366f672124753cefa5daa6c4c10f4d69af040d0
1479783c7b49a2bbde9ea12d6b9abb4d552311fad5ea3d1194a866c82ddf7d54
1537d4a7693f4840ad5484b03df34b08d0ed049696dd470ef07b55e1668d90a5
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
17389d2b816cd42930191c00df09c08669c18038ce38085452fc224228bfd2ab
178d21ba92f7134c1b38490946eadd0bddbf07248aa9e132d1ff30ddf735a62a
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1a4b71acc013b49315ff300c03f7163618bb6f1cc0408d710e11f97b255f9255
1b1ca0f15010e0124bd4ca481404643c88f7eda1b276e9554d0ed83fb45b7e30
1fac880ba682ed66308e46aa35e746e85d8bc26b0d57d281cf19e2e21e561bd2
1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea
21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81
21f14e408c57d0c0c9a833c314df5ff7f7695f054253d9eb2ce123ba0f2ac049
22346d290af69b1da56c0e33cd87a0176e385d97d077cb28d21633a7faac5a83
232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98
248143672c547e6928595867a5c2c7f127265619aa765588910435f1bc341fe4
24d3f7c545ffb8d31d407b24b2c130774fae929ec9a92d6fe92f42608c858372
25e40b307b4564d30d2b76065ee77f4792328e947e8c0c5397e25bdbc7dd092f
27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4
27d5ba2175dc395614adb2c69fe9f4bff9abddef3a7c6e3e30a68587f428a37b
281bdb69ef6f2abc92abda9b18117ebbf50e9add63b183b2d9bc3fe3afbb3011
28ea7827bde65c9ef822efd6c349b43454cfb91ca7850452bdf3bf36ff5e0ab5
2baa2ebe463ced52f500118a25caa59f75536f3a49a36ae911ff5c37e1265669
2e3479d14727cf6b6581add352dad3c9fb8a89b1586d49dc0e606249e7abe437
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
31f4e4abd5d8e145d6bd5505ae3ee469f66e6aba53fcc6cf04741d0a802ebc3d
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
36c7b56d7df17e27614b04230c5fc1793653b20a1fd66fb9311f5df573c0f617
384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7
38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642
3b3c66d6f6711dcb00f5ca69f10cc2e996c38c6c90facc8da13bbc88827433ca
3d2067d4b9b5b9d3003ffa4dc17b44616dc00a543f59eea17df555e959f20b53
41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd
41e8f29b28c908a3e09da0cdfc54be6adeef57c3ac6dbf393416e84e4d2c420b
42f08af6b63da4900374a960df1387e8a07bb1571b20b65dbc347d06c06e60a1
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
436d9fdefdf3800e7aa8d543d79138dafd6a5fa95340a6d9df9515a99d6a243f
457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d
462c848b90fb9d8f3599f4654813e4382222a6fd506a48158a01bc2eab95b357
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
48e3d1297ef373788e541f3e44bddae2cd83ec5b4f0bfdc62dcb229473f6d845
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5070152299c3d5a3ed255352b18e10649460f1e436363d4394e0f7d0acdb48de
50b78ad8578885f34aa7fa589dcd10075c466504e11467dd8a3ceed303ef4cb8
521f9f8f8e6568e42eaf00607a4f20642544eb7ad5cda07d65ee16a9c1aff3b9
528b3762e36893c9075ebbb38655afaa02aecbd106aefc59881bd879ffeba9c8
539cc993691ac34295a0b8e0b720aa3db63a2e80c78d49e1c4c4132bb4a5dc09
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
563d8b655debf02dc76ee9cad7e2114692c770d009bfc9ed1f9153eb384593d1
57fa232a003b023f9ee9ab9ca6f9d33569fc7cca884bf9b1ba464cc42df6ed79
5825c88b68a498c8b3d8d34f0090a625f063a366c8f3cbebf51e7657623fb13b
5942cf3294f46a9640870809b055e78887d7b48cc1e31a153d9c3b5dd7ef674b
5d93beb8e3ad2b9ac2f1fe45f48cdf2ffa7a20e1fa5a9010314de0e05bf719cf
5e7ef5ef8582671b083278bf8f81e640b0f839f3ed0c336c4a96eb7e8b6c4aca
60871d8328ce5f869ebb561d6d1a4a86e8253bdcb15534bc84dc7a2ce8f36d04
608c7e96914ee8dea1cc0bbd2eee01f5f6d0b03521cebbc6116a7ba5940043cb
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
62afec092c21b138eeb1fc55859f60c19dd12ca3c02bdfeb336a820b016a547b
6318394f737c66f0e2ccfcd88e3935c6667633a1b95fa29fba2b75431d55eef2
63fb13dd9df1b1c74e640bf15cc4fb8267554201148928703ab51eac439e3a6d
652f7dffd6cfbde8e4965c47e8c2d5dd6f56988029465589a1e7db1c5b88449e
65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98
668252abb09b70642638a85544b62098dad1e03b79f534ee177e6d1ebb08c295
67061517d6a26dcd4d91f387cabb723dac0e7ac68889d2399fa232a71d6f3bd7
6754c346274b01e1bb0147a62e28f2fec1b10f06e9e5baaf4df67f04d5a71357
68b34a28617137221b76b93546359bf577aea1d6b3aadbd65b40e8bbdae7dd0f
69e1767c60e702480b7a4604f7a71a344e3e03caa6e21f6a352a9f63908dc500
6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a
6c5185562ea83b7ca74358e9a65685f1e742af561432f012e85d80e0b93cc133
6de5c919517958977650a2e58760508d731c5bc036fbbe1e8b2390d6c34dd14d
6f4813e4fe6dd891838e421479bf603f6d3f0d2a55b90517b875a77050471d4b
712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca
71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3
72c786a14cc7a7c3831a33e49e63e54beddc81f6c50cc00149b29e0844aec2af
78066b196420840a9db1e76add2e6ed77a637dfd6706d1100ae6001aaf93b7f8
7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762
7c336d92df5a15ed71b50b12896ea0913fa25bda28e719e2065d9b13e4c21c76
7d60255211b63ebd7ab57221ffe52ae073eab1c1c3a93c48df42b224e7f7c527
815c4d0cf5937e27877ee3d17fb373dabb5b4cfa45a87636ad24f71bf59345db
82dae9ed70192fe3fa6b674ebd81954d52933c85e5d36718ea38c3ba3c77a86f
83fef62511d4754a257551bd24d92efdeeb31c2886d07de22e9e947942233f6f
84b833327b6a970273fe2d1db07531c22996780a441e6072ac8f03844a4fcf25
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8833293f6762feb57c976e996042e2dcf201b282c034504008e2bf0a98dd3527
8abe56f67c72b6b5ba0f7e27e49d42791f1b687f45b7e370f2f78bf50ec9ae55
8b05625742e37f242707bde42df16ce7b828cc94f93238332f02624415d6c01f
8d674b28f8c316180a29763d4d735629198158a03a780fb691025830bae98b30
8e483f5b5ac1b2ef3a28ccc7f8f7ab82cd8a56cb1e9c06294bf90b3020ccfe47
8f65a77cba4ced3c364ceac29d4093ecf8c1a8510286b05a7094a9cbe2023945
914dcb400670688bb8de60c955cce8afce0838c2fa2ad297b4bd4b34ec908ed0
942001ceddf42da68272e8b1c9a215259faf7a3246d8aa095b08319f7f79a17d
94f2f98f4273b0962a8cc7027ca354903e5de47187d935c9b5f929054e2fef40
968a8e56e4adaf8c135199ebd7f6cc065424ca45974d4dfbeb5607e69fe72fcd
98dfc9cde1ec9d071e7bfab7115eaae8026d059c5828cb9e20453e7f536d0d89
992f94f905118b8960ff39ecea7dcec52afbb5b2a484b14cd817844ba03d7eab
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5
9caffafcdae7b42e3d074103c18a33640d4edf81401c216e99dbb77a15dfa511
9da58863c2d4a7e1f3c71a9a498588e7b74c3bf65fb97ddd126f1564fa7f9f02
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1f50e52a7fda97827e6e3d2cd3bb2788a68a78296728fa2592be8e89d54b5b8
a2366f8ceefa49f15dbf946bb02a4cf52b6d2999f71712d3f52e8bd5f56e1988
a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678
a84f5718bcfaa18fbf0bc06b2fb8989141e7ef299b1a4793bd1082b48ce74cc2
aaaf0b2c3bd11afe20e1902624db617c2131b3272fabebd1160cb2f53dfb3750
aad870057003cbb9958374f555a06fb47dab183a03018ac1d1e88bffd1ded096
aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed
ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09
ac6c9e9f8bb73a61a0b100bf01691403fb25117aba818c503dfd00f2f3cbdd19
ace6c1d1cccc4686d29e81c0821be209d2e2d8b7ba44ee24649a698a5230f6ff
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b34be8844746dad264cb241d51d31529f766aec0ea6fdc6251ba2a296226fe47
b87216debe85ffb5d5f3f938c1c2cfed568d6736fd9bd06d64d85711ea5c8802
bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27
bc50bf49cbe79ee49b4ee8b56f26ff4877bc4945c16f260b1481ba2355c96347
be91c72c97adfae4e70b223c2f23ffd07eaf26d315a53bb66134b11dc40bb661
c190eb38a3f491bcbf96b136cf4a4ab534ac1293d37d9047fd77db6365c86682
c1b2da575466eb30982e08c1020f55bcf2d9565f53bd64c3da87a1d774d75588
c3477a72ef1db732762ffb13ba55d7df867b64c2abf5f88a1fdff29e6dbe374d
c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146
c4f459274e378b71dae7cd9514f4c3020545081e0de18560311a5aabf98f85b9
c5bcc597ce8a3ec0c0ef52ee8ece8f284ca9739c1bd1bbac380a3deb672d5446
c76762b6b5695ab0c2c3688f5f0b4932911daa89e9a905ad866e853dd00020ae
c868679a384546d80661e6085c6a40e95de3be2ad0487c56e116703ffd1850bf
c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1
c9092cfaa24952291b22481bfa4e399483260fc6fb162a6b942fed3ff42d76f0
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9
ca99f4149c1e35b584569e9cc4180ea45f2861e19f271dc043c2d28f7bc120ba
cd4f7f8633e0416fb43ecb648e78e181cf9fbcd23bd6067e60bd4e61bd35b588
ce2b61e64a17f1488f20bafee5aa20a8d8ec897b990f709634f5bd1cc620e6b0
ce56080747fb3b762486b9ccc59bc01f871c9647d354a1c27b52cdb73fc1bfe1
ceae381ecbf5ea0d6e5f6977b195b7eae7d9167dd575f1983b07829838e20632
cf86d359d1531aee2e46233f03df7649a5ef3041f9550ff063ba329d25103229
cf9c1e5799ab8b0002feafd6a0d62583e7f51e82c0fdd16486e1cc65e4b3d87f
d04da184f20eec8ec53c73f71b04f6eb462b391c982ca722500bb5abfb31cd20
d0a7940c5739597d973e2bb019d3e3cc8b5e8747e607982ebdbd4890f4288f3c
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d1feb54f2339859c3595bd26343b468bad05a7a11c0a5a9d86084c56e3a885ed
d3614dd0f01132224e0415cb88381437783d2b6e764382b944877e34fc5af758
d371219cab55549df0dc40dfb5a92d8d4be8b8ed24ab44d4c003fdb8b580cd56
d3d89aa5cc7dbbdea39f3111b7460d064d7663ea92b04e79df0b39ef2e63b196
d5054d6ecc3759e1b4b45ca0e0d2eb145c422a61a0dd8d1c05f0374c90ec23c4
d7502e785bdc8f7184cab7e278053c49be4458393085eb2fbddabf35b895c310
d752f92d971a6a3afd2a903855c7726ba385cf2ec11757e1fd694dbd661c45ef
d9b90d582c960458aef7a61a894bffb8c326910023e6be747b954cc8737986ff
daf927d970143656739c9b917412ba171dae6e997b8dfe53263effae772d1b69
dc938f914a45d9704b821d83ed0ac1360240d3ac62d7c60878288c3c67279bc3
dd97d75880df305f01f244538d61b6a29b73b5931dde717cafc438f3eb4fde20
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
df5f8f98ec7bd0263bb4dabff07ecf507a535c2c39a5e391e03e7ea124baa321
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3df018cd61d671d60bd4a1cae119f8fcf1e58e47a62a4ae80c6b8100d868dbc
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e5e166567ad908883ca1d769c38b6f65959bb067295e5ea3c2f850ec5fa2b8d9
e6e4ae30d0e1fe5bfda2cdf9a430e4d2da17e5706b0011bf909b312814bcbd1e
e74a84c9d52e2ef23512423d7e15031fc8644b0b800b89e82ad9abe3ad8b8912
e7b8d433b88d210c6aeb414da6fc440f45c471fad1b5aaae9f0b66c50122c62b
e86c41aba2a70f6e263fbe0c13257e5b4d36b0ba6ae34d86098013f7087441ba
ea232fa7c5b770b2cf38622815a9571929963c83db8a721557f35ceb826b8f86
ea7a3c479bb36c24f92b9d21be2f9c231b8e5af90d96e4741a0351666e44134c
eafb3e8e7ff731d4419a9683e280433e06a513e872f309333c0909890156bcdf
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
ec29871f7a6e470e699f7eb7a722c49ceffe8ebb682308c7279053da037d71d5
ec4840b5e373feeae1a57fd926d937285246bd4437db4b08e0b99ccf611f1775
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f05983b0651db23774b0ac51cc128eef55b1008c48d08c2b31fdf4cd9674b71e
f2d27ec07598049af75b5252143a57fd29957203c5293b6f2321ac38efb629c5
f430ad6611692180cc5bfba88afb989ac5cde063c2e929a28026be4c2c3e9f45
f59801d52f497b4065fd46b5d5cffcb2c0fe2fd250474c668b517d4e287ebb56
f69f24da425eac9ecd7ba5e9a956ee643849921ec5672a9a961e309c60a1feda
f6cbe31747c16c069d861a8ed01b15186eaee8c381f74ca1712087811c39f4d4
f97ff7af18b6fca33d99a223aaddee96afb3ddd73c2368a39acc15ff53b91c2b
f9b2b62632d02dd438da5c717fcedbe7babf3420940398db1778d5b19d342f5b
f9fa3ec121bafd59afa290ad711d446878d6613677c85dba3716f6ab801c8bfb
fa523f248a332cb89ae3ad8cf51d840153e0f96bcc2a4c8db736e02a340dab48
fbc6bed540723f219a878e5735ae8cb1c05aa9f7012bf21870cd79e41af25bcd
fbf65629db3825873b2e2b456b8b0dbb1724ff0bed8fc9cb158c26f15495e3d7
fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e
fc757f9ba6603eb9913106a4cd83c7a7c0a8a4f845a0aceb1103606bc324ad00
fccc0575472a30fd604539e50d3282a370aaeeb778520f53d5df2b111772fe87
fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

geocult.ru Open in urlscan Pro 185.182.111.117 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

306 Requests

91 %HTTPS

46 %IPv6

38 Domains

55 Subdomains

47 IPs

12 Countries

3652 kBTransfer

8051 kBSize

36 Cookies

1 Outgoing links

Page URL History

Redirected requests

306 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

geocult.ru Open in urlscan Pro
185.182.111.117 Public Scan

Screenshot
Live screenshot

Full Image

306
Requests

91 %
HTTPS

46 %
IPv6

38
Domains

55
Subdomains

47
IPs

12
Countries

3652 kB
Transfer

8051 kB
Size

36
Cookies

306 HTTP transactions
8 data transactions