povorotnetuda.ru Open in urlscan Pro
87.236.16.107 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://povorotnetuda.ru/login.php
Submission Tags: phishtake
Submission: On May 07 via api (May 7th 2021, 1:57:54 pm UTC) from JP

Summary HTTP 68 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 17 IPs in 7 countries across 15 domains to perform 68 HTTP transactions. The main IP is 87.236.16.107, located in Russian Federation and belongs to BEGET-AS, RU. The main domain is povorotnetuda.ru.

This is the only time povorotnetuda.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
29	87.236.16.107 87.236.16.107	198610 (BEGET-AS) (BEGET-AS)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2008	15169 (GOOGLE) (GOOGLE)
2 6	87.240.139.194 87.240.139.194	47541 (VKONTAKTE...) (VKONTAKTE-SPB-AS http://vk.com)
3	2a03:2880:f00... 2a03:2880:f008:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
5 11	2a02:6b8::1:119 2a02:6b8::1:119	13238 (YANDEX) (YANDEX)
2	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c04::9d	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
5	2a03:2880:f10... 2a03:2880:f108:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 3	54.247.111.165 54.247.111.165	16509 (AMAZON-02) (AMAZON-02)
1	84.201.147.165 84.201.147.165	200350 (YANDEXCLOUD) (YANDEXCLOUD)
5	2a03:90c0:41:... 2a03:90c0:41:2801::254	199524 (GCORE) (GCORE)
68	17

29 87.236.16.107 (Russian Federation)

ASN198610 (BEGET-AS, RU)
PTR: ssl.spectre.beget.com

povorotnetuda.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
xn--80adgd3bebafnxcn.xn--p1ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 87.240.139.194 (Russian Federation) 2 redirects

ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU)
PTR: srv194-139-240-87.vk.com

vk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f008:8:face:b00c:0:1 (Milan, Italy)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a02:6b8::1:119 (Moscow, Russian Federation) 5 redirects

ASN13238 (YANDEX, RU)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a03:2880:f108:83:face:b00c:0:25de (Milan, Italy)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.247.111.165 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-247-111-165.eu-west-1.compute.amazonaws.com

code.jivosite.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 84.201.147.165 (Russian Federation)

ASN200350 (YANDEXCLOUD, RU)

node-ya10.jivosite.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a03:90c0:41:2801::254 (Frankfurt am Main, Germany)

ASN199524 (GCORE, LU)

code-ya.jivosite.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
25	function sub() { [native code] }.	2 MB
9	jivosite.com 1 redirects code.jivosite.com node-ya10.jivosite.com code-ya.jivosite.com	376 KB
7	yandex.com 3 redirects mc.yandex.com	3 KB
6	vk.com 2 redirects vk.com	24 KB
5	facebook.com www.facebook.com	762 B
4	yandex.ru 2 redirects mc.yandex.ru	87 KB
4	povorotnetuda.ru povorotnetuda.ru	34 KB
3	facebook.net connect.facebook.net	169 KB
2	doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net	2 KB
2	google-analytics.com www.google-analytics.com	19 KB
1	google.de www.google.de	154 B
1	google.com www.google.com	327 B
1	googletagmanager.com www.googletagmanager.com	32 KB
1	googleadservices.com www.googleadservices.com	17 KB
1	jquery.com code.jquery.com	66 KB
68	15

	Domain	Requested by
25	xn--80adgd3bebafnxcn.xn--p1ai	povorotnetuda.ru xn--80adgd3bebafnxcn.xn--p1ai
7	mc.yandex.com	3 redirects povorotnetuda.ru
6	vk.com	2 redirects povorotnetuda.ru
5	code-ya.jivosite.com	code.jivosite.com povorotnetuda.ru
5	www.facebook.com	povorotnetuda.ru
4	mc.yandex.ru	2 redirects povorotnetuda.ru
4	povorotnetuda.ru	povorotnetuda.ru
3	code.jivosite.com	1 redirects code.jivosite.com
3	connect.facebook.net	povorotnetuda.ru connect.facebook.net
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	node-ya10.jivosite.com	code.jivosite.com
1	www.google.de	povorotnetuda.ru
1	www.google.com	povorotnetuda.ru
1	googleads.g.doubleclick.net	www.googleadservices.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	www.googletagmanager.com	povorotnetuda.ru
1	www.googleadservices.com	povorotnetuda.ru
1	code.jquery.com	povorotnetuda.ru
68	18

This site contains links to these domains. Also see Links.

Domain
xn--80adgd3bebafnxcn.xn--p1ai
vk.com
instagram.com
www.jivo.ru

Subject Issuer	Validity	Valid
jquery.org Sectigo RSA Domain Validation Secure Server CA	`2020-10-06` - `2021-10-16`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
*.vk.com GlobalSign Organization Validation CA - SHA256 - G2	`2020-06-09` - `2022-06-10`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-04-06` - `2021-07-03`	3 months	crt.sh
mc.yandex.ru Yandex CA	`2021-02-27` - `2021-08-09`	5 months	crt.sh
*.google.com GTS CA 1O1	`2021-04-13` - `2021-07-06`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
*.jivosite.com Go Daddy Secure Certificate Authority - G2	`2020-04-05` - `2022-06-04`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://povorotnetuda.ru/login.php
Frame ID: 34A0C9B4C9306EF809A3489CEF6E8F67
Requests: 71 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

68
Requests

49 %
HTTPS

69 %
IPv6

15
Domains

18
Subdomains

17
IPs

7
Countries

2402 kB
Transfer

4591 kB
Size

7
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://xn--80adgd3bebafnxcn.xn--p1ai/franshiza/
Title: Франшиза

Search URL Search Domain Scan URL

URL: https://xn--80adgd3bebafnxcn.xn--p1ai/podarit-strax/
Title: Сертификат

Search URL Search Domain Scan URL

URL: https://xn--80adgd3bebafnxcn.xn--p1ai/
Title: Поворот не туда

Search URL Search Domain Scan URL

URL: https://vk.com/povorot_ne_tuda_rf

Search URL Search Domain Scan URL

URL: https://instagram.com/povorot_ne_tuda.quest/

Search URL Search Domain Scan URL

URL: https://xn--80adgd3bebafnxcn.xn--p1ai/kvesty/
Title: Квесты

Search URL Search Domain Scan URL

URL: https://xn--80adgd3bebafnxcn.xn--p1ai/raspisanie/
Title: Расписание

Search URL Search Domain Scan URL

URL: https://xn--80adgd3bebafnxcn.xn--p1ai/korporativ-v-kvest-parke/
Title: Корпоратив

Search URL Search Domain Scan URL

URL: https://xn--80adgd3bebafnxcn.xn--p1ai/detskie-prazdniki/
Title: Детский праздник

Search URL Search Domain Scan URL

URL: https://xn--80adgd3bebafnxcn.xn--p1ai/kontakty/
Title: Контакты

Search URL Search Domain Scan URL

URL: https://www.jivo.ru/i_sa/?utm_source=povorotnetuda.ru&utm_medium=link&utm_content=label_tooltip&utm_campaign=from_widget
Title: Бизнес-мессенджер

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 21

http://vk.com/rtrg?r=ACp6bZsn5RPbXyYFaDHivYndeIUXq6PgCX4hjh5WBWNfnZILDY**960qdG03*Hn8KTyYbJNOTfzfv0S*kPQW4c5bvFm8NdqcNW277Vk57jwaQwZphnsorM2FEHrn3Vxx8TWuwWWHqBpui7VDzNonqLfS8TWnobVbe5Nk648QBXU-&pixel_id=1000095817 HTTP 301
https://vk.com/rtrg?r=ACp6bZsn5RPbXyYFaDHivYndeIUXq6PgCX4hjh5WBWNfnZILDY**960qdG03*Hn8KTyYbJNOTfzfv0S*kPQW4c5bvFm8NdqcNW277Vk57jwaQwZphnsorM2FEHrn3Vxx8TWuwWWHqBpui7VDzNonqLfS8TWnobVbe5Nk648QBXU-&pixel_id=1000095817

Request Chain 37

http://mc.yandex.ru/metrika/watch.js HTTP 302
https://mc.yandex.ru/metrika/watch.js

Request Chain 38

http://vk.com/rtrg?r=dXFGie9CR452uSxruIv/nRb*5/zzAbm/nJ10PttNevHlmM1oOjvYbYhbf7NvqYB6UWxzZtKiAo9KssttyE7wJQaRPZ4*eC*hCOcr2FG0MulF6fq3Os8vHtelZ83GX3xpXOtpt0/QL1f8tZ5mPMfWp2DjR/YiS5w*5d5OPD2SCTw- HTTP 301
https://vk.com/rtrg?r=dXFGie9CR452uSxruIv/nRb*5/zzAbm/nJ10PttNevHlmM1oOjvYbYhbf7NvqYB6UWxzZtKiAo9KssttyE7wJQaRPZ4*eC*hCOcr2FG0MulF6fq3Os8vHtelZ83GX3xpXOtpt0/QL1f8tZ5mPMfWp2DjR/YiS5w*5d5OPD2SCTw-

Request Chain 53

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9266.McidCfiDu7XQ7oaLxB4gHJFUI5YgbLVM7AsqzVOXjoH8dOrVq464o9lqrh44tG_K.OTes4wbCexGEJQg2BBsYUvDq-iY%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=9266.0Xm_oblnBIjYB_seR2Bw1tHZTP_eD3mQDqkL_mR8-ILGXYca0IPRnKnA3pKCXPQlKJxrUrxRjjXZckK_1uBSwQ%2C%2C.DxqMIBDEkm1DIdMaTmm2nvKXpFE%2C

Request Chain 55

http://code.jivosite.com/script/widget/xA6QUWUgQ5 HTTP 301
https://code.jivosite.com/script/widget/xA6QUWUgQ5

Request Chain 56

https://mc.yandex.com/watch/31361493?wmode=7&page-url=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Abx1nzewshzamry4%3Afp%3A521%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A504%3Acn%3A1%3Adp%3A0%3Als%3A308096294259%3Ahid%3A65943030%3Az%3A120%3Ai%3A20210507155737%3Aet%3A1620395857%3Ac%3A1%3Arn%3A1009064679%3Au%3A1620395857188503018%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1620395856308%3Ads%3A6%2C29%2C230%2C1%2C0%2C0%2C%2C381%2C7%2C%2C%2C%2C650%3Adsn%3A7%2C28%2C230%2C1%2C0%2C0%2C%2C382%2C7%2C%2C%2C%2C651%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1620395857%3At%3A HTTP 302
https://mc.yandex.com/watch/31361493/1?wmode=7&page-url=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Abx1nzewshzamry4%3Afp%3A521%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A504%3Acn%3A1%3Adp%3A0%3Als%3A308096294259%3Ahid%3A65943030%3Az%3A120%3Ai%3A20210507155737%3Aet%3A1620395857%3Ac%3A1%3Arn%3A1009064679%3Au%3A1620395857188503018%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1620395856308%3Ads%3A6%2C29%2C230%2C1%2C0%2C0%2C%2C381%2C7%2C%2C%2C%2C650%3Adsn%3A7%2C28%2C230%2C1%2C0%2C0%2C%2C382%2C7%2C%2C%2C%2C651%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1620395857%3At%3A

Request Chain 57

https://mc.yandex.com/watch/31051446?wmode=7&page-url=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Abx1nzewshzamry4%3Afp%3A521%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A504%3Acn%3A2%3Adp%3A0%3Als%3A726247061816%3Ahid%3A65943030%3Az%3A120%3Ai%3A20210507155737%3Aet%3A1620395857%3Ac%3A1%3Arn%3A757698271%3Au%3A1620395857188503018%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1620395856308%3Ads%3A6%2C29%2C230%2C1%2C0%2C0%2C%2C381%2C7%2C%2C%2C%2C650%3Adsn%3A7%2C28%2C230%2C1%2C0%2C0%2C%2C382%2C7%2C%2C%2C%2C651%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1620395857%3At%3A HTTP 302
https://mc.yandex.com/watch/31051446/1?wmode=7&page-url=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Abx1nzewshzamry4%3Afp%3A521%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A504%3Acn%3A2%3Adp%3A0%3Als%3A726247061816%3Ahid%3A65943030%3Az%3A120%3Ai%3A20210507155737%3Aet%3A1620395857%3Ac%3A1%3Arn%3A757698271%3Au%3A1620395857188503018%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1620395856308%3Ads%3A6%2C29%2C230%2C1%2C0%2C0%2C%2C381%2C7%2C%2C%2C%2C650%3Adsn%3A7%2C28%2C230%2C1%2C0%2C0%2C%2C382%2C7%2C%2C%2C%2C651%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1620395857%3At%3A

68 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 404
Not Found Primary Request login.php Show response
povorotnetuda.ru/ 35 KB
8 KB 266ms
230ms Document
text/html 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 / PHP/5.6.40
Resource Hash: afd85ea409d7a89914b6308b3a25965ab95428aedeb56e16ce481123552ebb50

Request headers

Host: povorotnetuda.ru
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Server: nginx-reuseport/1.13.4
Date: Fri, 07 May 2021 13:57:36 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Vary: Accept-Encoding
X-Powered-By: PHP/5.6.40
X-Pingback: http://xn--80adgd3bebafnxcn.xn--p1ai/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Content-Encoding: gzip

GET
H/1.1 200
OK easy-modal-site.css
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/easy-modal/assets/styles/ 1 KB
870 B 131ms
93ms Stylesheet
text/css 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/easy-modal/assets/styles/easy-modal-site.css?ver=0.1
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 5f626d986cb2b012e03225573f87ce60ecb1a44c997a24032cf905482faef82b

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 10:14:55 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5ae1a69f-496"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Fri, 14 May 2021 13:57:36 GMT

GET
H/1.1 200
OK styles.css
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/contact-form-7/includes/css/ 1 KB
857 B 130ms
93ms Stylesheet
text/css 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=4.2.1
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 96f1810d96a208f1b98ce9ba49368fcb9b8334105e87554602275b978c2c170a

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 10:14:55 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5ae1a69f-44f"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Fri, 14 May 2021 13:57:36 GMT

GET
H/1.1 200
OK slick.css
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/wp-slick-slider-and-image-carousel/assets/css/ 6 KB
2 KB 129ms
92ms Stylesheet
text/css 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/wp-slick-slider-and-image-carousel/assets/css/slick.css?ver=1.2.3
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 00528942400593edaa03cdca6778bec9fbf267df70aff9d0fad6f9d180207628

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 10:15:00 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5ae1a6a4-16a4"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Fri, 14 May 2021 13:57:36 GMT

GET
H/1.1 200
OK slick-slider-style.css
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/wp-slick-slider-and-image-carousel/assets/css/ 8 KB
2 KB 129ms
91ms Stylesheet
text/css 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/wp-slick-slider-and-image-carousel/assets/css/slick-slider-style.css?ver=1.2.3
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 229e5c85f951e93a5447f7dd03f9cfe9c1c5e5b3a6f34cca22b5da8f54075b86

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 10:15:00 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5ae1a6a4-205e"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Fri, 14 May 2021 13:57:36 GMT

GET
H/1.1 200
OK jquery.js Show response
xn--80adgd3bebafnxcn.xn--p1ai/wp-includes/js/jquery/ 94 KB
33 KB 132ms
95ms Script
application/x-javascript 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-includes/js/jquery/jquery.js?ver=1.11.2
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 9b1b195900c079b2a8859cb8ded918d2e179c49fbb2a3aab3491e68d33fbaa54

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 10:15:04 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5ae1a6a8-176d0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Fri, 14 May 2021 13:57:36 GMT

GET
H/1.1 200
OK jquery-migrate.min.js Show response
xn--80adgd3bebafnxcn.xn--p1ai/wp-includes/js/jquery/ 7 KB
3 KB 189ms
60ms Script
application/x-javascript 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 1e67d8dbcca1f6fd94e077c85c2fb40fa1c2756c99238daa8da882144260a68d

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 10:15:04 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5ae1a6a8-1c1f"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Fri, 14 May 2021 13:57:36 GMT

GET
H/1.1 200
OK slick.min.js Show response
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/wp-slick-slider-and-image-carousel/assets/js/ 39 KB
10 KB 191ms
62ms Script
application/x-javascript 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/wp-slick-slider-and-image-carousel/assets/js/slick.min.js?ver=1.2.3
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 56bab4312d57027e314de1d04483d708d95ffc1433d568d37af426d4106c7907

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 10:15:00 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5ae1a6a4-9d02"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Fri, 14 May 2021 13:57:36 GMT

GET
H/1.1 200
OK jquery.reveal.js Show response
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/js/ 5 KB
2 KB 191ms
61ms Script
application/x-javascript 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/js/jquery.reveal.js
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: a27c246df6c64b929864ef626f370de4654c126f7bd4328542896e9474bfb084

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 10:15:02 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5ae1a6a6-139e"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Fri, 14 May 2021 13:57:36 GMT

GET
H/1.1 200
OK style.css
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/ 31 KB
7 KB 129ms
92ms Stylesheet
text/css 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 0933e0c550e23364476c44047c0d7e52ff94b1bbe680f66f92bf4eb2a65584e1

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 10:15:00 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5ae1a6a4-7a46"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Fri, 14 May 2021 13:57:36 GMT

GET
H2 200 jquery-ui.min.js Show response
code.jquery.com/ui/1.12.1/ 248 KB
66 KB 30ms
11ms Script
application/javascript 2001:4de0:ac18::1:a:2b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/ui/1.12.1/jquery-ui.min.js
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 13:57:36 GMT
content-encoding: gzip
last-modified: Wed, 14 Sep 2016 16:34:16 GMT
server: nginx
etag: W/"57d97c08-3dee4"
vary: Accept-Encoding
x-hw: 1620395856.dop202.fr8.t,1620395856.cds257.fr8.hn,1620395856.cds151.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 67751

GET
H/1.1 200
OK bg-adr.png
povorotnetuda.ru/wp-content/themes/povorot/i/ 3 KB
3 KB 64ms
61ms Image
image/png 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://povorotnetuda.ru/wp-content/themes/povorot/i/bg-adr.png
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 15a6b347a9b93f8c94848ee620184cd4a893c6238a7267aa380a1c9d69a5a8e7

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: povorotnetuda.ru
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://povorotnetuda.ru/login.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://povorotnetuda.ru/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Last-Modified: Thu, 26 Apr 2018 10:15:00 GMT
Server: nginx-reuseport/1.13.4
ETag: "5ae1a6a4-a57"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 2647
Expires: Sun, 06 Jun 2021 13:57:36 GMT

GET
H/1.1 404
Not Found psychotherapy.jpg
povorotnetuda.ru/i/ 5 KB
5 KB 281ms
251ms Image
text/html 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://povorotnetuda.ru/i/psychotherapy.jpg
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 / PHP/5.6.40
Resource Hash: 51c37340f48a1c3f73c7f44c413e4ee52c5893b590d2dbb7ac47eca7f1d63f50

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: povorotnetuda.ru
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://povorotnetuda.ru/login.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://povorotnetuda.ru/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 07 May 2021 13:57:37 GMT
Server: nginx-reuseport/1.13.4
X-Powered-By: PHP/5.6.40
X-Pingback: http://xn--80adgd3bebafnxcn.xn--p1ai/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 404
Not Found horror.jpg
povorotnetuda.ru/i/ 18 KB
18 KB 242ms
211ms Image
text/html 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://povorotnetuda.ru/i/horror.jpg
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 / PHP/5.6.40
Resource Hash: 4a2815e0eb5669badc30aedd1398c0b9133e3479621e1e6ec8aefd2b3954daee

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: povorotnetuda.ru
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://povorotnetuda.ru/login.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://povorotnetuda.ru/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 07 May 2021 13:57:36 GMT
Server: nginx-reuseport/1.13.4
X-Powered-By: PHP/5.6.40
X-Pingback: http://xn--80adgd3bebafnxcn.xn--p1ai/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK core.min.js Show response
xn--80adgd3bebafnxcn.xn--p1ai/wp-includes/js/jquery/ui/ 4 KB
2 KB 61ms
60ms Script
application/x-javascript 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-includes/js/jquery/ui/core.min.js?ver=1.11.4
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 191622240e7646a2e888eb318557bcca854828b59b5b2e960545ee08ae142382

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 10:15:04 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5ae1a6a8-f9d"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Fri, 14 May 2021 13:57:36 GMT

GET
H/1.1 200
OK position.min.js Show response
xn--80adgd3bebafnxcn.xn--p1ai/wp-includes/js/jquery/ui/ 6 KB
3 KB 61ms
61ms Script
application/x-javascript 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-includes/js/jquery/ui/position.min.js?ver=1.11.4
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 7a3eca6361c114ba5ac314cbd4397f9e0329ec9fc5f5845e7a14800d469a19ec

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 10:15:04 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5ae1a6a8-1959"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Fri, 14 May 2021 13:57:36 GMT

GET
H/1.1 200
OK jquery.transit.min.js Show response
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/easy-modal/assets/scripts/ 8 KB
3 KB 64ms
61ms Script
application/x-javascript 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/easy-modal/assets/scripts/jquery.transit.min.js?ver=0.9.11
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: b259de534ce1ec151a383c5cfbc69f8fc568399e0d400b60f2d9534d072c76e0

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 10:14:55 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5ae1a69f-1e9b"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Fri, 14 May 2021 13:57:36 GMT

GET
H/1.1 200
OK easy-modal-site.js Show response
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/easy-modal/assets/scripts/ 22 KB
4 KB 63ms
62ms Script
application/x-javascript 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/easy-modal/assets/scripts/easy-modal-site.js?defer&ver=2
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 1fdcbc103efd36c93cec22826c56503704e3f4ea9defe97c43521c562d6ce140

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 10:14:55 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5ae1a69f-5756"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Fri, 14 May 2021 13:57:36 GMT

GET
H/1.1 200
OK jquery.form.min.js Show response
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/contact-form-7/includes/js/ 15 KB
6 KB 64ms
61ms Script
application/x-javascript 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/contact-form-7/includes/js/jquery.form.min.js?ver=3.51.0-2014.06.20
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: c90f0e501d2948fbc2b61bffd654fa4ab64741fd48923782419eeb14d3816fb8

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 10:14:55 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5ae1a69f-3b90"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Fri, 14 May 2021 13:57:36 GMT

GET
H/1.1 200
OK scripts.js Show response
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/contact-form-7/includes/js/ 11 KB
3 KB 64ms
62ms Script
application/x-javascript 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=4.2.1
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 3dbc832de930e5b39820c0fc94f59c8c89b134dbbe02c7e4dc31aeda65d604de

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 10:14:55 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5ae1a69f-2bc0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Fri, 14 May 2021 13:57:36 GMT

GET
H/1.1 200
OK conversion.js Show response
www.googleadservices.com/pagead/ 43 KB
17 KB 129ms
97ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.googleadservices.com/pagead/conversion.js

Requested by

Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php

Protocol

HTTP/1.1

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

8719e7caa8c8992a1d546c7a38c708d4929dd04bde1be9381def52752fd2a97f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Timing-Allow-Origin: *
Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 786077497703709746
Vary: Accept-Encoding
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Content-Type: text/javascript; charset=UTF-8
Content-Length: 16618
X-XSS-Protection: 0
Expires: Fri, 07 May 2021 13:57:36 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 82 KB
32 KB 33ms
31ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MGB2QLK

Requested by

Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0e42f6dd2a9e2d6ec836f18de554c8677317cf1014dd2955569e96e91844f244

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 13:57:36 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33014
x-xss-protection: 0
last-modified: Fri, 07 May 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 07 May 2021 13:57:36 GMT

GET
H2

200

rtrg
vk.com/
Redirect Chain

http://vk.com/rtrg?r=ACp6bZsn5RPbXyYFaDHivYndeIUXq6PgCX4hjh5WBWNfnZILDY**960qdG03*Hn8KTyYbJNOTfzfv0S*kPQW4c5bvFm8NdqcNW277Vk57jwaQwZphnsorM2FEHrn3Vxx8TWuwWWHqBpui7VDzNonqLfS8TWnobVbe5Nk648QBXU-&pix...
https://vk.com/rtrg?r=ACp6bZsn5RPbXyYFaDHivYndeIUXq6PgCX4hjh5WBWNfnZILDY**960qdG03*Hn8KTyYbJNOTfzfv0S*kPQW4c5bvFm8NdqcNW277Vk57jwaQwZphnsorM2FEHrn3Vxx8TWuwWWHqBpui7VDzNonqLfS8TWnobVbe5Nk648QBXU-&pi...

49 B
445 B

125ms
119ms

Image
image/gif

87.240.139.194
VKONTAKTE-SPB-AS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://vk.com/rtrg?r=ACp6bZsn5RPbXyYFaDHivYndeIUXq6PgCX4hjh5WBWNfnZILDY**960qdG03*Hn8KTyYbJNOTfzfv0S*kPQW4c5bvFm8NdqcNW277Vk57jwaQwZphnsorM2FEHrn3Vxx8TWuwWWHqBpui7VDzNonqLfS8TWnobVbe5Nk648QBXU-&pixel_id=1000095817

Requested by

Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.240.139.194 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU),

Reverse DNS

srv194-139-240-87.vk.com

Software

kittenx / KPHP/7.4.107054

Resource Hash

2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 13:57:37 GMT
content-encoding: gzip
x-frontend: front609304
server: kittenx
x-powered-by: KPHP/7.4.107054
strict-transport-security: max-age=15768000
content-type: image/gif
access-control-expose-headers: X-Frontend
cache-control: no-store
content-length: 65

Redirect headers

Date: Fri, 07 May 2021 13:57:36 GMT
X-Frontend: front609304
Server: kittenx
Content-Type: text/html
Location: https://vk.com/rtrg?r=ACp6bZsn5RPbXyYFaDHivYndeIUXq6PgCX4hjh5WBWNfnZILDY**960qdG03*Hn8KTyYbJNOTfzfv0S*kPQW4c5bvFm8NdqcNW277Vk57jwaQwZphnsorM2FEHrn3Vxx8TWuwWWHqBpui7VDzNonqLfS8TWnobVbe5Nk648QBXU-&pixel_id=1000095817
Access-Control-Expose-Headers: X-Frontend
Connection: keep-alive
Content-Length: 164

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 92 KB
24 KB 69ms
22ms Script
application/x-javascript 2a03:2880:f008:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f008:8:face:b00c:0:1 Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a517525b8a7d39bcaf1cf5f9695c5be8fce7a6b920a3924c1a4f70e8ea748c05

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23959
x-fb-rlafr: 0
pragma: public
x-fb-debug: a4W/wj6vx/GzmvTwq+gr1fuQ+tRoafQTNAXYI+C2ZPJnomQ02IPoPRh6nGF2JK2a3YSOAEU12U4YdhOromRu2Q==
x-fb-trip-id: 19638678
x-frame-options: DENY
date: Fri, 07 May 2021 13:57:36 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 openapi.js Show response
vk.com/js/api/ 100 KB
22 KB 212ms
73ms Script
application/x-javascript 87.240.139.194
VKONTAKTE-SPB-AS ...

General

Check archive.org

Show headers Download Go to

Full URL: https://vk.com/js/api/openapi.js?160
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 87.240.139.194 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU),
Reverse DNS: srv194-139-240-87.vk.com
Software: kittenx /
Resource Hash: 25fe45f80deb3a5943695bb19674ddaf60340575dd353fd3b2d227fb62a7e42b

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 13:57:36 GMT
content-encoding: br
x-frontend: front609304
last-modified: Wed, 21 Apr 2021 15:16:58 GMT
server: kittenx
etag: "608041ea-5800"
content-type: application/x-javascript
access-control-expose-headers: X-Frontend
cache-control: max-age=345600
content-length: 22528
expires: Tue, 11 May 2021 13:57:36 GMT

GET
H/1.1 200
OK bg-head3.png
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/ 733 KB
733 KB 76ms
65ms Image
image/png 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/bg-head3.png
Requested by: Host: xn--80adgd3bebafnxcn.xn--p1ai
URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 77272949e068ee9459287f707d250a93da595992b051605f4bd72de432cc0f1f

Request headers

Referer: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Last-Modified: Thu, 26 Apr 2018 10:15:01 GMT
Server: nginx-reuseport/1.13.4
ETag: "5ae1a6a5-b73fa"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 750586
Expires: Sun, 06 Jun 2021 13:57:36 GMT

GET
H/1.1 200
OK fran.png
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/ 2 KB
2 KB 158ms
60ms Image
image/png 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/fran.png
Requested by: Host: xn--80adgd3bebafnxcn.xn--p1ai
URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: b128bad7626d4fa6c496eecbdcf0bbd7c77753c8767867fb1709af0a5a000e73

Request headers

Referer: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Last-Modified: Thu, 26 Apr 2018 10:15:01 GMT
Server: nginx-reuseport/1.13.4
ETag: "5ae1a6a5-82f"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 2095
Expires: Sun, 06 Jun 2021 13:57:36 GMT

GET
H/1.1 200
OK bg-prise.png
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/ 1 KB
2 KB 156ms
60ms Image
image/png 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/bg-prise.png
Requested by: Host: xn--80adgd3bebafnxcn.xn--p1ai
URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 02c4639cfcedda1fb2353d2ca7cd4597f7eac7012042411c9faa22caecbedde5

Request headers

Referer: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Last-Modified: Thu, 26 Apr 2018 10:15:01 GMT
Server: nginx-reuseport/1.13.4
ETag: "5ae1a6a5-5b6"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 1462
Expires: Sun, 06 Jun 2021 13:57:36 GMT

GET
H/1.1 200
OK logo2.png
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/ 48 KB
49 KB 94ms
60ms Image
image/png 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/logo2.png
Requested by: Host: xn--80adgd3bebafnxcn.xn--p1ai
URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 7c57d6bb233afec5de2620f1aae77ee4764d4089021e30ec1f4029dffbeaf32a

Request headers

Referer: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Last-Modified: Thu, 26 Apr 2018 10:15:02 GMT
Server: nginx-reuseport/1.13.4
ETag: "5ae1a6a6-c165"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 49509
Expires: Sun, 06 Jun 2021 13:57:36 GMT

GET
H/1.1 200
OK style.css
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/ 31 KB
31 KB 95ms
61ms Image
text/css 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
Requested by: Host: xn--80adgd3bebafnxcn.xn--p1ai
URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Content-Encoding: gzip
Last-Modified: Thu, 26 Apr 2018 10:15:00 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5ae1a6a4-7a46"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Fri, 14 May 2021 13:57:36 GMT

GET
H/1.1 200
OK mail_icon.png
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/ 2 KB
2 KB 95ms
59ms Image
image/png 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/mail_icon.png
Requested by: Host: xn--80adgd3bebafnxcn.xn--p1ai
URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 977315eedf53531b879f0b2e8104d85fbf75742043bc5c10b90fdd76278a8b65

Request headers

Referer: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Last-Modified: Thu, 26 Apr 2018 10:15:02 GMT
Server: nginx-reuseport/1.13.4
ETag: "5ae1a6a6-841"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 2113
Expires: Sun, 06 Jun 2021 13:57:36 GMT

GET
H/1.1 200
OK vk.png
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/ 1 KB
2 KB 221ms
64ms Image
image/png 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/vk.png
Requested by: Host: xn--80adgd3bebafnxcn.xn--p1ai
URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: e0d79b1d24d974bd3b5adc50a4ebe5a6e8c24a11a1761f3d7e982f64bb8688b0

Request headers

Referer: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Last-Modified: Thu, 26 Apr 2018 10:15:02 GMT
Server: nginx-reuseport/1.13.4
ETag: "5ae1a6a6-557"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 1367
Expires: Sun, 06 Jun 2021 13:57:36 GMT

GET
H/1.1 200
OK in.png
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/ 2 KB
2 KB 96ms
60ms Image
image/png 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/in.png
Requested by: Host: xn--80adgd3bebafnxcn.xn--p1ai
URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 15eeae30bff8a86e63fa76d27b556ab4059cb4313e4d33cb9fee0293364bbc90

Request headers

Referer: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Last-Modified: Thu, 26 Apr 2018 10:15:02 GMT
Server: nginx-reuseport/1.13.4
ETag: "5ae1a6a6-78e"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 1934
Expires: Sun, 06 Jun 2021 13:57:36 GMT

GET
H/1.1 200
OK bg-nav.png
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/ 178 KB
179 KB 156ms
60ms Image
image/png 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/bg-nav.png
Requested by: Host: xn--80adgd3bebafnxcn.xn--p1ai
URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: ef3162728f25f19aecdd2eb12279035869b10d78cb6875f5692c2d8bc6c8414c

Request headers

Referer: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Last-Modified: Thu, 26 Apr 2018 10:15:01 GMT
Server: nginx-reuseport/1.13.4
ETag: "5ae1a6a5-2c9eb"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 182763
Expires: Sun, 06 Jun 2021 13:57:36 GMT

GET
H/1.1 200
OK bg-foot1.png
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/ 491 KB
491 KB 81ms
69ms Image
image/png 87.236.16.107
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/i/bg-foot1.png
Requested by: Host: xn--80adgd3bebafnxcn.xn--p1ai
URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
Protocol: HTTP/1.1
Server: 87.236.16.107 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.spectre.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 3fa6f131c82ce0a6b6647b746d78a14cff411a72a72027244e62b52bfdf1c846

Request headers

Referer: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:36 GMT
Last-Modified: Thu, 26 Apr 2018 10:15:01 GMT
Server: nginx-reuseport/1.13.4
ETag: "5ae1a6a5-7ab35"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 502581
Expires: Sun, 06 Jun 2021 13:57:36 GMT

GET BebasBold.woff
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/fonts/BebasBold/ 0
0

GET BebasRegular.woff
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/fonts/BebasRegular/ 0
0

GET
H2 200 watch.js Show response
mc.yandex.ru/metrika/ 123 KB
43 KB 149ms
49ms Script
application/javascript 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/watch.js

Requested by

Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

0dc25fa3b32fcdcb0c8d6960ce7a9ec11627d8769d78a0fcc5c8d06a8a4a757d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 13:57:36 GMT
content-encoding: br
last-modified: Fri, 30 Apr 2021 17:14:07 GMT
etag: "608a4fd7-abe7"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
content-length: 44007
expires: Fri, 07 May 2021 14:57:36 GMT

GET
H2

200

watch.js Show response
mc.yandex.ru/metrika/
Redirect Chain

http://mc.yandex.ru/metrika/watch.js
https://mc.yandex.ru/metrika/watch.js

123 KB
43 KB

158ms
146ms

Script
application/javascript

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/watch.js

Requested by

Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

0dc25fa3b32fcdcb0c8d6960ce7a9ec11627d8769d78a0fcc5c8d06a8a4a757d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 13:57:36 GMT
content-encoding: br
last-modified: Fri, 30 Apr 2021 17:14:07 GMT
etag: "608a4fd7-abe7"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
content-length: 44007
expires: Fri, 07 May 2021 14:57:36 GMT

Redirect headers

Location: https://mc.yandex.ru/metrika/watch.js
Content-Length: 0

GET
H2

200

rtrg
vk.com/
Redirect Chain

http://vk.com/rtrg?r=dXFGie9CR452uSxruIv/nRb*5/zzAbm/nJ10PttNevHlmM1oOjvYbYhbf7NvqYB6UWxzZtKiAo9KssttyE7wJQaRPZ4*eC*hCOcr2FG0MulF6fq3Os8vHtelZ83GX3xpXOtpt0/QL1f8tZ5mPMfWp2DjR/YiS5w*5d5OPD2SCTw-
https://vk.com/rtrg?r=dXFGie9CR452uSxruIv/nRb*5/zzAbm/nJ10PttNevHlmM1oOjvYbYhbf7NvqYB6UWxzZtKiAo9KssttyE7wJQaRPZ4*eC*hCOcr2FG0MulF6fq3Os8vHtelZ83GX3xpXOtpt0/QL1f8tZ5mPMfWp2DjR/YiS5w*5d5OPD2SCTw-

49 B
445 B

91ms
90ms

Image
image/gif

87.240.139.194
VKONTAKTE-SPB-AS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://vk.com/rtrg?r=dXFGie9CR452uSxruIv/nRb*5/zzAbm/nJ10PttNevHlmM1oOjvYbYhbf7NvqYB6UWxzZtKiAo9KssttyE7wJQaRPZ4*eC*hCOcr2FG0MulF6fq3Os8vHtelZ83GX3xpXOtpt0/QL1f8tZ5mPMfWp2DjR/YiS5w*5d5OPD2SCTw-

Requested by

Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.240.139.194 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU),

Reverse DNS

srv194-139-240-87.vk.com

Software

kittenx / KPHP/7.4.107054

Resource Hash

2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 13:57:37 GMT
content-encoding: gzip
x-frontend: front609304
server: kittenx
x-powered-by: KPHP/7.4.107054
strict-transport-security: max-age=15768000
content-type: image/gif
access-control-expose-headers: X-Frontend
cache-control: no-store
content-length: 65

Redirect headers

Date: Fri, 07 May 2021 13:57:36 GMT
X-Frontend: front609304
Server: kittenx
Content-Type: text/html
Location: https://vk.com/rtrg?r=dXFGie9CR452uSxruIv/nRb*5/zzAbm/nJ10PttNevHlmM1oOjvYbYhbf7NvqYB6UWxzZtKiAo9KssttyE7wJQaRPZ4*eC*hCOcr2FG0MulF6fq3Os8vHtelZ83GX3xpXOtpt0/QL1f8tZ5mPMfWp2DjR/YiS5w*5d5OPD2SCTw-
Access-Control-Expose-Headers: X-Frontend
Connection: keep-alive
Content-Length: 164

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGB2QLK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 5444
date: Fri, 07 May 2021 12:26:52 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Fri, 07 May 2021 14:26:52 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 13ms
13ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=763856701&t=pageview&_s=1&dl=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAAABAAAAAC~&jid=1721330340&gjid=1119901459&cid=649012338.1620395857&tid=UA-114395671-1&_gid=364017819.1620395857&_r=1&gtm=2wg4s0MGB2QLK&z=855682544

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 07 May 2021 13:57:36 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://povorotnetuda.ru
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 1484479458276977 Show response
connect.facebook.net/signals/config/ 254 KB
72 KB 47ms
22ms Script
application/x-javascript 2a03:2880:f008:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1484479458276977?v=2.9.39&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f008:8:face:b00c:0:1 Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

dd052d575957f7d321a98d99c1ac60d54fec29f543a81c380605edb95fca3082

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 74005
x-fb-rlafr: 0
pragma: public
x-fb-debug: uFdiSuYz1OQUp9R3+aPob+Hbdp++RyKIuxw586Q6/OhcXqgLdunuAlzMPccBFEXE2ajNxWTuBnHMoQ+28ybzVA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Fri, 07 May 2021 13:57:36 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
87 B 14ms
12ms XHR
text/plain 2a00:1450:400c:c04::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-114395671-1&cid=649012338.1620395857&jid=1721330340&gjid=1119901459&_gid=364017819.1620395857&_u=YEBAAAAAAAAAAC~&z=428510075

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 07 May 2021 13:57:36 GMT
content-type: text/plain
access-control-allow-origin: http://povorotnetuda.ru
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET BebasBold.ttf
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/fonts/BebasBold/ 0
0

GET BebasRegular.ttf
xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/fonts/BebasRegular/ 0
0

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/970697919/ 2 KB
2 KB 38ms
19ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970697919/?random=1620395856954&cv=9&fst=1620395856954&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

95d7afb75f1a317ae24c5f93399f827af7970243f56b58a39140c0329692451e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 May 2021 13:57:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 979
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/970697919/ 42 B
327 B 28ms
28ms Image
image/gif 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/970697919/?random=1620395856954&cv=9&fst=1620392400000&num=1&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&fmt=3&is_vtc=1&random=4144282658&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 May 2021 13:57:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/970697919/ 42 B
154 B 20ms
20ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/970697919/?random=1620395856954&cv=9&fst=1620392400000&num=1&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&fmt=3&is_vtc=1&random=4144282658&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 May 2021 13:57:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 688232001310482 Show response
connect.facebook.net/signals/config/ 254 KB
72 KB 23ms
22ms Script
application/x-javascript 2a03:2880:f008:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/688232001310482?v=2.9.39&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f008:8:face:b00c:0:1 Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a236a43883e55479a2c5b6e18dda928d4b9ade7687c09b0842a7c751e3c2a601

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 74002
x-fb-rlafr: 0
pragma: public
x-fb-debug: PX+/QuhmPAhlrHyoS0FBo4+UQ/Qjhw1frJHjcgwlXOGT+Bhi4KHjvzwqOrJQxF1jicW3GwxyLvabHHFe/vBXVg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Fri, 07 May 2021 13:57:37 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
410 B 66ms
21ms Image
image/gif 2a03:2880:f108:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1484479458276977&ev=PageView&dl=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&rl=&if=false&ts=1620395857026&sw=1600&sh=1200&v=2.9.39&r=stable&ec=0&o=30&fbp=fb.1.1620395857025.1955062922&it=1620395856918&coo=false&exp=l0&rqm=GET

Requested by

Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f108:83:face:b00c:0:25de Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 13:57:37 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Fri, 07 May 2021 13:57:37 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 45ms
22ms Image
image/gif 2a03:2880:f108:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1484479458276977&ev=PixelInitialized&dl=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&rl=&if=false&ts=1620395857092&sw=1600&sh=1200&v=2.9.39&r=stable&ec=1&o=30&fbp=fb.1.1620395857025.1955062922&it=1620395856918&coo=false&exp=l0&rqm=GET

Requested by

Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f108:83:face:b00c:0:25de Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 13:57:37 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Fri, 07 May 2021 13:57:37 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 45ms
23ms Image
image/gif 2a03:2880:f108:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=688232001310482&ev=PixelInitialized&dl=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&rl=&if=false&ts=1620395857095&sw=1600&sh=1200&v=2.9.39&r=stable&ec=0&o=30&fbp=fb.1.1620395857025.1955062922&it=1620395856918&coo=false&exp=l0&rqm=GET

Requested by

Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f108:83:face:b00c:0:25de Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 13:57:37 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Fri, 07 May 2021 13:57:37 GMT

GET
H2 200 rtrg
vk.com/ 49 B
363 B 77ms
76ms Image
image/gif 87.240.139.194
VKONTAKTE-SPB-AS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://vk.com/rtrg?p=VK-RTRG-330758-dl7Me&metatag_url=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php

Requested by

Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.240.139.194 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU),

Reverse DNS

srv194-139-240-87.vk.com

Software

kittenx / KPHP/7.4.107054

Resource Hash

2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 13:57:37 GMT
content-encoding: gzip
x-frontend: front609304
server: kittenx
x-powered-by: KPHP/7.4.107054
strict-transport-security: max-age=15768000
content-type: image/gif
access-control-expose-headers: X-Frontend
cache-control: no-store
content-length: 65

GET
H2

400

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9266.McidCfiDu7XQ7oaLxB4gHJFUI5YgbLVM7AsqzVOXjoH8dOrVq464o9lqrh44tG_K.OTes4wbCexGEJQg2BBsYUvDq-iY%2C
https://mc.yandex.com/sync_cookie_image_decide?token=9266.0Xm_oblnBIjYB_seR2Bw1tHZTP_eD3mQDqkL_mR8-ILGXYca0IPRnKnA3pKCXPQlKJxrUrxRjjXZckK_1uBSwQ%2C%2C.DxqMIBDEkm1DIdMaTmm2nvKXpFE%2C

75 B
75 B

57ms
57ms

Image
text/html

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=9266.0Xm_oblnBIjYB_seR2Bw1tHZTP_eD3mQDqkL_mR8-ILGXYca0IPRnKnA3pKCXPQlKJxrUrxRjjXZckK_1uBSwQ%2C%2C.DxqMIBDEkm1DIdMaTmm2nvKXpFE%2C

Requested by

Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 13:57:37 GMT
strict-transport-security: max-age=31536000
content-length: 75
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=9266.0Xm_oblnBIjYB_seR2Bw1tHZTP_eD3mQDqkL_mR8-ILGXYca0IPRnKnA3pKCXPQlKJxrUrxRjjXZckK_1uBSwQ%2C%2C.DxqMIBDEkm1DIdMaTmm2nvKXpFE%2C
date: Fri, 07 May 2021 13:57:37 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
136 B 52ms
52ms Image
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 13:57:37 GMT
last-modified: Fri, 30 Apr 2021 17:14:07 GMT
etag: "608a4fd7-2b"
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Fri, 07 May 2021 14:57:37 GMT

GET
H/1.1

200
OK

xA6QUWUgQ5 Show response
code.jivosite.com/script/widget/
Redirect Chain

http://code.jivosite.com/script/widget/xA6QUWUgQ5
https://code.jivosite.com/script/widget/xA6QUWUgQ5

17 KB
6 KB

277ms
136ms

Script
application/javascript

54.247.111.165
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jivosite.com/script/widget/xA6QUWUgQ5
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 54.247.111.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-247-111-165.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: fcab264e99079508ea218caaa0be0185340c2558353ad024b183ed46d633d682

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:37 GMT
Content-Encoding: br
Last-Modified: Tue, 27 Apr 2021 13:20:29 GMT
Server: nginx
Etag: "60880f9d-1750"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=7200
Connection: keep-alive
X-Geo-Shard: ya
Content-Length: 5968
Via: 1.1 sharxy
Expires: Fri, 07 May 2021 15:57:37 GMT

Redirect headers

Location: https://code.jivosite.com/script/widget/xA6QUWUgQ5
Date: Fri, 07 May 2021 13:57:37 GMT
Server: nginx
Connection: keep-alive
Content-Length: 162
Content-Type: text/html

GET
H2

200

1 Show response
mc.yandex.com/watch/31361493/
Redirect Chain

https://mc.yandex.com/watch/31361493?wmode=7&page-url=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Abx1nzewshzamry4%3Afp%3A521%3Afu%3A0%3Aen%3Autf-8...
https://mc.yandex.com/watch/31361493/1?wmode=7&page-url=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Abx1nzewshzamry4%3Afp%3A521%3Afu%3A0%3Aen%3Autf...

184 B
293 B

54ms
54ms

XHR
application/json

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/31361493/1?wmode=7&page-url=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Abx1nzewshzamry4%3Afp%3A521%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A504%3Acn%3A1%3Adp%3A0%3Als%3A308096294259%3Ahid%3A65943030%3Az%3A120%3Ai%3A20210507155737%3Aet%3A1620395857%3Ac%3A1%3Arn%3A1009064679%3Au%3A1620395857188503018%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1620395856308%3Ads%3A6%2C29%2C230%2C1%2C0%2C0%2C%2C381%2C7%2C%2C%2C%2C650%3Adsn%3A7%2C28%2C230%2C1%2C0%2C0%2C%2C382%2C7%2C%2C%2C%2C651%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1620395857%3At%3A

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

8735e92b5feadb262b74ea3084cc6fb579120a280396e5d10c66895173393618

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 May 2021 13:57:37 GMT
x-content-type-options: nosniff
last-modified: Fri, 07-May-2021 13:57:37 GMT
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: http://povorotnetuda.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 184
x-xss-protection: 1; mode=block
expires: Fri, 07-May-2021 13:57:37 GMT

Redirect headers

pragma: no-cache
date: Fri, 07 May 2021 13:57:37 GMT
last-modified: Fri, 07-May-2021 13:57:37 GMT
location: /watch/31361493/1?wmode=7&page-url=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Abx1nzewshzamry4%3Afp%3A521%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A504%3Acn%3A1%3Adp%3A0%3Als%3A308096294259%3Ahid%3A65943030%3Az%3A120%3Ai%3A20210507155737%3Aet%3A1620395857%3Ac%3A1%3Arn%3A1009064679%3Au%3A1620395857188503018%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1620395856308%3Ads%3A6%2C29%2C230%2C1%2C0%2C0%2C%2C381%2C7%2C%2C%2C%2C650%3Adsn%3A7%2C28%2C230%2C1%2C0%2C0%2C%2C382%2C7%2C%2C%2C%2C651%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1620395857%3At%3A
strict-transport-security: max-age=31536000
access-control-allow-origin: http://povorotnetuda.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Fri, 07-May-2021 13:57:37 GMT

GET
H2

200

1 Show response
mc.yandex.com/watch/31051446/
Redirect Chain

https://mc.yandex.com/watch/31051446?wmode=7&page-url=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Abx1nzewshzamry4%3Afp%3A521%3Afu%3A0%3Aen%3Autf-8...
https://mc.yandex.com/watch/31051446/1?wmode=7&page-url=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Abx1nzewshzamry4%3Afp%3A521%3Afu%3A0%3Aen%3Autf...

184 B
215 B

66ms
66ms

XHR
application/json

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/31051446/1?wmode=7&page-url=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Abx1nzewshzamry4%3Afp%3A521%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A504%3Acn%3A2%3Adp%3A0%3Als%3A726247061816%3Ahid%3A65943030%3Az%3A120%3Ai%3A20210507155737%3Aet%3A1620395857%3Ac%3A1%3Arn%3A757698271%3Au%3A1620395857188503018%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1620395856308%3Ads%3A6%2C29%2C230%2C1%2C0%2C0%2C%2C381%2C7%2C%2C%2C%2C650%3Adsn%3A7%2C28%2C230%2C1%2C0%2C0%2C%2C382%2C7%2C%2C%2C%2C651%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1620395857%3At%3A

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

309335fbb91309606e55fc7f28c76b979c62ecb99d0f9e4d7b75d574962deb16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 May 2021 13:57:37 GMT
x-content-type-options: nosniff
last-modified: Fri, 07-May-2021 13:57:37 GMT
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: http://povorotnetuda.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 184
x-xss-protection: 1; mode=block
expires: Fri, 07-May-2021 13:57:37 GMT

Redirect headers

pragma: no-cache
date: Fri, 07 May 2021 13:57:37 GMT
last-modified: Fri, 07-May-2021 13:57:37 GMT
location: /watch/31051446/1?wmode=7&page-url=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Abx1nzewshzamry4%3Afp%3A521%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A504%3Acn%3A2%3Adp%3A0%3Als%3A726247061816%3Ahid%3A65943030%3Az%3A120%3Ai%3A20210507155737%3Aet%3A1620395857%3Ac%3A1%3Arn%3A757698271%3Au%3A1620395857188503018%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1620395856308%3Ads%3A6%2C29%2C230%2C1%2C0%2C0%2C%2C381%2C7%2C%2C%2C%2C650%3Adsn%3A7%2C28%2C230%2C1%2C0%2C0%2C%2C382%2C7%2C%2C%2C%2C651%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1620395857%3At%3A
strict-transport-security: max-age=31536000
access-control-allow-origin: http://povorotnetuda.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Fri, 07-May-2021 13:57:37 GMT

GET
H/1.1 200
OK xA6QUWUgQ5 Show response
code.jivosite.com/script/widget/config/ 2 KB
1 KB 299ms
161ms XHR
application/x-javascript 54.247.111.165
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jivosite.com/script/widget/config/xA6QUWUgQ5
Requested by: Host: code.jivosite.com
URL: http://code.jivosite.com/script/widget/xA6QUWUgQ5
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 54.247.111.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-247-111-165.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e35d1ea5fa4b9ec9ba7e65f2723121342772ba5dcef5f36217119c6df52dbbb7

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 07 May 2021 13:57:38 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=7200
Connection: keep-alive
X-Geo-Shard: ya
Content-Length: 784
Via: 1.1 sharxy
Expires: Fri, 07 May 2021 15:57:37 GMT

GET
H2 200 xA6QUWUgQ5 Show response
node-ya10.jivosite.com/widget/status/812169/ 80 B
345 B 165ms
51ms XHR
application/json 84.201.147.165
YANDEXCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://node-ya10.jivosite.com/widget/status/812169/xA6QUWUgQ5?rnd=0.32400087088738583
Requested by: Host: code.jivosite.com
URL: http://code.jivosite.com/script/widget/xA6QUWUgQ5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 84.201.147.165 , Russian Federation, ASN200350 (YANDEXCLOUD, RU),
Reverse DNS
Software: foxy /
Resource Hash: a6121617bd9a18d9f9fbf7d09ab7303661860fbeb52098fe3bafd054c53491a7

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 May 2021 13:57:38 GMT
server: foxy
x-botmode: no
x-geoip: SE;26;Stockholm
content-type: application/json; charset=utf-8
access-control-allow-origin: http://povorotnetuda.ru
access-control-expose-headers: X-Geoip, X-Botmode
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-max-age: 1728000
content-length: 80

GET
H2 200 bundle_ru_RU.js Show response
code-ya.jivosite.com/js/ 1 MB
317 KB 190ms
56ms Script
application/javascript 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://code-ya.jivosite.com/js/bundle_ru_RU.js?rand=1619595180
Requested by: Host: code.jivosite.com
URL: http://code.jivosite.com/script/widget/xA6QUWUgQ5
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 5f581486e9d21f8615522c58d3356d4f8b70d93c6fc8386c5c641b3466aa3401

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-id: fr5-up-gc34
date: Fri, 07 May 2021 13:57:38 GMT
content-encoding: gzip
access-control-allow-origin: *
x-cached-since: 2021-05-07T13:05:46+00:00
x-geo-shard: ya
content-length: 324223
last-modified: Tue, 27 Apr 2021 13:23:16 GMT
server: nginx
etag: "60881044-4f27f"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 sharxy
cache-control: max-age=86400
cache: HIT
accept-ranges: bytes

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 22ms
21ms Image
image/gif 2a03:2880:f108:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1484479458276977&ev=Microdata&dl=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&rl=&if=false&ts=1620395858530&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%22%2C%22meta%3Adescription%22%3A%22%22%2C%22meta%3Akeywords%22%3A%22%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.39&r=stable&ec=2&o=30&fbp=fb.1.1620395857025.1955062922&it=1620395856918&coo=false&es=automatic&tm=3&exp=l0&rqm=GET

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f108:83:face:b00c:0:25de Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 13:57:38 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Fri, 07 May 2021 13:57:38 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 22ms
22ms Image
image/gif 2a03:2880:f108:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=688232001310482&ev=Microdata&dl=http%3A%2F%2Fpovorotnetuda.ru%2Flogin.php&rl=&if=false&ts=1620395858597&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%22%2C%22meta%3Adescription%22%3A%22%22%2C%22meta%3Akeywords%22%3A%22%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.39&r=stable&ec=1&o=30&fbp=fb.1.1620395857025.1955062922&it=1620395856918&coo=false&es=automatic&tm=3&exp=l0&rqm=GET

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f108:83:face:b00c:0:25de Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 13:57:38 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Fri, 07 May 2021 13:57:38 GMT

GET
H/1.1 200
OK widget.css
code-ya.jivosite.com/css/2325b35c/ 192 KB
37 KB 11ms
6ms Stylesheet
text/css 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: http://code-ya.jivosite.com/css/2325b35c/widget.css
Requested by: Host: povorotnetuda.ru
URL: http://povorotnetuda.ru/login.php
Protocol: HTTP/1.1
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: a7ed189b56d152e60a5ff5f0e80fe59e629af259a2d3f1aea0736d8ec29183bf

Request headers

Referer: http://povorotnetuda.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

X-ID: fr5-up-gc38
Date: Fri, 07 May 2021 13:57:38 GMT
Content-Encoding: gzip
X-Cached-Since: 2021-04-30T13:35:34+00:00
Connection: keep-alive
X-Geo-Shard: ya
Content-Length: 37015
Last-Modified: Tue, 27 Apr 2021 13:23:08 GMT
Server: nginx
Etag: "6088103c-9097"
Vary: Accept-Encoding
Content-Type: text/css
Via: 1.1 sharxy
Cache-Control: max-age=864000
Cache: HIT
Accept-Ranges: bytes
Expires: Mon, 10 May 2021 13:35:34 GMT

GET
DATA 200
OK truncated
/ 393 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c66b5eadbc121cef27de174430ad219f445c82ff938916a34582c712d4bf76d5

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2210b7e6d726c9d273fbb76890845c5054bdcc03ce803fe9b153ac7dac1dd646

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 447 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6d2b109a76164f78748127e2fcac439ea51f75befbbb92b2c95118b359cc2eaa

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 206 agent_message.mp3
code-ya.jivosite.com/sounds/ 4 KB
4 KB 47ms
46ms Media
audio/mpeg 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://code-ya.jivosite.com/sounds/agent_message.mp3
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: ff81aad05612f90cf97c238f219765884e5cbf49351d8dc96a4a063c598c3f43

Request headers

Referer: http://povorotnetuda.ru/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=0-

Response headers

x-id: fr5-up-gc34
date: Fri, 07 May 2021 13:57:38 GMT
via: 1.1 sharxy
x-cached-since: 2021-05-05T13:05:36+00:00
Content-Range: bytes 0-3759/3760
x-geo-shard: ya
Content-Length: 3760
last-modified: Tue, 27 Apr 2021 13:18:59 GMT
server: nginx
etag: "60880f43-eb0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: audio/mpeg
access-control-allow-origin: *
cache-control: max-age=2592000
cache: HIT
expires: Fri, 04 Jun 2021 13:05:36 GMT

GET
H2 206 notification.mp3
code-ya.jivosite.com/sounds/ 6 KB
6 KB 48ms
47ms Media
audio/mpeg 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://code-ya.jivosite.com/sounds/notification.mp3
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: 1112436abea08c851302bba4d4e37a27e25e5ec26b20474667a3369d41154bab

Request headers

Referer: http://povorotnetuda.ru/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=0-

Response headers

x-id: fr5-up-gc34
date: Fri, 07 May 2021 13:57:38 GMT
via: 1.1 sharxy
x-cached-since: 2021-05-05T13:05:36+00:00
Content-Range: bytes 0-5807/5808
x-geo-shard: ya
Content-Length: 5808
last-modified: Tue, 27 Apr 2021 13:18:59 GMT
server: nginx
etag: "60880f43-16b0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: audio/mpeg
access-control-allow-origin: *
cache-control: max-age=2592000
cache: HIT
expires: Fri, 04 Jun 2021 13:05:36 GMT

GET
H2 206 outgoing_message.mp3
code-ya.jivosite.com/sounds/ 5 KB
5 KB 48ms
48ms Media
audio/mpeg 2a03:90c0:41:2801::254
GCORE

General

Check archive.org

Show headers Download Go to

Full URL: https://code-ya.jivosite.com/sounds/outgoing_message.mp3
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a03:90c0:41:2801::254 Frankfurt am Main, Germany, ASN199524 (GCORE, LU),
Reverse DNS
Software: nginx /
Resource Hash: d44244617bf21df7a137694fa762d5cab3b82cb9fae8f33de5917977b02b2a11

Request headers

Referer: http://povorotnetuda.ru/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=0-

Response headers

x-id: fr5-up-gc34
date: Fri, 07 May 2021 13:57:38 GMT
via: 1.1 sharxy
x-cached-since: 2021-04-28T13:30:29+00:00
Content-Range: bytes 0-5013/5014
x-geo-shard: ya
Content-Length: 5014
last-modified: Tue, 27 Apr 2021 13:18:59 GMT
server: nginx
etag: "60880f43-1396"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: audio/mpeg
access-control-allow-origin: *
cache-control: max-age=2592000
cache: HIT
expires: Fri, 28 May 2021 13:30:29 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: xn--80adgd3bebafnxcn.xn--p1ai
URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/fonts/BebasBold/BebasBold.woff

Domain: xn--80adgd3bebafnxcn.xn--p1ai
URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/fonts/BebasRegular/BebasRegular.woff

Domain: xn--80adgd3bebafnxcn.xn--p1ai
URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/fonts/BebasBold/BebasBold.ttf

Domain: xn--80adgd3bebafnxcn.xn--p1ai
URL: http://xn--80adgd3bebafnxcn.xn--p1ai/wp-content/themes/povorot/fonts/BebasRegular/BebasRegular.ttf

Verdicts & Comments Add Verdict or Comment

89 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.povorotnetuda.ru/	1970-01-20 02:52:11	Name: _ym_d Value: 1620395857
.povorotnetuda.ru/	1970-01-20 02:52:11	Name: _ym_uid Value: 1620395857188503018
.povorotnetuda.ru/	1970-01-20 11:37:47	Name: _ga Value: GA1.2.649012338.1620395857
.povorotnetuda.ru/	1970-01-19 18:06:35	Name: _gat_UA-114395671-1 Value: 1
.povorotnetuda.ru/	1970-01-19 18:08:02	Name: _gid Value: GA1.2.364017819.1620395857
.povorotnetuda.ru/	1970-01-19 18:07:47	Name: _ym_isad Value: 2
.povorotnetuda.ru/	1970-01-19 20:16:11	Name: _fbp Value: fb.1.1620395857025.1955062922

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code-ya.jivosite.com
code.jivosite.com
code.jquery.com
connect.facebook.net
googleads.g.doubleclick.net
mc.yandex.com
mc.yandex.ru
node-ya10.jivosite.com
povorotnetuda.ru
stats.g.doubleclick.net
vk.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
xn--80adgd3bebafnxcn.xn--p1ai
xn--80adgd3bebafnxcn.xn--p1ai
142.250.185.194
2001:4de0:ac18::1:a:2b
2a00:1450:4001:803::2002
2a00:1450:4001:803::2003
2a00:1450:4001:808::2004
2a00:1450:4001:808::2008
2a00:1450:4001:828::200e
2a00:1450:400c:c04::9d
2a02:6b8::1:119
2a03:2880:f008:8:face:b00c:0:1
2a03:2880:f108:83:face:b00c:0:25de
2a03:90c0:41:2801::254
54.247.111.165
84.201.147.165
87.236.16.107
87.240.139.194
00528942400593edaa03cdca6778bec9fbf267df70aff9d0fad6f9d180207628
02c4639cfcedda1fb2353d2ca7cd4597f7eac7012042411c9faa22caecbedde5
0933e0c550e23364476c44047c0d7e52ff94b1bbe680f66f92bf4eb2a65584e1
0dc25fa3b32fcdcb0c8d6960ce7a9ec11627d8769d78a0fcc5c8d06a8a4a757d
0e42f6dd2a9e2d6ec836f18de554c8677317cf1014dd2955569e96e91844f244
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1112436abea08c851302bba4d4e37a27e25e5ec26b20474667a3369d41154bab
15a6b347a9b93f8c94848ee620184cd4a893c6238a7267aa380a1c9d69a5a8e7
15eeae30bff8a86e63fa76d27b556ab4059cb4313e4d33cb9fee0293364bbc90
191622240e7646a2e888eb318557bcca854828b59b5b2e960545ee08ae142382
1e67d8dbcca1f6fd94e077c85c2fb40fa1c2756c99238daa8da882144260a68d
1fdcbc103efd36c93cec22826c56503704e3f4ea9defe97c43521c562d6ce140
2210b7e6d726c9d273fbb76890845c5054bdcc03ce803fe9b153ac7dac1dd646
229e5c85f951e93a5447f7dd03f9cfe9c1c5e5b3a6f34cca22b5da8f54075b86
25fe45f80deb3a5943695bb19674ddaf60340575dd353fd3b2d227fb62a7e42b
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
309335fbb91309606e55fc7f28c76b979c62ecb99d0f9e4d7b75d574962deb16
3dbc832de930e5b39820c0fc94f59c8c89b134dbbe02c7e4dc31aeda65d604de
3fa6f131c82ce0a6b6647b746d78a14cff411a72a72027244e62b52bfdf1c846
4a2815e0eb5669badc30aedd1398c0b9133e3479621e1e6ec8aefd2b3954daee
51c37340f48a1c3f73c7f44c413e4ee52c5893b590d2dbb7ac47eca7f1d63f50
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5
56bab4312d57027e314de1d04483d708d95ffc1433d568d37af426d4106c7907
5f581486e9d21f8615522c58d3356d4f8b70d93c6fc8386c5c641b3466aa3401
5f626d986cb2b012e03225573f87ce60ecb1a44c997a24032cf905482faef82b
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d2b109a76164f78748127e2fcac439ea51f75befbbb92b2c95118b359cc2eaa
77272949e068ee9459287f707d250a93da595992b051605f4bd72de432cc0f1f
7a3eca6361c114ba5ac314cbd4397f9e0329ec9fc5f5845e7a14800d469a19ec
7c57d6bb233afec5de2620f1aae77ee4764d4089021e30ec1f4029dffbeaf32a
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
8719e7caa8c8992a1d546c7a38c708d4929dd04bde1be9381def52752fd2a97f
8735e92b5feadb262b74ea3084cc6fb579120a280396e5d10c66895173393618
95d7afb75f1a317ae24c5f93399f827af7970243f56b58a39140c0329692451e
96f1810d96a208f1b98ce9ba49368fcb9b8334105e87554602275b978c2c170a
977315eedf53531b879f0b2e8104d85fbf75742043bc5c10b90fdd76278a8b65
9b1b195900c079b2a8859cb8ded918d2e179c49fbb2a3aab3491e68d33fbaa54
a236a43883e55479a2c5b6e18dda928d4b9ade7687c09b0842a7c751e3c2a601
a27c246df6c64b929864ef626f370de4654c126f7bd4328542896e9474bfb084
a517525b8a7d39bcaf1cf5f9695c5be8fce7a6b920a3924c1a4f70e8ea748c05
a6121617bd9a18d9f9fbf7d09ab7303661860fbeb52098fe3bafd054c53491a7
a7ed189b56d152e60a5ff5f0e80fe59e629af259a2d3f1aea0736d8ec29183bf
afd85ea409d7a89914b6308b3a25965ab95428aedeb56e16ce481123552ebb50
b128bad7626d4fa6c496eecbdcf0bbd7c77753c8767867fb1709af0a5a000e73
b259de534ce1ec151a383c5cfbc69f8fc568399e0d400b60f2d9534d072c76e0
c66b5eadbc121cef27de174430ad219f445c82ff938916a34582c712d4bf76d5
c90f0e501d2948fbc2b61bffd654fa4ab64741fd48923782419eeb14d3816fb8
d44244617bf21df7a137694fa762d5cab3b82cb9fae8f33de5917977b02b2a11
dd052d575957f7d321a98d99c1ac60d54fec29f543a81c380605edb95fca3082
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e0d79b1d24d974bd3b5adc50a4ebe5a6e8c24a11a1761f3d7e982f64bb8688b0
e35d1ea5fa4b9ec9ba7e65f2723121342772ba5dcef5f36217119c6df52dbbb7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef3162728f25f19aecdd2eb12279035869b10d78cb6875f5692c2d8bc6c8414c
fcab264e99079508ea218caaa0be0185340c2558353ad024b183ed46d633d682
ff81aad05612f90cf97c238f219765884e5cbf49351d8dc96a4a063c598c3f43

povorotnetuda.ru Open in urlscan Pro 87.236.16.107 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

68 Requests

49 %HTTPS

69 %IPv6

15 Domains

18 Subdomains

17 IPs

7 Countries

2402 kBTransfer

4591 kBSize

7 Cookies

11 Outgoing links

Redirected requests

68 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

povorotnetuda.ru Open in urlscan Pro
87.236.16.107 Public Scan

Screenshot
Live screenshot

Full Image

68
Requests

49 %
HTTPS

69 %
IPv6

15
Domains

18
Subdomains

17
IPs

7
Countries

2402 kB
Transfer

4591 kB
Size

7
Cookies

68 HTTP transactions
3 data transactions