www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru Open in urlscan Pro
45.147.197.153 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Submission: On June 15 via api (June 15th 2023, 2:42:37 pm UTC) from US — Scanned from US

Summary HTTP 201 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 32 IPs in 5 countries across 38 domains to perform 201 HTTP transactions. The main IP is 45.147.197.153, located in Dronten, Netherlands and belongs to ON-LINE-DATA Server location - Netherlands, Dronten, NL. The main domain is www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru.
TLS certificate: Issued by R3 on June 15th 2023. Valid for: 3 months.

This is the only time www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
11	45.147.197.153 45.147.197.153	204601 (ON-LINE-D...) (ON-LINE-DATA Server location - Netherlands)
2 12	2a02:6b8:20::215 2a02:6b8:20::215	208722 (GLOBAL_DC) (GLOBAL_DC)
2	2a02:6b8:a::a 2a02:6b8:a::a	208722 (GLOBAL_DC) (GLOBAL_DC)
6	2607:f8b0:400... 2607:f8b0:4006:820::2002	15169 (GOOGLE) (GOOGLE)
12	2606:4700:303... 2606:4700:3038::6815:e9df	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	2607:f8b0:400... 2607:f8b0:4006:821::2002	15169 (GOOGLE) (GOOGLE)
1 5	2a02:6b8::90 2a02:6b8::90	208722 (GLOBAL_DC) (GLOBAL_DC)
1 2	88.212.202.52 88.212.202.52	39134 (UNITEDNET) (UNITEDNET)
1	89.184.81.35 89.184.81.35	28907 (MIROHOST ...) (MIROHOST Web hosting)
4 14	2a02:6b8::1:119 2a02:6b8::1:119	208722 (GLOBAL_DC) (GLOBAL_DC)
10	2607:f8b0:400... 2607:f8b0:4006:824::2002	15169 (GOOGLE) (GOOGLE)
7	2607:f8b0:400... 2607:f8b0:4006:823::2002	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:817::2001	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4006:824::200e	15169 (GOOGLE) (GOOGLE)
1	2620:100:a001::3 2620:100:a001::3	19750 (AS-CRITEO) (AS-CRITEO)
4	2620:100:a001... 2620:100:a001::24	19750 (AS-CRITEO) (AS-CRITEO)
11	2607:f8b0:400... 2607:f8b0:4006:81c::2001	15169 (GOOGLE) (GOOGLE)
5	2607:f8b0:400... 2607:f8b0:4006:81e::2004	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:817::2008	15169 (GOOGLE) (GOOGLE)
1 2	2620:112:f002... 2620:112:f002:bbbb::21	6336 (TURN-US-ASN) (TURN-US-ASN)
2 28	142.251.32.98 142.251.32.98	15169 (GOOGLE) (GOOGLE)
3 3	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
1	34.96.105.8 34.96.105.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	35.173.115.238 35.173.115.238	14618 (AMAZON-AES) (AMAZON-AES)
1 1	54.205.93.130 54.205.93.130	14618 (AMAZON-AES) (AMAZON-AES)
2 2	199.38.167.131 199.38.167.131	54312 (ROCKETFUEL) (ROCKETFUEL)
28	2620:100:a001::4 2620:100:a001::4	19750 (AS-CRITEO) (AS-CRITEO)
4	74.119.119.147 74.119.119.147	19750 (AS-CRITEO) (AS-CRITEO)
10	2620:100:a001::9 2620:100:a001::9	19750 (AS-CRITEO) (AS-CRITEO)
7	2620:100:a001... 2620:100:a001::16	19750 (AS-CRITEO) (AS-CRITEO)
1	2a02:6b8::16b 2a02:6b8::16b	208722 (GLOBAL_DC) (GLOBAL_DC)
1	96.46.186.57 96.46.186.57	7979 (SERVERS-COM) (SERVERS-COM)
3	2620:100:a005... 2620:100:a005::14	19750 (AS-CRITEO) (AS-CRITEO)
2 2	2606:ae80:147... 2606:ae80:1471:1a::1400	25751 (VALUECLICK) (VALUECLICK)
2 2	54.209.34.236 54.209.34.236	14618 (AMAZON-AES) (AMAZON-AES)
1 1	52.1.202.173 52.1.202.173	14618 (AMAZON-AES) (AMAZON-AES)
2 2	185.98.54.153 185.98.54.153	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
4 4	185.167.164.49 185.167.164.49	198622 (ADFORM) (ADFORM)
4 4	174.137.133.49 174.137.133.49	27257 (WEBAIR-IN...) (WEBAIR-INTERNET)
2 2	38.98.69.175 38.98.69.175	174 (COGENT-174) (COGENT-174)
1	74.119.119.150 74.119.119.150	19750 (AS-CRITEO) (AS-CRITEO)
1 1	52.2.225.179 52.2.225.179	14618 (AMAZON-AES) (AMAZON-AES)
1 1	151.101.66.49 151.101.66.49	54113 (FASTLY) (FASTLY)
1 1	34.150.170.96 34.150.170.96	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	64.202.112.223 64.202.112.223	23352 (SERVERCEN...) (SERVERCENTRAL)
2 2	35.207.24.140 35.207.24.140	15169 (GOOGLE) (GOOGLE)
2 2	3.135.132.32 3.135.132.32	16509 (AMAZON-02) (AMAZON-02)
201	32

11 45.147.197.153 (Dronten, Netherlands)

ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL)
PTR: vm1670795.nvme.had.yt

www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a02:6b8:20::215 (Moscow, Russian Federation) 2 redirects

ASN208722 (GLOBAL_DC, FI)

yastatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:6b8:a::a (Moscow, Russian Federation)

ASN208722 (GLOBAL_DC, FI)

yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4006:820::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700:3038::6815:e9df (United States)

ASN13335 (CLOUDFLARENET, US)

xp4stm90bvzr.frontroute.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2607:f8b0:4006:821::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:6b8::90 (Moscow, Russian Federation) 1 redirects

ASN208722 (GLOBAL_DC, FI)

an.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.212.202.52 (Russian Federation) 1 redirects

ASN39134 (UNITEDNET, RU)
PTR: host152.rax.ru

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 89.184.81.35 (Kyiv, Ukraine)

ASN28907 (MIROHOST Web hosting, datacenter and domain names registration in Ukraine, US)
PTR: c.hit.ua

c.hit.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a02:6b8::1:119 (Moscow, Russian Federation) 4 redirects

ASN208722 (GLOBAL_DC, FI)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2607:f8b0:4006:824::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:4006:823::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:817::2001 (Flushing, United States)

ASN15169 (GOOGLE, US)

dad5d4bc16389101446b988e3b9e0a4d.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:824::200e (Flushing, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:100:a001::3 (United States)

ASN19750 (AS-CRITEO, US)

rtb.va.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:100:a001::24 (United States)

ASN19750 (AS-CRITEO, US)

ads.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2607:f8b0:4006:81c::2001 (Flushing, United States)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:81e::2004 (Flushing, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:817::2008 (Flushing, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:112:f002:bbbb::21 (United States) 1 redirects

ASN6336 (TURN-US-ASN, US)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 142.251.32.98 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s77-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.71.131.137 (United States) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.105.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.105.96.34.bc.googleusercontent.com

tr.blismedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.173.115.238 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-115-238.compute-1.amazonaws.com

rtb.adentifi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.205.93.130 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-205-93-130.compute-1.amazonaws.com

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.38.167.131 (United States) 2 redirects

ASN54312 (ROCKETFUEL, US)

a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 2620:100:a001::4 (United States)

ASN19750 (AS-CRITEO, US)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 74.119.119.147 (United States)

ASN19750 (AS-CRITEO, US)

cat.va.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2620:100:a001::9 (United States)

ASN19750 (AS-CRITEO, US)

imageproxy.us.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2620:100:a001::16 (United States)

ASN19750 (AS-CRITEO, US)

csm.us.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6b8::16b (Moscow, Russian Federation)

ASN208722 (GLOBAL_DC, FI)

matchid.adfox.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 96.46.186.57 (United States)

ASN7979 (SERVERS-COM, US)

ads.betweendigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:100:a005::14 (United States)

ASN19750 (AS-CRITEO, US)

rtb.da.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:ae80:1471:1a::1400 (United States) 2 redirects

ASN25751 (VALUECLICK, US)

dclk-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.209.34.236 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-209-34-236.compute-1.amazonaws.com

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.1.202.173 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-1-202-173.compute-1.amazonaws.com

fksnk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.98.54.153 (Netherlands) 2 redirects

ASN39572 (ADVANCEDHOSTERS-AS, NL)

s.uuidksinc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.167.164.49 (Denmark) 4 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 174.137.133.49 (United States) 4 redirects

ASN27257 (WEBAIR-INTERNET, US)

dsp.adkernel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rtb2-useast.e-volution.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 38.98.69.175 (New York, United States) 2 redirects

ASN174 (COGENT-174, US)

aep.mxptint.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.119.119.150 (United States)

ASN19750 (AS-CRITEO, US)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.2.225.179 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-2-225-179.compute-1.amazonaws.com

beacon.lynx.cognitivlabs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.49 (United States) 1 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.150.170.96 (Washington, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 96.170.150.34.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.202.112.223 (Chicago, United States) 2 redirects

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.207.24.140 (North Charleston, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 140.24.207.35.bc.googleusercontent.com

rtb.mfadsrvr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.135.132.32 (Columbus, United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-135-132-32.us-east-2.compute.amazonaws.com

sync-dmp.mobtrakk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
45	criteo.net static.criteo.net — Cisco Umbrella Rank: 583 imageproxy.us.criteo.net — Cisco Umbrella Rank: 3090 csm.us.criteo.net — Cisco Umbrella Rank: 3136	1 MB
43	doubleclick.net 2 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 219 googleads.g.doubleclick.net — Cisco Umbrella Rank: 57 cm.g.doubleclick.net — Cisco Umbrella Rank: 244	228 KB
27	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 133 dad5d4bc16389101446b988e3b9e0a4d.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 155	296 KB
13	criteo.com rtb.va.us.criteo.com — Cisco Umbrella Rank: 9888 ads.us.criteo.com — Cisco Umbrella Rank: 3029 cat.va.us.criteo.com — Cisco Umbrella Rank: 2936 rtb.da.us.criteo.com — Cisco Umbrella Rank: 15445 dis.criteo.com — Cisco Umbrella Rank: 601	162 KB
12	yandex.com 3 redirects mc.yandex.com — Cisco Umbrella Rank: 9369	4 KB
12	frontroute.org xp4stm90bvzr.frontroute.org — Cisco Umbrella Rank: 793368
12	yastatic.net 2 redirects yastatic.net — Cisco Umbrella Rank: 5737	213 KB
11	bookmp3.ru www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru	307 KB
10	yandex.ru 2 redirects yandex.ru — Cisco Umbrella Rank: 1709 an.yandex.ru — Cisco Umbrella Rank: 5036 mc.yandex.ru — Cisco Umbrella Rank: 3239 matchid.adfox.yandex.ru — Cisco Umbrella Rank: 28023	184 KB
8	google.com adservice.google.com — Cisco Umbrella Rank: 107 www.google.com — Cisco Umbrella Rank: 3	1 KB
4	adform.net 4 redirects c1.adform.net — Cisco Umbrella Rank: 635	3 KB
4	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 207	224 KB
3	adsrvr.org 3 redirects match.adsrvr.org — Cisco Umbrella Rank: 375	2 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 60	21 KB
2	mobtrakk.com 2 redirects sync-dmp.mobtrakk.com — Cisco Umbrella Rank: 2589	800 B
2	mfadsrvr.com 2 redirects rtb.mfadsrvr.com — Cisco Umbrella Rank: 1160	1 KB
2	zemanta.com 2 redirects b1sync.zemanta.com — Cisco Umbrella Rank: 560	1 KB
2	e-volution.ai 2 redirects rtb2-useast.e-volution.ai — Cisco Umbrella Rank: 12226	966 B
2	mxptint.net 2 redirects aep.mxptint.net — Cisco Umbrella Rank: 7479	1 KB
2	adkernel.com 2 redirects dsp.adkernel.com — Cisco Umbrella Rank: 9107	1 KB
2	uuidksinc.net 2 redirects s.uuidksinc.net — Cisco Umbrella Rank: 10545	586 B
2	w55c.net 2 redirects pm.w55c.net — Cisco Umbrella Rank: 1012	2 KB
2	dotomi.com 2 redirects dclk-match.dotomi.com — Cisco Umbrella Rank: 3231	887 B
2	rfihub.com 2 redirects a.rfihub.com — Cisco Umbrella Rank: 3320	2 KB
2	turn.com 1 redirects ad.turn.com — Cisco Umbrella Rank: 1039 r.turn.com — Cisco Umbrella Rank: 3929	869 B
2	yadro.ru 1 redirects counter.yadro.ru — Cisco Umbrella Rank: 9773	2 KB
1	simpli.fi 1 redirects um.simpli.fi — Cisco Umbrella Rank: 976	717 B
1	cognitivlabs.com 1 redirects beacon.lynx.cognitivlabs.com — Cisco Umbrella Rank: 1669	644 B
1	fksnk.com 1 redirects fksnk.com — Cisco Umbrella Rank: 5707	613 B
1	betweendigital.com ads.betweendigital.com — Cisco Umbrella Rank: 1846	948 B
1	stackadapt.com 1 redirects sync.srv.stackadapt.com — Cisco Umbrella Rank: 792	993 B
1	adentifi.com rtb.adentifi.com — Cisco Umbrella Rank: 1337	35 B
1	blismedia.com tr.blismedia.com — Cisco Umbrella Rank: 2376	173 B
1	everesttech.net sync-tm.everesttech.net — Cisco Umbrella Rank: 778 Failed	545 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 82	76 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1107	417 B
1	hit.ua c.hit.ua — Cisco Umbrella Rank: 146588	738 B
0	mail.ru Failed ad.mail.ru Failed
201	38

	Domain	Requested by
28	static.criteo.net	ads.us.criteo.com
28	cm.g.doubleclick.net	2 redirects www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru googleads.g.doubleclick.net
15	pagead2.googlesyndication.com	www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru pagead2.googlesyndication.com googleads.g.doubleclick.net securepubads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
12	mc.yandex.com	3 redirects www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru mc.yandex.ru
12	xp4stm90bvzr.frontroute.org	www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
12	yastatic.net	2 redirects yastatic.net
11	tpc.googlesyndication.com	googleads.g.doubleclick.net securepubads.g.doubleclick.net tpc.googlesyndication.com
11	www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru	www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
10	imageproxy.us.criteo.net	ads.us.criteo.com www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
10	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
7	csm.us.criteo.net	ads.us.criteo.com
5	www.google.com	googleads.g.doubleclick.net tpc.googlesyndication.com
5	an.yandex.ru	1 redirects yastatic.net googleads.g.doubleclick.net
5	securepubads.g.doubleclick.net	www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru securepubads.g.doubleclick.net
4	c1.adform.net	4 redirects
4	cat.va.us.criteo.com	ads.us.criteo.com
4	www.googletagservices.com	googleads.g.doubleclick.net
4	ads.us.criteo.com	googleads.g.doubleclick.net
3	rtb.da.us.criteo.com	www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
3	match.adsrvr.org	3 redirects
3	www.google-analytics.com	www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru www.google-analytics.com www.googletagmanager.com
3	adservice.google.com	securepubads.g.doubleclick.net pagead2.googlesyndication.com
2	sync-dmp.mobtrakk.com	2 redirects
2	rtb.mfadsrvr.com	2 redirects
2	b1sync.zemanta.com	2 redirects
2	rtb2-useast.e-volution.ai	2 redirects
2	aep.mxptint.net	2 redirects
2	dsp.adkernel.com	2 redirects
2	s.uuidksinc.net	2 redirects
2	pm.w55c.net	2 redirects
2	dclk-match.dotomi.com	2 redirects
2	a.rfihub.com	2 redirects
2	mc.yandex.ru	1 redirects www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
2	counter.yadro.ru	1 redirects www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
2	yandex.ru	www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
1	um.simpli.fi	1 redirects
1	beacon.lynx.cognitivlabs.com	1 redirects
1	dis.criteo.com	googleads.g.doubleclick.net
1	fksnk.com	1 redirects
1	ads.betweendigital.com	yastatic.net
1	matchid.adfox.yandex.ru	yastatic.net
1	sync.srv.stackadapt.com	1 redirects
1	rtb.adentifi.com	googleads.g.doubleclick.net
1	tr.blismedia.com	googleads.g.doubleclick.net
1	sync-tm.everesttech.net	googleads.g.doubleclick.net
1	r.turn.com	www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
1	ad.turn.com	1 redirects
1	www.googletagmanager.com	www.google-analytics.com
1	rtb.va.us.criteo.com	googleads.g.doubleclick.net
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	dad5d4bc16389101446b988e3b9e0a4d.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	c.hit.ua	www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
0	ad.mail.ru Failed	yastatic.net
201	53

This site contains links to these domains. Also see Links.

Domain
mir-knigi.info
vk.com
www.facebook.com
twitter.com
bookmp3.ru
www.liveinternet.ru
hit.ua

Subject Issuer	Validity	Valid
pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru R3	`2023-06-15` - `2023-09-13`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
frontroute.org E1	`2023-04-27` - `2023-07-26`	3 months	crt.sh
*.yastatic-net.ru GlobalSign ECC OV SSL CA 2018	`2023-02-01` - `2023-08-01`	6 months	crt.sh
bs.yandex.ru GlobalSign ECC OV SSL CA 2018	`2023-04-08` - `2023-10-07`	6 months	crt.sh
hit.ua R3	`2023-06-13` - `2023-09-11`	3 months	crt.sh
mc.yandex.ru GlobalSign ECC OV SSL CA 2018	`2023-03-17` - `2023-08-27`	5 months	crt.sh
*.google.com GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
*.va.us.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-01` - `2023-08-02`	3 months	crt.sh
*.us.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-04-22` - `2023-07-19`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
tr.blismedia.com GTS CA 1D4	`2023-06-09` - `2023-09-07`	3 months	crt.sh
adentifi.com Amazon RSA 2048 M02	`2023-02-22` - `2023-09-03`	6 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-27` - `2023-08-27`	3 months	crt.sh
*.us.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-04` - `2023-08-31`	3 months	crt.sh
matchid.adfox.yandex.ru GlobalSign RSA OV SSL CA 2018	`2023-06-01` - `2023-11-24`	6 months	crt.sh
*.ads.betweendigital.com Sectigo RSA Domain Validation Secure Server CA	`2023-01-13` - `2024-02-13`	a year	crt.sh
*.da.us.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-04-16` - `2023-07-16`	3 months	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-12` - `2023-08-10`	3 months	crt.sh

This page contains 18 frames:

Primary Page: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Frame ID: E1096D7C94524FF2BD7DC237D6CBB53E
Requests: 73 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20190131/zrt_lookup.html
Frame ID: C6795A135EF3DF55B7006FC6445E8C01
Requests: 1 HTTP requests in this frame

Frame: https://dad5d4bc16389101446b988e3b9e0a4d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: EDC70A018001EBA6AC3592616D3B337D
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&h=178&slotname=2609168587&adk=1374432671&adf=4036610663&pi=t.ma~as.2609168587&w=710&fwrn=4&lmt=1686840149&rafmt=11&format=710x178&url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686840148783&bpp=5&bdt=1859&idt=262&shv=r20230613&mjsv=m202306080101&ptt=9&saldr=aa&abxe=1&correlator=1325168925188&frm=20&pv=2&ga_vid=22385216.1686840149&ga_sid=1686840149&ga_hid=632164813&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=295&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759875%2C44759926%2C42532277%2C44792109%2C42532279%2C31074583%2C31075068%2C44785295%2C44788441&oid=2&pvsid=3936331350408028&tmod=504077616&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=nNrCucJOQk&p=https%3A//www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&dtd=313
Frame ID: 7F111E1BE94D6571413C34C399F7A7DE
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&adk=1812271804&adf=3025194257&lmt=1686840149&plat=2%3A16777216%2C8%3A64%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=260x1080_l%7C260x1080_r&format=0x0&url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686840149232&bpp=5&bdt=2308&idt=5&shv=r20230613&mjsv=m202306080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3De90c8a82ed80e392-22ece1c782e10032%3AT%3D1686840149%3ART%3D1686840149%3AS%3DALNI_Maxc8c3yYxsgwaZau_6WtOEy6gjWg&gpic=UID%3D00000c4f5f4a2d18%3AT%3D1686840149%3ART%3D1686840149%3AS%3DALNI_MYQ9ibWM8pFfDfMTvRFfCpzTNfdOg&prev_fmts=710x178&nras=1&correlator=1325168925188&frm=20&pv=1&ga_vid=22385216.1686840149&ga_sid=1686840149&ga_hid=632164813&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759875%2C44759926%2C42532277%2C44792109%2C42532279%2C31074583%2C31075068%2C44785295%2C44788441&oid=2&pvsid=3936331350408028&tmod=504077616&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=29
Frame ID: 7C943347951B9535E1DEAAFE19A63A69
Requests: 1 HTTP requests in this frame

Frame: https://ads.us.criteo.com/delivery/r/afr.php?z=ZIsjVQACS8IFKNSaAAVaMeiczzPBXKy3BxDopQ&u=%7CNrB6qWOMqpbLQFR4sy8DXL6D3zZfMl%2B%2FLZSZcAGcWMM%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-dbHERHVj9MQgFtTN83TUdVFZz6mvMC78rklu3251mk0_VW95qPKEIYdWIoLP2zI1lFdmyWX-EUluSDCMLOezK7T4oqb6sMRZp-JA9tpBj87IFJAoc8-H2uRnPws5WAaVkIgLN1G22iEXpIFbl548AuRLN9F_yOIpP6jr_FzDjwlrZzJfC7SKwlhHLECVq1JsH8eUj9GLX1_su-tRPhrDbFveeCLWCMKOK817EN-loC8jE7oDare_plKOQ-X6Qfcth4jNwvxGcdg3NOmuBfLRCP_RidQ4YSa6w6uLidRa2LKTI6kGFIFNu5lR_jddBVaCXtxnnyWmDkgNNSD0x0Yf4AI2UzFTcofl82VsfR2QzENEJ-doU4TVWu6hRLU7DDlIwuINx9d7H3H8IGyf127l-s2hUXtracw70Pmw0DyhGBv2JxbCr528rW6Kdrg-tEni5Z57vaiMQ3MEJYCVm2jAmKD60Nb45NoqFB8cEvLSzSPpNoBZT6979m0DhiY-j2fB5Qz7depGdmdkGtJem3a7d5o4oOBuPv0sanwhmqi6ckuIHHP8foaFiAqDu6W5IXpx27G6IlW8nG4jOP0jiuiKLw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCDYENVSOLZMKXCZqpo9kPsbSV4Aicge-wXILzt52dAcCNtwEQASAAYMm2o4jwo-wSggEXY2EtcHViLTE2MTg1OTIyMDUwODM3ODDIAQmoAwGqBKgCT9Ck7oA95wU7M9cAjovM8JnCBwE2T3fBoPzWjPUds1yshy1wD7PWGknbGFcvC3M6WgK5j18V37ncl5MBSLSszp9GEKNCDOk_sn6kLBFf2RpY0TdlzCGV93yP_msBtVBRJeewdmK3DX7DhS2VQVq7tfT1U5kM6eEuLQU94KvUS5LMI96Z8xJDXMwnaY5TxZsD93xMu10e-NsmbAHz5NV5we_N9ZJZBwjBpfWpwVXUIuEvyGNY6VOJJHjOYllsANA4VYsMqjWvgEP7gQ96P_S3NjQaIKZYNn3jwnl81xDFarnd44ENXqXTMEcdZ8GWfNWqbt8cJSE2Qpp6P6XhHx1lHkyuiphEbG0yC-HyGNNDA6qdMjeo-tVND1_fJKWo6qH5Gh7q4jdOBe6ABsnH_frd-O6SF6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3fzQjXq_NtU0Ai3IuZER2Eh9xU3w%26client%3Dca-pub-1618592205083780%26adurl%3D
Frame ID: 10A3722ACB9E5EE5AD58C8335E77A1F3
Requests: 11 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: F5056CDF6AF83062EC88ED8739A1C9C8
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1
Frame ID: DEC04680C51F230891AD2C3C8DA2C31A
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1
Frame ID: 621A3348EC8288C03FFFFD0BA6E57FE2
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1
Frame ID: 2C9E58A586AE038FB7C8F796098567E9
Requests: 9 HTTP requests in this frame

Frame: https://ads.us.criteo.com/delivery/r/afr.php?z=ZIsjVQAEww0DihcFAAB47OhtAtnzaJc_8MuqvA&u=%7CNrB6qWOMqpbgo1HE3WCoBmLKDVyRgcYI%2FFrnFWRrIU0%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-dbHERHVj9MQgFtTN83TUdVFZz6mvMC78rklu3251mk0_VW95qPKEIXKMcagyaaUrwsatiHQNdVi49B9893ZFljTdwwSr-eINSmFwnMVbNdmoDkSxy48eLh6UHBch-rTZitK7nr07Y3KkwTX0OP_uYtsckZtYZtN9kuCJY-XRnVdNmI4iENPXqvDHhLO0TSFpSo-IZNRpwObpCSAKIOHG9cJU8t0XMqx5kkqD8lrjnU3MpiCQiLQ2aVUS-KRb3w4m9biRUT3vC9KPlBPvpHkAc65e0kbeOZraH236UgkWEWfzWQ1_dSexEK-y_qX66gH6i5m7n1J82Jo670dgNtJw8fDmY2UyAhFCRj-HxgQ8bRlDOOtQ-927tvDNwieOOq4hdx7cEfbm9TH5_64zqZOs0llUqvykGab5lAWABei_VpKIYFGa0gSuOtJRJ_Ks1k5YW8c_EvSinKy8TmmfZ8Tazr5UOAAHg2O0bgiju6bWh8NTJb-AhtibjDExL-dbqwQwLMukFj-xjrYdi7W4oqTSJTdqYFsBIJgpd2QkXFQY0Ii0Z2zBuSboUNg8qqle7nQiy6VsJawop-b3CSCJ4SVjlg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCa-HjVSOLZI2GE4WuqMwP7PGBkAWcge-wXLKaqap0wI23ARABIABgybajiPCj7BKCARdjYS1wdWItMTYxODU5MjIwNTA4Mzc4MMgBCagDAaoEowJP0AGiPH2lcwKIlR-gEAVV_uRwGzq-3Nf234CJSELMAVU4O3CqiWBjyyE0pr3J7c6J0qjU66Kq5lOcRmNfj-SP7GN-3id7Y-uVTEBODEcUM_tTlFckgwS4S8N8oVjhc1nBk86c9rbDjadUYlZi6C1Zrt99xVZMmRwqf_igy9TPP6oaGBIqggDI-OU7Zdp7RoZwe7Zsd-Wf0MhF7fr17YvaslBoZxuNDsC-eBmTVdqcBArHb_aD9B5KYvE_Yalsm5Nm-mt1HCQF1ZrE1EA0XPYS7i0q2SxpfvLnITjW61cxFCI_OKoR3e4-CazrDx4tQZrtDqLDIWhGSYHR6D9j7rXPMpvCEnUFPjWJ5ao2RvleqIC79lJpTBO37CQMqJJITKvHbsyABsnH_frd-O6SF6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0D0GIxXcMoMVyQVUFF3Fw1OzbujA%26client%3Dca-pub-1618592205083780%26adurl%3D
Frame ID: 9744634113B0B5909CD64D69FD9032AE
Requests: 12 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: C3BDBF4C1EC3C3C9A696D9075D640F15
Requests: 9 HTTP requests in this frame

Frame: https://ads.us.criteo.com/delivery/r/afr.php?z=ZIsjVQAEww4DihcFAAB47ISTA6b2r1EU0fx3FQ&u=%7CNrB6qWOMqpYBr1T1VZtM9IrErM51vpupZGu96brEPbs%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-pdBd4Yn-iAyg0RfPc5NXLXF37ShTWqW301lTwe_4Te2RkftdHPyuUKUKX8cibUu9QY22lctH8HR4VEp1DsbOwrqKY6RG3quH0OiZI8kjhArS-2fNndIOS2pwvWQa9TZ4v3kGNb7DZ7Said2OH5qg64HRKWuQZaJQc5Vqh_HS_9Fj85ToYLNdG6Keg9Q2f6I-n6LUhuoK_QaO48Vefe00EqmMlNKfPH7x1BCSVgMAqwxMGdQ4Z-Y3Av0j82s6wuo47EnIDYgjsOwZOZsgcAU6cOHYdq8IvVFOfXygtBq4ea4QlUpmS7hgUaBwJ1e3RceNA7F40xlPxfb_klG4IMZToergJA1vdQoHXNor352JztDP7Xb47oZgC2rXaLvbZnjRCD9XeJ7CJEwYGA3QjpG5XE-HpT4PZDIQegPyS-ekuBdzLvfkpbbedLck3mAux_7eq2rOVODzlDPosTUwU15Ho4jUzNkjF7yjMRePyxBfVwc-Jnj8tM2mTFx-_yCyLjLW1A5A_47hQYzZJNlIWKRnX6clG1wyLL6vSeVapNHMyH728cOPpnzMlvSlCUZXwdOayWIkC4HDC1oQk3fYozFkeA&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCW4_lVSOLZI6GE4WuqMwP7PGBkAWcge-wXLKaqap0wI23ARABIABgybajiPCj7BKCARdjYS1wdWItMTYxODU5MjIwNTA4Mzc4MMgBCagDAaoEowJP0FUvbZORgOslr2EHitJFFqiiYo_3RGfrnWfxypNTo9q6n7eeByc90p_h67urHkUUPRgS66WXxX1omXDtOp0EjNpWFtKjwxqzrmEmE-tKdy-hKjnoxnObH-Sqm0YCMd_hpK4aFeC_Oq13DeBHTJJSn6hGXlfT2etFXaRdN0_22uvsWH2WRsAd34Tef6c8C-CcyEa_6seRbDyJ_Y40UCdWpEdqh2MktsaDz4nR5ehtTJ5hVQpwOQUjlku5TELbJh0qYDEh0I-SuEvjqUhS7agEPeStEuINgUTaqGgBqUjBxFEWEfeU-R3FImkHvqLNDqGLhmnc2-uyuHbRI3sK0AYpWXFwVJdPbByXCNFUEtfsVEhUsR6UsOx7mIv6c4F0Kb6rDheABsnH_frd-O6SF6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1L4y7T_B1GqyKGeOKPyWO7acp4GQ%26client%3Dca-pub-1618592205083780%26adurl%3D
Frame ID: D6BC961363889CA70C86AA47A3EFC73C
Requests: 15 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 0420066262DC276BAF70460D0E71C789
Requests: 9 HTTP requests in this frame

Frame: https://ads.us.criteo.com/delivery/r/afr.php?z=ZIsjVQAEww8DihcFAAB47I-87xnLKrSFTTif-g&u=%7CNrB6qWOMqpYEqjTUvXRmu9q5S%2Bxx9XYDXiHAb8jf3qQ%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-pdBd4Yn-iAyg0RfPc5NXLXF37ShTWqW301lTwe_4Te2RkftdHPyuUKUKX8cibUu9QY22lctH8HR8yrTDHAKTfoskH3hFRkoFzhsJ2sjaOXIKRhd_aM7kzhH5qQk5NKPIID-vocPX2TOUu-uABLFI88_KkRd8y2Qg5plKe2MNBM8zXpRchpFBiyYNkkdvI95gkZY5EgYi4pHZ3UlfUvmfoc13BNLk6aodo3bZlPD_iJ8O6xq2kahIR_71IB6FiNcGGbR61QtcjijxcHM-oa4U5lDIjs1frd1I_KiJbEdu8eiDse8DMWqY29f_riJQQx90WDqdbMEfICEBubMAC0Z1XBuB9oymzpPqe4lcOj-QUXfuGRRSW7u74oRY05hjoLWElID6nr-VLocO5u2XYKw5_UqOkaaRuFXP_U-vacRh5gPdXY8FFFuQUROoLoR9cCuXhGFTTFvzI8SVBZB6kEUHr7HrkJpKY0ET2Ef_olbuPO1JaETHEGcgLU1cmQE1nY03gHQiEjEhUm3Wqu-08Z-SkkGyN0HvegO8nlTMm1tGq7Y0Vg2Y_FXExTtV2PEiM2z33Ky9jIrsh27HMUVmAbweAg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCN_3lVSOLZI-GE4WuqMwP7PGBkAWcge-wXLKaqap0wI23ARABIABgybajiPCj7BKCARdjYS1wdWItMTYxODU5MjIwNTA4Mzc4MMgBCagDAaoEogJP0DJ7xndADvXQlTvFc-Q0HqPhMKWnu0ET27EYACSb4hJ5MRNdbxB2mIrZqo7tj4K-HdLvyG9DIfZE37hAU6gvmyEcsOB2eFSvYu2Og8PSXOYcOBpzQ58OGPe4ILUfER1ddscE5tXcASUfl-JnDluVRz19gO7ODH15_nsz1_biW2_KQGI9YmnPfIZ7F4EPbqxIMifqqs4n3Tg0RnQBMoXjrvuijOenyvfv5YAn8poIaHQos1o6vHvWaIJTs0VV5RHXytm-pSL8GVC3_rhBwv3iA0xxm2IC8VPgQWy9RlOLd-gVTwOi1oDM8tE3i1zUFM3MzZjhEWXTOKCc7y-yUWQ_-3my7-AyDPnGMc2D8BKkAr7dwURCB9ovlPC023GqBAXB5YAGycf9-t347pIXoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDQiAYRABMgKKAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1JRXX12PlURyJ61Fs9tz_6S6qmTg%26client%3Dca-pub-1618592205083780%26adurl%3D
Frame ID: 51FD89DFC7CF73E82319DAA81D683874
Requests: 15 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 5BE2DD393D73AE9701E478A316657919
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 167A71EF43E7907E6C49FDDF0CCE9B25
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: CB0E783D8389F0635C98D8BBBF017B35
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Аудиокниги слушать онлайн бесплатно :: bookmp3.ru

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Yandex.Direct (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://an\.yandex\.ru/

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

201
Requests

84 %
HTTPS

49 %
IPv6

38
Domains

53
Subdomains

32
IPs

5
Countries

2792 kB
Transfer

6623 kB
Size

70
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://mir-knigi.info/
Title: Книги

Search URL Search Domain Scan URL

URL: https://vk.com/bookmp3_ru

Search URL Search Domain Scan URL

URL: https://www.facebook.com/bookmp3ru/

Search URL Search Domain Scan URL

URL: https://twitter.com/bookmp3

Search URL Search Domain Scan URL

URL: https://bookmp3.ru/rss

Search URL Search Domain Scan URL

URL: http://bookmp3.ru/authors
Title: «Авторы»,

Search URL Search Domain Scan URL

URL: http://bookmp3.ru/genres
Title: «Жанры»

Search URL Search Domain Scan URL

URL: http://bookmp3.ru/top
Title: «Топ 100»

Search URL Search Domain Scan URL

URL: https://www.liveinternet.ru/click

Search URL Search Domain Scan URL

URL: http://hit.ua/?x=84925
Title:     <img src='//c.hit.ua/hit?i=84925&g=0&x=1' border='0' width='88' height='31' alt='hit.ua: сейчас на сайте, посетителей и просмотров за сегодня' title='hit.ua: сейчас на сайте, посетителей и просмотров за сегодня'/>

Search URL Search Domain Scan URL

URL: https://bookmp3.ru/
Title: bookmp3.ru

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://yastatic.net/pcode/adfox/header-bidding.js HTTP 302
https://yandex.ru/ads/system/header-bidding.js

Request Chain 5

https://yastatic.net/pcode/adfox/loader.js HTTP 302
https://yandex.ru/ads/system/context.js

Request Chain 35

https://counter.yadro.ru/hit?t11.6;r;s1600*1200*24;uhttps%3A//www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/;0.5703042002866716 HTTP 302
https://counter.yadro.ru/hit?q;t11.6;r;s1600*1200*24;uhttps%3A//www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/;0.5703042002866716

Request Chain 62

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10035.p4hbpI9Cww9hvwVhmz_YL0aAV8n4JY1IJXZJFfAVg-LGi5NnzfBzf40x2iNTUGWW.rmuXsRObmcuxmFKUm-yHzjmdr2I%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=10035.bdKAt20dJ491NOiqAysXdvKN4vSUNF2hG3PVoTX0HYujbJ3EuOK9EZMzLOYoPLqzG7ks4KkaJSIxSx5YMcpzq9Oa6umJ14kgnBayPGCzbt856BLM1iNHpZIhwzBNVcHuYO-C_I7xXeQNulT2qmN4-7wKphYbbRdE_H1BQwGwPb3A21Bz9bL_Ew5U_mGGkcuRcEHpBOpy6tt2qSNKhapwN4Q8xoVe8PrDZeqzZBlDb6c%2C.sNYNV-0PeFV2x7aGHlApZZB4FuA%2C

Request Chain 65

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEOnxv2TfQobZyTvC1ay-P-g&google_cver=1&google_push=ATf1kGPXPAR0kvnl_zPBRsREIVo7uScEbMyoplTTI-tPDncOjY2iFgPuhcFKk-D_XepZ2sg2Iv6fW97Sydc2gzN6ztSg0IjBkAdENw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzE4OTIxNTQxMDMxNjU5MDM1MQ==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEMRzpWAkjJeAR7ZVdvVBVm0&google_cver=1

Request Chain 67

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEJdctEdGr4Qb6zCX-p5_mn0&google_cver=1&google_push=ATf1kGMAMC6Jpl0V6gRJY4wHL3T3FvV7m24dAsqRDJ6aGpiGXeIkJmKA-0YFovUBLS8x7do3wMlkCkZRlSzYUMufg2MXfJYnea8GeA HTTP 302
https://match.adsrvr.org/track/cmb/google?google_gid=CAESEJdctEdGr4Qb6zCX-p5_mn0&google_cver=1&google_push=ATf1kGMAMC6Jpl0V6gRJY4wHL3T3FvV7m24dAsqRDJ6aGpiGXeIkJmKA-0YFovUBLS8x7do3wMlkCkZRlSzYUMufg2MXfJYnea8GeA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OTBmOGVmMTUtNTYyMi00ZWVhLTk1MWItMGM3YjQ4NWYzZDkz&google_push&gdpr=0&gdpr_consent=&ttd_tdid=90f8ef15-5622-4eea-951b-0c7b485f3d93

Request Chain 70

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEMz3tKrdaauI8ohIMF-FHWc&google_cver=1&google_push=ATf1kGPslejF1WTf_1Tqspx1aTGVkthqvGRNV6kZW_o37vrWyjkKLzW-V6ryIlw6PVBwDHliz00yWKdTGSSkzJzLA6GxjZdcpbIbK5s HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=iWSX6l3eUnZn200VwtbtD6dYB6I&google_push=ATf1kGPslejF1WTf_1Tqspx1aTGVkthqvGRNV6kZW_o37vrWyjkKLzW-V6ryIlw6PVBwDHliz00yWKdTGSSkzJzLA6GxjZdcpbIbK5s

Request Chain 71

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESENe59YhTZ11pK7XytPY9yxQ&google_cver=1&google_push=ATf1kGMVcr1LVqx0ycUi2LWyjBI84401tTCuBoFRW9mYcNA0nh4tGRD6Hp48N6ADzZUow8VRsmj3ffVaQKeS9CX_FPzPwD758Tt9n4w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGMVcr1LVqx0ycUi2LWyjBI84401tTCuBoFRW9mYcNA0nh4tGRD6Hp48N6ADzZUow8VRsmj3ffVaQKeS9CX_FPzPwD758Tt9n4w&google_hm=NDk5NjM3MTY3ODEzNTA2MzAwMA==

Request Chain 89

https://mc.yandex.com/watch/42093449?wmode=7&page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&nohit=1&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A7sm39m606e08f3pmdzdgwin%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1060%3Acn%3A2%3Adp%3A1%3Als%3A1249469764033%3Ahid%3A189696770%3Az%3A0%3Ai%3A20230615144229%3Aet%3A1686840150%3Ac%3A1%3Arn%3A395925618%3Au%3A1686840149714077504%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1686840120672%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1686840150&t=gdpr(14%2C14)mc(p-1)clc(0-0-0)lt(6500)aw(1)ti(2) HTTP 302
https://mc.yandex.com/watch/42093449/1?wmode=7&page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&nohit=1&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A7sm39m606e08f3pmdzdgwin%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1060%3Acn%3A2%3Adp%3A1%3Als%3A1249469764033%3Ahid%3A189696770%3Az%3A0%3Ai%3A20230615144229%3Aet%3A1686840150%3Ac%3A1%3Arn%3A395925618%3Au%3A1686840149714077504%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1686840120672%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1686840150&t=gdpr%2814%2C14%29mc%28p-1%29clc%280-0-0%29lt%286500%29aw%281%29ti%282%29

Request Chain 90

https://mc.yandex.com/watch/46501593?wmode=7&page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A7sm39m606e08f3pmdzdgwin%3Afp%3A27982%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1060%3Acn%3A1%3Adp%3A0%3Als%3A1530691519693%3Ahid%3A189696770%3Az%3A0%3Ai%3A20230615144229%3Aet%3A1686840149%3Ac%3A1%3Arn%3A265741673%3Arqn%3A1%3Au%3A1686840149714077504%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ads%3A39%2C128%2C25821%2C2%2C222%2C0%2C%2C2299%2C43%2C%2C%2C%2C28548%3Aco%3A0%3Acpf%3A1%3Ans%3A1686840120672%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1686840150%3At%3A%D0%90%D1%83%D0%B4%D0%B8%D0%BE%D0%BA%D0%BD%D0%B8%D0%B3%D0%B8%20%D1%81%D0%BB%D1%83%D1%88%D0%B0%D1%82%D1%8C%20%D0%BE%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20%3A%3A%20bookmp3.ru&t=gdpr(14)mc(p-1)clc(0-0-0)rqnt(1)aw(1)ti(2) HTTP 302
https://mc.yandex.com/watch/46501593/1?wmode=7&page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A7sm39m606e08f3pmdzdgwin%3Afp%3A27982%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1060%3Acn%3A1%3Adp%3A0%3Als%3A1530691519693%3Ahid%3A189696770%3Az%3A0%3Ai%3A20230615144229%3Aet%3A1686840149%3Ac%3A1%3Arn%3A265741673%3Arqn%3A1%3Au%3A1686840149714077504%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ads%3A39%2C128%2C25821%2C2%2C222%2C0%2C%2C2299%2C43%2C%2C%2C%2C28548%3Aco%3A0%3Acpf%3A1%3Ans%3A1686840120672%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1686840150%3At%3A%D0%90%D1%83%D0%B4%D0%B8%D0%BE%D0%BA%D0%BD%D0%B8%D0%B3%D0%B8%20%D1%81%D0%BB%D1%83%D1%88%D0%B0%D1%82%D1%8C%20%D0%BE%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20%3A%3A%20bookmp3.ru&t=gdpr%2814%29mc%28p-1%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29

Request Chain 129

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEJISabOUoeOfliU2VPML8nM&google_cver=1&google_push=ATf1kGMhPk0Oo1L7ysvZyJVnIs_-tT_oMh3i9NmfgFP1AlxexUu3W2-RSFcVk-XdpojsWffhA6wKmEL49Ibz2l4qXHbC0UXspy-M6g HTTP 302
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=10dd92739f2b05ae&is_secure=true&networkId=14000&version=1&google_gid=CAESEJISabOUoeOfliU2VPML8nM&google_cver=1&google_push=ATf1kGMhPk0Oo1L7ysvZyJVnIs_-tT_oMh3i9NmfgFP1AlxexUu3W2-RSFcVk-XdpojsWffhA6wKmEL49Ibz2l4qXHbC0UXspy-M6g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAACBJb6SD0ugwNLmIpwAAAAAAA&expiration=1686926550&google_cver=1&is_secure=true&google_gid=CAESEJISabOUoeOfliU2VPML8nM&google_push=ATf1kGMhPk0Oo1L7ysvZyJVnIs_-tT_oMh3i9NmfgFP1AlxexUu3W2-RSFcVk-XdpojsWffhA6wKmEL49Ibz2l4qXHbC0UXspy-M6g

Request Chain 130

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEHbJao0ekzePnTe6IpyChpQ&google_cver=1&google_push=ATf1kGNNpZJYmPNKFiSwBkayw3aoYAW2LICt1eINnKtQGemePsT8Fl6X5UonFB9RlXYwnvwX0G1P56rqwS3V-6pu5d-Yz3HgEErw HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEHbJao0ekzePnTe6IpyChpQ&google_cver=1&google_push=ATf1kGNNpZJYmPNKFiSwBkayw3aoYAW2LICt1eINnKtQGemePsT8Fl6X5UonFB9RlXYwnvwX0G1P56rqwS3V-6pu5d-Yz3HgEErw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=d1dqSXBjeGQxUTlPYmM1&google_gid=CAESEHbJao0ekzePnTe6IpyChpQ&google_cver=1&google_push=ATf1kGNNpZJYmPNKFiSwBkayw3aoYAW2LICt1eINnKtQGemePsT8Fl6X5UonFB9RlXYwnvwX0G1P56rqwS3V-6pu5d-Yz3HgEErw

Request Chain 131

https://fksnk.com/cs/google?google_gid=CAESEI4btMiWOGuyA8REPen6VDo&google_cver=1&google_push=ATf1kGNh5mGmuaLHtRFQvRhZdTFhpOob0xK8Hbhomq48qm65Ou7Xu0yq7wXCUR6T-iEUwaiPRgesTNw_TZK_ckTgoAry2FS-xhksbA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=Q0ZEMjU2MjZDMUNFN0MwQw==

Request Chain 132

https://s.uuidksinc.net/match/47/?remote_uid=CAESEP2PMd7nDdI2AwnXnbF4csw&c_param1=ATf1kGPCCQdUaYSLBns566awOpmgq7BRVEgtQGXsaICrZJMsWtZgo9wDZVGjj3dWYS936wBq9vH8l_oJP3Bx4bYCzPs8XRANVz6lTw&gdpr=%%GDPR%%&addtl_consent=%%ADDTL_CONSENT%%&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ATf1kGPCCQdUaYSLBns566awOpmgq7BRVEgtQGXsaICrZJMsWtZgo9wDZVGjj3dWYS936wBq9vH8l_oJP3Bx4bYCzPs8XRANVz6lTw

Request Chain 133

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEI1E0hwzOcDhb6qUq0rMQx8&google_cver=1&google_push=ATf1kGMIem7GaJhQcKRuewVgefvzHtLzNAkXuRU-4bId6YmGVlJnqk0SftmB5YGSDaauifSVyx2pC5JpvwuPYLwG6v4SHyjSguGZbw HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEI1E0hwzOcDhb6qUq0rMQx8&google_cver=1&google_push=ATf1kGMIem7GaJhQcKRuewVgefvzHtLzNAkXuRU-4bId6YmGVlJnqk0SftmB5YGSDaauifSVyx2pC5JpvwuPYLwG6v4SHyjSguGZbw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODgzODY3OTY5OTgzNTQ5ODI5MQ&google_push=ATf1kGMIem7GaJhQcKRuewVgefvzHtLzNAkXuRU-4bId6YmGVlJnqk0SftmB5YGSDaauifSVyx2pC5JpvwuPYLwG6v4SHyjSguGZbw

Request Chain 134

https://dsp.adkernel.com/sync?exchange=11&google_gid=CAESEPzXPg1G_YoxYD35waxULx4&google_cver=1&google_push=ATf1kGN5VbCVOElGszXcg3Zj7GtYTvH4VqTw0jVVHuj2Sez_-lUTTJuPseeaS9reVoY456BZ1267LfjvpBMQpXoPibown-q1IAC-cA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTMwNjE3NTg1ODc0NTk3NDc5MTA&google_push=ATf1kGN5VbCVOElGszXcg3Zj7GtYTvH4VqTw0jVVHuj2Sez_-lUTTJuPseeaS9reVoY456BZ1267LfjvpBMQpXoPibown-q1IAC-cA

Request Chain 135

https://an.yandex.ru/mapuid/google/CAESEFuIoJTSRWAp35D0qwWvl2w?ext-param=ATf1kGOuYxuIUfMhX7xXEXuOpuGwaWJCCO7Lka4DKG80Z4y6GSCJMgoPQiyeBd9UFVRx4E63Go3ojFVQnYx_t3Xl0DZqtLaOpgtL4ag&partner-tag=yandex_ag&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yandex_ag&google_hm=CAESEFuIoJTSRWAp35D0qwWvl2w&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif HTTP 302
https://an.yandex.ru/resource/spacer.gif

Request Chain 147

https://aep.mxptint.net/sn.ashx?google_gid=CAESEPs5Wan2zHdJy4qF4dwcly0&google_cver=1&google_push=ATf1kGOINuNfSWlSnd0Ax0rL3CEeDhQnqfH996jQf40v2LgoXrPAQaSvR2liIQFrbKswcsKdyDEWgdGMZdvblqqNlsqcRi3wggs9x-4 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=ATf1kGOINuNfSWlSnd0Ax0rL3CEeDhQnqfH996jQf40v2LgoXrPAQaSvR2liIQFrbKswcsKdyDEWgdGMZdvblqqNlsqcRi3wggs9x-4&google_hm=UjMzNjQ1XzEwNDRGQTZCQl81NUUyRTg4Mg%3D%3D

Request Chain 148

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEAylvauLEE6bZyCokiDeUi8&google_cver=1&google_push=ATf1kGNsVVVnVQGHUd6nYRPhD4LaFfTTQiSOCtNPXVT2FWadsJmGQU3_qMnL75PO9uKXKFKKngd2WqPeaGjCfcOp32xODYOHQJok8-M HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OTBmOGVmMTUtNTYyMi00ZWVhLTk1MWItMGM3YjQ4NWYzZDkz&google_push&gdpr=0&gdpr_consent=&ttd_tdid=90f8ef15-5622-4eea-951b-0c7b485f3d93

Request Chain 150

https://s.uuidksinc.net/match/47/?remote_uid=CAESEP2PMd7nDdI2AwnXnbF4csw&c_param1=ATf1kGOxUGkfutnBSQDbosmEWMj_FGkPpsZRe2xczPSyS9T-uJDuzQn75wgNs4EwF7Z1Gs33tFvU9duORpnUQLLrNPDps6k5MdS3jhs&gdpr=%%GDPR%%&addtl_consent=%%ADDTL_CONSENT%%&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ATf1kGOxUGkfutnBSQDbosmEWMj_FGkPpsZRe2xczPSyS9T-uJDuzQn75wgNs4EwF7Z1Gs33tFvU9duORpnUQLLrNPDps6k5MdS3jhs

Request Chain 151

https://rtb2-useast.e-volution.ai/sync?exchange=193&google_gid=CAESEFZNBqgXHeHfGGiA96oJUsY&google_cver=1&google_push=ATf1kGMZuNeBclItDeym0sdGsH_cHL98d8r3SZCZy8-BJhhUBSEychu65lv7IUyDOBzGIK7O9tV7BEyOro1hBAX0iomEi8VNqTHjV4Y HTTP 302
https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.e-volution.ai%2Fsync%3Fexchange%3D193%26google_gid%3DCAESEFZNBqgXHeHfGGiA96oJUsY%26google_cver%3D1%26google_push%3DATf1kGMZuNeBclItDeym0sdGsH_cHL98d8r3SZCZy8-BJhhUBSEychu65lv7IUyDOBzGIK7O9tV7BEyOro1hBAX0iomEi8VNqTHjV4Y HTTP 302
https://rtb2-useast.e-volution.ai/sync?adkuid=A3061758587459747910&exchange=193&google_gid=CAESEFZNBqgXHeHfGGiA96oJUsY&google_cver=1&google_push=ATf1kGMZuNeBclItDeym0sdGsH_cHL98d8r3SZCZy8-BJhhUBSEychu65lv7IUyDOBzGIK7O9tV7BEyOro1hBAX0iomEi8VNqTHjV4Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTMwNjE3NTg1ODc0NTk3NDc5MTA&google_push=ATf1kGMZuNeBclItDeym0sdGsH_cHL98d8r3SZCZy8-BJhhUBSEychu65lv7IUyDOBzGIK7O9tV7BEyOro1hBAX0iomEi8VNqTHjV4Y

Request Chain 152

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEGIXT-77cFHRp1H39hT0vW8&google_cver=1&google_push=ATf1kGOxK4KXUYZs7WV59O2vzuB2SV1XBNwRjYBYxsy0ZYZ-uASnofFozWdlkeAK4czaPxVt_Q7Ml5y2AqvwTnpw-92DMnC1S6DVcwNf HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGOxK4KXUYZs7WV59O2vzuB2SV1XBNwRjYBYxsy0ZYZ-uASnofFozWdlkeAK4czaPxVt_Q7Ml5y2AqvwTnpw-92DMnC1S6DVcwNf&google_hm=NDk5NjM3MTY3ODEzNTA2MzAwMA==

Request Chain 153

https://beacon.lynx.cognitivlabs.com/adx.gif?google_gid=CAESEAZFhYt530U3oDfEuGMdJkg&google_cver=1&google_push=ATf1kGOveOjnjc1RJ-RG-hfDsAv9TB6VLYKgrkWbHfqAqW7R932s3buJnW1oxfphFV_kHmfv2v-FAKS6vgYiqfYYx8L6LvOtrNFs31JE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=Q8wiYMFL8UmNaj12gEdfcw&google_push=ATf1kGOveOjnjc1RJ-RG-hfDsAv9TB6VLYKgrkWbHfqAqW7R932s3buJnW1oxfphFV_kHmfv2v-FAKS6vgYiqfYYx8L6LvOtrNFs31JE

Request Chain 165

https://aep.mxptint.net/sn.ashx?google_gid=CAESEPs5Wan2zHdJy4qF4dwcly0&google_cver=1&google_push=ATf1kGMWQ_FUS6zl0Q8p4kXW-tXcx9gTs1Xc7zfM__dCPoxUUqiG22aiNPwg9Hli5Dcc5CchDWZBDqKeyb2Yb2H8s21sNu9HdZgaWQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=ATf1kGMWQ_FUS6zl0Q8p4kXW-tXcx9gTs1Xc7zfM__dCPoxUUqiG22aiNPwg9Hli5Dcc5CchDWZBDqKeyb2Yb2H8s21sNu9HdZgaWQ&google_hm=UjMzNjQ1XzEwNDRGQTZCQl81NUUyRTg4Mg%3D%3D

Request Chain 166

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEAMPwjUUM8J-PChz0SMSN0Y&google_cver=1&google_push=ATf1kGM5VgzdjyfT-3RksOn4KNAApFhJLCeJrv8q30hJ6Rok6ZqjOLt-KXjoYoP18-5e6-gDWUN7tfzS2M_H1M6fqed6hS7CuVYSGA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEAMPwjUUM8J-PChz0SMSN0Y&google_push=ATf1kGM5VgzdjyfT-3RksOn4KNAApFhJLCeJrv8q30hJ6Rok6ZqjOLt-KXjoYoP18-5e6-gDWUN7tfzS2M_H1M6fqed6hS7CuVYSGA

Request Chain 167

https://um.simpli.fi/gp_match?google_gid=CAESEEZQtmCZhVemtrpPOIyXWl8&google_cver=1&google_push=ATf1kGOHZRf8aG51AJBdrGDLQJZ2VEY88bGFttW8xchhoq3BCxqnL2da4ilJpiJSlVr7uvOZBdsTlNySk0SLjhvznB_TIE5Ecnd88Vo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=DBE78E55CD8A4F8BA66CBF68308278B7&google_push=ATf1kGOHZRf8aG51AJBdrGDLQJZ2VEY88bGFttW8xchhoq3BCxqnL2da4ilJpiJSlVr7uvOZBdsTlNySk0SLjhvznB_TIE5Ecnd88Vo

Request Chain 168

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEI1E0hwzOcDhb6qUq0rMQx8&google_cver=1&google_push=ATf1kGN4mRZuXFlkT06vLw-OGZU3J20oBBXeJbFNbwoJf3kFDPW5Jrzbp4T05xbiolgEvqeD_aYyWejbAl87NsSdrnIu3ickyQyrphQ HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEI1E0hwzOcDhb6qUq0rMQx8&google_cver=1&google_push=ATf1kGN4mRZuXFlkT06vLw-OGZU3J20oBBXeJbFNbwoJf3kFDPW5Jrzbp4T05xbiolgEvqeD_aYyWejbAl87NsSdrnIu3ickyQyrphQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTUyNjAxMTM3MTEwNjQ2NzYwMw&google_push=ATf1kGN4mRZuXFlkT06vLw-OGZU3J20oBBXeJbFNbwoJf3kFDPW5Jrzbp4T05xbiolgEvqeD_aYyWejbAl87NsSdrnIu3ickyQyrphQ

Request Chain 169

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEIYU0ip3Ea8hsD2cwzWJZPA&google_cver=1&google_push=ATf1kGNnt49rJFis0xcQ_rVyiFXmaESSB4UH0-5ZnoCYR8TuKzIJWG44lftuK17MuXlCFoHFEVp5cMHRbzOU3yClM6TatjL4l-Z9Sw HTTP 302
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEIYU0ip3Ea8hsD2cwzWJZPA&google_push=ATf1kGNnt49rJFis0xcQ_rVyiFXmaESSB4UH0-5ZnoCYR8TuKzIJWG44lftuK17MuXlCFoHFEVp5cMHRbzOU3yClM6TatjL4l-Z9Sw&s=2 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=ATf1kGNnt49rJFis0xcQ_rVyiFXmaESSB4UH0-5ZnoCYR8TuKzIJWG44lftuK17MuXlCFoHFEVp5cMHRbzOU3yClM6TatjL4l-Z9Sw&google_hm=VjBLLVlhcnNfSlR6YVEtV0J0S0Q=

Request Chain 170

https://rtb.mfadsrvr.com/sync?ssp=google&ssp_init=step1&google_gid=CAESEK4mowas69OruINSA0DY-Ik&google_cver=1&google_push=ATf1kGPNyQsqtzV5yoNJ9Ul4oPEvIQCrtz0hj-hflSR0aens9XKXJh7rxORt9xRWU2ZUVLO0aP6PEQWgtXdvbf8V3YUPwfrSseVL_Bo HTTP 302
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=google&ssp_init=step1&google_gid=CAESEK4mowas69OruINSA0DY-Ik&google_cver=1&google_push=ATf1kGPNyQsqtzV5yoNJ9Ul4oPEvIQCrtz0hj-hflSR0aens9XKXJh7rxORt9xRWU2ZUVLO0aP6PEQWgtXdvbf8V3YUPwfrSseVL_Bo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=iP5Bq8DIQUe5EC4JBU0sSw==&no_redirect=1&google_push=ATf1kGPNyQsqtzV5yoNJ9Ul4oPEvIQCrtz0hj-hflSR0aens9XKXJh7rxORt9xRWU2ZUVLO0aP6PEQWgtXdvbf8V3YUPwfrSseVL_Bo

Request Chain 171

https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEEBKkUVnmVV3c5CqB0-NnSI&google_cver=1&google_push=ATf1kGNc7TWp820aj6sIqdT6qKSX9nBZHiwhQTrd0PSPz-VHXGhgzylj_GGX85pq6YtF94iDW31mxeWdnZxEuHCt4TqiDbuGn-vZTahI HTTP 302
https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEEBKkUVnmVV3c5CqB0-NnSI&google_cver=1&google_push=ATf1kGNc7TWp820aj6sIqdT6qKSX9nBZHiwhQTrd0PSPz-VHXGhgzylj_GGX85pq6YtF94iDW31mxeWdnZxEuHCt4TqiDbuGn-vZTahI&chk=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=N2QxMTFhN2U3MTZlMGMxYw&google_push=ATf1kGNc7TWp820aj6sIqdT6qKSX9nBZHiwhQTrd0PSPz-VHXGhgzylj_GGX85pq6YtF94iDW31mxeWdnZxEuHCt4TqiDbuGn-vZTahI

201 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/ 70 KB
14 KB 26024ms
25819ms Document
text/html 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard / PHP/7.1.33

Resource Hash

66b620fcff5a59ab0855325dfcacee0d556f2014e49145c2e5861fa726b0a1cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: Content-Type
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
cache-control: max-age=1, private, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 15 Jun 2023 14:42:26 GMT
expires: Thu, 15 Jun 2023 14:42:02 GMT
server: ddos-guard
strict-transport-security: max-age=31536000;
vary: Accept-Encoding
x-powered-by: PHP/7.1.33

GET
H2 200 jquery.js Show response
www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/js/ 334 KB
96 KB 762ms
760ms Script
application/javascript 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/js/jquery.js

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

b9db30db84c353b393ebed43c0803e40d62453ec010584b9449a28f0348cd01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000;
last-modified: Tue, 10 Oct 2017 08:53:06 GMT
server: ddos-guard
etag: "536b8-55b2d6f820080-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, private
accept-ranges: bytes
expires: Thu, 15 Jun 2023 14:42:28 GMT

GET
H2 200 main.js Show response
www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/js/ 860 B
612 B 178ms
177ms Script
application/javascript 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/js/main.js

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

a94755ecd90a113ceb5ffbb9a9834639bbf215711895074c4181eb309929ca25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000;
last-modified: Wed, 25 Oct 2017 18:13:28 GMT
server: ddos-guard
etag: "35c-55c630327a200-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, private
accept-ranges: bytes
content-length: 447
expires: Thu, 15 Jun 2023 14:42:28 GMT

GET
H2 200 style.css
www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/ 94 KB
15 KB 723ms
721ms Stylesheet
text/css 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/style.css?v=2.6

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

47a37cabd33f930dd28119e3ba60cca269770f1b2a774a52bad0a75d8076cd8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000;
last-modified: Wed, 30 Jun 2021 13:22:17 GMT
server: ddos-guard
etag: "17698-5c5fb9c888be4-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 15374
expires: Sat, 15 Jul 2023 14:42:27 GMT

GET
H2 200 font-awesome.min.css
www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/ 30 KB
7 KB 572ms
571ms Stylesheet
text/css 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/font-awesome.min.css

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:27 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000;
last-modified: Tue, 10 Oct 2017 15:14:28 GMT
server: ddos-guard
etag: "7918-55b32c3619d00-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 7053
expires: Sat, 15 Jul 2023 14:42:27 GMT

GET
H2

200

header-bidding.js Show response
yandex.ru/ads/system/
Redirect Chain

https://yastatic.net/pcode/adfox/header-bidding.js
https://yandex.ru/ads/system/header-bidding.js

115 KB
34 KB

489ms
173ms

Script
text/javascript

2a02:6b8:a::a
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/system/header-bidding.js

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

037b420714a2fb0b7991cc3a543699cd114cb0e63efb8261a3c809519f8cc3e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-encoding: br
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
x-yandex-req-id: 1686840149396795-9332021357656069685-balancer-l7leveler-kubr-yp-vla-96-BAL-3136
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Thu, 15 Jun 2023 15:42:29 GMT

Redirect headers

date: Thu, 15 Jun 2023 14:42:28 GMT
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
server: nginx/1.17.9
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
location: https://yandex.ru/ads/system/header-bidding.js
access-control-allow-origin: *
timing-allow-origin: *
content-length: 0

GET
H2

200

context.js Show response
yandex.ru/ads/system/
Redirect Chain

https://yastatic.net/pcode/adfox/loader.js
https://yandex.ru/ads/system/context.js

309 KB
90 KB

498ms
170ms

Script
text/javascript

2a02:6b8:a::a
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/system/context.js

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

d88be0ee6e8377978f2e89e00285ce047bfa41fdbff601fc37b5ad3642e5793f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-encoding: br
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
x-yandex-req-id: 1686840147949437-16261050109231401128-balancer-l7leveler-kubr-yp-vla-138-BAL-4190
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Thu, 15 Jun 2023 15:42:27 GMT

Redirect headers

date: Thu, 15 Jun 2023 14:42:27 GMT
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
server: nginx/1.17.9
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
location: https://yandex.ru/ads/system/context.js
access-control-allow-origin: *
timing-allow-origin: *
content-length: 0

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 76 KB
25 KB 199ms
72ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

80817ceead858dd49119fe01e4e87ba98a74d6a34ca07ae5f9bb71b6c379c0b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25407
x-xss-protection: 0
server: cafe
etag: 580 / 19523 / 31075344 / config-hash: 6874735801147936747
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:42:28 GMT

GET
H2 502 audiobook-sistemnye-zapiski.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/4/0/ 0
0 502ms
374ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/4/0/audiobook-sistemnye-zapiski.jpg
Requested by: Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 502 audiobook-istorija-moikh-bedstvijj.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/3/9/ 0
0 524ms
397ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/3/9/audiobook-istorija-moikh-bedstvijj.jpg
Requested by: Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 502 audiobook-cherepakha-tunejadca-vitjushi.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/3/8/ 0
0 505ms
379ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/3/8/audiobook-cherepakha-tunejadca-vitjushi.jpg
Requested by: Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 502 audiobook-prizrak-obolshhenija.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/5/ 0
0 531ms
405ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/5/audiobook-prizrak-obolshhenija.jpg
Requested by: Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 502 audiobook-katastrofa-2.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/4/ 0
0 503ms
377ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/4/audiobook-katastrofa-2.jpg
Requested by: Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 502 audiobook-tonnel-v-leto-vykhod-proshhanijj.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/3/ 0
0 532ms
406ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/3/audiobook-tonnel-v-leto-vykhod-proshhanijj.jpg
Requested by: Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 502 audiobook-tma-2.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/2/ 0
0 455ms
371ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/2/audiobook-tma-2.jpg
Requested by: Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 502 audiobook-testorium-29.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/1/ 0
0 490ms
406ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/1/audiobook-testorium-29.jpg
Requested by: Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 502 audiobook-nikto-ne-angel.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/0/ 0
0 483ms
399ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/0/audiobook-nikto-ne-angel.jpg
Requested by: Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 502 audiobook-shtanishki-na-malchika-1.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/1/3/ 0
0 485ms
401ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/1/3/audiobook-shtanishki-na-malchika-1.jpg
Requested by: Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 502 audiobook-belosnezhka-i-jarostnye-gnomy-skazka-pervaja.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/1/2/ 0
0 455ms
371ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/1/2/audiobook-belosnezhka-i-jarostnye-gnomy-skazka-pervaja.jpg
Requested by: Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 502 audiobook-materinskoe-voskresene.jpg
xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/1/1/ 0
0 457ms
373ms Image
text/html 2606:4700:3038::6815:e9df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/1/1/audiobook-materinskoe-voskresene.jpg
Requested by: Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:e9df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 137 KB
47 KB 197ms
73ms Script
text/javascript 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d84ad69a383d387af3b53da2110d938167350fc5ff7f3a51199e9cbcf26f796c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47386
x-xss-protection: 0
server: cafe
etag: 13438028493122414469
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:42:28 GMT

GET
H2 200 webfont.js Show response
www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/js/ 13 KB
5 KB 585ms
585ms Script
application/javascript 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/js/webfont.js

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000;
last-modified: Tue, 10 Oct 2017 08:53:02 GMT
server: ddos-guard
etag: "3384-55b2d6f44f780-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, private
accept-ranges: bytes
content-length: 5415
expires: Thu, 15 Jun 2023 14:42:29 GMT

GET
H2 200 audioplayer.js Show response
www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/js/ 386 KB
65 KB 501ms
500ms Script
application/javascript 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/js/audioplayer.js

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

f919c02713441d1502a5297ec6201783ecf8070a47d5df866a78ca2fb83bc865

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000;
last-modified: Tue, 10 Oct 2017 14:24:22 GMT
server: ddos-guard
etag: "607be-55b321035b180-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, private
accept-ranges: bytes
expires: Thu, 15 Jun 2023 14:42:29 GMT

GET
H2 200 60f440ae59e356a63e0e.js Show response
yastatic.net/partner-code-bundles/787310/ 14 KB
5 KB 331ms
328ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/787310/60f440ae59e356a63e0e.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

19eaf1e870bdb8712cc22161dea59e8aae717c901415cb6b2d7a71fbe7889829

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 4777
last-modified: Wed, 14 Jun 2023 16:23:04 GMT
server: nginx/1.17.9
etag: "f1aaefb720f6cf53a07c717fc30f650f"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sat, 14 Jun 2053 21:14:07 GMT

GET
H2 200 4fe48612440824ab5c38.js Show response
yastatic.net/partner-code-bundles/787310/ 19 KB
7 KB 363ms
360ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/787310/4fe48612440824ab5c38.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

d6d6716cbd4765998e3b1d03bdc02fe3f1dc5f5876e71194e1b2098228e0911b

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 6455
last-modified: Wed, 14 Jun 2023 16:23:04 GMT
server: nginx/1.17.9
etag: "96177c263c284c82c89b1a369fc9f1bd"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sat, 14 Jun 2053 21:17:47 GMT

GET
H2 200 74bde05979fb5a8830f9.js Show response
yastatic.net/partner-code-bundles/787310/ 112 KB
24 KB 419ms
417ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/787310/74bde05979fb5a8830f9.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

3ec4196556cc8b9a1774f069cc5e0881910e8af98192fc3c81cdc63b68a63a14

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 23715
last-modified: Wed, 14 Jun 2023 16:23:04 GMT
server: nginx/1.17.9
etag: "8dc592d89a7a5b9ccae98ab99e158a53"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sat, 14 Jun 2053 21:18:17 GMT

GET
H2 200 host.js Show response
yastatic.net/safeframe-bundles/0.83/ 33 KB
9 KB 475ms
472ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/safeframe-bundles/0.83/host.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 8878
last-modified: Wed, 03 Nov 2021 13:42:58 GMT
server: nginx/1.17.9
etag: "f80882bf67cf261aa08d636da095149a"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sat, 14 Jun 2053 21:16:17 GMT

GET
H2 200 text-variable-full.woff2
yastatic.net/s3/home/fonts/ys/3/ 25 KB
26 KB 213ms
213ms Font
font/woff2 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/s3/home/fonts/ys/3/text-variable-full.woff2

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 26004
x-amz-meta-owner: {"role":"admin","login":"4eb0da"}
last-modified: Mon, 25 Apr 2022 14:02:39 GMT
server: nginx/1.17.9
etag: "7f0cdaf91230f9789ca4162aedff612e"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31556952
x-nginx-request-id: 12c4a2e7fd9cdad9
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 14 Jun 2024 20:29:28 GMT

GET
H2 200 4168a7ae35bfbcdd0f85.js Show response
yastatic.net/partner-code-bundles/787310/ 23 KB
8 KB 492ms
490ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/787310/4168a7ae35bfbcdd0f85.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

c2811e78f286560048117ac1f4a9ae74d3d07f11c7472b939a6148fcd07cb0f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 7927
last-modified: Wed, 14 Jun 2023 16:23:04 GMT
server: nginx/1.17.9
etag: "173926b1a783e5643b8c3f74a5db9253"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sat, 14 Jun 2053 21:14:07 GMT

GET
H2 200 fb4ce5a844de960d39c8.js Show response
yastatic.net/partner-code-bundles/787310/ 7 KB
3 KB 493ms
491ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/787310/fb4ce5a844de960d39c8.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

151b2b51325341cc624a0eb44835b53bf6f54ac713b6f318455f76f3b7d2b789

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 2076
last-modified: Wed, 14 Jun 2023 16:23:05 GMT
server: nginx/1.17.9
etag: "48d578774f76a730c2070ae338306bbc"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sat, 14 Jun 2053 21:17:47 GMT

GET
H2 200 480084dda271f8fcbf8d.js Show response
yastatic.net/partner-code-bundles/787310/ 632 KB
118 KB 493ms
491ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/787310/480084dda271f8fcbf8d.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e2c341422188fa1c4d9bd46360583722454235ceb01cbcae83c0ebb84657836f

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 119690
last-modified: Wed, 14 Jun 2023 16:23:04 GMT
server: nginx/1.17.9
etag: "4caac117d2a11844f1e50aa25cc3aad7"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sat, 14 Jun 2053 21:18:17 GMT

GET
H2 200 fontawesome-webfont.woff2
www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/fonts/ 75 KB
76 KB 482ms
481ms Font
application/octet-stream 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/font-awesome.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/font-awesome.min.css
Origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
strict-transport-security: max-age=31536000;
last-modified: Tue, 10 Oct 2017 15:17:21 GMT
server: ddos-guard
etag: "12d68-55b32cdb16240"
cache-control: max-age=1
accept-ranges: bytes
content-length: 77160
expires: Thu, 15 Jun 2023 14:42:29 GMT

GET
H2 200 bookmp3-logo.png
www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/images/ 27 KB
27 KB 488ms
487ms Image
image/png 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/images/bookmp3-logo.png?v1

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/style.css?v=2.6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

12d8aae0cf51d039bfbef1c8f7ec828851423f05c8f9e5d290b2c2e15cd9a8a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/style.css?v=2.6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
strict-transport-security: max-age=31536000;
last-modified: Sat, 21 Oct 2017 10:38:23 GMT
server: ddos-guard
etag: "6d15-55c0c3048e5c0"
content-type: image/png
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 27925
expires: Sat, 15 Jul 2023 14:42:28 GMT

GET
H2 200 icon-menu-dd.png
www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/images/ 190 B
262 B 562ms
561ms Image
image/png 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/images/icon-menu-dd.png?v1

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/style.css?v=2.6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

db0d17ee9c24794dc313d2588c0c19bccccb2f7439a0dcb6be8cc985df84baf3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/style.css?v=2.6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
strict-transport-security: max-age=31536000;
last-modified: Thu, 12 Oct 2017 17:43:11 GMT
server: ddos-guard
etag: "be-55b5d12ea89c0"
content-type: image/png
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 190
expires: Sat, 15 Jul 2023 14:42:28 GMT

GET
H2 200 icon-search.png
www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/images/ 380 B
477 B 580ms
579ms Image
image/png 45.147.197.153
Netherlands

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/images/icon-search.png?v1

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/style.css?v=2.6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.147.197.153 Dronten, Netherlands, ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),

Reverse DNS

vm1670795.nvme.had.yt

Software

ddos-guard /

Resource Hash

3be3f024c46ff93eb55bb00f599911ef69c7957b19c8c3df9aca743259f35ae3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/css/style.css?v=2.6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:29 GMT
strict-transport-security: max-age=31536000;
last-modified: Thu, 12 Oct 2017 17:41:41 GMT
server: ddos-guard
etag: "17c-55b5d0d8d3f40"
content-type: image/png
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 380
expires: Sat, 15 Jul 2023 14:42:28 GMT

GET
H2 200 v2 Show response
an.yandex.ru/adfox/264109/getBulk/ 210 B
827 B 531ms
192ms XHR
application/json 2a02:6b8::90
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/adfox/264109/getBulk/v2?pr=2744450886&pr1=318207820&dl=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&prr=&extid_loader=&extid_tag_loader=www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&date=2023-06-15T14%3A42%3A28.547%2B00%3A00&pd=15&pw=4&pv=14&pdw=1600&pdh=1200&ylv=0.787310&ybv=0.787310&ytt=482685604855813&is-turbo=0&skip-token=&ad-session-id=4588291686840148554&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A9.7%2C%22supportHDRBrightness%22%3Afalse%2C%22isInIframe%22%3Afalse%2C%22w%22%3A1600%2C%22h%22%3A0%2C%22width%22%3A0%2C%22height%22%3A0%2C%22visible%22%3A0%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A810%2C%22top%22%3A-12%2C%22darkTheme%22%3Afalse%2C%22req_no%22%3A0%2C%22ad_no%22%3A0%7D&enable-flat-highlight=1&pcode-version=787310&p1=cmaqk&p2=gxwa&slotNumber=3&bids=W10%3D&utf8=%E2%9C%93&pcode-test-ids=770116%2C0%2C75%3B781457%2C0%2C99%3B769344%2C0%2C5%3B764673%2C0%2C78%3B780962%2C0%2C96%3B780721%2C0%2C76%3B785564%2C0%2C25%3B783311%2C0%2C2%3B782716%2C0%2C24%3B785826%2C0%2C77%3B782173%2C0%2C32%3B788052%2C0%2C17&pcode-flags-map=eJy1Wdty2zgS%2FRc9TzK8glTeQBKUMCYJLgBa0UxNoZRY42jLVrYceyabVP59GyB1ISVBsuN9kWVKfdBAd58%2BDX0fXWOhxJTNFM5UgRNSqJxxRSuV4KoifPTuj%2B%2Bjvxd3T8vRu5HkDRn9MnpcfnmkN%2FA%2FQr4fRKMff%2F6yg6k5y5pUCsUqVeNGECtC5I4Dv0UgFU4KokjKyh1IQYXUzlzTjDD9Bj5NmMK87MEuv%2F5ngBr6oUHNqDCwKWsqqTjJKCephsR1bffMc4LA2%2B4NNqLKppCUs6IAtErqN4SrGZbplGRK0pIolueCSDuu7znR4MwkleAirjKVsGyuI1FjjksiAT8jOYZ1e5g5LkQfNIgCtAPlRPK5DkBF5IzxK0U4Z%2FZQRiEKovEWoQuGSDG8FvQK3jb8mswBcQYuCTqp7HDIifzoAO5nMApWTVRe4Ik%2Bs6bIFESwmCtxRev28K9x0ZzJtghFMerFVPsCEJUi14TPZ1PCz0FEQeBvISD06RXUzZw1UomCwQv9nUAYmyrDnBJxBix2A7e%2FQ%2FK%2BbncJNZASISg8gw%2Blel8WdrDYd4PocjCVzCEumRJzqKjXh8ZZpkraPk8LJqBEEo7Tq3NH8qJdpCwjquHFs7CFNEkJcReU9VMxioGVvL5t5LgtpTQVLRjOoDY1U%2BKyxyOPD0%2FLPbPAi%2F2x05pBtglhqHVgM6SvPSOgAkFIpVgiCNROv4aX68WHu2XP0kfeuN3hHOiEvFe8URkrMa1sC4ZO5PnoqJkCApWcJlZzz3VQ0Jlry9ZE4WKG58JqCcc8bgsgy2vgLVGzCs5J1zNUVM%2FUcxynbxs4frtqbeKfatNK2tcLAaY72ZzBPokO5WY9nWl28yCKvENzmmvOnumcgmC9BGHjwAGH%2Bc5x65pTxqmc6%2Fy%2FpmRWM27fOYpQl1Oblti1wlRwq%2BHYhWowhqaHQtrLeU2UbzcK4ijc22bJU3BT0IQW4LSlYMByHKGTlrqppQVNr86svsEwLbtVMgrqNqdAQ1RvIscpsWPEXtemWz86kFaISGaaNPB%2BApS2JwdskMjxAr%2BNnu46nOSQ71OguAlNrXZu7KNNBKqc8lIHnQN3dxRUc5LQzAoBFeq5vegDHXE8gXrpeljeFIVIuSYbIaxVgNyxGwT7mm2gzjrJAg9yWlFJQM2kV9C0rQmKgtBBqOeiKDGX6l8NaYgGP%2BdWiBAKt%2BwupxyU1cAzo4N0DtEKKo1mpmVbQSM36mIGUqgA0%2B7cca4rgeZapinTDuwBiOIxGm%2F7QA7SoMpAvbT2uiXU9s317ZMrozOECX9%2Fj3aUceBEW5SCQBIDglVLIxQHqE2dvRSZcDg80HBXktn9jlHg%2Bvu5shN%2FR5xXMyqn59Q9GnsobqlsYJ0XTHfkrNObdpBx3AX2FIg54R7GX6uv6n7xVX1arm4%2FPZ6A6%2FKkTTUQlNV%2BaVWgEE0RTxquFVGjZ5KU0Gt7%2BkSuE3R8yrlq2UM2vOrS0DCiyfhmMj0zbwFSm0cF%2Fn1uMleZ9rlv9n301%2FLx46dy8XC7Wo%2FeuSE0ofvPH1Z3S%2FFxcbda347eeT96qCGwpUHdr1mt25JCE6Qe4%2FYX%2BGN0v1jdvX14At%2F%2Bu1jfLL%2FC%2B19X94vb5Zfeo9vFvXly8225br%2B%2B%2BHv1%2BLl9e%2F9275%2Bb9ap7qpG3CPDgYfHt7vO3T93H3x7av08Pi7fr5T9fDr7w78Xn%2B5Ux%2FfP4FissIV6qJHyiXzOKlcQTq84BDvG6IjLlTyD2nOBUgvA8Yxj6jnfYhmhVA3nrPvTMJhT5yEfxScC9ItVT0YVIMPNuSd%2FAVE2ZnPEjdP2oLWJzS2AmcrAEbk5I2pKiafv2MgaYyGkLI6fvdYvQbX6YzwdWyHPctoN1s2QKjZCTbhA3Q7jmZOi0zyNYGA6dyN0HNqpfzgsyaQDlNVETxnUjYjAVQAo8GxL53QkM6W9HVpI16bRdC1SpJiup5RcrmD20esoOX46tv1%2FAGCJSXNvDeMlCXZP6qW3otMJZqaXaxNQHzXJ8hNRIlns48tAbl%2BTemyBI8ZskyZI3WYo9P44JQWHWZ5U4DMfHW9nwqEzn0HO0LhEYXbnuHL%2BBgD%2FTOaABB22VTjhOPJ0nIBYzcnYKhYk3cFtBtplOQGia66%2FdRVgnh4%2BMa9A0%2BvNaBAP0WbykyXNIalLWoPULWtIh6LMRr2tMs9f3UMfnxaiVvht9ZU9PYP5UfI5j%2Fv9O4KXRN3q%2FQ4aWCGOVqQ9YA6YloSecpoIJB9P%2BNVc4cDN2g3B3PYSl1I6I5yC6pwCfc7mdM6ZFHfSzM6WNxn43hxly4%2FoCOaUSBuXKOh9HKECRPzQ0qvRCsz6%2FHmh5OcGKl3WbIkacmt1fMgZGsTNG3k8sYj6%2FcIWjWNsloauCTEs5E%2BKCgWIPtgv2Zf6%2FuquHV0hWLzmpCZbGNa36Brl4NGQf1493Azej7nZhTz9uTJ%2BrTHZg%2BkIPBphUak1Qal1pLtc3V192lDDs7kwyAqeERTttQecXakboZNrf0sPy9ulu8XACYnAo%2Bvi1ijvxO8bH4en4vuv2cfaCV2hfYHYj5Zn08qIN251UCrqaU4nNL0nbn%2FO6uUDYfTxEH%2BAmdKKwAKUvTBQuRNtc5Uy1TD1xAzj6Z3Vzu3xUHxbr9XIYgthDuyve4QU4SBR%2FSLmxE%2Br8%2FvE%2Fyi59xg%3D%3D&use-server-side-rendering=1&pcode-icookie=GvkpUDaFV7UalN6MdiC7wROiKEb%2BarBw66WsLQrfO%2FFWFOIlL%2Fa3q7dAO9cVqAKhpHH%2Ft76SWkEb%2FZIlrMOiR1Y38uQ%3D&top-ancestor=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&top-ancestor-undetermined=0&grab-orig-len=2996&grab=eyJncmFiX3ZlcnNpb24iOjIsImlzX2FzeW5jIjoxLCJvbGRfZ3JhYl9zaXplIjoxNjB9ChKlMpHkuO1BBNbFw7QdcLvU5i_z6QT9hDWq53XclJ9tvPO4iY1c2zTAT9Omru_ncePYsYlitOlL26XrgLk_wb4I5JKCKswdb-uahpP9wy9_urGwTEVFBVQRVRUwbNArScNq0hY0SRMuGHaT9krWxJWkwm7ySlqJ-kIUNnGTN4wm7A1Cky0E9MtX0oUe9Dzv-jhGqFHR0UfkSC0NygIfp8Jssr6iuVogNTfIVdFkCydarmG94bbFafK-kFakbIEdjOS5l1yOu3FHStcgLqSgN_TpiVWAv53FlWC7kW7PhnlWyxqESvBG8gr7MMvwSgrS-wOxlRE0zGVdJRvxTfQCjRShRmswUqSZzmAMk1CbGkBHZo220seoScOsqzNNitiuS5VUUaIKk1ht71SxOkzVIWJ7w98-4kq0HMu62boAUc34wonPNP7in-YArTTps3MRfsr7ShBuYUHD6AtVsmLJ6HsDbrKJvf1WuGghgZ8SltUBSux5Oy9Fp4XN_xOgmJ7SU_GCkFe4W7iU3m7jZwbCFHj4caRTulgiB1c6GFE5qKtSjqK5qfj12gp16GMd8AajLkHQqbSZUonYrmfwS-16BvhRprLzQgpjlT6L-KTCTK9N-WSjGD6fPFWq1a40udaT1ybKcOW1icGYuSQZtIkaod0AQCAbpGU5erdYrUZbtvVcGMpCoO9BNrqrosJErgBok-y95Fx7qW5BSpELtPly31fvP5HDI_52CBo2cgVB9ShRIMRGruXOWI8SRBRPnlKVqQ0Nt8Lcl_zJQYVL_-L2yASVODfaRjxXEqaXbVtxAITqzampKWKtLo3sHKEkanUarUSaRZQJCJxEarJEzQPtV-NqU6SoqfeDrk6CDMaIYrtBEM9epIEznEuCuNjlcaiPQxeHgvwJRGtSNblLsDZBRTB1EqaaF1No1BN7KZ8eGjCCvxb6dJ_aSS_-SAeNnTiHMDf_KPXGb0A3oBoeWAET6uJF0Bpeg8YNvPkLZRxpuBiqXOqlovgXDgElqlDG0YQ4uCJfSTFEI4VFAPFnGTyxa5ZEBLeLv2SPhbeJKlaGSv5zFBbyiz1HC2BKQwkCNTVVjGAi1heZcRBLXVLEMdrdIjbUw1hj52-pD9WdX2xpyYN3cee-kiCfv8mXnWMJA8nncF3jwYL2cKIN2skD5kYq-mXuoqLC5eCffAXosjBDPm7ZKZNoSRGqWEuuUTvE6royjBI1Iruhb8yL7773BuimdVnO8XwoNAYoOSVlou4AyyhTh_3NNPnxIpTweRcg5rnA9lzQ5l5L2hQX656YtBIX3w3Lt_ClDYNFXgW5Eq1_ruiLP7-QdTiqwuEltyv-HZreAFuWLM59jMZxX6s5t1hys4l5I7beCOJpY6kEfXklvvVLutyt8bR2GtbaxGu8AneXvxLe_GSRAwHoEXibD9KZ-wQu2yXHURx-sDdgb6-MHTiN8DbLS_-bUmftrJbciiQ3Mckddj4G8lAq5q2KJrmdD8FXwcNaqhwlPoucB_ATaJtb0ZI4y3rs_Z98S3FE8OA-80v30vcD8DZCvzvriMgx0-a0zBOx80RQR2cs97WyQYXX5CzyKUAWdyfZehQNq69nIZmIlI0_5Ix8Wzz5hsMzc2Jo_XdI00B-7TeYE0W0ptxKw7wRW28EadTPwvHliK5O_fnv7zD2GzXrpwd_d1EYwSqqI5ZweXArjGMGAJlYk463IHkiHd8P4LooVWebUzMozt5jyumWDKJjvoed71kbWMQi5NF6XOA3OjGa6CjCeONHHN1f4UhVL9Cx42-GxEfNBmOHxkKXW0y5mfkt9hFMMrde_q6dGWQWIbquVFFMQfLDCwfx3JHLBP1a-yMu3scJGubmRHjr0GFHWmtOxzwVO08FZXtJCvKIcHQaC459955F_gT02J8E14TLiuNxlBhH-nvo4-nK3-ktSR74ztx_JGuEMn0n9v0J0BmgX7kPu2zJhWW-Lx8FPpw_hjUcfCA3xy9I2BvEir-nPIo2hsNDgphpVElErqGhoXGm00eSm0BhXoqtl8Ifu-Rr6Vui4H-yL3CvTPA3uD6iJvYX3uvNwaQvxoV8MbIRgz7-25KRLKLsXF94VKi4g2wvBnMPnltJD3U8eEwHGvU1Nq20zHOw9Ry4Y4TIRlskHDSh4HfBmSdIRjfwUajwCKms8h68NS5h_DtAHOGvwnNiT0KZ_zwgsHxU5gkRybjpYO5WW2lzkymnBevTcHOf6RAwoF2WT0KvjakQojhAV2WIEnUWxhH_2tiX-mCvzLf9kbcPLhhqW3h22WYeeToeeVoeeROPPBLuCTXf1pqb5e4BXJiCEHZeGAZ_46paYvdD0TKhk5alLNp-m7HPoq6S9CFlyIoLU4kH9v71rLxwBjFRVBDL_REdnBm3v7MMpN4AcXsho4hcTsUDZDmo-2NvsLWdZEfXfnzCG8NS5G3jBseGO49SlDF0Je4TcMTzxdlADjrn4sju4dPRN18cOhq2O_MyafeWToPyPl52Ydwj5MtWUrTp17P8Z2AwPs2BN4kteQ9m_Eja722WcdLJXJ78lUyWMRnpoB0SlWqXrTCmWNGHiie08ZejQc_F_jJxkif0ieWSmVeL-iiY3mhTGYwUZgPoH_wYbdv4L7_a-c4jeA8DcU-4SK4A7qNZxinXLmMe8aHB8ZHxiSrh4cfFPxUdhE-IbUIk1wuv4DG6fz3pvSOhT2syLwtS9415RzaV8EkoaST8mk262JfwKSpzpnFfiOmPn7g7eUwPyhOWm8WG0BpuA4J53YIezePQhKfS91_wAdCT_XFM2brheMt0nK0ee3YsWEc58b2I8j-404rMHeDnVOqvWYaSh5tfT3bCJShzpRfrlSmZs84SVFQKIyh9B85j4uxySsTDK0gVjH0SKSneeB8XVLIHnLCT-BaakItaUHv3_rHvsz8SAcA%3D&tga-with-creatives=1

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

8687243a605d506b71823d4dabe58db65d0522bd2391cd8fcd25bd1533b9d9db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:29 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Thu, 15 Jun 2023 14:42:29 GMT
x-yandex-req-id: 1686840148996942-438739486731151822500288-production-app-host-vla-pcode-57
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
content-type: application/json
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Thu, 15 Jun 2023 14:42:29 GMT

GET
H/1.1

200
OK

hit
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit?t11.6;r;s1600*1200*24;uhttps%3A//www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/;0.5703042002866716
https://counter.yadro.ru/hit?q;t11.6;r;s1600*1200*24;uhttps%3A//www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/;0.5703042002866716

753 B
1 KB

161ms
161ms

Image
image/gif

88.212.202.52
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit?q;t11.6;r;s1600*1200*24;uhttps%3A//www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/;0.5703042002866716

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

HTTP/1.1

Server

88.212.202.52 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host152.rax.ru

Software

nginx/1.17.9 /

Resource Hash

a61735542ef93f832ab8321f9670a83ff11f58b5e122b2fb014199e32de05312

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 15 Jun 2023 14:42:29 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: image/gif
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin: *
Cache-control: no-cache
Connection: keep-alive
Content-Length: 753
Expires: Tue, 14 Jun 2022 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 15 Jun 2023 14:42:28 GMT
Strict-Transport-Security: max-age=86400
Server: nginx/1.17.9
Content-Type: text/html
Location: https://counter.yadro.ru/hit?q;t11.6;r;s1600*1200*24;uhttps%3A//www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/;0.5703042002866716
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Cache-control: no-cache
Connection: keep-alive
Content-Length: 32
Expires: Tue, 14 Jun 2022 21:00:00 GMT

GET
H2 200 hit
c.hit.ua/ 471 B
738 B 621ms
148ms Image
image/png 89.184.81.35
MIROHOST Web hosting

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.hit.ua/hit?i=84925&g=0&x=1&s=1&c=1&t=0&w=1600&h=1200&d=24&0.2229061038132527&r=&u=https%3A//www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Requested by: Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 89.184.81.35 Kyiv, Ukraine, ASN28907 (MIROHOST Web hosting, datacenter and domain names registration in Ukraine, US),
Reverse DNS: c.hit.ua
Software: nginx/1.17.9 /
Resource Hash: 48b551ea7cc10bfe0fd691b67bbb5951ced65174095642157f46c60385d0fc38

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p: policyref="/w3c/p3p.xml", CP="UNI"
pragma: no-cache
date: Thu, 15 Jun 2023 14:42:29 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/png
server: nginx/1.17.9
expires: 0

GET
H2 200 watch.js Show response
mc.yandex.ru/metrika/ 165 KB
58 KB 640ms
310ms Script
application/javascript 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/watch.js

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

1c86a366ec6f558c2fc53da4077489f28ec37a572c24f8bdb2b375409ae03716

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Thu, 08 Jun 2023 15:38:48 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "6481cbd8-e775"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
timing-allow-origin: *
content-length: 59253
expires: Thu, 15 Jun 2023 15:42:29 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306060101/ 404 KB
125 KB 46ms
45ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306060101/pubads_impl.js?cb=31075344

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0c384e9f5a0511e6e45bbaf26eba3f51edf331b05e20efa57f243d87ad4c452e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 18:36:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72375
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 127303
x-xss-protection: 0
server: cafe
etag: 14748094856067035890
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Thu, 13 Jun 2024 18:36:13 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 88 B
100 B 156ms
63ms XHR
application/json 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&ppc_eid=31075026

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bb21e3fde4bacb45fc038813bce8c6da58e3d3630e658f3a24ec9a8e6c885dd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75
x-xss-protection: 0
expires: Thu, 15 Jun 2023 14:42:28 GMT

GET
H2 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306080101/ 352 KB
118 KB 111ms
111ms Script
text/javascript 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306080101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ccd49ed7c444d095aad6a9a136955f70cf21a0140005c0f92eef6c39abf2dc55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:28 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 120767
x-xss-protection: 0
server: cafe
etag: 9963560553589208768
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:42:28 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230613/r20190131/ Frame C679 10 KB
5 KB 158ms
46ms Document
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230613/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 69413
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 14 Jun 2023 19:25:35 GMT
etag: 15057649708203361565
expires: Wed, 28 Jun 2023 19:25:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 172ms
63ms Script
application/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306060101/pubads_impl.js?cb=31075344

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
528 B 92ms
91ms XHR
text/plain 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3936331350408028&correlator=322906960437087&eid=31075026%2C31075344%2C31068367&output=ldjh&gdfp_req=1&vrg=202306060101&ptt=17&impl=fif&iu_parts=21635236099%2Cbookmp3.ru%2CM_Interstitial&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ifi=2&adks=218515113&sfv=1-0-40&ists=1&fas=8&sc=1&cookie_enabled=1&abxe=1&dt=1686840148976&lmt=1686840148&dlt=1686840146924&idt=1985&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=22385216.1686840149&ga_sid=1686840149&ga_hid=632164813&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306060101/pubads_impl.js?cb=31075344

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c53a5737c7a48a4a035d1af0c7c364922ae5c63eded7b95146e1116f6e5afc16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:29 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 498
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
dad5d4bc16389101446b988e3b9e0a4d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame EDC7 6 KB
3 KB 180ms
61ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://dad5d4bc16389101446b988e3b9e0a4d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306060101/pubads_impl.js?cb=31075344

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 15 Jun 2023 14:42:29 GMT
expires: Fri, 14 Jun 2024 14:42:29 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306060101/ 37 KB
13 KB 56ms
55ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306060101/pubads_impl_page_level_ads.js?cb=31075344

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306060101/pubads_impl.js?cb=31075344

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

95ac0261ac793f12426f513852780977bd0cf558e29fec5ab00c773a133f58d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 18:38:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72256
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13124
x-xss-protection: 0
server: cafe
etag: 18412689142917685927
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Thu, 13 Jun 2024 18:38:13 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 387 B
417 B 85ms
61ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&callback=_gfp_s_&client=ca-pub-1618592205083780

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306080101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d09b9cf5cae9b79ad02a0076919caebcfa94ea95bb8f3e2efac3c4c8d189f98e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 249
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7F11 32 KB
14 KB 262ms
259ms Document
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&h=178&slotname=2609168587&adk=1374432671&adf=4036610663&pi=t.ma~as.2609168587&w=710&fwrn=4&lmt=1686840149&rafmt=11&format=710x178&url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686840148783&bpp=5&bdt=1859&idt=262&shv=r20230613&mjsv=m202306080101&ptt=9&saldr=aa&abxe=1&correlator=1325168925188&frm=20&pv=2&ga_vid=22385216.1686840149&ga_sid=1686840149&ga_hid=632164813&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=295&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759875%2C44759926%2C42532277%2C44792109%2C42532279%2C31074583%2C31075068%2C44785295%2C44788441&oid=2&pvsid=3936331350408028&tmod=504077616&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=nNrCucJOQk&p=https%3A//www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&dtd=313

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306080101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0a8f9918ddcc17d14cd3afeb05e5e999cacb85523c3447db6107969bb275710d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 13611
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 15 Jun 2023 14:42:29 GMT
expires: Thu, 15 Jun 2023 14:42:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 a202de4ec1f676f61efc.js Show response
yastatic.net/partner-code-bundles/787310/ 9 KB
4 KB 155ms
154ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/787310/a202de4ec1f676f61efc.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

5b981fdc5a41fcfaa4fb2da3d69f61df024fb1202b82cce98506e8b31d917111

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:29 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 3558
last-modified: Wed, 14 Jun 2023 16:23:04 GMT
server: nginx/1.17.9
etag: "49418863b3893662cd836793549953e9"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sat, 14 Jun 2053 21:15:30 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 145ms
45ms Script
text/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::200e Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 15 Jun 2023 13:56:36 GMT
last-modified: Mon, 17 Apr 2023 22:36:01 GMT
server: Golfe2
age: 2753
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20737
expires: Thu, 15 Jun 2023 15:56:36 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 71ms
63ms Script
application/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306080101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 62ms
60ms Image
image/gif 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=DIV&cls=b-topbar&ign=false&pw=1600&ph=1200&x=800&y=0

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7C94 163 KB
28 KB 462ms
460ms Document
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&adk=1812271804&adf=3025194257&lmt=1686840149&plat=2%3A16777216%2C8%3A64%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=260x1080_l%7C260x1080_r&format=0x0&url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686840149232&bpp=5&bdt=2308&idt=5&shv=r20230613&mjsv=m202306080101&ptt=9&saldr=aa&abxe=1&cookie=ID%3De90c8a82ed80e392-22ece1c782e10032%3AT%3D1686840149%3ART%3D1686840149%3AS%3DALNI_Maxc8c3yYxsgwaZau_6WtOEy6gjWg&gpic=UID%3D00000c4f5f4a2d18%3AT%3D1686840149%3ART%3D1686840149%3AS%3DALNI_MYQ9ibWM8pFfDfMTvRFfCpzTNfdOg&prev_fmts=710x178&nras=1&correlator=1325168925188&frm=20&pv=1&ga_vid=22385216.1686840149&ga_sid=1686840149&ga_hid=632164813&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759875%2C44759926%2C42532277%2C44792109%2C42532279%2C31074583%2C31075068%2C44785295%2C44788441&oid=2&pvsid=3936331350408028&tmod=504077616&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=29

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306080101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cfe72a24bd8aec49791ed914f7f92b1b7c9598df4f19c0afb2a60a605b60fe2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 28901
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 15 Jun 2023 14:42:29 GMT
expires: Thu, 15 Jun 2023 14:42:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 7F11 0
0 70ms
69ms Fetch
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Ce9NmVSOLZMKXCZqpo9kPsbSV4Aicge-wXILzt52dAcCNtwEQASAAYMm2o4jwo-wSggEXY2EtcHViLTE2MTg1OTIyMDUwODM3ODDIAQmoAwGqBKUCT9Ck7oA95wU7M9cAjovM8JnCBwE2T3fBoPzWjPUds1yshy1wD7PWGknbGFcvC3M6WgK5j18V37ncl5MBSLSszp9GEKNCDOk_sn6kLBFf2RpY0TdlzCGV93yP_msBtVBRJeewdmK3DX7DhS2VQVq7tfT1U5kM6eEuLQU94KvUS5LMI96Z8xJDXMwnaY5TxZsD93xMu10e-NsmbAHz5NV5we_N9ZJZBwjBpfWpwVXUIuEvyGNY6VOJJHjOYllsANA4VYsMqjWvgEP7gQ96P_S3NjQaIKZYNn3jwnl81xDFarnd44ENXqXTMEcdZ8GWfNWqbt8cJSE2Qpp6P6XhHx1lHg6sqgrvnuQyyGiflDg5imkqDh-h1M2JlKylrWwW9I3hs8h74vSABsnH_frd-O6SF6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBAgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTE2MTg1OTIyMDUwODM3ODAYAA&sigh=MJQ2gOjB6JE&uach_m=[UACH]&cid=CAQSKQBygQiD8TUpRvJV3AS1yfnyFYT8dQim2uqu0k2do9hoaf1VZWeh4GcnGAE

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&h=178&slotname=2609168587&adk=1374432671&adf=4036610663&pi=t.ma~as.2609168587&w=710&fwrn=4&lmt=1686840149&rafmt=11&format=710x178&url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686840148783&bpp=5&bdt=1859&idt=262&shv=r20230613&mjsv=m202306080101&ptt=9&saldr=aa&abxe=1&correlator=1325168925188&frm=20&pv=2&ga_vid=22385216.1686840149&ga_sid=1686840149&ga_hid=632164813&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=295&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759875%2C44759926%2C42532277%2C44792109%2C42532279%2C31074583%2C31075068%2C44785295%2C44788441&oid=2&pvsid=3936331350408028&tmod=504077616&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=nNrCucJOQk&p=https%3A//www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&dtd=313

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&h=178&slotname=2609168587&adk=1374432671&adf=4036610663&pi=t.ma~as.2609168587&w=710&fwrn=4&lmt=1686840149&rafmt=11&format=710x178&url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686840148783&bpp=5&bdt=1859&idt=262&shv=r20230613&mjsv=m202306080101&ptt=9&saldr=aa&abxe=1&correlator=1325168925188&frm=20&pv=2&ga_vid=22385216.1686840149&ga_sid=1686840149&ga_hid=632164813&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=295&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759875%2C44759926%2C42532277%2C44792109%2C42532279%2C31074583%2C31075068%2C44785295%2C44788441&oid=2&pvsid=3936331350408028&tmod=504077616&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=nNrCucJOQk&p=https%3A//www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&dtd=313
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 15 Jun 2023 14:42:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.va.us.criteo.com/google/auction/ Frame 7F11 0
0 137ms
43ms Fetch 2620:100:a001::3
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.va.us.criteo.com/google/auction/notify?profile=14&payload=kOSJF836RMYFsgHiIp0XAgAAAIHwBbb3yQw3EFUji2QOKMrT86GeHIvpAAASAAAKCkFRVUJDZ0VCQ2c&wp=ZIsjVQACS8IFKNSaAAVaMeiczzPBXKy3BxDopQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::3 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:29 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 161223
server: Kestrel
content-length: 0

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame 10A3 105 KB
39 KB 159ms
61ms Document
text/html 2620:100:a001::24
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZIsjVQACS8IFKNSaAAVaMeiczzPBXKy3BxDopQ&u=%7CNrB6qWOMqpbLQFR4sy8DXL6D3zZfMl%2B%2FLZSZcAGcWMM%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-dbHERHVj9MQgFtTN83TUdVFZz6mvMC78rklu3251mk0_VW95qPKEIYdWIoLP2zI1lFdmyWX-EUluSDCMLOezK7T4oqb6sMRZp-JA9tpBj87IFJAoc8-H2uRnPws5WAaVkIgLN1G22iEXpIFbl548AuRLN9F_yOIpP6jr_FzDjwlrZzJfC7SKwlhHLECVq1JsH8eUj9GLX1_su-tRPhrDbFveeCLWCMKOK817EN-loC8jE7oDare_plKOQ-X6Qfcth4jNwvxGcdg3NOmuBfLRCP_RidQ4YSa6w6uLidRa2LKTI6kGFIFNu5lR_jddBVaCXtxnnyWmDkgNNSD0x0Yf4AI2UzFTcofl82VsfR2QzENEJ-doU4TVWu6hRLU7DDlIwuINx9d7H3H8IGyf127l-s2hUXtracw70Pmw0DyhGBv2JxbCr528rW6Kdrg-tEni5Z57vaiMQ3MEJYCVm2jAmKD60Nb45NoqFB8cEvLSzSPpNoBZT6979m0DhiY-j2fB5Qz7depGdmdkGtJem3a7d5o4oOBuPv0sanwhmqi6ckuIHHP8foaFiAqDu6W5IXpx27G6IlW8nG4jOP0jiuiKLw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCDYENVSOLZMKXCZqpo9kPsbSV4Aicge-wXILzt52dAcCNtwEQASAAYMm2o4jwo-wSggEXY2EtcHViLTE2MTg1OTIyMDUwODM3ODDIAQmoAwGqBKgCT9Ck7oA95wU7M9cAjovM8JnCBwE2T3fBoPzWjPUds1yshy1wD7PWGknbGFcvC3M6WgK5j18V37ncl5MBSLSszp9GEKNCDOk_sn6kLBFf2RpY0TdlzCGV93yP_msBtVBRJeewdmK3DX7DhS2VQVq7tfT1U5kM6eEuLQU94KvUS5LMI96Z8xJDXMwnaY5TxZsD93xMu10e-NsmbAHz5NV5we_N9ZJZBwjBpfWpwVXUIuEvyGNY6VOJJHjOYllsANA4VYsMqjWvgEP7gQ96P_S3NjQaIKZYNn3jwnl81xDFarnd44ENXqXTMEcdZ8GWfNWqbt8cJSE2Qpp6P6XhHx1lHkyuiphEbG0yC-HyGNNDA6qdMjeo-tVND1_fJKWo6qH5Gh7q4jdOBe6ABsnH_frd-O6SF6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3fzQjXq_NtU0Ai3IuZER2Eh9xU3w%26client%3Dca-pub-1618592205083780%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

00a7d2e7e17c9771efecd01f4d2a952d5f495ec47aa6f97ec2678efe661a7ef6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 15 Jun 2023 14:42:28 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=tmO6auEtjxjqvmNcSydAdGurHdqYnP4LJzs-PnC-LxLTNCxeX2fYUZN2KfKsINcy7iWTzyL5qnaR1mViHKZ8q5M2EDeCbd1XkiMlQh5SpWugngeGS1M55aIF7Es13IN80XpFz9dxN4LQJHfO2HrxCzCIJHOSa791TRxUmdWua35qmHZpRvg7fmlg60gYLhsduKLYilJzgQRm_Z346yvVmRUQtAIPKsyjB-LOFw-OmolgUKHDCmd_GPoVQj_kjdt4mbXuQQ"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 13408223
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230613/r20110914/client/ Frame 7F11 3 KB
1 KB 155ms
51ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230613/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:44:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 82655
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Jun 2023 15:44:54 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame F505 1 KB
643 B 46ms
45ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 78824
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 14 Jun 2023 16:48:45 GMT
etag: 48472445140208031
expires: Thu, 15 Jun 2023 16:48:45 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230613/r20110914/client/ Frame 7F11 19 KB
8 KB 148ms
46ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230613/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3521f5e84dbf85e9b7a304002330fbccf347abc9d0a43765a1838336b8a98c0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:44:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 82655
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8120
x-xss-protection: 0
server: cafe
etag: 8171891181101138299
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Jun 2023 15:44:54 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 7F11 0
0 165ms
63ms Image
text/html 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTbXBw5i5GQM_OZ5MIHLNgEz3Gtnk4H4SysJ7eO5NS4VsuuCJgoFrx0XcZvqTVx12M8XxjkZHWDPk2PI8RSaQXkAnspyg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&h=178&slotname=2609168587&adk=1374432671&adf=4036610663&pi=t.ma~as.2609168587&w=710&fwrn=4&lmt=1686840149&rafmt=11&format=710x178&url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686840148783&bpp=5&bdt=1859&idt=262&shv=r20230613&mjsv=m202306080101&ptt=9&saldr=aa&abxe=1&correlator=1325168925188&frm=20&pv=2&ga_vid=22385216.1686840149&ga_sid=1686840149&ga_hid=632164813&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=295&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759875%2C44759926%2C42532277%2C44792109%2C42532279%2C31074583%2C31075068%2C44785295%2C44788441&oid=2&pvsid=3936331350408028&tmod=504077616&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=nNrCucJOQk&p=https%3A//www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&dtd=313
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81e::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7F11 178 KB
56 KB 192ms
73ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57029
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1686742752845198"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:42:29 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
259 B 60ms
58ms XHR
text/plain 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j100&a=632164813&t=pageview&_s=1&dl=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&ul=en-us&de=UTF-8&dt=%D0%90%D1%83%D0%B4%D0%B8%D0%BE%D0%BA%D0%BD%D0%B8%D0%B3%D0%B8%20%D1%81%D0%BB%D1%83%D1%88%D0%B0%D1%82%D1%8C%20%D0%BE%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20%3A%3A%20bookmp3.ru&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IAhAAEABAAAAACAAI~&jid=1247276567&gjid=768347156&cid=22385216.1686840149&tid=UA-109514583-1&_gid=1693538489.1686840149&_r=1&_slc=1&z=1971495496

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::200e Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

bc4540a14193a6537e0c03127bbf19848e6226bd437f2550d18f1f385c55eccb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:29 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10035.p4hbpI9Cww9hvwVhmz_YL0aAV8n4JY1IJXZJFfAVg-LGi5NnzfBzf40x2iNTUGWW.rmuXsRObmcuxmFKUm-yHzjmdr2I%2C
https://mc.yandex.com/sync_cookie_image_decide?token=10035.bdKAt20dJ491NOiqAysXdvKN4vSUNF2hG3PVoTX0HYujbJ3EuOK9EZMzLOYoPLqzG7ks4KkaJSIxSx5YMcpzq9Oa6umJ14kgnBayPGCzbt856BLM1iNHpZIhwzBNVcHuYO-C_I7xXe...

43 B
483 B

172ms
172ms

Image
image/gif

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=10035.bdKAt20dJ491NOiqAysXdvKN4vSUNF2hG3PVoTX0HYujbJ3EuOK9EZMzLOYoPLqzG7ks4KkaJSIxSx5YMcpzq9Oa6umJ14kgnBayPGCzbt856BLM1iNHpZIhwzBNVcHuYO-C_I7xXeQNulT2qmN4-7wKphYbbRdE_H1BQwGwPb3A21Bz9bL_Ew5U_mGGkcuRcEHpBOpy6tt2qSNKhapwN4Q8xoVe8PrDZeqzZBlDb6c%2C.sNYNV-0PeFV2x7aGHlApZZB4FuA%2C

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:29 GMT
strict-transport-security: max-age=31536000
content-length: 43
x-xss-protection: 1; mode=block
content-type: image/gif

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=10035.bdKAt20dJ491NOiqAysXdvKN4vSUNF2hG3PVoTX0HYujbJ3EuOK9EZMzLOYoPLqzG7ks4KkaJSIxSx5YMcpzq9Oa6umJ14kgnBayPGCzbt856BLM1iNHpZIhwzBNVcHuYO-C_I7xXeQNulT2qmN4-7wKphYbbRdE_H1BQwGwPb3A21Bz9bL_Ew5U_mGGkcuRcEHpBOpy6tt2qSNKhapwN4Q8xoVe8PrDZeqzZBlDb6c%2C.sNYNV-0PeFV2x7aGHlApZZB4FuA%2C
date: Thu, 15 Jun 2023 14:42:29 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
114 B 164ms
163ms Image
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:29 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 08 Jun 2023 15:38:48 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "6481cbd8-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 43
expires: Thu, 15 Jun 2023 15:42:29 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 209 KB
76 KB 555ms
87ms Script
application/javascript 2607:f8b0:4006:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-XR25G8TDFM&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2008 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

15af8c5f6fd626f5aef15d32d6867911f0a084dfeef9d4f28e692505d5cabcc2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 77077
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 15 Jun 2023 14:42:30 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame F505
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEOnxv2TfQobZyTvC1ay-P-g&google_cver=1&google_push=ATf1kGPXPAR0kvnl_zPBRsREIVo7uScEbMyoplTTI-tPDncOjY2iFgPuhcFKk-D_XepZ2sg2Iv6fW97Sydc2gzN6ztSg0IjBkAdENw
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzE4OTIxNTQxMDMxNjU5MDM1MQ==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEMRzpWAkjJeAR7ZVdvVBVm0&google_cver=1

43 B
398 B

112ms
59ms

Image
image/gif

2620:112:f002:bbbb::21
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEMRzpWAkjJeAR7ZVdvVBVm0&google_cver=1
Requested by: Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Protocol: H2
Server: 2620:112:f002:bbbb::21 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 15 Jun 2023 14:42:29 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEMRzpWAkjJeAR7ZVdvVBVm0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET 5w3jqr4k
sync-tm.everesttech.net/upi/pid/ Frame F505 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F505
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEJdctEdGr4Qb6zCX-p5_mn0&google_cver=1&google_push=ATf1kGMAMC6Jpl0V6gRJY4wHL3T3FvV7m24dAsqRDJ6aGpiGXeIkJmKA-0YFovUBLS8x7do3wMlkCkZRlSzYUMufg2...
https://match.adsrvr.org/track/cmb/google?google_gid=CAESEJdctEdGr4Qb6zCX-p5_mn0&google_cver=1&google_push=ATf1kGMAMC6Jpl0V6gRJY4wHL3T3FvV7m24dAsqRDJ6aGpiGXeIkJmKA-0YFovUBLS8x7do3wMlkCkZRlSzYUMufg2...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OTBmOGVmMTUtNTYyMi00ZWVhLTk1MWItMGM3YjQ4NWYzZDkz&google_push&gdpr=0&gdpr_consent=&ttd_tdid=90f8ef15-5622-4eea-951b-0c7b485f3d93

170 B
188 B

63ms
63ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OTBmOGVmMTUtNTYyMi00ZWVhLTk1MWItMGM3YjQ4NWYzZDkz&google_push&gdpr=0&gdpr_consent=&ttd_tdid=90f8ef15-5622-4eea-951b-0c7b485f3d93

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:32 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OTBmOGVmMTUtNTYyMi00ZWVhLTk1MWItMGM3YjQ4NWYzZDkz&google_push&gdpr=0&gdpr_consent=&ttd_tdid=90f8ef15-5622-4eea-951b-0c7b485f3d93
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 423

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame F505 0
173 B 521ms
69ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEBsaxu_JyH5PXFzwZxmYD4w&google_cver=1&google_push=ATf1kGP2bu16amlWPmV0aO6-Ctb265WII9j9w9s3pMXt3UjWVQ8gRH4ph39roWoyBBnzXUwfK5rQ7MF1rTA5UHZZ_ymjqLiUucDvSUI
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&h=178&slotname=2609168587&adk=1374432671&adf=4036610663&pi=t.ma~as.2609168587&w=710&fwrn=4&lmt=1686840149&rafmt=11&format=710x178&url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686840148783&bpp=5&bdt=1859&idt=262&shv=r20230613&mjsv=m202306080101&ptt=9&saldr=aa&abxe=1&correlator=1325168925188&frm=20&pv=2&ga_vid=22385216.1686840149&ga_sid=1686840149&ga_hid=632164813&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=295&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759875%2C44759926%2C42532277%2C44792109%2C42532279%2C31074583%2C31075068%2C44785295%2C44788441&oid=2&pvsid=3936331350408028&tmod=504077616&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=nNrCucJOQk&p=https%3A//www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&dtd=313
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:29 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 204 CookieSyncAdX
rtb.adentifi.com/ Frame F505 0
35 B 539ms
60ms Image
text/plain 35.173.115.238
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESEHOtm9TOpjHSIN2KnTWuB0s&google_cver=1&google_push=ATf1kGPEnjYlOMLfSUjBlIHamYhNNdFy8sqbuxiycc0s-b3Uj0V87lzOfltd0t9fLncegSfMZH5r4f8msIj1eRC-_9rWQ-rJ1rfbNKo
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&h=178&slotname=2609168587&adk=1374432671&adf=4036610663&pi=t.ma~as.2609168587&w=710&fwrn=4&lmt=1686840149&rafmt=11&format=710x178&url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686840148783&bpp=5&bdt=1859&idt=262&shv=r20230613&mjsv=m202306080101&ptt=9&saldr=aa&abxe=1&correlator=1325168925188&frm=20&pv=2&ga_vid=22385216.1686840149&ga_sid=1686840149&ga_hid=632164813&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=295&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759875%2C44759926%2C42532277%2C44792109%2C42532279%2C31074583%2C31075068%2C44785295%2C44788441&oid=2&pvsid=3936331350408028&tmod=504077616&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=nNrCucJOQk&p=https%3A//www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&dtd=313
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.115.238 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-115-238.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame F505
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEMz3tKrdaauI8ohIMF-FHWc&google_cver=1&google_push=ATf1kGPslejF1WTf_1Tqspx1aTGVkthqvGRNV6kZW_o37vrWyjkKLzW-V6ryIlw6PVBwDHliz00yWKdTGSSkzJz...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=iWSX6l3eUnZn200VwtbtD6dYB6I&google_push=ATf1kGPslejF1WTf_1Tqspx1aTGVkthqvGRNV6kZW_o37vrWyjkKLzW-V6ryIlw6PVBwDHliz00yWKdTGSSkzJ...

170 B
232 B

64ms
63ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=iWSX6l3eUnZn200VwtbtD6dYB6I&google_push=ATf1kGPslejF1WTf_1Tqspx1aTGVkthqvGRNV6kZW_o37vrWyjkKLzW-V6ryIlw6PVBwDHliz00yWKdTGSSkzJzLA6GxjZdcpbIbK5s

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=iWSX6l3eUnZn200VwtbtD6dYB6I&google_push=ATf1kGPslejF1WTf_1Tqspx1aTGVkthqvGRNV6kZW_o37vrWyjkKLzW-V6ryIlw6PVBwDHliz00yWKdTGSSkzJzLA6GxjZdcpbIbK5s
Date: Thu, 15 Jun 2023 14:42:30 GMT
Connection: keep-alive
Content-Length: 245
Content-Type: text/html; charset=utf-8

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame F505
Redirect Chain

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESENe59YhTZ11pK7XytPY9yxQ&google_cver=1&google_push=ATf1kGMVcr1LVqx0ycUi2LWyjBI84401tTCuBoFRW9mYcNA0nh4tGRD6Hp48N6ADzZUow8VRsmj3ffVaQKeS9CX_FPzPwD7...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGMVcr1LVqx0ycUi2LWyjBI84401tTCuBoFRW9mYcNA0nh4tGRD6Hp48N6ADzZUow8VRsmj3ffVaQKeS9CX_FPzPwD758Tt9n4w&google_hm=NDk5NjM3...

170 B
243 B

69ms
68ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGMVcr1LVqx0ycUi2LWyjBI84401tTCuBoFRW9mYcNA0nh4tGRD6Hp48N6ADzZUow8VRsmj3ffVaQKeS9CX_FPzPwD758Tt9n4w&google_hm=NDk5NjM3MTY3ODEzNTA2MzAwMA==

Requested by

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGMVcr1LVqx0ycUi2LWyjBI84401tTCuBoFRW9mYcNA0nh4tGRD6Hp48N6ADzZUow8VRsmj3ffVaQKeS9CX_FPzPwD758Tt9n4w&google_hm=NDk5NjM3MTY3ODEzNTA2MzAwMA==
Date: Thu, 15 Jun 2023 14:42:29 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame F505 0
130 B 540ms
61ms Image
text/html 142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LDOZxAxIsAA3Ctpf0libgwwK6HLN0sTy6slsqVKN_O3kAiFQwLMBa2NaUQyXN6y4lankpDDA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame 7F11 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 241ea6d0d799b0e6d33ac6071f1f71166021ac71eedf37cfe791af11fa5476dd

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 10A3 2 KB
1 KB 465ms
47ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZIsjVQACS8IFKNSaAAVaMeiczzPBXKy3BxDopQ&u=%7CNrB6qWOMqpbLQFR4sy8DXL6D3zZfMl%2B%2FLZSZcAGcWMM%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-dbHERHVj9MQgFtTN83TUdVFZz6mvMC78rklu3251mk0_VW95qPKEIYdWIoLP2zI1lFdmyWX-EUluSDCMLOezK7T4oqb6sMRZp-JA9tpBj87IFJAoc8-H2uRnPws5WAaVkIgLN1G22iEXpIFbl548AuRLN9F_yOIpP6jr_FzDjwlrZzJfC7SKwlhHLECVq1JsH8eUj9GLX1_su-tRPhrDbFveeCLWCMKOK817EN-loC8jE7oDare_plKOQ-X6Qfcth4jNwvxGcdg3NOmuBfLRCP_RidQ4YSa6w6uLidRa2LKTI6kGFIFNu5lR_jddBVaCXtxnnyWmDkgNNSD0x0Yf4AI2UzFTcofl82VsfR2QzENEJ-doU4TVWu6hRLU7DDlIwuINx9d7H3H8IGyf127l-s2hUXtracw70Pmw0DyhGBv2JxbCr528rW6Kdrg-tEni5Z57vaiMQ3MEJYCVm2jAmKD60Nb45NoqFB8cEvLSzSPpNoBZT6979m0DhiY-j2fB5Qz7depGdmdkGtJem3a7d5o4oOBuPv0sanwhmqi6ckuIHHP8foaFiAqDu6W5IXpx27G6IlW8nG4jOP0jiuiKLw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCDYENVSOLZMKXCZqpo9kPsbSV4Aicge-wXILzt52dAcCNtwEQASAAYMm2o4jwo-wSggEXY2EtcHViLTE2MTg1OTIyMDUwODM3ODDIAQmoAwGqBKgCT9Ck7oA95wU7M9cAjovM8JnCBwE2T3fBoPzWjPUds1yshy1wD7PWGknbGFcvC3M6WgK5j18V37ncl5MBSLSszp9GEKNCDOk_sn6kLBFf2RpY0TdlzCGV93yP_msBtVBRJeewdmK3DX7DhS2VQVq7tfT1U5kM6eEuLQU94KvUS5LMI96Z8xJDXMwnaY5TxZsD93xMu10e-NsmbAHz5NV5we_N9ZJZBwjBpfWpwVXUIuEvyGNY6VOJJHjOYllsANA4VYsMqjWvgEP7gQ96P_S3NjQaIKZYNn3jwnl81xDFarnd44ENXqXTMEcdZ8GWfNWqbt8cJSE2Qpp6P6XhHx1lHkyuiphEbG0yC-HyGNNDA6qdMjeo-tVND1_fJKWo6qH5Gh7q4jdOBe6ABsnH_frd-O6SF6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3fzQjXq_NtU0Ai3IuZER2Eh9xU3w%26client%3Dca-pub-1618592205083780%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:29 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:29 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 10A3 2 KB
1 KB 504ms
86ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 10A3 308 B
636 B 476ms
59ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 10A3 293 B
621 B 467ms
49ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:29 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 09 Jun 2024 14:42:29 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame 10A3 43 B
348 B 461ms
55ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=YuXC76GCShzmOLQz9Dw8IboXfVQlNlxtw9g3VVvGe6yEA4H9hx6JhvaLlhuQhxkOPGpNfpHw59pqF9g8uEGJuc4m61pzhvsU3gBA-KVw-bLGu7cpZGbUw-fZrppmrcRTnIdFLB0jXumlrSjWxiJVjejBI94k2rn59t0mxqrPYT2rp-VOgNRsed4yKL3epGyyQ-qWvp6KkaSrM0wVz1rY2tLg2teNzBBJAx7NDxJxOSz3RzsrE_maccPyVxtR80LqeSP2vevygW6-gsO2apkimoFD8enJV_-tQAtrzoTovVOvVdYNI4SbQmFR427pxNf77SWukyRKAd1MNJIn2KP4zL24PFJlFOJ2BG2PYJ1GmgCATplPLF7UDEyjK9Xx6AuJbfRbXZxWa3tT_EE7e0GhNM23VYpuZfQcIs6LnJLDN_SozLJG

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:29 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2060827
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 10A3 12 KB
6 KB 404ms
58ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 10A3 27 KB
28 KB 394ms
102ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?h=352&m=0&partner=52383&q=80&r=0&u=http%3A%2F%2Fstatic.va.us.criteo.net%2Fdesign%2Fdt%2F52383%2F4774029%2Fd776ec11ea57494ba0020202cc6e56d5_black_logo_600.png&v=3&w=284&s=HBfvElW0S6jGqeYZrlSX19Qx

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

50e4c20b2a1596f5618dbccb3ad11d4f42f18066d9f89bfe7cb6b6b633a1afcb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:29 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 28037
expires: Sat, 01 Jun 2024 17:02:46 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame 10A3 0
128 B 355ms
50ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=tmO6auEtjxjqvmNcSydAdGurHdqYnP4LJzs-PnC-LxLTNCxeX2fYUZN2KfKsINcy7iWTzyL5qnaR1mViHKZ8q5M2EDeCbd1XkiMlQh5SpWugngeGS1M55aIF7Es13IN80XpFz9dxN4LQJHfO2HrxCzCIJHOSa791TRxUmdWua35qmHZpRvg7fmlg60gYLhsduKLYilJzgQRm_Z346yvVmRUQtAIPKsyjB-LOFw-OmolgUKHDCmd_GPoVQj_kjdt4mbXuQQ&sds=2&rev=87007&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 15 Jun 2023 14:42:29 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 10A3 2 KB
1 KB 362ms
59ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 10A3 2 KB
1 KB 45ms
44ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 getcookie Show response
matchid.adfox.yandex.ru/ 87 B
312 B 490ms
156ms XHR
application/json 2a02:6b8::16b
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://matchid.adfox.yandex.ru/getcookie

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/header-bidding.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a02:6b8::16b Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

e0d8a23d4a1a42084225802bf300a946e66215a6a2186e30437dcc7ddd724dd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
date: Thu, 15 Jun 2023 14:42:30 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
timing-allow-origin: *
content-length: 87
content-type: application/json

GET
H2 200 7c722f406003359d8bf4.js Show response
yastatic.net/partner-code-bundles/787310/ 30 KB
9 KB 158ms
157ms Script
text/javascript 2a02:6b8:20::215
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/787310/7c722f406003359d8bf4.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/header-bidding.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

dc4bf55610b9fa925d2960408f4d88cb4d9934e10854aea41296fa953e864e00

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:29 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 8556
last-modified: Wed, 14 Jun 2023 16:23:04 GMT
server: nginx/1.17.9
etag: "a08f246a600fa28d2dfe59825a941120"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Sat, 14 Jun 2053 21:17:35 GMT

POST
H2 200 adjson Show response
ads.betweendigital.com/ 11 B
948 B 300ms
69ms XHR
application/json 96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.betweendigital.com/adjson?t=adfox
Requested by: Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/header-bidding.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json

POST /
ad.mail.ru/hbid_yandex/ 0
0

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306080101/ 152 KB
52 KB 94ms
94ms Script
text/javascript 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306080101/reactive_library_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306080101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3d5ed64d6d4f56e89303854e8a3acf527b1d3b6b59c8970da831bb23df80ed43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52875
x-xss-protection: 0
server: cafe
etag: 7991725801023684120
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:42:30 GMT

GET
H2

200

1 Show response
mc.yandex.com/watch/42093449/
Redirect Chain

https://mc.yandex.com/watch/42093449?wmode=7&page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&nohit=1&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3A...
https://mc.yandex.com/watch/42093449/1?wmode=7&page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&nohit=1&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%...

439 B
475 B

163ms
162ms

XHR
application/json

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/42093449/1?wmode=7&page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&nohit=1&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A7sm39m606e08f3pmdzdgwin%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1060%3Acn%3A2%3Adp%3A1%3Als%3A1249469764033%3Ahid%3A189696770%3Az%3A0%3Ai%3A20230615144229%3Aet%3A1686840150%3Ac%3A1%3Arn%3A395925618%3Au%3A1686840149714077504%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1686840120672%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1686840150&t=gdpr%2814%2C14%29mc%28p-1%29clc%280-0-0%29lt%286500%29aw%281%29ti%282%29

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

eef8fa6be25456db9d35b5ce8f508da26be76b9f6164fe8bdf55a76b053ed920

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Thu, 15-Jun-2023 14:42:30 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 439
x-xss-protection: 1; mode=block
expires: Thu, 15-Jun-2023 14:42:30 GMT

Redirect headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 15-Jun-2023 14:42:30 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
location: /watch/42093449/1?wmode=7&page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&nohit=1&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A7sm39m606e08f3pmdzdgwin%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1060%3Acn%3A2%3Adp%3A1%3Als%3A1249469764033%3Ahid%3A189696770%3Az%3A0%3Ai%3A20230615144229%3Aet%3A1686840150%3Ac%3A1%3Arn%3A395925618%3Au%3A1686840149714077504%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1686840120672%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1686840150&t=gdpr%2814%2C14%29mc%28p-1%29clc%280-0-0%29lt%286500%29aw%281%29ti%282%29
access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Thu, 15-Jun-2023 14:42:30 GMT

GET
H2

200

1 Show response
mc.yandex.com/watch/46501593/
Redirect Chain

https://mc.yandex.com/watch/46501593?wmode=7&page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A7sm...
https://mc.yandex.com/watch/46501593/1?wmode=7&page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A7...

446 B
538 B

157ms
156ms

XHR
application/json

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/46501593/1?wmode=7&page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A7sm39m606e08f3pmdzdgwin%3Afp%3A27982%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1060%3Acn%3A1%3Adp%3A0%3Als%3A1530691519693%3Ahid%3A189696770%3Az%3A0%3Ai%3A20230615144229%3Aet%3A1686840149%3Ac%3A1%3Arn%3A265741673%3Arqn%3A1%3Au%3A1686840149714077504%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ads%3A39%2C128%2C25821%2C2%2C222%2C0%2C%2C2299%2C43%2C%2C%2C%2C28548%3Aco%3A0%3Acpf%3A1%3Ans%3A1686840120672%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1686840150%3At%3A%D0%90%D1%83%D0%B4%D0%B8%D0%BE%D0%BA%D0%BD%D0%B8%D0%B3%D0%B8%20%D1%81%D0%BB%D1%83%D1%88%D0%B0%D1%82%D1%8C%20%D0%BE%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20%3A%3A%20bookmp3.ru&t=gdpr%2814%29mc%28p-1%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

cb487b1dea588fcbde560a7eda87f48e20e6acf52f0b66e9c26e63f720d7d904

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Thu, 15-Jun-2023 14:42:30 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 446
x-xss-protection: 1; mode=block
expires: Thu, 15-Jun-2023 14:42:30 GMT

Redirect headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 15-Jun-2023 14:42:30 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
location: /watch/46501593/1?wmode=7&page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A7sm39m606e08f3pmdzdgwin%3Afp%3A27982%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1060%3Acn%3A1%3Adp%3A0%3Als%3A1530691519693%3Ahid%3A189696770%3Az%3A0%3Ai%3A20230615144229%3Aet%3A1686840149%3Ac%3A1%3Arn%3A265741673%3Arqn%3A1%3Au%3A1686840149714077504%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ads%3A39%2C128%2C25821%2C2%2C222%2C0%2C%2C2299%2C43%2C%2C%2C%2C28548%3Aco%3A0%3Acpf%3A1%3Ans%3A1686840120672%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1686840150%3At%3A%D0%90%D1%83%D0%B4%D0%B8%D0%BE%D0%BA%D0%BD%D0%B8%D0%B3%D0%B8%20%D1%81%D0%BB%D1%83%D1%88%D0%B0%D1%82%D1%8C%20%D0%BE%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20%3A%3A%20bookmp3.ru&t=gdpr%2814%29mc%28p-1%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29
access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Thu, 15-Jun-2023 14:42:30 GMT

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 70ms
69ms Script
application/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306080101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/ Frame DEC0 10 KB
4 KB 46ms
45ms Document
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306080101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 81488
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 14 Jun 2023 16:04:22 GMT
etag: 15057649708203361565
expires: Wed, 28 Jun 2023 16:04:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/ Frame 621A 10 KB
4 KB 46ms
45ms Document
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306080101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 81488
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 14 Jun 2023 16:04:22 GMT
etag: 15057649708203361565
expires: Wed, 28 Jun 2023 16:04:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/ Frame 2C9E 10 KB
4 KB 45ms
45ms Document
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306080101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 81488
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 14 Jun 2023 16:04:22 GMT
etag: 15057649708203361565
expires: Wed, 28 Jun 2023 16:04:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 61ms
60ms Ping
text/plain 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-XR25G8TDFM&gtm=45je36c0&_p=632164813&ul=en-us&sr=1600x1200&cid=22385216.1686840149&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EBA&ngs=1&_s=1&dl=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&dt=%D0%90%D1%83%D0%B4%D0%B8%D0%BE%D0%BA%D0%BD%D0%B8%D0%B3%D0%B8%20%D1%81%D0%BB%D1%83%D1%88%D0%B0%D1%82%D1%8C%20%D0%BE%D0%BD%D0%BB%D0%B0%D0%B9%D0%BD%20%D0%B1%D0%B5%D1%81%D0%BF%D0%BB%D0%B0%D1%82%D0%BD%D0%BE%20%3A%3A%20bookmp3.ru&sid=1686840150&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-XR25G8TDFM&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:824::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 v2 Show response
an.yandex.ru/adfox/264109/getBulk/ 211 B
255 B 201ms
200ms XHR
application/json 2a02:6b8::90
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/adfox/264109/getBulk/v2?pr=2744450886&pr1=1612055547&dl=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&prr=&extid_loader=MTY4Njg0MDE0OTcxNDA3NzUwNA%3D%3D&extid_tag_loader=www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&date=2023-06-15T14%3A42%3A30.283%2B00%3A00&pd=15&pw=4&pv=14&pdw=1600&pdh=1200&ylv=0.787310&ybv=0.787310&ytt=482685604855813&is-turbo=0&skip-token=&ad-session-id=4588291686840148554&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A9.7%2C%22supportHDRBrightness%22%3Afalse%2C%22isInIframe%22%3Afalse%2C%22w%22%3A300%2C%22h%22%3A0%2C%22width%22%3A300%2C%22height%22%3A0%2C%22visible%22%3A1%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A1015%2C%22top%22%3A107%2C%22darkTheme%22%3Afalse%2C%22req_no%22%3A1%2C%22ad_no%22%3A0%7D&enable-flat-highlight=1&pcode-version=787310&p1=cmaok&p2=gxvo&slotNumber=2&bids=W3siYmlkZGVyTmFtZSI6ImJldHdlZW5kaWdpdGFsIiwiY2FtcGFpZ25faWQiOjgxMjk1NywicmVzcG9uc2VfdGltZSI6MzE5LCJlcnJvciI6eyJjb2RlIjoxfSwicGxhY2VtZW50X2lkIjoiMzk0NTIxOCJ9LHsiYmlkZGVyTmFtZSI6Im15dGFyZ2V0IiwiY2FtcGFpZ25faWQiOjEwMzI3OTUsInJlc3BvbnNlX3RpbWUiOjUzNCwiZXJyb3IiOnsiY29kZSI6M30sInBsYWNlbWVudF9pZCI6IjgxNjAxNiJ9XQ%3D%3D&utf8=%E2%9C%93&duid=MTY4Njg0MDE0OTcxNDA3NzUwNA%3D%3D&pcode-test-ids=770116%2C0%2C75%3B781457%2C0%2C99%3B769344%2C0%2C5%3B764673%2C0%2C78%3B780962%2C0%2C96%3B780721%2C0%2C76%3B785564%2C0%2C25%3B783311%2C0%2C2%3B782716%2C0%2C24%3B785826%2C0%2C77%3B782173%2C0%2C32%3B788052%2C0%2C17&pcode-flags-map=eJy1Wdty2zgS%2FRc9TzK8glTeQBKUMCYJLgBa0UxNoZRY42jLVrYceyabVP59GyB1ISVBsuN9kWVKfdBAd58%2BDX0fXWOhxJTNFM5UgRNSqJxxRSuV4KoifPTuj%2B%2Bjvxd3T8vRu5HkDRn9MnpcfnmkN%2FA%2FQr4fRKMff%2F6yg6k5y5pUCsUqVeNGECtC5I4Dv0UgFU4KokjKyh1IQYXUzlzTjDD9Bj5NmMK87MEuv%2F5ngBr6oUHNqDCwKWsqqTjJKCephsR1bffMc4LA2%2B4NNqLKppCUs6IAtErqN4SrGZbplGRK0pIolueCSDuu7znR4MwkleAirjKVsGyuI1FjjksiAT8jOYZ1e5g5LkQfNIgCtAPlRPK5DkBF5IzxK0U4Z%2FZQRiEKovEWoQuGSDG8FvQK3jb8mswBcQYuCTqp7HDIifzoAO5nMApWTVRe4Ik%2Bs6bIFESwmCtxRev28K9x0ZzJtghFMerFVPsCEJUi14TPZ1PCz0FEQeBvISD06RXUzZw1UomCwQv9nUAYmyrDnBJxBix2A7e%2FQ%2FK%2BbncJNZASISg8gw%2Blel8WdrDYd4PocjCVzCEumRJzqKjXh8ZZpkraPk8LJqBEEo7Tq3NH8qJdpCwjquHFs7CFNEkJcReU9VMxioGVvL5t5LgtpTQVLRjOoDY1U%2BKyxyOPD0%2FLPbPAi%2F2x05pBtglhqHVgM6SvPSOgAkFIpVgiCNROv4aX68WHu2XP0kfeuN3hHOiEvFe8URkrMa1sC4ZO5PnoqJkCApWcJlZzz3VQ0Jlry9ZE4WKG58JqCcc8bgsgy2vgLVGzCs5J1zNUVM%2FUcxynbxs4frtqbeKfatNK2tcLAaY72ZzBPokO5WY9nWl28yCKvENzmmvOnumcgmC9BGHjwAGH%2Bc5x65pTxqmc6%2Fy%2FpmRWM27fOYpQl1Oblti1wlRwq%2BHYhWowhqaHQtrLeU2UbzcK4ijc22bJU3BT0IQW4LSlYMByHKGTlrqppQVNr86svsEwLbtVMgrqNqdAQ1RvIscpsWPEXtemWz86kFaISGaaNPB%2BApS2JwdskMjxAr%2BNnu46nOSQ71OguAlNrXZu7KNNBKqc8lIHnQN3dxRUc5LQzAoBFeq5vegDHXE8gXrpeljeFIVIuSYbIaxVgNyxGwT7mm2gzjrJAg9yWlFJQM2kV9C0rQmKgtBBqOeiKDGX6l8NaYgGP%2BdWiBAKt%2BwupxyU1cAzo4N0DtEKKo1mpmVbQSM36mIGUqgA0%2B7cca4rgeZapinTDuwBiOIxGm%2F7QA7SoMpAvbT2uiXU9s317ZMrozOECX9%2Fj3aUceBEW5SCQBIDglVLIxQHqE2dvRSZcDg80HBXktn9jlHg%2Bvu5shN%2FR5xXMyqn59Q9GnsobqlsYJ0XTHfkrNObdpBx3AX2FIg54R7GX6uv6n7xVX1arm4%2FPZ6A6%2FKkTTUQlNV%2BaVWgEE0RTxquFVGjZ5KU0Gt7%2BkSuE3R8yrlq2UM2vOrS0DCiyfhmMj0zbwFSm0cF%2Fn1uMleZ9rlv9n301%2FLx46dy8XC7Wo%2FeuSE0ofvPH1Z3S%2FFxcbda347eeT96qCGwpUHdr1mt25JCE6Qe4%2FYX%2BGN0v1jdvX14At%2F%2Bu1jfLL%2FC%2B19X94vb5Zfeo9vFvXly8225br%2B%2B%2BHv1%2BLl9e%2F9275%2Bb9ap7qpG3CPDgYfHt7vO3T93H3x7av08Pi7fr5T9fDr7w78Xn%2B5Ux%2FfP4FissIV6qJHyiXzOKlcQTq84BDvG6IjLlTyD2nOBUgvA8Yxj6jnfYhmhVA3nrPvTMJhT5yEfxScC9ItVT0YVIMPNuSd%2FAVE2ZnPEjdP2oLWJzS2AmcrAEbk5I2pKiafv2MgaYyGkLI6fvdYvQbX6YzwdWyHPctoN1s2QKjZCTbhA3Q7jmZOi0zyNYGA6dyN0HNqpfzgsyaQDlNVETxnUjYjAVQAo8GxL53QkM6W9HVpI16bRdC1SpJiup5RcrmD20esoOX46tv1%2FAGCJSXNvDeMlCXZP6qW3otMJZqaXaxNQHzXJ8hNRIlns48tAbl%2BTemyBI8ZskyZI3WYo9P44JQWHWZ5U4DMfHW9nwqEzn0HO0LhEYXbnuHL%2BBgD%2FTOaABB22VTjhOPJ0nIBYzcnYKhYk3cFtBtplOQGia66%2FdRVgnh4%2BMa9A0%2BvNaBAP0WbykyXNIalLWoPULWtIh6LMRr2tMs9f3UMfnxaiVvht9ZU9PYP5UfI5j%2Fv9O4KXRN3q%2FQ4aWCGOVqQ9YA6YloSecpoIJB9P%2BNVc4cDN2g3B3PYSl1I6I5yC6pwCfc7mdM6ZFHfSzM6WNxn43hxly4%2FoCOaUSBuXKOh9HKECRPzQ0qvRCsz6%2FHmh5OcGKl3WbIkacmt1fMgZGsTNG3k8sYj6%2FcIWjWNsloauCTEs5E%2BKCgWIPtgv2Zf6%2FuquHV0hWLzmpCZbGNa36Brl4NGQf1493Azej7nZhTz9uTJ%2BrTHZg%2BkIPBphUak1Qal1pLtc3V192lDDs7kwyAqeERTttQecXakboZNrf0sPy9ulu8XACYnAo%2Bvi1ijvxO8bH4en4vuv2cfaCV2hfYHYj5Zn08qIN251UCrqaU4nNL0nbn%2FO6uUDYfTxEH%2BAmdKKwAKUvTBQuRNtc5Uy1TD1xAzj6Z3Vzu3xUHxbr9XIYgthDuyve4QU4SBR%2FSLmxE%2Br8%2FvE%2Fyi59xg%3D%3D&use-server-side-rendering=1&pcode-icookie=GvkpUDaFV7UalN6MdiC7wROiKEb%2BarBw66WsLQrfO%2FFWFOIlL%2Fa3q7dAO9cVqAKhpHH%2Ft76SWkEb%2FZIlrMOiR1Y38uQ%3D&top-ancestor=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&top-ancestor-undetermined=0&grab-orig-len=2996&grab=eyJncmFiX3ZlcnNpb24iOjIsImlzX2FzeW5jIjoxLCJvbGRfZ3JhYl9zaXplIjoxNjB9ChKlMpHkuO1BBNbFw7QdcLvU5i_z6QT9hDWq53XclJ9tvPO4iY1c2zTAT9Omru_ncePYsYlitOlL26XrgLk_wb4I5JKCKswdb-uahpP9wy9_urGwTEVFBVQRVRUwbNArScNq0hY0SRMuGHaT9krWxJWkwm7ySlqJ-kIUNnGTN4wm7A1Cky0E9MtX0oUe9Dzv-jhGqFHR0UfkSC0NygIfp8Jssr6iuVogNTfIVdFkCydarmG94bbFafK-kFakbIEdjOS5l1yOu3FHStcgLqSgN_TpiVWAv53FlWC7kW7PhnlWyxqESvBG8gr7MMvwSgrS-wOxlRE0zGVdJRvxTfQCjRShRmswUqSZzmAMk1CbGkBHZo220seoScOsqzNNitiuS5VUUaIKk1ht71SxOkzVIWJ7w98-4kq0HMu62boAUc34wonPNP7in-YArTTps3MRfsr7ShBuYUHD6AtVsmLJ6HsDbrKJvf1WuGghgZ8SltUBSux5Oy9Fp4XN_xOgmJ7SU_GCkFe4W7iU3m7jZwbCFHj4caRTulgiB1c6GFE5qKtSjqK5qfj12gp16GMd8AajLkHQqbSZUonYrmfwS-16BvhRprLzQgpjlT6L-KTCTK9N-WSjGD6fPFWq1a40udaT1ybKcOW1icGYuSQZtIkaod0AQCAbpGU5erdYrUZbtvVcGMpCoO9BNrqrosJErgBok-y95Fx7qW5BSpELtPly31fvP5HDI_52CBo2cgVB9ShRIMRGruXOWI8SRBRPnlKVqQ0Nt8Lcl_zJQYVL_-L2yASVODfaRjxXEqaXbVtxAITqzampKWKtLo3sHKEkanUarUSaRZQJCJxEarJEzQPtV-NqU6SoqfeDrk6CDMaIYrtBEM9epIEznEuCuNjlcaiPQxeHgvwJRGtSNblLsDZBRTB1EqaaF1No1BN7KZ8eGjCCvxb6dJ_aSS_-SAeNnTiHMDf_KPXGb0A3oBoeWAET6uJF0Bpeg8YNvPkLZRxpuBiqXOqlovgXDgElqlDG0YQ4uCJfSTFEI4VFAPFnGTyxa5ZEBLeLv2SPhbeJKlaGSv5zFBbyiz1HC2BKQwkCNTVVjGAi1heZcRBLXVLEMdrdIjbUw1hj52-pD9WdX2xpyYN3cee-kiCfv8mXnWMJA8nncF3jwYL2cKIN2skD5kYq-mXuoqLC5eCffAXosjBDPm7ZKZNoSRGqWEuuUTvE6royjBI1Iruhb8yL7773BuimdVnO8XwoNAYoOSVlou4AyyhTh_3NNPnxIpTweRcg5rnA9lzQ5l5L2hQX656YtBIX3w3Lt_ClDYNFXgW5Eq1_ruiLP7-QdTiqwuEltyv-HZreAFuWLM59jMZxX6s5t1hys4l5I7beCOJpY6kEfXklvvVLutyt8bR2GtbaxGu8AneXvxLe_GSRAwHoEXibD9KZ-wQu2yXHURx-sDdgb6-MHTiN8DbLS_-bUmftrJbciiQ3Mckddj4G8lAq5q2KJrmdD8FXwcNaqhwlPoucB_ATaJtb0ZI4y3rs_Z98S3FE8OA-80v30vcD8DZCvzvriMgx0-a0zBOx80RQR2cs97WyQYXX5CzyKUAWdyfZehQNq69nIZmIlI0_5Ix8Wzz5hsMzc2Jo_XdI00B-7TeYE0W0ptxKw7wRW28EadTPwvHliK5O_fnv7zD2GzXrpwd_d1EYwSqqI5ZweXArjGMGAJlYk463IHkiHd8P4LooVWebUzMozt5jyumWDKJjvoed71kbWMQi5NF6XOA3OjGa6CjCeONHHN1f4UhVL9Cx42-GxEfNBmOHxkKXW0y5mfkt9hFMMrde_q6dGWQWIbquVFFMQfLDCwfx3JHLBP1a-yMu3scJGubmRHjr0GFHWmtOxzwVO08FZXtJCvKIcHQaC459955F_gT02J8E14TLiuNxlBhH-nvo4-nK3-ktSR74ztx_JGuEMn0n9v0J0BmgX7kPu2zJhWW-Lx8FPpw_hjUcfCA3xy9I2BvEir-nPIo2hsNDgphpVElErqGhoXGm00eSm0BhXoqtl8Ifu-Rr6Vui4H-yL3CvTPA3uD6iJvYX3uvNwaQvxoV8MbIRgz7-25KRLKLsXF94VKi4g2wvBnMPnltJD3U8eEwHGvU1Nq20zHOw9Ry4Y4TIRlskHDSh4HfBmSdIRjfwUajwCKms8h68NS5h_DtAHOGvwnNiT0KZ_zwgsHxU5gkRybjpYO5WW2lzkymnBevTcHOf6RAwoF2WT0KvjakQojhAV2WIEnUWxhH_2tiX-mCvzLf9kbcPLhhqW3h22WYeeToeeVoeeROPPBLuCTXf1pqb5e4BXJiCEHZeGAZ_46paYvdD0TKhk5alLNp-m7HPoq6S9CFlyIoLU4kH9v71rLxwBjFRVBDL_REdnBm3v7MMpN4AcXsho4hcTsUDZDmo-2NvsLWdZEfXfnzCG8NS5G3jBseGO49SlDF0Je4TcMTzxdlADjrn4sju4dPRN18cOhq2O_MyafeWToPyPl52Ydwj5MtWUrTp17P8Z2AwPs2BN4kteQ9m_Eja722WcdLJXJ78lUyWMRnpoB0SlWqXrTCmWNGHiie08ZejQc_F_jJxkif0ieWSmVeL-iiY3mhTGYwUZgPoH_wYbdv4L7_a-c4jeA8DcU-4SK4A7qNZxinXLmMe8aHB8ZHxiSrh4cfFPxUdhE-IbUIk1wuv4DG6fz3pvSOhT2syLwtS9415RzaV8EkoaST8mk262JfwKSpzpnFfiOmPn7g7eUwPyhOWm8WG0BpuA4J53YIezePQhKfS91_wAdCT_XFM2brheMt0nK0ee3YsWEc58b2I8j-404rMHeDnVOqvWYaSh5tfT3bCJShzpRfrlSmZs84SVFQKIyh9B85j4uxySsTDK0gVjH0SKSneeB8XVLIHnLCT-BaakItaUHv3_rHvsz8SAcA%3D&tga-with-creatives=1

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

cff0c1a96448090f545a7aa6bfc07c0cbfcdf51d370f0bd7cf72fe51e6a3ffe8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Thu, 15 Jun 2023 14:42:30 GMT
x-yandex-req-id: 1686840150369671-1742459732442669207200204-production-app-host-sas-pcode-525
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
content-type: application/json
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Thu, 15 Jun 2023 14:42:30 GMT

GET
H2 200 v2 Show response
an.yandex.ru/adfox/264109/getBulk/ 210 B
324 B 195ms
194ms XHR
application/json 2a02:6b8::90
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/adfox/264109/getBulk/v2?pr=2744450886&pr1=715588933&dl=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&prr=&extid_loader=MTY4Njg0MDE0OTcxNDA3NzUwNA%3D%3D&extid_tag_loader=www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&date=2023-06-15T14%3A42%3A30.287%2B00%3A00&pd=15&pw=4&pv=14&pdw=1600&pdh=1200&ylv=0.787310&ybv=0.787310&ytt=482685604986885&is-turbo=0&skip-token=&ad-session-id=4588291686840148554&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A9.7%2C%22supportHDRBrightness%22%3Afalse%2C%22isInIframe%22%3Afalse%2C%22w%22%3A300%2C%22h%22%3A0%2C%22width%22%3A300%2C%22height%22%3A0%2C%22visible%22%3A1%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A1015%2C%22top%22%3A107%2C%22darkTheme%22%3Afalse%2C%22req_no%22%3A2%2C%22ad_no%22%3A0%7D&enable-flat-highlight=1&pcode-version=787310&p1=cmaon&p2=gxvp&slotNumber=5&bids=W3siYmlkZGVyTmFtZSI6ImJldHdlZW5kaWdpdGFsIiwiY2FtcGFpZ25faWQiOjgxMjk1NywicmVzcG9uc2VfdGltZSI6MzE5LCJlcnJvciI6eyJjb2RlIjoxfSwicGxhY2VtZW50X2lkIjoiMzk0NTIxOSJ9LHsiYmlkZGVyTmFtZSI6Im15dGFyZ2V0IiwiY2FtcGFpZ25faWQiOjEwMzI3OTUsInJlc3BvbnNlX3RpbWUiOjUzNCwiZXJyb3IiOnsiY29kZSI6M30sInBsYWNlbWVudF9pZCI6IjgxNjAxOCJ9XQ%3D%3D&utf8=%E2%9C%93&duid=MTY4Njg0MDE0OTcxNDA3NzUwNA%3D%3D&pcode-test-ids=770116%2C0%2C75%3B781457%2C0%2C99%3B769344%2C0%2C5%3B764673%2C0%2C78%3B780962%2C0%2C96%3B780721%2C0%2C76%3B785564%2C0%2C25%3B783311%2C0%2C2%3B782716%2C0%2C24%3B785826%2C0%2C77%3B782173%2C0%2C32%3B788052%2C0%2C17&pcode-flags-map=eJy1Wdty2zgS%2FRc9TzK8glTeQBKUMCYJLgBa0UxNoZRY42jLVrYceyabVP59GyB1ISVBsuN9kWVKfdBAd58%2BDX0fXWOhxJTNFM5UgRNSqJxxRSuV4KoifPTuj%2B%2Bjvxd3T8vRu5HkDRn9MnpcfnmkN%2FA%2FQr4fRKMff%2F6yg6k5y5pUCsUqVeNGECtC5I4Dv0UgFU4KokjKyh1IQYXUzlzTjDD9Bj5NmMK87MEuv%2F5ngBr6oUHNqDCwKWsqqTjJKCephsR1bffMc4LA2%2B4NNqLKppCUs6IAtErqN4SrGZbplGRK0pIolueCSDuu7znR4MwkleAirjKVsGyuI1FjjksiAT8jOYZ1e5g5LkQfNIgCtAPlRPK5DkBF5IzxK0U4Z%2FZQRiEKovEWoQuGSDG8FvQK3jb8mswBcQYuCTqp7HDIifzoAO5nMApWTVRe4Ik%2Bs6bIFESwmCtxRev28K9x0ZzJtghFMerFVPsCEJUi14TPZ1PCz0FEQeBvISD06RXUzZw1UomCwQv9nUAYmyrDnBJxBix2A7e%2FQ%2FK%2BbncJNZASISg8gw%2Blel8WdrDYd4PocjCVzCEumRJzqKjXh8ZZpkraPk8LJqBEEo7Tq3NH8qJdpCwjquHFs7CFNEkJcReU9VMxioGVvL5t5LgtpTQVLRjOoDY1U%2BKyxyOPD0%2FLPbPAi%2F2x05pBtglhqHVgM6SvPSOgAkFIpVgiCNROv4aX68WHu2XP0kfeuN3hHOiEvFe8URkrMa1sC4ZO5PnoqJkCApWcJlZzz3VQ0Jlry9ZE4WKG58JqCcc8bgsgy2vgLVGzCs5J1zNUVM%2FUcxynbxs4frtqbeKfatNK2tcLAaY72ZzBPokO5WY9nWl28yCKvENzmmvOnumcgmC9BGHjwAGH%2Bc5x65pTxqmc6%2Fy%2FpmRWM27fOYpQl1Oblti1wlRwq%2BHYhWowhqaHQtrLeU2UbzcK4ijc22bJU3BT0IQW4LSlYMByHKGTlrqppQVNr86svsEwLbtVMgrqNqdAQ1RvIscpsWPEXtemWz86kFaISGaaNPB%2BApS2JwdskMjxAr%2BNnu46nOSQ71OguAlNrXZu7KNNBKqc8lIHnQN3dxRUc5LQzAoBFeq5vegDHXE8gXrpeljeFIVIuSYbIaxVgNyxGwT7mm2gzjrJAg9yWlFJQM2kV9C0rQmKgtBBqOeiKDGX6l8NaYgGP%2BdWiBAKt%2BwupxyU1cAzo4N0DtEKKo1mpmVbQSM36mIGUqgA0%2B7cca4rgeZapinTDuwBiOIxGm%2F7QA7SoMpAvbT2uiXU9s317ZMrozOECX9%2Fj3aUceBEW5SCQBIDglVLIxQHqE2dvRSZcDg80HBXktn9jlHg%2Bvu5shN%2FR5xXMyqn59Q9GnsobqlsYJ0XTHfkrNObdpBx3AX2FIg54R7GX6uv6n7xVX1arm4%2FPZ6A6%2FKkTTUQlNV%2BaVWgEE0RTxquFVGjZ5KU0Gt7%2BkSuE3R8yrlq2UM2vOrS0DCiyfhmMj0zbwFSm0cF%2Fn1uMleZ9rlv9n301%2FLx46dy8XC7Wo%2FeuSE0ofvPH1Z3S%2FFxcbda347eeT96qCGwpUHdr1mt25JCE6Qe4%2FYX%2BGN0v1jdvX14At%2F%2Bu1jfLL%2FC%2B19X94vb5Zfeo9vFvXly8225br%2B%2B%2BHv1%2BLl9e%2F9275%2Bb9ap7qpG3CPDgYfHt7vO3T93H3x7av08Pi7fr5T9fDr7w78Xn%2B5Ux%2FfP4FissIV6qJHyiXzOKlcQTq84BDvG6IjLlTyD2nOBUgvA8Yxj6jnfYhmhVA3nrPvTMJhT5yEfxScC9ItVT0YVIMPNuSd%2FAVE2ZnPEjdP2oLWJzS2AmcrAEbk5I2pKiafv2MgaYyGkLI6fvdYvQbX6YzwdWyHPctoN1s2QKjZCTbhA3Q7jmZOi0zyNYGA6dyN0HNqpfzgsyaQDlNVETxnUjYjAVQAo8GxL53QkM6W9HVpI16bRdC1SpJiup5RcrmD20esoOX46tv1%2FAGCJSXNvDeMlCXZP6qW3otMJZqaXaxNQHzXJ8hNRIlns48tAbl%2BTemyBI8ZskyZI3WYo9P44JQWHWZ5U4DMfHW9nwqEzn0HO0LhEYXbnuHL%2BBgD%2FTOaABB22VTjhOPJ0nIBYzcnYKhYk3cFtBtplOQGia66%2FdRVgnh4%2BMa9A0%2BvNaBAP0WbykyXNIalLWoPULWtIh6LMRr2tMs9f3UMfnxaiVvht9ZU9PYP5UfI5j%2Fv9O4KXRN3q%2FQ4aWCGOVqQ9YA6YloSecpoIJB9P%2BNVc4cDN2g3B3PYSl1I6I5yC6pwCfc7mdM6ZFHfSzM6WNxn43hxly4%2FoCOaUSBuXKOh9HKECRPzQ0qvRCsz6%2FHmh5OcGKl3WbIkacmt1fMgZGsTNG3k8sYj6%2FcIWjWNsloauCTEs5E%2BKCgWIPtgv2Zf6%2FuquHV0hWLzmpCZbGNa36Brl4NGQf1493Azej7nZhTz9uTJ%2BrTHZg%2BkIPBphUak1Qal1pLtc3V192lDDs7kwyAqeERTttQecXakboZNrf0sPy9ulu8XACYnAo%2Bvi1ijvxO8bH4en4vuv2cfaCV2hfYHYj5Zn08qIN251UCrqaU4nNL0nbn%2FO6uUDYfTxEH%2BAmdKKwAKUvTBQuRNtc5Uy1TD1xAzj6Z3Vzu3xUHxbr9XIYgthDuyve4QU4SBR%2FSLmxE%2Br8%2FvE%2Fyi59xg%3D%3D&use-server-side-rendering=1&pcode-icookie=GvkpUDaFV7UalN6MdiC7wROiKEb%2BarBw66WsLQrfO%2FFWFOIlL%2Fa3q7dAO9cVqAKhpHH%2Ft76SWkEb%2FZIlrMOiR1Y38uQ%3D&top-ancestor=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&top-ancestor-undetermined=0&grab-orig-len=2996&grab=eyJncmFiX3ZlcnNpb24iOjIsImlzX2FzeW5jIjoxLCJvbGRfZ3JhYl9zaXplIjoxNjB9ChKlMpHkuO1BBNbFw7QdcLvU5i_z6QT9hDWq53XclJ9tvPO4iY1c2zTAT9Omru_ncePYsYlitOlL26XrgLk_wb4I5JKCKswdb-uahpP9wy9_urGwTEVFBVQRVRUwbNArScNq0hY0SRMuGHaT9krWxJWkwm7ySlqJ-kIUNnGTN4wm7A1Cky0E9MtX0oUe9Dzv-jhGqFHR0UfkSC0NygIfp8Jssr6iuVogNTfIVdFkCydarmG94bbFafK-kFakbIEdjOS5l1yOu3FHStcgLqSgN_TpiVWAv53FlWC7kW7PhnlWyxqESvBG8gr7MMvwSgrS-wOxlRE0zGVdJRvxTfQCjRShRmswUqSZzmAMk1CbGkBHZo220seoScOsqzNNitiuS5VUUaIKk1ht71SxOkzVIWJ7w98-4kq0HMu62boAUc34wonPNP7in-YArTTps3MRfsr7ShBuYUHD6AtVsmLJ6HsDbrKJvf1WuGghgZ8SltUBSux5Oy9Fp4XN_xOgmJ7SU_GCkFe4W7iU3m7jZwbCFHj4caRTulgiB1c6GFE5qKtSjqK5qfj12gp16GMd8AajLkHQqbSZUonYrmfwS-16BvhRprLzQgpjlT6L-KTCTK9N-WSjGD6fPFWq1a40udaT1ybKcOW1icGYuSQZtIkaod0AQCAbpGU5erdYrUZbtvVcGMpCoO9BNrqrosJErgBok-y95Fx7qW5BSpELtPly31fvP5HDI_52CBo2cgVB9ShRIMRGruXOWI8SRBRPnlKVqQ0Nt8Lcl_zJQYVL_-L2yASVODfaRjxXEqaXbVtxAITqzampKWKtLo3sHKEkanUarUSaRZQJCJxEarJEzQPtV-NqU6SoqfeDrk6CDMaIYrtBEM9epIEznEuCuNjlcaiPQxeHgvwJRGtSNblLsDZBRTB1EqaaF1No1BN7KZ8eGjCCvxb6dJ_aSS_-SAeNnTiHMDf_KPXGb0A3oBoeWAET6uJF0Bpeg8YNvPkLZRxpuBiqXOqlovgXDgElqlDG0YQ4uCJfSTFEI4VFAPFnGTyxa5ZEBLeLv2SPhbeJKlaGSv5zFBbyiz1HC2BKQwkCNTVVjGAi1heZcRBLXVLEMdrdIjbUw1hj52-pD9WdX2xpyYN3cee-kiCfv8mXnWMJA8nncF3jwYL2cKIN2skD5kYq-mXuoqLC5eCffAXosjBDPm7ZKZNoSRGqWEuuUTvE6royjBI1Iruhb8yL7773BuimdVnO8XwoNAYoOSVlou4AyyhTh_3NNPnxIpTweRcg5rnA9lzQ5l5L2hQX656YtBIX3w3Lt_ClDYNFXgW5Eq1_ruiLP7-QdTiqwuEltyv-HZreAFuWLM59jMZxX6s5t1hys4l5I7beCOJpY6kEfXklvvVLutyt8bR2GtbaxGu8AneXvxLe_GSRAwHoEXibD9KZ-wQu2yXHURx-sDdgb6-MHTiN8DbLS_-bUmftrJbciiQ3Mckddj4G8lAq5q2KJrmdD8FXwcNaqhwlPoucB_ATaJtb0ZI4y3rs_Z98S3FE8OA-80v30vcD8DZCvzvriMgx0-a0zBOx80RQR2cs97WyQYXX5CzyKUAWdyfZehQNq69nIZmIlI0_5Ix8Wzz5hsMzc2Jo_XdI00B-7TeYE0W0ptxKw7wRW28EadTPwvHliK5O_fnv7zD2GzXrpwd_d1EYwSqqI5ZweXArjGMGAJlYk463IHkiHd8P4LooVWebUzMozt5jyumWDKJjvoed71kbWMQi5NF6XOA3OjGa6CjCeONHHN1f4UhVL9Cx42-GxEfNBmOHxkKXW0y5mfkt9hFMMrde_q6dGWQWIbquVFFMQfLDCwfx3JHLBP1a-yMu3scJGubmRHjr0GFHWmtOxzwVO08FZXtJCvKIcHQaC459955F_gT02J8E14TLiuNxlBhH-nvo4-nK3-ktSR74ztx_JGuEMn0n9v0J0BmgX7kPu2zJhWW-Lx8FPpw_hjUcfCA3xy9I2BvEir-nPIo2hsNDgphpVElErqGhoXGm00eSm0BhXoqtl8Ifu-Rr6Vui4H-yL3CvTPA3uD6iJvYX3uvNwaQvxoV8MbIRgz7-25KRLKLsXF94VKi4g2wvBnMPnltJD3U8eEwHGvU1Nq20zHOw9Ry4Y4TIRlskHDSh4HfBmSdIRjfwUajwCKms8h68NS5h_DtAHOGvwnNiT0KZ_zwgsHxU5gkRybjpYO5WW2lzkymnBevTcHOf6RAwoF2WT0KvjakQojhAV2WIEnUWxhH_2tiX-mCvzLf9kbcPLhhqW3h22WYeeToeeVoeeROPPBLuCTXf1pqb5e4BXJiCEHZeGAZ_46paYvdD0TKhk5alLNp-m7HPoq6S9CFlyIoLU4kH9v71rLxwBjFRVBDL_REdnBm3v7MMpN4AcXsho4hcTsUDZDmo-2NvsLWdZEfXfnzCG8NS5G3jBseGO49SlDF0Je4TcMTzxdlADjrn4sju4dPRN18cOhq2O_MyafeWToPyPl52Ydwj5MtWUrTp17P8Z2AwPs2BN4kteQ9m_Eja722WcdLJXJ78lUyWMRnpoB0SlWqXrTCmWNGHiie08ZejQc_F_jJxkif0ieWSmVeL-iiY3mhTGYwUZgPoH_wYbdv4L7_a-c4jeA8DcU-4SK4A7qNZxinXLmMe8aHB8ZHxiSrh4cfFPxUdhE-IbUIk1wuv4DG6fz3pvSOhT2syLwtS9415RzaV8EkoaST8mk262JfwKSpzpnFfiOmPn7g7eUwPyhOWm8WG0BpuA4J53YIezePQhKfS91_wAdCT_XFM2brheMt0nK0ee3YsWEc58b2I8j-404rMHeDnVOqvWYaSh5tfT3bCJShzpRfrlSmZs84SVFQKIyh9B85j4uxySsTDK0gVjH0SKSneeB8XVLIHnLCT-BaakItaUHv3_rHvsz8SAcA%3D&tga-with-creatives=1

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

bd6c0a1e26482503724c59cdcad0389c7b946cb5d9c4a96f327274803811ffda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Thu, 15 Jun 2023 14:42:30 GMT
x-yandex-req-id: 1686840150370067-329382922954932739200265-production-app-host-vla-pcode-434
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
content-type: application/json
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Thu, 15 Jun 2023 14:42:30 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame DEC0 0
0 72ms
71ms Fetch
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CQrldVSOLZI2GE4WuqMwP7PGBkAWcge-wXLKaqap0wI23ARABIABgybajiPCj7BKCARdjYS1wdWItMTYxODU5MjIwNTA4Mzc4MMgBCagDAaoEoAJP0AGiPH2lcwKIlR-gEAVV_uRwGzq-3Nf234CJSELMAVU4O3CqiWBjyyE0pr3J7c6J0qjU66Kq5lOcRmNfj-SP7GN-3id7Y-uVTEBODEcUM_tTlFckgwS4S8N8oVjhc1nBk86c9rbDjadUYlZi6C1Zrt99xVZMmRwqf_igy9TPP6oaGBIqggDI-OU7Zdp7RoZwe7Zsd-Wf0MhF7fr17YvaslBoZxuNDsC-eBmTVdqcBArHb_aD9B5KYvE_Yalsm5Nm-mt1HCQF1ZrE1EA0XPYS7i0q2SxpfvLnITjW61cxFCI_OKoR3e4-CazrDx4tQZrtDqLDIWhGSYHR6H1hzidkwBLC0fxost7zbGmBetFXhph_baETxdoJ8ggUAUTZTGiABsnH_frd-O6SF6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBAgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTE2MTg1OTIyMDUwODM3ODAYAA&sigh=VZKubfKMUvQ&uach_m=[UACH]&cid=CAQSPABygQiDX8o3E6tbJ4CyBuJE_M1Ea4Vt0QUZPim227Guxp4Ox81fsLnROTblOU00aE9WKwI1g1FZqPjHaBgB

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 15 Jun 2023 14:42:30 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.da.us.criteo.com/google/auction/ Frame DEC0 0
0 410ms
51ms Fetch 2620:100:a005::14
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.da.us.criteo.com/google/auction/notify?profile=14&payload=kOSJF836RO0HfOIinRcCAAAA7heiWihsFucQVSOLZPaciRTgEagO_PIAABIAAAoKQVFVQkRBRUJEQQ&wp=ZIsjVQAEww0DihcFAAB47OhtAtnzaJc_8MuqvA

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a005::14 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 212139
server: Kestrel
content-length: 0

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame 9744 104 KB
39 KB 71ms
71ms Document
text/html 2620:100:a001::24
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZIsjVQAEww0DihcFAAB47OhtAtnzaJc_8MuqvA&u=%7CNrB6qWOMqpbgo1HE3WCoBmLKDVyRgcYI%2FFrnFWRrIU0%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-dbHERHVj9MQgFtTN83TUdVFZz6mvMC78rklu3251mk0_VW95qPKEIXKMcagyaaUrwsatiHQNdVi49B9893ZFljTdwwSr-eINSmFwnMVbNdmoDkSxy48eLh6UHBch-rTZitK7nr07Y3KkwTX0OP_uYtsckZtYZtN9kuCJY-XRnVdNmI4iENPXqvDHhLO0TSFpSo-IZNRpwObpCSAKIOHG9cJU8t0XMqx5kkqD8lrjnU3MpiCQiLQ2aVUS-KRb3w4m9biRUT3vC9KPlBPvpHkAc65e0kbeOZraH236UgkWEWfzWQ1_dSexEK-y_qX66gH6i5m7n1J82Jo670dgNtJw8fDmY2UyAhFCRj-HxgQ8bRlDOOtQ-927tvDNwieOOq4hdx7cEfbm9TH5_64zqZOs0llUqvykGab5lAWABei_VpKIYFGa0gSuOtJRJ_Ks1k5YW8c_EvSinKy8TmmfZ8Tazr5UOAAHg2O0bgiju6bWh8NTJb-AhtibjDExL-dbqwQwLMukFj-xjrYdi7W4oqTSJTdqYFsBIJgpd2QkXFQY0Ii0Z2zBuSboUNg8qqle7nQiy6VsJawop-b3CSCJ4SVjlg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCa-HjVSOLZI2GE4WuqMwP7PGBkAWcge-wXLKaqap0wI23ARABIABgybajiPCj7BKCARdjYS1wdWItMTYxODU5MjIwNTA4Mzc4MMgBCagDAaoEowJP0AGiPH2lcwKIlR-gEAVV_uRwGzq-3Nf234CJSELMAVU4O3CqiWBjyyE0pr3J7c6J0qjU66Kq5lOcRmNfj-SP7GN-3id7Y-uVTEBODEcUM_tTlFckgwS4S8N8oVjhc1nBk86c9rbDjadUYlZi6C1Zrt99xVZMmRwqf_igy9TPP6oaGBIqggDI-OU7Zdp7RoZwe7Zsd-Wf0MhF7fr17YvaslBoZxuNDsC-eBmTVdqcBArHb_aD9B5KYvE_Yalsm5Nm-mt1HCQF1ZrE1EA0XPYS7i0q2SxpfvLnITjW61cxFCI_OKoR3e4-CazrDx4tQZrtDqLDIWhGSYHR6D9j7rXPMpvCEnUFPjWJ5ao2RvleqIC79lJpTBO37CQMqJJITKvHbsyABsnH_frd-O6SF6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0D0GIxXcMoMVyQVUFF3Fw1OzbujA%26client%3Dca-pub-1618592205083780%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

930f35a5eafccc0461464e55d2fa2915e83b87e884dfca96494b277ddfc08257

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 15 Jun 2023 14:42:30 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=2BKNseEtjxjqvmNc_ljK6fXOeGftAHlGYQ7cj3Gi24vLSL9G3KQy9G8Glsau9jYO3MQjKUHYhLULeMPVZJIg16yzMQGPyD5VScS-st1L5zyVH4qrMPRU3iyL_nbjgUCE52zfekhRXR8RKh8_DsT-92iSdG5QB8IdZDTUtTsYE8feub3jNxNTvfJ3nkANwZlGN4XDZ3Z1Tr_XdpL1H7XVlwi9Mh9pysBo8pptOzwg8pF0KGpa0W3dRHdXZq8hniZJbmFLkA"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 15490040
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230613/r20110914/client/ Frame DEC0 3 KB
1 KB 46ms
45ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230613/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:44:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 82656
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Jun 2023 15:44:54 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C3BD 1 KB
643 B 47ms
44ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 78825
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 14 Jun 2023 16:48:45 GMT
etag: 48472445140208031
expires: Thu, 15 Jun 2023 16:48:45 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230613/r20110914/client/ Frame DEC0 19 KB
8 KB 46ms
45ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230613/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3521f5e84dbf85e9b7a304002330fbccf347abc9d0a43765a1838336b8a98c0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:44:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 82656
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8120
x-xss-protection: 0
server: cafe
etag: 8171891181101138299
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Jun 2023 15:44:54 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame DEC0 0
0 70ms
66ms Image
text/html 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT6rgHfraYA0yR0RUvK9pVv_kVQlDY5xSs4yO9EwHpTV-bEtsz3qrnKaqgERvhZX8hh8Lir6Vo445fxFOcnf-s9hZBEZg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81e::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DEC0 178 KB
56 KB 85ms
82ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57029
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1686742752845198"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:42:30 GMT

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame D6BC 115 KB
41 KB 71ms
71ms Document
text/html 2620:100:a001::24
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZIsjVQAEww4DihcFAAB47ISTA6b2r1EU0fx3FQ&u=%7CNrB6qWOMqpYBr1T1VZtM9IrErM51vpupZGu96brEPbs%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-pdBd4Yn-iAyg0RfPc5NXLXF37ShTWqW301lTwe_4Te2RkftdHPyuUKUKX8cibUu9QY22lctH8HR4VEp1DsbOwrqKY6RG3quH0OiZI8kjhArS-2fNndIOS2pwvWQa9TZ4v3kGNb7DZ7Said2OH5qg64HRKWuQZaJQc5Vqh_HS_9Fj85ToYLNdG6Keg9Q2f6I-n6LUhuoK_QaO48Vefe00EqmMlNKfPH7x1BCSVgMAqwxMGdQ4Z-Y3Av0j82s6wuo47EnIDYgjsOwZOZsgcAU6cOHYdq8IvVFOfXygtBq4ea4QlUpmS7hgUaBwJ1e3RceNA7F40xlPxfb_klG4IMZToergJA1vdQoHXNor352JztDP7Xb47oZgC2rXaLvbZnjRCD9XeJ7CJEwYGA3QjpG5XE-HpT4PZDIQegPyS-ekuBdzLvfkpbbedLck3mAux_7eq2rOVODzlDPosTUwU15Ho4jUzNkjF7yjMRePyxBfVwc-Jnj8tM2mTFx-_yCyLjLW1A5A_47hQYzZJNlIWKRnX6clG1wyLL6vSeVapNHMyH728cOPpnzMlvSlCUZXwdOayWIkC4HDC1oQk3fYozFkeA&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCW4_lVSOLZI6GE4WuqMwP7PGBkAWcge-wXLKaqap0wI23ARABIABgybajiPCj7BKCARdjYS1wdWItMTYxODU5MjIwNTA4Mzc4MMgBCagDAaoEowJP0FUvbZORgOslr2EHitJFFqiiYo_3RGfrnWfxypNTo9q6n7eeByc90p_h67urHkUUPRgS66WXxX1omXDtOp0EjNpWFtKjwxqzrmEmE-tKdy-hKjnoxnObH-Sqm0YCMd_hpK4aFeC_Oq13DeBHTJJSn6hGXlfT2etFXaRdN0_22uvsWH2WRsAd34Tef6c8C-CcyEa_6seRbDyJ_Y40UCdWpEdqh2MktsaDz4nR5ehtTJ5hVQpwOQUjlku5TELbJh0qYDEh0I-SuEvjqUhS7agEPeStEuINgUTaqGgBqUjBxFEWEfeU-R3FImkHvqLNDqGLhmnc2-uyuHbRI3sK0AYpWXFwVJdPbByXCNFUEtfsVEhUsR6UsOx7mIv6c4F0Kb6rDheABsnH_frd-O6SF6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1L4y7T_B1GqyKGeOKPyWO7acp4GQ%26client%3Dca-pub-1618592205083780%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

35885fc384e841d5ad9f0bf15c68cddff795555c9fe5606ea0bdf5987b1b6889

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 15 Jun 2023 14:42:30 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=WxSaKuEtjxjqvmNchnrHr8jFUv6fTEbsAbyEPn8ulPVFm_zdjtIS-URaa2dO2d_bwnFwSkMa-iByeYlykvaOTlX3UUjAgBxZUZjsDjpBhxSUK9i0fNCIkbLeUZkOkEZWgXFn8BqcWOLmaF0QV4xcBec9ReepRvkqmMk5IP9oF9FmQ1l_tZCWx_5IzWHZf5ETskzX9sQjAnhe2PpRgQeSYJioVR522BwQamavauZ7VtgnYVRPYU5VZIH-cDHQyM0SlUGBBw"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 14821051
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230613/r20110914/client/ Frame 621A 3 KB
1 KB 46ms
45ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230613/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:44:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 82656
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Jun 2023 15:44:54 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0420 1 KB
643 B 46ms
45ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 78825
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 14 Jun 2023 16:48:45 GMT
etag: 48472445140208031
expires: Thu, 15 Jun 2023 16:48:45 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230613/r20110914/client/ Frame 621A 19 KB
8 KB 45ms
45ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230613/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3521f5e84dbf85e9b7a304002330fbccf347abc9d0a43765a1838336b8a98c0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:44:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 82656
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8120
x-xss-protection: 0
server: cafe
etag: 8171891181101138299
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Jun 2023 15:44:54 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 621A 0
0 74ms
73ms Image
text/html 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSoO4ff8p8G1gYTwCAgKqXc9WLerDrQGDE5W8siJkJpQI9l8K3I7QkTGLWcKWnOfv_eBtnGlw26FtVWbDppM8srMq_btA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81e::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 621A 178 KB
56 KB 83ms
82ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57029
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1686742752845198"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:42:30 GMT

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame 51FD 115 KB
41 KB 68ms
67ms Document
text/html 2620:100:a001::24
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZIsjVQAEww8DihcFAAB47I-87xnLKrSFTTif-g&u=%7CNrB6qWOMqpYEqjTUvXRmu9q5S%2Bxx9XYDXiHAb8jf3qQ%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-pdBd4Yn-iAyg0RfPc5NXLXF37ShTWqW301lTwe_4Te2RkftdHPyuUKUKX8cibUu9QY22lctH8HR8yrTDHAKTfoskH3hFRkoFzhsJ2sjaOXIKRhd_aM7kzhH5qQk5NKPIID-vocPX2TOUu-uABLFI88_KkRd8y2Qg5plKe2MNBM8zXpRchpFBiyYNkkdvI95gkZY5EgYi4pHZ3UlfUvmfoc13BNLk6aodo3bZlPD_iJ8O6xq2kahIR_71IB6FiNcGGbR61QtcjijxcHM-oa4U5lDIjs1frd1I_KiJbEdu8eiDse8DMWqY29f_riJQQx90WDqdbMEfICEBubMAC0Z1XBuB9oymzpPqe4lcOj-QUXfuGRRSW7u74oRY05hjoLWElID6nr-VLocO5u2XYKw5_UqOkaaRuFXP_U-vacRh5gPdXY8FFFuQUROoLoR9cCuXhGFTTFvzI8SVBZB6kEUHr7HrkJpKY0ET2Ef_olbuPO1JaETHEGcgLU1cmQE1nY03gHQiEjEhUm3Wqu-08Z-SkkGyN0HvegO8nlTMm1tGq7Y0Vg2Y_FXExTtV2PEiM2z33Ky9jIrsh27HMUVmAbweAg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCN_3lVSOLZI-GE4WuqMwP7PGBkAWcge-wXLKaqap0wI23ARABIABgybajiPCj7BKCARdjYS1wdWItMTYxODU5MjIwNTA4Mzc4MMgBCagDAaoEogJP0DJ7xndADvXQlTvFc-Q0HqPhMKWnu0ET27EYACSb4hJ5MRNdbxB2mIrZqo7tj4K-HdLvyG9DIfZE37hAU6gvmyEcsOB2eFSvYu2Og8PSXOYcOBpzQ58OGPe4ILUfER1ddscE5tXcASUfl-JnDluVRz19gO7ODH15_nsz1_biW2_KQGI9YmnPfIZ7F4EPbqxIMifqqs4n3Tg0RnQBMoXjrvuijOenyvfv5YAn8poIaHQos1o6vHvWaIJTs0VV5RHXytm-pSL8GVC3_rhBwv3iA0xxm2IC8VPgQWy9RlOLd-gVTwOi1oDM8tE3i1zUFM3MzZjhEWXTOKCc7y-yUWQ_-3my7-AyDPnGMc2D8BKkAr7dwURCB9ovlPC023GqBAXB5YAGycf9-t347pIXoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDQiAYRABMgKKAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1JRXX12PlURyJ61Fs9tz_6S6qmTg%26client%3Dca-pub-1618592205083780%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5f521295f1a9eca57c79994d10371e9d5ba4f540755a4aee43163c10dd99b772

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 15 Jun 2023 14:42:30 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=yGwXkeEtjxjqvmNc7wiQL_TFUygTst_4AWki0sRS2RQvs-m5LZbLC-WOD79QhcR7DuDB517QM7FVe-57zxTdzkhtJ04rcRcUi4RhNCQzZoN0lyCxcB-_Z04cNFTQOgUMe0Tr2pZniIXqnIyZDGL_6wogDHYUDrT3BSq2adT_GwD1AXWcMrnpZGJhJx9N-DPbNFs-pOO7bIYdcJaW_xxAzlG-JtFSpI3SiQMBgJ7fciV1I9lADR_PmV_-uxDgPrLx9HnCpA"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 18026375
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230613/r20110914/client/ Frame 2C9E 3 KB
1 KB 47ms
46ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230613/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:44:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 82656
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Jun 2023 15:44:54 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5BE2 1 KB
643 B 51ms
47ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 78825
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 14 Jun 2023 16:48:45 GMT
etag: 48472445140208031
expires: Thu, 15 Jun 2023 16:48:45 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230613/r20110914/client/ Frame 2C9E 19 KB
8 KB 47ms
44ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230613/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3521f5e84dbf85e9b7a304002330fbccf347abc9d0a43765a1838336b8a98c0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 15:44:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 82656
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8120
x-xss-protection: 0
server: cafe
etag: 8171891181101138299
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 28 Jun 2023 15:44:54 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 2C9E 0
0 66ms
63ms Image
text/html 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRLi9xZ0W-pQ0_u2B2zCGKTSWmLZRLebpiXsmTjJsqvRERQEkDBwiNeeqsf7eXXZb3ydKqTqGniSFlFF77Xm4CIlSApmw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81e::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2C9E 178 KB
56 KB 81ms
79ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57029
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1686742752845198"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:42:30 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 9744 2 KB
1 KB 55ms
46ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZIsjVQAEww0DihcFAAB47OhtAtnzaJc_8MuqvA&u=%7CNrB6qWOMqpbgo1HE3WCoBmLKDVyRgcYI%2FFrnFWRrIU0%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-dbHERHVj9MQgFtTN83TUdVFZz6mvMC78rklu3251mk0_VW95qPKEIXKMcagyaaUrwsatiHQNdVi49B9893ZFljTdwwSr-eINSmFwnMVbNdmoDkSxy48eLh6UHBch-rTZitK7nr07Y3KkwTX0OP_uYtsckZtYZtN9kuCJY-XRnVdNmI4iENPXqvDHhLO0TSFpSo-IZNRpwObpCSAKIOHG9cJU8t0XMqx5kkqD8lrjnU3MpiCQiLQ2aVUS-KRb3w4m9biRUT3vC9KPlBPvpHkAc65e0kbeOZraH236UgkWEWfzWQ1_dSexEK-y_qX66gH6i5m7n1J82Jo670dgNtJw8fDmY2UyAhFCRj-HxgQ8bRlDOOtQ-927tvDNwieOOq4hdx7cEfbm9TH5_64zqZOs0llUqvykGab5lAWABei_VpKIYFGa0gSuOtJRJ_Ks1k5YW8c_EvSinKy8TmmfZ8Tazr5UOAAHg2O0bgiju6bWh8NTJb-AhtibjDExL-dbqwQwLMukFj-xjrYdi7W4oqTSJTdqYFsBIJgpd2QkXFQY0Ii0Z2zBuSboUNg8qqle7nQiy6VsJawop-b3CSCJ4SVjlg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCa-HjVSOLZI2GE4WuqMwP7PGBkAWcge-wXLKaqap0wI23ARABIABgybajiPCj7BKCARdjYS1wdWItMTYxODU5MjIwNTA4Mzc4MMgBCagDAaoEowJP0AGiPH2lcwKIlR-gEAVV_uRwGzq-3Nf234CJSELMAVU4O3CqiWBjyyE0pr3J7c6J0qjU66Kq5lOcRmNfj-SP7GN-3id7Y-uVTEBODEcUM_tTlFckgwS4S8N8oVjhc1nBk86c9rbDjadUYlZi6C1Zrt99xVZMmRwqf_igy9TPP6oaGBIqggDI-OU7Zdp7RoZwe7Zsd-Wf0MhF7fr17YvaslBoZxuNDsC-eBmTVdqcBArHb_aD9B5KYvE_Yalsm5Nm-mt1HCQF1ZrE1EA0XPYS7i0q2SxpfvLnITjW61cxFCI_OKoR3e4-CazrDx4tQZrtDqLDIWhGSYHR6D9j7rXPMpvCEnUFPjWJ5ao2RvleqIC79lJpTBO37CQMqJJITKvHbsyABsnH_frd-O6SF6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0D0GIxXcMoMVyQVUFF3Fw1OzbujA%26client%3Dca-pub-1618592205083780%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 9744 2 KB
1 KB 56ms
47ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 9744 308 B
636 B 46ms
45ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 9744 293 B
621 B 49ms
48ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame 9744 43 B
347 B 52ms
51ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=hBlffBPHr5zmT5vujDNQWadiDnmKSUegQRwHoC_tqjM-FVa16FbidoWsZFATxLT-QKp2hEZi1dhkVMkHFf9rNXauR6itJSm69ZZLkccvPXKZ5WHhIWCkUA1RRwmqxxQ843CQLOS2KhXGV_-4KgysgedzXZANxFKoHDgJ0YY3xdanpvkY7FtxNyKX1Op6EJKgGr-0eVQD3zpVZth3WblVrLFaRLxgkBy8ilolVbydUe59vt0hGfcIfefy8ktxcMKbyArT6u3I07acaPRiJv85Dq8sLJWZXNWq9FFXrGMQezHLqvQJT0wcPLlFNx0EA_k66gJw_TVZ7zto7g3e5fCFGqp_bflC-zU7nQb3HYg4Ts3K7fKx5cIa8ohNk8kS4jrfLIo92pM4YdlNdB5hMC32GfY5fMqI1QLWds1h6QawzItd4BFn

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:29 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2072572
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame D6BC 2 KB
1 KB 48ms
46ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZIsjVQAEww4DihcFAAB47ISTA6b2r1EU0fx3FQ&u=%7CNrB6qWOMqpYBr1T1VZtM9IrErM51vpupZGu96brEPbs%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-pdBd4Yn-iAyg0RfPc5NXLXF37ShTWqW301lTwe_4Te2RkftdHPyuUKUKX8cibUu9QY22lctH8HR4VEp1DsbOwrqKY6RG3quH0OiZI8kjhArS-2fNndIOS2pwvWQa9TZ4v3kGNb7DZ7Said2OH5qg64HRKWuQZaJQc5Vqh_HS_9Fj85ToYLNdG6Keg9Q2f6I-n6LUhuoK_QaO48Vefe00EqmMlNKfPH7x1BCSVgMAqwxMGdQ4Z-Y3Av0j82s6wuo47EnIDYgjsOwZOZsgcAU6cOHYdq8IvVFOfXygtBq4ea4QlUpmS7hgUaBwJ1e3RceNA7F40xlPxfb_klG4IMZToergJA1vdQoHXNor352JztDP7Xb47oZgC2rXaLvbZnjRCD9XeJ7CJEwYGA3QjpG5XE-HpT4PZDIQegPyS-ekuBdzLvfkpbbedLck3mAux_7eq2rOVODzlDPosTUwU15Ho4jUzNkjF7yjMRePyxBfVwc-Jnj8tM2mTFx-_yCyLjLW1A5A_47hQYzZJNlIWKRnX6clG1wyLL6vSeVapNHMyH728cOPpnzMlvSlCUZXwdOayWIkC4HDC1oQk3fYozFkeA&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCW4_lVSOLZI6GE4WuqMwP7PGBkAWcge-wXLKaqap0wI23ARABIABgybajiPCj7BKCARdjYS1wdWItMTYxODU5MjIwNTA4Mzc4MMgBCagDAaoEowJP0FUvbZORgOslr2EHitJFFqiiYo_3RGfrnWfxypNTo9q6n7eeByc90p_h67urHkUUPRgS66WXxX1omXDtOp0EjNpWFtKjwxqzrmEmE-tKdy-hKjnoxnObH-Sqm0YCMd_hpK4aFeC_Oq13DeBHTJJSn6hGXlfT2etFXaRdN0_22uvsWH2WRsAd34Tef6c8C-CcyEa_6seRbDyJ_Y40UCdWpEdqh2MktsaDz4nR5ehtTJ5hVQpwOQUjlku5TELbJh0qYDEh0I-SuEvjqUhS7agEPeStEuINgUTaqGgBqUjBxFEWEfeU-R3FImkHvqLNDqGLhmnc2-uyuHbRI3sK0AYpWXFwVJdPbByXCNFUEtfsVEhUsR6UsOx7mIv6c4F0Kb6rDheABsnH_frd-O6SF6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1L4y7T_B1GqyKGeOKPyWO7acp4GQ%26client%3Dca-pub-1618592205083780%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame D6BC 2 KB
1 KB 48ms
47ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame D6BC 308 B
636 B 46ms
44ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame D6BC 293 B
621 B 47ms
45ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame D6BC 43 B
347 B 54ms
52ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=RlGnhKGCShzmOLQz9Dw8IboXfVSkCHRWuFFSrtLSehuNrFvQstOgNdtHwISz3tfliQQ574ZeKNtD9ifxNGE74QIvB9eOGwJZN7VSfSKXiG7blJehVjRDkRtHnTTSC2PpsUJzsU4lH0STPNCvPvctYP7xr1KM-9JQHy6IhH_umhK2OmcypZ991PxxdYWTpi5tUYxiUToSgiOXaM6cZO9Zah45XESvy1y1CEpi_qlZaqo7wZ525wmUih4oGZorJAvAs8ipqvdFC459Ka3PrkYfanvqfD0RCHpPTM5JfHYlMrDjE9nsf4ukIAMEAM_DQXYrP6HgvJxmxP-FO72__T7H81zI4VOHotMjVLmYQfWXznZDyk0kAEVJoAfXGNd6s4DQT8ykynZdhi-p5WN17LI3ijteyKaq0gvIQ5NA1VCHjQMMeOed

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2849677
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 9744 12 KB
6 KB 49ms
49ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C3BD
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEJISabOUoeOfliU2VPML8nM&google_cver=1&google_push=ATf1kGMhPk0Oo1L7ysvZyJVnIs_-tT_oMh3i9NmfgFP1AlxexUu3W2-...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=10dd92739f2b05ae&is_secure=true&networkId=14000&version=1&google_gid=CAESEJISabOUoeOfliU2VPML8nM&google_cver=1&google_push=ATf1kGMhPk0O...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAACBJb6SD0ugwNLmIpwAAAAAAA&expiration=1686926550&google_cver=1&is_secure=true&google_gid=CAESEJISabOUoeOfliU2VPML8...

170 B
188 B

69ms
69ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAACBJb6SD0ugwNLmIpwAAAAAAA&expiration=1686926550&google_cver=1&is_secure=true&google_gid=CAESEJISabOUoeOfliU2VPML8nM&google_push=ATf1kGMhPk0Oo1L7ysvZyJVnIs_-tT_oMh3i9NmfgFP1AlxexUu3W2-RSFcVk-XdpojsWffhA6wKmEL49Ibz2l4qXHbC0UXspy-M6g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAACBJb6SD0ugwNLmIpwAAAAAAA&expiration=1686926550&google_cver=1&is_secure=true&google_gid=CAESEJISabOUoeOfliU2VPML8nM&google_push=ATf1kGMhPk0Oo1L7ysvZyJVnIs_-tT_oMh3i9NmfgFP1AlxexUu3W2-RSFcVk-XdpojsWffhA6wKmEL49Ibz2l4qXHbC0UXspy-M6g
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C3BD
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEHbJao0ekzePnTe6IpyChpQ&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEHbJao0ekzePnTe6IpyChpQ&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=d1dqSXBjeGQxUTlPYmM1&google_gid=CAESEHbJao0ekzePnTe6IpyChpQ&google_cver=1&google_push=ATf1kGNNpZJYmPNKFiSwBkayw3aoYAW2LICt1eINnKtQGem...

170 B
188 B

69ms
69ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=d1dqSXBjeGQxUTlPYmM1&google_gid=CAESEHbJao0ekzePnTe6IpyChpQ&google_cver=1&google_push=ATf1kGNNpZJYmPNKFiSwBkayw3aoYAW2LICt1eINnKtQGemePsT8Fl6X5UonFB9RlXYwnvwX0G1P56rqwS3V-6pu5d-Yz3HgEErw

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 15 Jun 2023 14:42:30 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-780-gdfb6b2e#rel-ec2-master i-023329e0a498b46ac@us-east-1e@dxedge-app-us-east-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=d1dqSXBjeGQxUTlPYmM1&google_gid=CAESEHbJao0ekzePnTe6IpyChpQ&google_cver=1&google_push=ATf1kGNNpZJYmPNKFiSwBkayw3aoYAW2LICt1eINnKtQGemePsT8Fl6X5UonFB9RlXYwnvwX0G1P56rqwS3V-6pu5d-Yz3HgEErw
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C3BD
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEI4btMiWOGuyA8REPen6VDo&google_cver=1&google_push=ATf1kGNh5mGmuaLHtRFQvRhZdTFhpOob0xK8Hbhomq48qm65Ou7Xu0yq7wXCUR6T-iEUwaiPRgesTNw_TZK_ckTgoAry2FS-xhksbA
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=Q0ZEMjU2MjZDMUNFN0MwQw==

170 B
188 B

64ms
64ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=Q0ZEMjU2MjZDMUNFN0MwQw==

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=Q0ZEMjU2MjZDMUNFN0MwQw==
date: Thu, 15 Jun 2023 14:42:30 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C3BD
Redirect Chain

https://s.uuidksinc.net/match/47/?remote_uid=CAESEP2PMd7nDdI2AwnXnbF4csw&c_param1=ATf1kGPCCQdUaYSLBns566awOpmgq7BRVEgtQGXsaICrZJMsWtZgo9wDZVGjj3dWYS936wBq9vH8l_oJP3Bx4bYCzPs8XRANVz6lTw&gdpr=%%GDPR%...
https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ATf1kGPCCQdUaYSLBns566awOpmgq7BRVEgtQGXsaICrZJMsWtZgo9wDZVGjj3dWYS936wBq9vH8l_oJP3Bx4bYCzPs8XRANVz6lTw

170 B
188 B

80ms
79ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ATf1kGPCCQdUaYSLBns566awOpmgq7BRVEgtQGXsaICrZJMsWtZgo9wDZVGjj3dWYS936wBq9vH8l_oJP3Bx4bYCzPs8XRANVz6lTw

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ATf1kGPCCQdUaYSLBns566awOpmgq7BRVEgtQGXsaICrZJMsWtZgo9wDZVGjj3dWYS936wBq9vH8l_oJP3Bx4bYCzPs8XRANVz6lTw
date: Thu, 15 Jun 2023 14:42:30 GMT
server: nginx/1.23.2
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C3BD
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEI1E0hwzOcDhb6qUq0rMQx8&google_cver=1&google_push=ATf1kGMIem7GaJhQcKRuewVgefvzHtLzNAkXuRU-4bId6YmGVlJnqk0SftmB5YGSDaauifSVyx2pC5Jp...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEI1E0hwzOcDhb6qUq0rMQx8&google_cver=1&google_push=ATf1kGMIem7GaJhQcKRuewVgefvzHtLzNAkXuRU-4bId6YmGVlJnqk0SftmB5YGSDaauifSVyx2...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODgzODY3OTY5OTgzNTQ5ODI5MQ&google_push=ATf1kGMIem7GaJhQcKRuewVgefvzHtLzNAkXuRU-4bId6YmGVlJnqk0SftmB5YGSDaauifSVyx2pC5...

170 B
188 B

66ms
65ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODgzODY3OTY5OTgzNTQ5ODI5MQ&google_push=ATf1kGMIem7GaJhQcKRuewVgefvzHtLzNAkXuRU-4bId6YmGVlJnqk0SftmB5YGSDaauifSVyx2pC5JpvwuPYLwG6v4SHyjSguGZbw

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODgzODY3OTY5OTgzNTQ5ODI5MQ&google_push=ATf1kGMIem7GaJhQcKRuewVgefvzHtLzNAkXuRU-4bId6YmGVlJnqk0SftmB5YGSDaauifSVyx2pC5JpvwuPYLwG6v4SHyjSguGZbw
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C3BD
Redirect Chain

https://dsp.adkernel.com/sync?exchange=11&google_gid=CAESEPzXPg1G_YoxYD35waxULx4&google_cver=1&google_push=ATf1kGN5VbCVOElGszXcg3Zj7GtYTvH4VqTw0jVVHuj2Sez_-lUTTJuPseeaS9reVoY456BZ1267LfjvpBMQpXoPib...
https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTMwNjE3NTg1ODc0NTk3NDc5MTA&google_push=ATf1kGN5VbCVOElGszXcg3Zj7GtYTvH4VqTw0jVVHuj2Sez_-lUTTJuPseeaS9reVoY456BZ1267LfjvpBMQpXoPibow...

170 B
188 B

64ms
63ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTMwNjE3NTg1ODc0NTk3NDc5MTA&google_push=ATf1kGN5VbCVOElGszXcg3Zj7GtYTvH4VqTw0jVVHuj2Sez_-lUTTJuPseeaS9reVoY456BZ1267LfjvpBMQpXoPibown-q1IAC-cA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTMwNjE3NTg1ODc0NTk3NDc5MTA&google_push=ATf1kGN5VbCVOElGszXcg3Zj7GtYTvH4VqTw0jVVHuj2Sez_-lUTTJuPseeaS9reVoY456BZ1267LfjvpBMQpXoPibown-q1IAC-cA
Date: Thu, 15 Jun 2023 14:42:30 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

spacer.gif
an.yandex.ru/resource/ Frame C3BD
Redirect Chain

https://an.yandex.ru/mapuid/google/CAESEFuIoJTSRWAp35D0qwWvl2w?ext-param=ATf1kGOuYxuIUfMhX7xXEXuOpuGwaWJCCO7Lka4DKG80Z4y6GSCJMgoPQiyeBd9UFVRx4E63Go3ojFVQnYx_t3Xl0DZqtLaOpgtL4ag&partner-tag=yandex_a...
https://cm.g.doubleclick.net/pixel?google_nid=yandex_ag&google_hm=CAESEFuIoJTSRWAp35D0qwWvl2w&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
https://an.yandex.ru/resource/spacer.gif

43 B
144 B

162ms
160ms

Image
image/gif

2a02:6b8::90
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/resource/spacer.gif

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

2a02:6b8::90 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Wed, 18 Apr 2001 10:28:03 GMT
content-type: image/gif
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Thu, 30 May 2024 14:42:30 GMT

Redirect headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://an.yandex.ru/resource/spacer.gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 237
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C3BD 0
12 B 62ms
61ms Image
text/html 142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JnFhOAONlMwFD22qr-1uIZBCX97WYme533ENv_zXqW-CAo81FjihnFb3l46b_yqCN7wLHdaw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H2 200 1 Show response
mc.yandex.com/watch/46501593/ 43 B
86 B 159ms
157ms XHR
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/46501593/1?page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&charset=utf-8&hittoken=1686840150_8855441d1831e37229cdb6956ee14b69ff25765336b68fa7904ba6f1f56c9799&browser-info=pa%3A1%3Aar%3A1%3Avf%3A7sm39m606e08f3pmdzdgwin%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1060%3Acn%3A1%3Adp%3A1%3Als%3A1530691519693%3Ahid%3A189696770%3Az%3A0%3Ai%3A20230615144230%3Aet%3A1686840150%3Ac%3A1%3Arn%3A321404446%3Arqn%3A2%3Au%3A1686840149714077504%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1686840120672%3Anp%3AV2luMzI%3D%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1686840151&t=gdpr(14%2C14)mc(p-4-h-1)clc(0-0-0)rqnt(2)lt(17900)aw(1)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 15-Jun-2023 14:42:30 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Thu, 15-Jun-2023 14:42:30 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame D6BC 12 KB
6 KB 50ms
50ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 9744 24 KB
24 KB 62ms
61ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?h=244&m=0&partner=52383&q=80&r=0&u=http%3A%2F%2Fstatic.va.us.criteo.net%2Fdesign%2Fdt%2F52383%2F4774029%2Fd776ec11ea57494ba0020202cc6e56d5_black_logo_600.png&v=3&w=402&s=fonyKxBgjmwN8jTpfxbYjviE

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

a390b07212dbcb94117883431160d2f769673c3a7aee37da082c571a453c92ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 24324
expires: Sat, 01 Jun 2024 17:02:46 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame 9744 0
127 B 51ms
51ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=2BKNseEtjxjqvmNc_ljK6fXOeGftAHlGYQ7cj3Gi24vLSL9G3KQy9G8Glsau9jYO3MQjKUHYhLULeMPVZJIg16yzMQGPyD5VScS-st1L5zyVH4qrMPRU3iyL_nbjgUCE52zfekhRXR8RKh8_DsT-92iSdG5QB8IdZDTUtTsYE8feub3jNxNTvfJ3nkANwZlGN4XDZ3Z1Tr_XdpL1H7XVlwi9Mh9pysBo8pptOzwg8pF0KGpa0W3dRHdXZq8hniZJbmFLkA&sds=2&rev=87007&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 15 Jun 2023 14:42:29 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 9744 2 KB
1 KB 46ms
46ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 9744 2 KB
1 KB 47ms
44ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

POST
H2 200 1 Show response
mc.yandex.com/watch/42093449/ 43 B
74 B 163ms
152ms XHR
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/42093449/1?page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&charset=utf-8&hittoken=1686840150_a6e7cc49eb471f854ea1fc49a54560fdbc2ae3f4232ed3a50f9a15dd710b339d&browser-info=pa%3A1%3Aar%3A1%3Avf%3A7sm39m606e08f3pmdzdgwin%3Afp%3A27982%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1060%3Acn%3A2%3Adp%3A1%3Als%3A1249469764033%3Ahid%3A189696770%3Az%3A0%3Ai%3A20230615144230%3Aet%3A1686840150%3Ac%3A1%3Arn%3A59910428%3Arqn%3A1%3Au%3A1686840149714077504%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ads%3A39%2C128%2C25821%2C2%2C222%2C0%2C%2C2299%2C43%2C%2C%2C%2C28548%3Aco%3A0%3Acpf%3A1%3Aeu%3A2%3Ans%3A1686840120672%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1686840151&t=gdpr(14%2C14)mc(p-4-h-1)clc(0-0-0)rqnt(1)lt(17900)aw(1)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 15-Jun-2023 14:42:30 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Thu, 15-Jun-2023 14:42:30 GMT

POST
H2 200 1 Show response
mc.yandex.com/watch/42093449/ 43 B
74 B 169ms
157ms XHR
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/42093449/1?page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&charset=utf-8&hittoken=1686840150_a6e7cc49eb471f854ea1fc49a54560fdbc2ae3f4232ed3a50f9a15dd710b339d&browser-info=pa%3A1%3Aar%3A1%3Avf%3A7sm39m606e08f3pmdzdgwin%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1060%3Acn%3A2%3Adp%3A1%3Als%3A1249469764033%3Ahid%3A189696770%3Az%3A0%3Ai%3A20230615144230%3Aet%3A1686840150%3Ac%3A1%3Arn%3A717571162%3Arqn%3A2%3Au%3A1686840149714077504%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Aeu%3A2%3Ans%3A1686840120672%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1686840151&t=gdpr(14%2C14)mc(p-4-h-1)clc(0-0-0)rqnt(2)lt(17900)aw(1)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 15-Jun-2023 14:42:30 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Thu, 15-Jun-2023 14:42:30 GMT

POST
H2 200 1 Show response
mc.yandex.com/watch/42093449/ 43 B
74 B 171ms
160ms XHR
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/42093449/1?page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&charset=utf-8&hittoken=1686840150_a6e7cc49eb471f854ea1fc49a54560fdbc2ae3f4232ed3a50f9a15dd710b339d&browser-info=pa%3A1%3Aar%3A1%3Avf%3A7sm39m606e08f3pmdzdgwin%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1060%3Acn%3A2%3Adp%3A1%3Als%3A1249469764033%3Ahid%3A189696770%3Az%3A0%3Ai%3A20230615144230%3Aet%3A1686840150%3Ac%3A1%3Arn%3A79341023%3Arqn%3A3%3Au%3A1686840149714077504%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Aeu%3A2%3Ans%3A1686840120672%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1686840151&t=gdpr(14%2C14)mc(p-4-h-1)clc(0-0-0)rqnt(3)lt(17900)aw(1)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 15-Jun-2023 14:42:30 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Thu, 15-Jun-2023 14:42:30 GMT

GET
H2 200 42093449 Show response
mc.yandex.com/watch/ 43 B
74 B 167ms
155ms XHR
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/42093449?page-url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&charset=utf-8&site-info=%7B%22787310%22%3A%7B%22remoteLogString%22%3A%7B%22Error%22%3A%7B%7D%7D%7D%7D&hittoken=1686840150_a6e7cc49eb471f854ea1fc49a54560fdbc2ae3f4232ed3a50f9a15dd710b339d&browser-info=pv%3A1%3Aar%3A1%3Avf%3A7sm39m606e08f3pmdzdgwin%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1060%3Acn%3A2%3Adp%3A1%3Als%3A1249469764033%3Ahid%3A189696770%3Az%3A0%3Ai%3A20230615144230%3Aet%3A1686840150%3Ac%3A1%3Arn%3A782799174%3Arqn%3A4%3Au%3A1686840149714077504%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Aeu%3A2%3Ans%3A1686840120672%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1686840151&t=gdpr(14%2C14)mc(p-4-h-1)clc(0-0-0)rqnt(4)lt(17900)aw(1)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 15-Jun-2023 14:42:30 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Thu, 15-Jun-2023 14:42:30 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0420
Redirect Chain

https://aep.mxptint.net/sn.ashx?google_gid=CAESEPs5Wan2zHdJy4qF4dwcly0&google_cver=1&google_push=ATf1kGOINuNfSWlSnd0Ax0rL3CEeDhQnqfH996jQf40v2LgoXrPAQaSvR2liIQFrbKswcsKdyDEWgdGMZdvblqqNlsqcRi3wggs9x-4
https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=ATf1kGOINuNfSWlSnd0Ax0rL3CEeDhQnqfH996jQf40v2LgoXrPAQaSvR2liIQFrbKswcsKdyDEWgdGMZdvblqqNlsqcRi3wggs9x-4&google_hm=UjMzNjQ1XzEwN...

170 B
188 B

63ms
61ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=ATf1kGOINuNfSWlSnd0Ax0rL3CEeDhQnqfH996jQf40v2LgoXrPAQaSvR2liIQFrbKswcsKdyDEWgdGMZdvblqqNlsqcRi3wggs9x-4&google_hm=UjMzNjQ1XzEwNDRGQTZCQl81NUUyRTg4Mg%3D%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=ATf1kGOINuNfSWlSnd0Ax0rL3CEeDhQnqfH996jQf40v2LgoXrPAQaSvR2liIQFrbKswcsKdyDEWgdGMZdvblqqNlsqcRi3wggs9x-4&google_hm=UjMzNjQ1XzEwNDRGQTZCQl81NUUyRTg4Mg%3D%3D
Date: Thu, 15 Jun 2023 14:42:30 GMT
Cache-Control: private
Strict-Transport-Security: max-age=-369844933; includeSubDomains
P3P: CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE", CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE"
Content-Length: 349
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0420
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_gid=CAESEAylvauLEE6bZyCokiDeUi8&google_cver=1&google_push=ATf1kGNsVVVnVQGHUd6nYRPhD4LaFfTTQiSOCtNPXVT2FWadsJmGQU3_qMnL75PO9uKXKFKKngd2WqPeaGjCfcOp32...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OTBmOGVmMTUtNTYyMi00ZWVhLTk1MWItMGM3YjQ4NWYzZDkz&google_push&gdpr=0&gdpr_consent=&ttd_tdid=90f8ef15-5622-4eea-951b-0c7b485f3d93

170 B
188 B

69ms
69ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OTBmOGVmMTUtNTYyMi00ZWVhLTk1MWItMGM3YjQ4NWYzZDkz&google_push&gdpr=0&gdpr_consent=&ttd_tdid=90f8ef15-5622-4eea-951b-0c7b485f3d93

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OTBmOGVmMTUtNTYyMi00ZWVhLTk1MWItMGM3YjQ4NWYzZDkz&google_push&gdpr=0&gdpr_consent=&ttd_tdid=90f8ef15-5622-4eea-951b-0c7b485f3d93
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 423

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 0420 43 B
363 B 158ms
49ms Image
image/gif 74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DPUSH_DATA&google_gid=CAESEIo92ys8cAxPvrLPbijUvxg&google_cver=1&google_push=ATf1kGOqgimyPRe11V1RjeFocRowwwQPCRbkrlT0k5_6X1JCDpZdJgITMTR4iR68pU390pkT_B4LL3VlkpzRO26oXsaM0_40lUjPeg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 243438
expires: Thu, 15 Jun 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0420
Redirect Chain

https://s.uuidksinc.net/match/47/?remote_uid=CAESEP2PMd7nDdI2AwnXnbF4csw&c_param1=ATf1kGOxUGkfutnBSQDbosmEWMj_FGkPpsZRe2xczPSyS9T-uJDuzQn75wgNs4EwF7Z1Gs33tFvU9duORpnUQLLrNPDps6k5MdS3jhs&gdpr=%%GDPR...
https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ATf1kGOxUGkfutnBSQDbosmEWMj_FGkPpsZRe2xczPSyS9T-uJDuzQn75wgNs4EwF7Z1Gs33tFvU9duORpnUQLLrNPDps6k5MdS3jhs

170 B
188 B

85ms
84ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ATf1kGOxUGkfutnBSQDbosmEWMj_FGkPpsZRe2xczPSyS9T-uJDuzQn75wgNs4EwF7Z1Gs33tFvU9duORpnUQLLrNPDps6k5MdS3jhs

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=ATf1kGOxUGkfutnBSQDbosmEWMj_FGkPpsZRe2xczPSyS9T-uJDuzQn75wgNs4EwF7Z1Gs33tFvU9duORpnUQLLrNPDps6k5MdS3jhs
date: Thu, 15 Jun 2023 14:42:30 GMT
server: nginx/1.23.2
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0420
Redirect Chain

https://rtb2-useast.e-volution.ai/sync?exchange=193&google_gid=CAESEFZNBqgXHeHfGGiA96oJUsY&google_cver=1&google_push=ATf1kGMZuNeBclItDeym0sdGsH_cHL98d8r3SZCZy8-BJhhUBSEychu65lv7IUyDOBzGIK7O9tV7BEyO...
https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.e-volution.ai%2Fsync%3Fexchange%3D193%26google_gid%3DCAESEFZNBqgXHeHfGGiA96oJUsY%26google_cver%3D1%26google_push%3DATf1kGMZuNeBclItDeym0s...
https://rtb2-useast.e-volution.ai/sync?adkuid=A3061758587459747910&exchange=193&google_gid=CAESEFZNBqgXHeHfGGiA96oJUsY&google_cver=1&google_push=ATf1kGMZuNeBclItDeym0sdGsH_cHL98d8r3SZCZy8-BJhhUBSEy...
https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTMwNjE3NTg1ODc0NTk3NDc5MTA&google_push=ATf1kGMZuNeBclItDeym0sdGsH_cHL98d8r3SZCZy8-BJhhUBSEychu65lv7IUyDOBzGIK7O9tV7BEy...

170 B
188 B

88ms
63ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTMwNjE3NTg1ODc0NTk3NDc5MTA&google_push=ATf1kGMZuNeBclItDeym0sdGsH_cHL98d8r3SZCZy8-BJhhUBSEychu65lv7IUyDOBzGIK7O9tV7BEyOro1hBAX0iomEi8VNqTHjV4Y

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTMwNjE3NTg1ODc0NTk3NDc5MTA&google_push=ATf1kGMZuNeBclItDeym0sdGsH_cHL98d8r3SZCZy8-BJhhUBSEychu65lv7IUyDOBzGIK7O9tV7BEyOro1hBAX0iomEi8VNqTHjV4Y
Date: Thu, 15 Jun 2023 14:42:30 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0420
Redirect Chain

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEGIXT-77cFHRp1H39hT0vW8&google_cver=1&google_push=ATf1kGOxK4KXUYZs7WV59O2vzuB2SV1XBNwRjYBYxsy0ZYZ-uASnofFozWdlkeAK4czaPxVt_Q7Ml5y2AqvwTnpw-92DMnC...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGOxK4KXUYZs7WV59O2vzuB2SV1XBNwRjYBYxsy0ZYZ-uASnofFozWdlkeAK4czaPxVt_Q7Ml5y2AqvwTnpw-92DMnC1S6DVcwNf&google_hm=NDk5NjM...

170 B
188 B

67ms
66ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGOxK4KXUYZs7WV59O2vzuB2SV1XBNwRjYBYxsy0ZYZ-uASnofFozWdlkeAK4czaPxVt_Q7Ml5y2AqvwTnpw-92DMnC1S6DVcwNf&google_hm=NDk5NjM3MTY3ODEzNTA2MzAwMA==

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGOxK4KXUYZs7WV59O2vzuB2SV1XBNwRjYBYxsy0ZYZ-uASnofFozWdlkeAK4czaPxVt_Q7Ml5y2AqvwTnpw-92DMnC1S6DVcwNf&google_hm=NDk5NjM3MTY3ODEzNTA2MzAwMA==
Date: Thu, 15 Jun 2023 14:42:30 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0420
Redirect Chain

https://beacon.lynx.cognitivlabs.com/adx.gif?google_gid=CAESEAZFhYt530U3oDfEuGMdJkg&google_cver=1&google_push=ATf1kGOveOjnjc1RJ-RG-hfDsAv9TB6VLYKgrkWbHfqAqW7R932s3buJnW1oxfphFV_kHmfv2v-FAKS6vgYiqfY...
https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=Q8wiYMFL8UmNaj12gEdfcw&google_push=ATf1kGOveOjnjc1RJ-RG-hfDsAv9TB6VLYKgrkWbHfqAqW7R932s3buJnW1oxfphFV_kHmfv2v-FAKS6vgYiqfYYx8L6LvOtr...

170 B
188 B

62ms
60ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=Q8wiYMFL8UmNaj12gEdfcw&google_push=ATf1kGOveOjnjc1RJ-RG-hfDsAv9TB6VLYKgrkWbHfqAqW7R932s3buJnW1oxfphFV_kHmfv2v-FAKS6vgYiqfYYx8L6LvOtrNFs31JE

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=Q8wiYMFL8UmNaj12gEdfcw&google_push=ATf1kGOveOjnjc1RJ-RG-hfDsAv9TB6VLYKgrkWbHfqAqW7R932s3buJnW1oxfphFV_kHmfv2v-FAKS6vgYiqfYYx8L6LvOtrNFs31JE
Date: Thu, 15 Jun 2023 14:42:30 GMT
Server: Kestrel
Connection: keep-alive
Content-Length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 0420 0
12 B 64ms
61ms Image
text/html 142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Im_9m2zO_qEw4bZkqdYBXhEvRQxSFjeRLBTBRG744VJgI1_79Z2db8w7iCUrstAwZjEFKsti6A

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame DEC0 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 28c8c0c76b514f3b4abc6fff4a2edc99b0020737d0db600d42d33a9f70c18cdd

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 all
csm.us.criteo.net/ Frame D6BC 0
127 B 52ms
51ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=WxSaKuEtjxjqvmNchnrHr8jFUv6fTEbsAbyEPn8ulPVFm_zdjtIS-URaa2dO2d_bwnFwSkMa-iByeYlykvaOTlX3UUjAgBxZUZjsDjpBhxSUK9i0fNCIkbLeUZkOkEZWgXFn8BqcWOLmaF0QV4xcBec9ReepRvkqmMk5IP9oF9FmQ1l_tZCWx_5IzWHZf5ETskzX9sQjAnhe2PpRgQeSYJioVR522BwQamavauZ7VtgnYVRPYU5VZIH-cDHQyM0SlUGBBw&sds=2&rev=87007&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 15 Jun 2023 14:42:29 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame D6BC 2 KB
1 KB 48ms
46ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame D6BC 2 KB
1 KB 48ms
47ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 51FD 2 KB
1 KB 47ms
46ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZIsjVQAEww8DihcFAAB47I-87xnLKrSFTTif-g&u=%7CNrB6qWOMqpYEqjTUvXRmu9q5S%2Bxx9XYDXiHAb8jf3qQ%3D%7C&c1=SMhbYeryLxkG14NwFf2jh1KVMrwDvmO-pdBd4Yn-iAyg0RfPc5NXLXF37ShTWqW301lTwe_4Te2RkftdHPyuUKUKX8cibUu9QY22lctH8HR8yrTDHAKTfoskH3hFRkoFzhsJ2sjaOXIKRhd_aM7kzhH5qQk5NKPIID-vocPX2TOUu-uABLFI88_KkRd8y2Qg5plKe2MNBM8zXpRchpFBiyYNkkdvI95gkZY5EgYi4pHZ3UlfUvmfoc13BNLk6aodo3bZlPD_iJ8O6xq2kahIR_71IB6FiNcGGbR61QtcjijxcHM-oa4U5lDIjs1frd1I_KiJbEdu8eiDse8DMWqY29f_riJQQx90WDqdbMEfICEBubMAC0Z1XBuB9oymzpPqe4lcOj-QUXfuGRRSW7u74oRY05hjoLWElID6nr-VLocO5u2XYKw5_UqOkaaRuFXP_U-vacRh5gPdXY8FFFuQUROoLoR9cCuXhGFTTFvzI8SVBZB6kEUHr7HrkJpKY0ET2Ef_olbuPO1JaETHEGcgLU1cmQE1nY03gHQiEjEhUm3Wqu-08Z-SkkGyN0HvegO8nlTMm1tGq7Y0Vg2Y_FXExTtV2PEiM2z33Ky9jIrsh27HMUVmAbweAg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCN_3lVSOLZI-GE4WuqMwP7PGBkAWcge-wXLKaqap0wI23ARABIABgybajiPCj7BKCARdjYS1wdWItMTYxODU5MjIwNTA4Mzc4MMgBCagDAaoEogJP0DJ7xndADvXQlTvFc-Q0HqPhMKWnu0ET27EYACSb4hJ5MRNdbxB2mIrZqo7tj4K-HdLvyG9DIfZE37hAU6gvmyEcsOB2eFSvYu2Og8PSXOYcOBpzQ58OGPe4ILUfER1ddscE5tXcASUfl-JnDluVRz19gO7ODH15_nsz1_biW2_KQGI9YmnPfIZ7F4EPbqxIMifqqs4n3Tg0RnQBMoXjrvuijOenyvfv5YAn8poIaHQos1o6vHvWaIJTs0VV5RHXytm-pSL8GVC3_rhBwv3iA0xxm2IC8VPgQWy9RlOLd-gVTwOi1oDM8tE3i1zUFM3MzZjhEWXTOKCc7y-yUWQ_-3my7-AyDPnGMc2D8BKkAr7dwURCB9ovlPC023GqBAXB5YAGycf9-t347pIXoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDQiAYRABMgKKAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1JRXX12PlURyJ61Fs9tz_6S6qmTg%26client%3Dca-pub-1618592205083780%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 51FD 2 KB
1 KB 45ms
45ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 51FD 308 B
636 B 46ms
45ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 51FD 293 B
621 B 51ms
50ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame 51FD 43 B
347 B 52ms
51ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=0ldPfKGCShzmOLQz9Dw8IboXfVQU3BmY5hlkzpuuXu21uTGmeb7RtRoU0BC3rxeKp0c5Y8XjCH6-j0euGCXt9LUzAi3mWkoQt5P5oiDOjUOj5qGAdIrykXoR99yLEAuSojCmlCPzmf_SRLx7pHuNZUd4tYy1EAXiOyTYt4o9ACrATHPkCg03pNrFxrbDq26w7KfAtP6fDUwq3gVv-Iy5TV_SdIx4ufDgJJ8HgcnVSG-zcIJ66s8-OTjG_pFI1GE9ryYjgB6Bda0KglmyMFgaXkGDtX5n_SJcwa_fOputsRaviseIh05Fm79P1HU5DeFoH7d8lJx-TSPseKAceBgH37dQxBXMei1n3JdRu-cEQQCAAXv8kMnLrztWR6wTbbEiek9Ddg1kmoofvc2N90m9U5NcjmZugCzJB4PYV8iq4OVRbyVv

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2881708
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 51FD 12 KB
6 KB 48ms
47ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5BE2
Redirect Chain

https://aep.mxptint.net/sn.ashx?google_gid=CAESEPs5Wan2zHdJy4qF4dwcly0&google_cver=1&google_push=ATf1kGMWQ_FUS6zl0Q8p4kXW-tXcx9gTs1Xc7zfM__dCPoxUUqiG22aiNPwg9Hli5Dcc5CchDWZBDqKeyb2Yb2H8s21sNu9HdZgaWQ
https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=ATf1kGMWQ_FUS6zl0Q8p4kXW-tXcx9gTs1Xc7zfM__dCPoxUUqiG22aiNPwg9Hli5Dcc5CchDWZBDqKeyb2Yb2H8s21sNu9HdZgaWQ&google_hm=UjMzNjQ1XzEwND...

170 B
188 B

75ms
74ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=ATf1kGMWQ_FUS6zl0Q8p4kXW-tXcx9gTs1Xc7zfM__dCPoxUUqiG22aiNPwg9Hli5Dcc5CchDWZBDqKeyb2Yb2H8s21sNu9HdZgaWQ&google_hm=UjMzNjQ1XzEwNDRGQTZCQl81NUUyRTg4Mg%3D%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=ATf1kGMWQ_FUS6zl0Q8p4kXW-tXcx9gTs1Xc7zfM__dCPoxUUqiG22aiNPwg9Hli5Dcc5CchDWZBDqKeyb2Yb2H8s21sNu9HdZgaWQ&google_hm=UjMzNjQ1XzEwNDRGQTZCQl81NUUyRTg4Mg%3D%3D
Date: Thu, 15 Jun 2023 14:42:30 GMT
Cache-Control: private
Strict-Transport-Security: max-age=-369844933; includeSubDomains
P3P: CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE"
Content-Length: 348
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5BE2
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEAMPwjUUM8J-PChz0SMSN0Y&google_push=ATf1kGM5VgzdjyfT-3RksOn4KNAApFhJLCeJrv8q30hJ6Rok6ZqjOLt-KX...

170 B
188 B

76ms
74ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEAMPwjUUM8J-PChz0SMSN0Y&google_push=ATf1kGM5VgzdjyfT-3RksOn4KNAApFhJLCeJrv8q30hJ6Rok6ZqjOLt-KXjoYoP18-5e6-gDWUN7tfzS2M_H1M6fqed6hS7CuVYSGA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-chi-kigq8000167-CHI
pragma: no-cache
date: Thu, 15 Jun 2023 14:42:30 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1686840151.890822,VS0,VE21
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEAMPwjUUM8J-PChz0SMSN0Y&google_push=ATf1kGM5VgzdjyfT-3RksOn4KNAApFhJLCeJrv8q30hJ6Rok6ZqjOLt-KXjoYoP18-5e6-gDWUN7tfzS2M_H1M6fqed6hS7CuVYSGA
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5BE2
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEEZQtmCZhVemtrpPOIyXWl8&google_cver=1&google_push=ATf1kGOHZRf8aG51AJBdrGDLQJZ2VEY88bGFttW8xchhoq3BCxqnL2da4ilJpiJSlVr7uvOZBdsTlNySk0SLjhvznB_TIE5Ecnd88Vo
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=DBE78E55CD8A4F8BA66CBF68308278B7&google_push=ATf1kGOHZRf8aG51AJBdrGDLQJZ2VEY88bGFttW8xchhoq3BCxqnL2da4ilJpiJSlVr7uvOZBdsTlNySk0SLjhv...

170 B
188 B

71ms
70ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=DBE78E55CD8A4F8BA66CBF68308278B7&google_push=ATf1kGOHZRf8aG51AJBdrGDLQJZ2VEY88bGFttW8xchhoq3BCxqnL2da4ilJpiJSlVr7uvOZBdsTlNySk0SLjhvznB_TIE5Ecnd88Vo

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 15 Jun 2023 14:42:31 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=DBE78E55CD8A4F8BA66CBF68308278B7&google_push=ATf1kGOHZRf8aG51AJBdrGDLQJZ2VEY88bGFttW8xchhoq3BCxqnL2da4ilJpiJSlVr7uvOZBdsTlNySk0SLjhvznB_TIE5Ecnd88Vo
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 14 Jun 2023 14:42:31 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5BE2
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEI1E0hwzOcDhb6qUq0rMQx8&google_cver=1&google_push=ATf1kGN4mRZuXFlkT06vLw-OGZU3J20oBBXeJbFNbwoJf3kFDPW5Jrzbp4T05xbiolgEvqeD_aYyWejb...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEI1E0hwzOcDhb6qUq0rMQx8&google_cver=1&google_push=ATf1kGN4mRZuXFlkT06vLw-OGZU3J20oBBXeJbFNbwoJf3kFDPW5Jrzbp4T05xbiolgEvqeD_aY...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTUyNjAxMTM3MTEwNjQ2NzYwMw&google_push=ATf1kGN4mRZuXFlkT06vLw-OGZU3J20oBBXeJbFNbwoJf3kFDPW5Jrzbp4T05xbiolgEvqeD_aYyWe...

170 B
188 B

63ms
62ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTUyNjAxMTM3MTEwNjQ2NzYwMw&google_push=ATf1kGN4mRZuXFlkT06vLw-OGZU3J20oBBXeJbFNbwoJf3kFDPW5Jrzbp4T05xbiolgEvqeD_aYyWejbAl87NsSdrnIu3ickyQyrphQ

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTUyNjAxMTM3MTEwNjQ2NzYwMw&google_push=ATf1kGN4mRZuXFlkT06vLw-OGZU3J20oBBXeJbFNbwoJf3kFDPW5Jrzbp4T05xbiolgEvqeD_aYyWejbAl87NsSdrnIu3ickyQyrphQ
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5BE2
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEIYU0ip3Ea8hsD2cwzWJZPA&google_cver=1&google_push=ATf1kGNnt49rJFis0xcQ_rVyiFXmaESSB4UH0-5ZnoCYR8TuKzIJWG44lftuK17MuXlCFoHFEVp5cMHRbzOU3...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEIYU0ip3Ea8hsD2cwzWJZPA&google_push=ATf1kGNnt49rJFis0xcQ_rVyiFXmaESSB4UH0-5ZnoCYR8TuKzIJWG44lftuK17MuXlCFoHFEVp5cMHRbzOU3...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=ATf1kGNnt49rJFis0xcQ_rVyiFXmaESSB4UH0-5ZnoCYR8TuKzIJWG44lftuK17MuXlCFoHFEVp5cMHRbzOU3yClM6TatjL4l-Z9Sw&google_hm=VjBLLVlhcnNfSlR6YV...

170 B
188 B

69ms
63ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=ATf1kGNnt49rJFis0xcQ_rVyiFXmaESSB4UH0-5ZnoCYR8TuKzIJWG44lftuK17MuXlCFoHFEVp5cMHRbzOU3yClM6TatjL4l-Z9Sw&google_hm=VjBLLVlhcnNfSlR6YVEtV0J0S0Q=

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 15 Jun 2023 14:42:31 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=ATf1kGNnt49rJFis0xcQ_rVyiFXmaESSB4UH0-5ZnoCYR8TuKzIJWG44lftuK17MuXlCFoHFEVp5cMHRbzOU3yClM6TatjL4l-Z9Sw&google_hm=VjBLLVlhcnNfSlR6YVEtV0J0S0Q=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 238
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5BE2
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=google&ssp_init=step1&google_gid=CAESEK4mowas69OruINSA0DY-Ik&google_cver=1&google_push=ATf1kGPNyQsqtzV5yoNJ9Ul4oPEvIQCrtz0hj-hflSR0aens9XKXJh7rxORt9xRWU2ZUVLO0aP6P...
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=google&ssp_init=step1&google_gid=CAESEK4mowas69OruINSA0DY-Ik&google_cver=1&google_push=ATf1kGPNyQsqtzV5yoNJ9Ul4oPEvIQCrtz0hj-hflSR0aens9XKXJh7rxORt9xRWU2ZUVL...
https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=iP5Bq8DIQUe5EC4JBU0sSw==&no_redirect=1&google_push=ATf1kGPNyQsqtzV5yoNJ9Ul4oPEvIQCrtz0hj-hflSR0aens9XKXJh...

170 B
188 B

64ms
61ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=iP5Bq8DIQUe5EC4JBU0sSw==&no_redirect=1&google_push=ATf1kGPNyQsqtzV5yoNJ9Ul4oPEvIQCrtz0hj-hflSR0aens9XKXJh7rxORt9xRWU2ZUVLO0aP6PEQWgtXdvbf8V3YUPwfrSseVL_Bo

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=iP5Bq8DIQUe5EC4JBU0sSw==&no_redirect=1&google_push=ATf1kGPNyQsqtzV5yoNJ9Ul4oPEvIQCrtz0hj-hflSR0aens9XKXJh7rxORt9xRWU2ZUVLO0aP6PEQWgtXdvbf8V3YUPwfrSseVL_Bo
date: Thu, 15 Jun 2023 14:42:31 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5BE2
Redirect Chain

https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEEBKkUVnmVV3c5CqB0-NnSI&google_cver=1&google_push=ATf1kGNc7TWp820aj6sIqdT6qKSX9nBZHiwhQTrd0PSPz-VHXGhgzylj_GGX85pq6YtF94iDW31mxeWdnZxEuHCt4...
https://sync-dmp.mobtrakk.com/match/google?google_gid=CAESEEBKkUVnmVV3c5CqB0-NnSI&google_cver=1&google_push=ATf1kGNc7TWp820aj6sIqdT6qKSX9nBZHiwhQTrd0PSPz-VHXGhgzylj_GGX85pq6YtF94iDW31mxeWdnZxEuHCt4...
https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=N2QxMTFhN2U3MTZlMGMxYw&google_push=ATf1kGNc7TWp820aj6sIqdT6qKSX9nBZHiwhQTrd0PSPz-VHXGhgzylj_GGX85pq6YtF94iDW31mxeWdnZxEuHCt4TqiDbuG...

170 B
188 B

66ms
64ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=N2QxMTFhN2U3MTZlMGMxYw&google_push=ATf1kGNc7TWp820aj6sIqdT6qKSX9nBZHiwhQTrd0PSPz-VHXGhgzylj_GGX85pq6YtF94iDW31mxeWdnZxEuHCt4TqiDbuGn-vZTahI

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 15 Jun 2023 14:42:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: nginx
x-frame-options: SAMEORIGIN
location: https://cm.g.doubleclick.net/pixel?google_nid=992917243&google_hm=N2QxMTFhN2U3MTZlMGMxYw&google_push=ATf1kGNc7TWp820aj6sIqdT6qKSX9nBZHiwhQTrd0PSPz-VHXGhgzylj_GGX85pq6YtF94iDW31mxeWdnZxEuHCt4TqiDbuGn-vZTahI
content-length: 0
x-xss-protection: 1; mode=block

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5BE2 0
12 B 64ms
62ms Image
text/html 142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I8U6ChwURX37PpaEYlBJzkdBHdImHEiaNs0ctt-TMk8dR-lMaMp-5mVEtkxCVnpMEXX_8JG10

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H2 200 all
csm.us.criteo.net/ Frame 51FD 0
127 B 50ms
50ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=yGwXkeEtjxjqvmNc7wiQL_TFUygTst_4AWki0sRS2RQvs-m5LZbLC-WOD79QhcR7DuDB517QM7FVe-57zxTdzkhtJ04rcRcUi4RhNCQzZoN0lyCxcB-_Z04cNFTQOgUMe0Tr2pZniIXqnIyZDGL_6wogDHYUDrT3BSq2adT_GwD1AXWcMrnpZGJhJx9N-DPbNFs-pOO7bIYdcJaW_xxAzlG-JtFSpI3SiQMBgJ7fciV1I9lADR_PmV_-uxDgPrLx9HnCpA&sds=2&rev=87007&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 51FD 2 KB
1 KB 44ms
43ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 51FD 2 KB
1 KB 47ms
47ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 09 Jun 2024 14:42:30 GMT

GET
DATA 200
OK truncated
/ Frame 621A 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f791311d76da0dc8a0984636e32e5701efd3abbf5aa51181a4b72eb169db3c9b

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 621A 0
19 B 71ms
69ms Image
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CCyEVVSOLZI6GE4WuqMwP7PGBkAWcge-wXLKaqap0wI23ARABIABgybajiPCj7BKCARdjYS1wdWItMTYxODU5MjIwNTA4Mzc4MMgBCagDAaoEoAJP0FUvbZORgOslr2EHitJFFqiiYo_3RGfrnWfxypNTo9q6n7eeByc90p_h67urHkUUPRgS66WXxX1omXDtOp0EjNpWFtKjwxqzrmEmE-tKdy-hKjnoxnObH-Sqm0YCMd_hpK4aFeC_Oq13DeBHTJJSn6hGXlfT2etFXaRdN0_22uvsWH2WRsAd34Tef6c8C-CcyEa_6seRbDyJ_Y40UCdWpEdqh2MktsaDz4nR5ehtTJ5hVQpwOQUjlku5TELbJh0qYDEh0I-SuEvjqUhS7agEPeStEuINgUTaqGgBqUjBxFEWEfeU-R3FImkHvqLNDqGLhmnc2-uyuHbRIzkI8JSCq_hwlx4i4PftgRLjLv_lelCQKu3uOSXFhqfi2lflKX2ABsnH_frd-O6SF6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBAgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTE2MTg1OTIyMDUwODM3ODAYAA&sigh=tTtOlewNPmc&uach_m=[UACH]&cid=CAQSPABygQiDX8o3E6tbJ4CyBuJE_M1Ea4Vt0QUZPim227Guxp4Ox81fsLnROTblOU00aE9WKwI1g1FZqPjHaBgB&vis=1

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 15 Jun 2023 14:42:30 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.da.us.criteo.com/google/auction/ Frame 621A 0
125 B 56ms
51ms Image
text/plain 2620:100:a005::14
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.da.us.criteo.com/google/auction/notify?profile=14&payload=kOSJF836RMgB2ATiIp0XAgAAAO4XoloobBbnEFQji2QOercCr-vn02F-AAASAAAKCkFRVUJEQUVCREE&wp=ZIsjVQAEww4DihcFAAB47ISTA6b2r1EU0fx3FQ

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a005::14 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 325074
server: Kestrel
content-length: 0

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame D6BC 227 KB
227 KB 99ms
72ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?m=0&partner=52383&q=80&r=0&u=http%3A%2F%2Fstatic.va.us.criteo.net%2Fdesign%2Fdt%2F52383%2F4778698%2F0879816351e44cdba2a0c46de2f016d3_742.jpg&v=3&s=9fXGxhiHEQMTR-9kVML6pJFB

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

fbdc0902cc7b4f7617d0dfc0adc79639079176c40c1cf80ddf9e06084e573e7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 232210
expires: Mon, 03 Jun 2024 14:41:51 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame D6BC 16 KB
17 KB 84ms
57ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?h=180&m=0&partner=52383&q=80&r=0&u=http%3A%2F%2Fstatic.va.us.criteo.net%2Fdesign%2Fdt%2F52383%2F4778698%2F54b6f21bb8c24ce98d92e0a2b278c96c_black_logo_600.png&v=3&w=340&s=TWxCqVtNu7ygS1OGEIDndCt6

Requested by

Host: www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
URL: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

a8d55e611caf007e5c10d083fa7007c20814dcc30450977bbe23636541fc5cde

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 16829
expires: Mon, 03 Jun 2024 14:43:32 GMT

GET
DATA 200
OK truncated
/ Frame 2C9E 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 08fbf7c8cd8c3259c79fe276c00b6d0f2d2f91c34eb41973e6eb2118812f89c9

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 176ms
74ms XHR
application/json 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202306060101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306060101/pubads_impl.js?cb=31075344

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ba1bc728d9185fbc48b53cd3d3721e1c567d212b5b553e1f87e88d688be97517

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11219
x-xss-protection: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 2C9E 0
19 B 70ms
68ms Image
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cfw1cVSOLZI-GE4WuqMwP7PGBkAWcge-wXLKaqap0wI23ARABIABgybajiPCj7BKCARdjYS1wdWItMTYxODU5MjIwNTA4Mzc4MMgBCagDAaoEnwJP0DJ7xndADvXQlTvFc-Q0HqPhMKWnu0ET27EYACSb4hJ5MRNdbxB2mIrZqo7tj4K-HdLvyG9DIfZE37hAU6gvmyEcsOB2eFSvYu2Og8PSXOYcOBpzQ58OGPe4ILUfER1ddscE5tXcASUfl-JnDluVRz19gO7ODH15_nsz1_biW2_KQGI9YmnPfIZ7F4EPbqxIMifqqs4n3Tg0RnQBMoXjrvuijOenyvfv5YAn8poIaHQos1o6vHvWaIJTs0VV5RHXytm-pSL8GVC3_rhBwv3iA0xxm2IC8VPgQWy9RlOLd-gVTwOi1oDM8tE3i1zUFM3MzZjhEWXTOKCcrS2Sw8_NcnlxZo2-54NP8nq_2BuKGnpGMj7LzmQxuOgdDeCqx4AGycf9-t347pIXoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDQiAYRABMgKKAjoCgECACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItMTYxODU5MjIwNTA4Mzc4MBgA&sigh=pv-IXQRtBdE&uach_m=[UACH]&cid=CAQSPABygQiDX8o3E6tbJ4CyBuJE_M1Ea4Vt0QUZPim227Guxp4Ox81fsLnROTblOU00aE9WKwI1g1FZqPjHaBgB&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20230613/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 15 Jun 2023 14:42:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.da.us.criteo.com/google/auction/ Frame 2C9E 0
125 B 59ms
51ms Image
text/plain 2620:100:a005::14
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.da.us.criteo.com/google/auction/notify?profile=14&payload=kOSJF836RMgB2ATiIp0XAgAAAO4XoloobBbnEFQji2RYpsRSbdW3bh-2AAASAAAKCkFRVUJEQUVCREE&wp=ZIsjVQAEww8DihcFAAB47I-87xnLKrSFTTif-g

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a005::14 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 225741
server: Kestrel
content-length: 0

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 51FD 227 KB
227 KB 170ms
168ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

fbdc0902cc7b4f7617d0dfc0adc79639079176c40c1cf80ddf9e06084e573e7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 232210
expires: Mon, 03 Jun 2024 14:41:51 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 51FD 16 KB
17 KB 164ms
163ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

a8d55e611caf007e5c10d083fa7007c20814dcc30450977bbe23636541fc5cde

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 16829
expires: Mon, 03 Jun 2024 14:43:32 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame D6BC 16 KB
17 KB 137ms
135ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

a8d55e611caf007e5c10d083fa7007c20814dcc30450977bbe23636541fc5cde

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 16829
expires: Mon, 03 Jun 2024 14:43:32 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 67ms
66ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306060101/pubads_impl.js?cb=31075344

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 15 Jun 2023 14:42:31 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame D6BC 227 KB
227 KB 64ms
49ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

fbdc0902cc7b4f7617d0dfc0adc79639079176c40c1cf80ddf9e06084e573e7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 232210
expires: Mon, 03 Jun 2024 14:41:51 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 51FD 16 KB
17 KB 58ms
47ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

a8d55e611caf007e5c10d083fa7007c20814dcc30450977bbe23636541fc5cde

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 16829
expires: Mon, 03 Jun 2024 14:43:32 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 51FD 227 KB
227 KB 47ms
46ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

fbdc0902cc7b4f7617d0dfc0adc79639079176c40c1cf80ddf9e06084e573e7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:30 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 232210
expires: Mon, 03 Jun 2024 14:41:51 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 167A 13 KB
5 KB 51ms
46ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 164813
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 13 Jun 2023 16:55:38 GMT
expires: Wed, 12 Jun 2024 16:55:38 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame CB0E 783 B
534 B 70ms
66ms Document
text/html 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2004 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

63d5b2cdf6009957f81d3f509378d6f3afd2d1cebafde8f78cf875a8a7aaac89

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-P1Azi1debUMmTv6Io82nXg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-P1Azi1debUMmTv6Io82nXg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 15 Jun 2023 14:42:31 GMT
expires: Thu, 15 Jun 2023 14:42:31 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js Show response
pagead2.googlesyndication.com/bg/ Frame 167A 37 KB
14 KB 48ms
47ms Script
text/javascript 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c7dd9b3c12fde91e325f5a42fbc0f6d83566d528b624b0b4833ca87a9cc3f64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 14 Jun 2023 19:20:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69745
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14492
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 13 Jun 2024 19:20:06 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame CB0E 0
0 61ms
60ms Image
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202306060101&jk=3936331350408028&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 167A 0
10 B 45ms
45ms Image
text/plain 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?rFX7Pg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81c::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 14:42:31 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DEC0 42 B
64 B 61ms
60ms Fetch
image/gif 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsugl3OTt1QlIZpNT__3GD9R1XyMdaby4wEHD7P6a8K6JCz8KL875k1-BuTCs0sIn60d7DLESIpuPhLnQxSei2JIekM&sig=Cg0ArKJSzLHguTdliPUbEAE&id=lidar2&mcvt=1006&p=0,0,124,1005&mtos=285,938,1006,1152,1152&tos=285,653,68,146,0&v=20230614&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1686840150161&rpt=451&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 621A 42 B
64 B 63ms
62ms Fetch
image/gif 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstleYqNERQOvw8gaT50HYSlA3tpJDXjbd_ytsKEt6QiSQvRaGAWFZEyVHUhNhgHVJV5fb9q8vNpakKyYyRY-E2TEkQ&sig=Cg0ArKJSzChsYr3QnfMyEAE&id=lidar2&mcvt=1001&p=0,0,600,200&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20230614&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271803&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1686840150182&rpt=504&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame D6BC 0
127 B 49ms
48ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 15 Jun 2023 14:42:31 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

POST
H2 200 all
csm.us.criteo.net/ Frame 51FD 0
127 B 48ms
48ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 15 Jun 2023 14:42:31 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2C9E 42 B
64 B 64ms
63ms Fetch
image/gif 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuBgcDWEoaolm4pPL94WOVxBxa2xicdOhAX5AWGFss8W4nqV3jihzZ1Ilq1QAFspBqmjd1dFacS2nQYLmF0io2Q9f8&sig=Cg0ArKJSzHEilbF1RP37EAE&id=lidar2&mcvt=1000&p=0,0,600,200&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230614&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271804&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1686840150192&rpt=569&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Jun 2023 14:42:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 63ms
62ms Image
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202306060101&jk=3936331350408028&bg=!oaKlovbNAAaGYqkwpmI7ADkAdvg8Wj9epXKEwvkmLHeV0OTYAT8yZCatBv4JN-vnrMPSAEw2F8SslFF9ZqEQNWPZP80yWKg1L8ACAAAA3FIAAAAnaAEHmQMRFP1oIp71K4rhpQKlfC-i4ys3VbZMGXS6DJl4oTMNTlVVSKxNeGo85OcIqIY53PbcBfrhYFQ-YvGUg57GNu0QJpSbKVhFEbdQpLGtBkqUoIDqET__F_FWmPTa0tC_jy6bmXYSLz66koTmeTexlTLpubb0kXGhPYpOVL5smrlyLLnSfUm0ThPPshH3HZvOYoevSfhhp86IIKKm6hP_hqa4LSzv09UtlqUXS8KcNLwA1jRleO6_UOfIhmR6KzRWPeCrHmeKieVHCmYhlQUNaJ_DhtNdYyAZboYKKj3L-63aTfWIlzPr0DsCupk3GzSJlemk6MwPPJgkJIHrnzXQ-x38TImYTT215ST64cY5VFdiy1qhxRLlxbtoWWtNcGqaHRIBn5kllayNq9h4BJrt-yrEvOAUnvQGl3hxtXM5ClqsfR094KcCPTSZDSkrJUkdFrD7vUk1zSSlXIxXZUtLz14muPINnt8yRiiQCC5McKHB0S4AGgFh6wDGelZgn8gBDd5YNhQ5CMT2aS8wSyAn5SJCc-1Mi8lf6f-uOJpTbctjDkoqQQkAgb5xZYuBKwCpgv7xkf99HaIVlpE4hLOskLPzXI0KyVKlCfauAMhMlERaLjHwNEMl71x1ne0wfVza_Btzq3dOMnWhKq-nYjs78nuRW2T3XesodUuEppiwxAuUjF70bliFJBjuFOyCEi0DfP5Ba2eGhLXaGPr6HP_EodZiV3frGvt0zFscPr5ApNvaGM_l35rj64nDnT2Sp3__-amySN84H5pi5zA0hjEASTfvgNJybYGjVXMbXh9CdxuXxue-25QtVMvOpsseizKZyMn1lqmQlPwbl4-Vuu5jcdlgOk_fwBTPAJtULrj7O-COtGU0iAq5C-KLNlDV-LeAKATbU5e0rTtz4n-bH5NHqR66N3j2taOoY55q-swddfQNFIMJM5YprQspHUBkZhUjlLySgvxcTaKns64CWeKc7LUZEIg-hmtTzRyMOxCOmDDCiZImoPQaOXIhaIRo82kz0sH21KtQMktRNyqcv6k5ZTh6Vso
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:821::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

POST
H2 200 all
csm.us.criteo.net/ Frame 9744 0
127 B 48ms
47ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 15 Jun 2023 14:42:31 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: sync-tm.everesttech.net
URL: https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEI1phIPTVkWfwssiEGLwhKc&google_cver=1&google_push=ATf1kGNTmH1FQ5RO4EjsN71JngYj7zAD65o2UAZOnReqiPsnZdp2Awrci6np6M2dDueVZfufEAEh0AiO25puCLlxDK5fxlkqU_j5Lew

Domain: ad.mail.ru
URL: https://ad.mail.ru/hbid_yandex/

Verdicts & Comments Add Verdict or Comment

193 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

70 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.bookmp3.ru/	1970-01-20 21:19:36	Name: __ddg1_ Value: hY7DbqIHpv2lcyxxkLC3
www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/	1969-12-31 23:59:59	Name: _csrf-frontend Value: c73827798bd0b39a658da19f29deab554096f55c5fcee942459fb3cda4fde970a%3A2%3A%7Bi%3A0%3Bs%3A14%3A%22_csrf-frontend%22%3Bi%3A1%3Bs%3A32%3A%22%2CW%FC%D8%E8q%3C%E7%AC%F3%E9%BC7%E5%8D%99-%7D%09N%C0%85%92%9B%CB%CB+N%E7%CDg%9C%22%3B%7D
www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru/	1969-12-31 23:59:59	Name: b Value: b
.yadro.ru/	1970-01-20 21:18:32	Name: FTID Value: 1aYoDK2p3q8a1aYoDK00370R
.bookmp3.ru/	1970-01-20 21:55:36	Name: __gads Value: ID=e90c8a82ed80e392-22ece1c782e10032:T=1686840149:RT=1686840149:S=ALNI_Maxc8c3yYxsgwaZau_6WtOEy6gjWg
.bookmp3.ru/	1970-01-20 21:55:36	Name: __gpi Value: UID=00000c4f5f4a2d18:T=1686840149:RT=1686840149:S=ALNI_MYQ9ibWM8pFfDfMTvRFfCpzTNfdOg
.hit.ua/	1970-01-20 22:10:00	Name: uid Value: 401596307.1686840149.3263220228
.yadro.ru/	1970-01-20 21:18:32	Name: VID Value: 2gGyNx3YMNua1aYoDL003Oda
.bookmp3.ru/	1970-01-20 22:10:00	Name: _ga Value: GA1.2.22385216.1686840149
.bookmp3.ru/	1970-01-20 12:35:26	Name: _gid Value: GA1.2.1693538489.1686840149
.bookmp3.ru/	1970-01-20 12:34:00	Name: _gat Value: 1
.bookmp3.ru/	1970-01-20 21:19:36	Name: _ym_uid Value: 1686840149714077504
.bookmp3.ru/	1970-01-20 21:19:36	Name: _ym_d Value: 1686840149
.yandex.ru/	1970-01-20 22:10:00	Name: i Value: 0bAkSgwHP2W2LhddYOqDZTo87QC6/zNNF/BjHE+UFa/SxQPotqjAw03Vy8zgSeML97jDCIovLwUFU1qjZDSNSJHPFXk=
.yandex.ru/	1970-01-20 22:10:00	Name: yandexuid Value: 6560696851686840149
.mc.yandex.com/	1970-01-20 12:34:00	Name: sync_cookie_csrf Value: 1753514524fake
.doubleclick.net/	1970-01-20 22:10:00	Name: IDE Value: AHWqTUnvdshykpYDZ4L7Gc6_f1rSNZW9T9lBojwi9mQTw4FW9BO0z56v2yR9k20IPNg
.bookmp3.ru/	1970-01-20 12:35:12	Name: _ym_isad Value: 2
.mc.yandex.ru/	1970-01-20 12:34:00	Name: sync_cookie_csrf Value: 2068608614fake
.yandex.com/	1970-01-20 21:19:36	Name: yandexuid Value: 6560696851686840149
.yandex.com/	1970-01-20 21:19:36	Name: yuidss Value: 6560696851686840149
.yandex.com/	1970-01-20 22:10:00	Name: i Value: 0bAkSgwHP2W2LhddYOqDZTo87QC6/zNNF/BjHE+UFa/SxQPotqjAw03Vy8zgSeML97jDCIovLwUFU1qjZDSNSJHPFXk=
.mc.yandex.com/	1970-01-20 12:35:26	Name: sync_cookie_ok Value: synced
.blismedia.com/	1970-01-20 21:19:40	Name: b Value: 648B23557366E2368AD96FFBBLIS
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNrG0NDM2NzQztzA0NjUwMzYwMBDiM9QtNQ-vTAnISXGtzPIAACJYvOclAAAA
.rfihub.com/	1970-01-20 21:55:36	Name: rud Value: H4sIAAAAAAAA_-MSNrG0NDM2NzQztzA0NjUwMzYwMBDiM9QtNQ-vTAnISXGtzPIAACJYvOclAAAA
.turn.com/	1970-01-20 16:53:12	Name: uid Value: 3189215410316590351
.adsrvr.org/	1970-01-20 21:21:02	Name: TDID Value: 90f8ef15-5622-4eea-951b-0c7b485f3d93
.betweendigital.com/	1970-01-20 21:19:36	Name: dc Value: was1
.betweendigital.com/	1970-01-20 21:19:36	Name: tuuid Value: 16d7cb65-faa6-53a6-8580-6156e10b4200
.betweendigital.com/	1970-01-20 21:19:36	Name: ut Value: ZIsjVgAALuAqg9aGg_zqkIKM5tcxTohfbRRUjg==
.betweendigital.com/	1970-01-20 21:19:36	Name: ss Value: 1
.betweendigital.com/	1970-01-20 21:19:36	Name: unm Value: 1
sync.srv.stackadapt.com/	1970-01-20 21:19:36	Name: sa-user-id Value: s%3A0-896497ea-5dde-5276-67db-4d15c2d6ed0f.vgTudeveT1F6qRFIqB517RvqV6CnEZbgB6%2BgVF0mXHU
sync.srv.stackadapt.com/	1970-01-20 21:19:36	Name: sa-user-id-v2 Value: s%3AiWSX6l3eUnZn200VwtbtD6dYB6I.2Gp0zfPAdb81bcbFc1jXx3mS94YBAB65S76PSaIPWQI
.srv.stackadapt.com/	1970-01-20 21:19:36	Name: sa-user-id-v2 Value: s%3AiWSX6l3eUnZn200VwtbtD6dYB6I.2Gp0zfPAdb81bcbFc1jXx3mS94YBAB65S76PSaIPWQI
.yandex.com/	1970-01-20 21:19:36	Name: ymex Value: 1718376150.yrts.1686840150
.yandex.com/	1970-01-20 21:19:36	Name: bh Value: KgI/MA==
mc.yandex.com/	1969-12-31 23:59:59	Name: yabs-sid Value: 1771108361686840150
.bookmp3.ru/	1970-01-20 22:10:00	Name: _ga_XR25G8TDFM Value: GS1.2.1686840150.1.0.1686840150.0.0.0
.bookmp3.ru/	1970-01-20 12:34:01	Name: _ym_visorc Value: w
.rfihub.com/	1970-01-20 21:55:36	Name: eud Value: H4sIAAAAAAAA_-OSMXR2dA12dfeMCNE1N0928wgqMPQwtswIMSgLtwjiNTSzMLMwMTA0NTAztHjFiMoHAEOji349AAAA
.rfihub.com/	1969-12-31 23:59:59	Name: euds Value: H4sIAAAAAAAA_-OSMXR2dA12dfeMCNE1N0928wgqMPQwtswIMSgLtwAAVztDXR4AAAA
.yandex.ru/	1970-01-20 22:10:00	Name: yuidss Value: 6560696851686840149
.adkernel.com/	1970-01-20 12:54:09	Name: ADK_EX_11 Value: 1
.adkernel.com/	1970-01-20 13:17:12	Name: ADKUID Value: A3061758587459747910
fksnk.com/	1970-01-20 12:44:04	Name: AWSALBCORS Value: 7DhdNUaiqFHce1rykFCdgemAtEYxHdKL7RHX+BTw5J7k2/1Zy6p6UaV9mtofF4HoAUIO3P5AmIv1eNdjENeX6PT503BqPIqpZMR6qDbmApM5zofKCSuzE6ka7MH2
.fksnk.com/	1970-01-20 14:43:36	Name: f_001 Value: CFD25626C1CE7C0C
.fksnk.com/	1970-01-20 12:35:26	Name: g_001 Value: 1
.mxptint.net/	1970-01-20 22:10:00	Name: mxpim Value: R33645_1044FA6BB_55E2E882.1.648B2356
.dotomi.com/	1970-01-20 12:34:00	Name: DotomiTest Value: 10dd92739f2b05ae
beacon.lynx.cognitivlabs.com/	1970-01-20 21:21:02	Name: UID Value: 6022cc43-4bc1-49f1-8d6a-3d7680475f73
beacon.lynx.cognitivlabs.com/	1970-01-20 21:21:02	Name: ss Value: J4zUQFWbOI1tS90xkWNDo0Rzn4yw34KFPxuxJ39vz%2FMn%2BBOk1dRIpWBcgMZwZ6KS2oioAUVMm2X4cvP552P%2FeA%3D%3D
.w55c.net/	1970-01-20 22:04:14	Name: wfivefivec Value: wWjIpcxd1Q9Obc5
.w55c.net/	1970-01-20 13:17:12	Name: matchgoogle Value: 5
.uuidksinc.net/	1970-01-20 21:19:36	Name: jcsuuid Value: YGbEFcADlQj6q8VxlGno
.everesttech.net/	1970-01-20 21:19:36	Name: everest_g_v2 Value: g_surferid~ZIsjVgAHxsvWJQBI
.e-volution.ai/	1970-01-20 12:54:09	Name: ADK_EX_193 Value: 1
.e-volution.ai/	1970-01-20 13:17:12	Name: ADKUID Value: A3061758587459747910
.adform.net/	1970-01-20 13:17:12	Name: C Value: 1
.simpli.fi/	1970-01-20 21:21:02	Name: suid Value: DBE78E55CD8A4F8BA66CBF68308278B7
sync-dmp.mobtrakk.com/	1969-12-31 23:59:59	Name: chk Value: 1
.mfadsrvr.com/	1970-01-20 22:10:00	Name: tuuid Value: 88fe41ab-c0c8-4147-b910-2e09054d2c4b
.mfadsrvr.com/	1970-01-20 22:10:00	Name: c Value: 1686840151
.mfadsrvr.com/	1970-01-20 22:10:00	Name: tuuid_lu Value: 1686840151
.zemanta.com/	1970-01-20 21:19:36	Name: zuid Value: V0K-Yars_JTzaQ-WBtKD
.adform.net/	1970-01-20 14:00:24	Name: uid Value: 5526011371106467603
sync-dmp.mobtrakk.com/	1970-01-20 22:10:00	Name: pid Value: N2QxMTFhN2U3MTZlMGMxYw
.mfadsrvr.com/	1970-01-20 22:10:00	Name: ssh Value: !google,1686840151
.adsrvr.org/	1970-01-20 21:21:02	Name: TDCPM Value: CAESFQoGZ29vZ2xlEgsItrL6ipnu9jsQBRgFIAEoAjILCP6Hu6Kv7vY7EAU4AQ..

13 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/2/audiobook-tma-2.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/1/2/audiobook-belosnezhka-i-jarostnye-gnomy-skazka-pervaja.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/1/1/audiobook-materinskoe-voskresene.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/4/0/audiobook-sistemnye-zapiski.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/4/audiobook-katastrofa-2.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/3/8/audiobook-cherepakha-tunejadca-vitjushi.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/3/9/audiobook-istorija-moikh-bedstvijj.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/0/audiobook-nikto-ne-angel.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/1/3/audiobook-shtanishki-na-malchika-1.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/5/audiobook-prizrak-obolshhenija.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/3/audiobook-tonnel-v-leto-vykhod-proshhanijj.jpg Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: https://xp4stm90bvzr.frontroute.org/s02/images/audiobooks/6/4/0/2/1/audiobook-testorium-29.jpg Message: Failed to load resource: the server responded with a status of 502 ()
other	warning	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1618592205083780&output=html&h=178&slotname=2609168587&adk=1374432671&adf=4036610663&pi=t.ma~as.2609168587&w=710&fwrn=4&lmt=1686840149&rafmt=11&format=710x178&url=https%3A%2F%2Fwww.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686840148783&bpp=5&bdt=1859&idt=262&shv=r20230613&mjsv=m202306080101&ptt=9&saldr=aa&abxe=1&correlator=1325168925188&frm=20&pv=2&ga_vid=22385216.1686840149&ga_sid=1686840149&ga_hid=632164813&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=295&ady=1629&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759875%2C44759926%2C42532277%2C44792109%2C42532279%2C31074583%2C31075068%2C44785295%2C44788441&oid=2&pvsid=3936331350408028&tmod=504077616&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=nNrCucJOQk&p=https%3A//www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru&dtd=313 Message: Origin trial controlled feature not enabled: 'attribution-reporting'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.rfihub.com
ad.mail.ru
ad.turn.com
ads.betweendigital.com
ads.us.criteo.com
adservice.google.com
aep.mxptint.net
an.yandex.ru
b1sync.zemanta.com
beacon.lynx.cognitivlabs.com
c.hit.ua
c1.adform.net
cat.va.us.criteo.com
cm.g.doubleclick.net
counter.yadro.ru
csm.us.criteo.net
dad5d4bc16389101446b988e3b9e0a4d.safeframe.googlesyndication.com
dclk-match.dotomi.com
dis.criteo.com
dsp.adkernel.com
fksnk.com
googleads.g.doubleclick.net
imageproxy.us.criteo.net
match.adsrvr.org
matchid.adfox.yandex.ru
mc.yandex.com
mc.yandex.ru
pagead2.googlesyndication.com
partner.googleadservices.com
pm.w55c.net
r.turn.com
rtb.adentifi.com
rtb.da.us.criteo.com
rtb.mfadsrvr.com
rtb.va.us.criteo.com
rtb2-useast.e-volution.ai
s.uuidksinc.net
securepubads.g.doubleclick.net
static.criteo.net
sync-dmp.mobtrakk.com
sync-tm.everesttech.net
sync.srv.stackadapt.com
tpc.googlesyndication.com
tr.blismedia.com
um.simpli.fi
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru
xp4stm90bvzr.frontroute.org
yandex.ru
yastatic.net
ad.mail.ru
sync-tm.everesttech.net
142.251.32.98
151.101.66.49
174.137.133.49
185.167.164.49
185.98.54.153
199.38.167.131
2606:4700:3038::6815:e9df
2606:ae80:1471:1a::1400
2607:f8b0:4006:817::2001
2607:f8b0:4006:817::2008
2607:f8b0:4006:81c::2001
2607:f8b0:4006:81e::2004
2607:f8b0:4006:820::2002
2607:f8b0:4006:821::2002
2607:f8b0:4006:823::2002
2607:f8b0:4006:824::2002
2607:f8b0:4006:824::200e
2620:100:a001::16
2620:100:a001::24
2620:100:a001::3
2620:100:a001::4
2620:100:a001::9
2620:100:a005::14
2620:112:f002:bbbb::21
2a02:6b8:20::215
2a02:6b8::16b
2a02:6b8::1:119
2a02:6b8::90
2a02:6b8:a::a
3.135.132.32
34.150.170.96
34.96.105.8
35.173.115.238
35.207.24.140
35.71.131.137
38.98.69.175
45.147.197.153
52.1.202.173
52.2.225.179
54.205.93.130
54.209.34.236
64.202.112.223
74.119.119.147
74.119.119.150
88.212.202.52
89.184.81.35
96.46.186.57
00a7d2e7e17c9771efecd01f4d2a952d5f495ec47aa6f97ec2678efe661a7ef6
033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9
037b420714a2fb0b7991cc3a543699cd114cb0e63efb8261a3c809519f8cc3e1
08fbf7c8cd8c3259c79fe276c00b6d0f2d2f91c34eb41973e6eb2118812f89c9
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0a8f9918ddcc17d14cd3afeb05e5e999cacb85523c3447db6107969bb275710d
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c384e9f5a0511e6e45bbaf26eba3f51edf331b05e20efa57f243d87ad4c452e
12d8aae0cf51d039bfbef1c8f7ec828851423f05c8f9e5d290b2c2e15cd9a8a6
151b2b51325341cc624a0eb44835b53bf6f54ac713b6f318455f76f3b7d2b789
15af8c5f6fd626f5aef15d32d6867911f0a084dfeef9d4f28e692505d5cabcc2
19eaf1e870bdb8712cc22161dea59e8aae717c901415cb6b2d7a71fbe7889829
1c86a366ec6f558c2fc53da4077489f28ec37a572c24f8bdb2b375409ae03716
241ea6d0d799b0e6d33ac6071f1f71166021ac71eedf37cfe791af11fa5476dd
28c8c0c76b514f3b4abc6fff4a2edc99b0020737d0db600d42d33a9f70c18cdd
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55
3521f5e84dbf85e9b7a304002330fbccf347abc9d0a43765a1838336b8a98c0c
35885fc384e841d5ad9f0bf15c68cddff795555c9fe5606ea0bdf5987b1b6889
3be3f024c46ff93eb55bb00f599911ef69c7957b19c8c3df9aca743259f35ae3
3d5ed64d6d4f56e89303854e8a3acf527b1d3b6b59c8970da831bb23df80ed43
3ec4196556cc8b9a1774f069cc5e0881910e8af98192fc3c81cdc63b68a63a14
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
47a37cabd33f930dd28119e3ba60cca269770f1b2a774a52bad0a75d8076cd8a
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
48b551ea7cc10bfe0fd691b67bbb5951ced65174095642157f46c60385d0fc38
4c7dd9b3c12fde91e325f5a42fbc0f6d83566d528b624b0b4833ca87a9cc3f64
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
50e4c20b2a1596f5618dbccb3ad11d4f42f18066d9f89bfe7cb6b6b633a1afcb
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5b981fdc5a41fcfaa4fb2da3d69f61df024fb1202b82cce98506e8b31d917111
5f521295f1a9eca57c79994d10371e9d5ba4f540755a4aee43163c10dd99b772
60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63d5b2cdf6009957f81d3f509378d6f3afd2d1cebafde8f78cf875a8a7aaac89
66b620fcff5a59ab0855325dfcacee0d556f2014e49145c2e5861fa726b0a1cb
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
80817ceead858dd49119fe01e4e87ba98a74d6a34ca07ae5f9bb71b6c379c0b6
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b
8687243a605d506b71823d4dabe58db65d0522bd2391cd8fcd25bd1533b9d9db
8cfe72a24bd8aec49791ed914f7f92b1b7c9598df4f19c0afb2a60a605b60fe2
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
930f35a5eafccc0461464e55d2fa2915e83b87e884dfca96494b277ddfc08257
95ac0261ac793f12426f513852780977bd0cf558e29fec5ab00c773a133f58d8
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a390b07212dbcb94117883431160d2f769673c3a7aee37da082c571a453c92ff
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a61735542ef93f832ab8321f9670a83ff11f58b5e122b2fb014199e32de05312
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a8d55e611caf007e5c10d083fa7007c20814dcc30450977bbe23636541fc5cde
a94755ecd90a113ceb5ffbb9a9834639bbf215711895074c4181eb309929ca25
b9db30db84c353b393ebed43c0803e40d62453ec010584b9449a28f0348cd01b
ba1bc728d9185fbc48b53cd3d3721e1c567d212b5b553e1f87e88d688be97517
bb21e3fde4bacb45fc038813bce8c6da58e3d3630e658f3a24ec9a8e6c885dd5
bc4540a14193a6537e0c03127bbf19848e6226bd437f2550d18f1f385c55eccb
bd6c0a1e26482503724c59cdcad0389c7b946cb5d9c4a96f327274803811ffda
c2811e78f286560048117ac1f4a9ae74d3d07f11c7472b939a6148fcd07cb0f7
c53a5737c7a48a4a035d1af0c7c364922ae5c63eded7b95146e1116f6e5afc16
cb487b1dea588fcbde560a7eda87f48e20e6acf52f0b66e9c26e63f720d7d904
ccd49ed7c444d095aad6a9a136955f70cf21a0140005c0f92eef6c39abf2dc55
cff0c1a96448090f545a7aa6bfc07c0cbfcdf51d370f0bd7cf72fe51e6a3ffe8
d09b9cf5cae9b79ad02a0076919caebcfa94ea95bb8f3e2efac3c4c8d189f98e
d6d6716cbd4765998e3b1d03bdc02fe3f1dc5f5876e71194e1b2098228e0911b
d84ad69a383d387af3b53da2110d938167350fc5ff7f3a51199e9cbcf26f796c
d88be0ee6e8377978f2e89e00285ce047bfa41fdbff601fc37b5ad3642e5793f
db0d17ee9c24794dc313d2588c0c19bccccb2f7439a0dcb6be8cc985df84baf3
dc4bf55610b9fa925d2960408f4d88cb4d9934e10854aea41296fa953e864e00
e0d8a23d4a1a42084225802bf300a946e66215a6a2186e30437dcc7ddd724dd5
e2c341422188fa1c4d9bd46360583722454235ceb01cbcae83c0ebb84657836f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d
eef8fa6be25456db9d35b5ce8f508da26be76b9f6164fe8bdf55a76b053ed920
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f791311d76da0dc8a0984636e32e5701efd3abbf5aa51181a4b72eb169db3c9b
f919c02713441d1502a5297ec6201783ecf8070a47d5df866a78ca2fb83bc865
fbdc0902cc7b4f7617d0dfc0adc79639079176c40c1cf80ddf9e06084e573e7e

www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru Open in urlscan Pro 45.147.197.153 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

201 Requests

84 %HTTPS

49 %IPv6

38 Domains

53 Subdomains

32 IPs

5 Countries

2792 kBTransfer

6623 kBSize

70 Cookies

11 Outgoing links

Redirected requests

201 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.pay.pay.sber.sber.qbdkzlgnrid7p9h.ljudi-i-neljudi-1.bookmp3.ru Open in urlscan Pro
45.147.197.153 Public Scan

Screenshot
Live screenshot

Full Image

201
Requests

84 %
HTTPS

49 %
IPv6

38
Domains

53
Subdomains

32
IPs

5
Countries

2792 kB
Transfer

6623 kB
Size

70
Cookies

201 HTTP transactions
4 data transactions