legas.com.ua Open in urlscan Pro
2a06:98c1:3120::7 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://legas.com.ua/
Effective URL:
https://legas.com.ua/
Submission: On April 25 via api (April 25th 2022, 7:15:24 am UTC) from GB — Scanned from GB

Summary HTTP 179 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 34 IPs in 8 countries across 39 domains to perform 179 HTTP transactions. The main IP is 2a06:98c1:3120::7, located in United States and belongs to CLOUDFLARENET, US. The main domain is legas.com.ua.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 24th 2022. Valid for: a year.

This is the only time legas.com.ua was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
10 20	2a06:98c1:312... 2a06:98c1:3120::7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	31.131.16.29 31.131.16.29	56851 (VPS-UA-AS) (VPS-UA-AS)
1	49.12.116.255 49.12.116.255	24940 (HETZNER-AS) (HETZNER-AS)
23	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
1	2a02:6b8::130 2a02:6b8::130	208722 (YNDX) (YNDX)
1	2606:4700:303... 2606:4700:3033::6815:2c6c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:829::2008	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f02... 2a03:2880:f02d:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
13	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
1 1	192.102.6.73 192.102.6.73	57682 (HVDS-AS) (HVDS-AS)
1 1	142.132.202.70 142.132.202.70	24940 (HETZNER-AS) (HETZNER-AS)
1 1	176.9.60.211 176.9.60.211	24940 (HETZNER-AS) (HETZNER-AS)
1 1	104.92.94.3 104.92.94.3	16625 (AKAMAI-AS) (AKAMAI-AS)
1	5.187.1.114 5.187.1.114	44066 (DE-FIRSTC...) (DE-FIRSTCOLO www.first-colo.net)
1	104.18.2.81 104.18.2.81	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:6b8::14 2a02:6b8::14	208722 (YNDX) (YNDX)
28	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
1	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:400c:c06::9a	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f12... 2a03:2880:f12d:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
41	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:803::2006	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
2 3	2a00:1450:400... 2a00:1450:4001:82a::2004	15169 (GOOGLE) (GOOGLE)
3 13	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
3 5	23.35.236.247 23.35.236.247	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	37.252.172.249 37.252.172.249	29990 (ASN-APPNEX) (ASN-APPNEX)
2	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2006	15169 (GOOGLE) (GOOGLE)
1 2	52.8.151.228 52.8.151.228	16509 (AMAZON-02) (AMAZON-02)
2	2620:116:800d... 2620:116:800d:21:8c6e:cf2c:8d6:9fb5	16509 (AMAZON-02) (AMAZON-02)
1 1	3.120.51.47 3.120.51.47	16509 (AMAZON-02) (AMAZON-02)
2 2	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
2	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
4 4	192.82.242.209 192.82.242.209	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 2	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
1 1	108.128.215.255 108.128.215.255	16509 (AMAZON-02) (AMAZON-02)
1	2a05:d01c:1d8... 2a05:d01c:1d8:8100:fcf5:ef31:f27f:f1a6	16509 (AMAZON-02) (AMAZON-02)
179	34

20 2a06:98c1:3120::7 (United States) 10 redirects

ASN13335 (CLOUDFLARENET, US)

legas.com.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.131.16.29 (Ukraine)

ASN56851 (VPS-UA-AS, UA)
PTR: 29.16.131.31.uashared05.twinservers.net

caddy.com.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 49.12.116.255 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.255.116.12.49.clients.your-server.de

www.meteoprog.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6b8::130 (Moscow, Russian Federation)

ASN208722 (YNDX, FI)

info.maps.yandex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::6815:2c6c (United States)

ASN13335 (CLOUDFLARENET, US)

cpa.com.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.102.6.73 (Kyiv, Ukraine) 1 redirects

ASN57682 (HVDS-AS, UA)
PTR: s1.zevshost.net

040510111616.c.mystat-in.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.132.202.70 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.70.202.132.142.clients.your-server.de

webcache.pp.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 176.9.60.211 (Weimar, Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.211.60.9.176.clients.your-server.de

pubmedya.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.92.94.3 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-92-94-3.deploy.static.akamaitechnologies.com

www.zenaps.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 5.187.1.114 (Frankfurt am Main, Germany)

ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE)
PTR: dsde333-3.fornex.org

www.admitad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.2.81 (None, )

ASN13335 (CLOUDFLARENET, US)

r.i.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6b8::14 (Moscow, Russian Federation)

ASN208722 (YNDX, FI)

clck.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400c:c06::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

41 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:803::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

static.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 142.250.184.194 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.35.236.247 (Frankfurt am Main, Germany) 3 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-236-247.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.252.172.249 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.8.151.228 (San Jose, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-8-151-228.us-west-1.compute.amazonaws.com

t.myvisualiq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 (United States)

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.120.51.47 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-120-51-47.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.227.252.103 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.82.242.209 (United States) 4 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.144.165 (Frankfurt am Main, Germany) 2 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.128.215.255 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-108-128-215-255.eu-west-1.compute.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d01c:1d8:8100:fcf5:ef31:f27f:f1a6 (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
64	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 96 tpc.googlesyndication.com — Cisco Umbrella Rank: 127	667 KB
41	doubleclick.net 3 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 38 stats.g.doubleclick.net — Cisco Umbrella Rank: 80 static.doubleclick.net — Cisco Umbrella Rank: 328 cm.g.doubleclick.net — Cisco Umbrella Rank: 195 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 272	1023 KB
20	legas.com.ua 10 redirects legas.com.ua	159 KB
13	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 35	40 KB
7	gstatic.com www.gstatic.com fonts.gstatic.com	93 KB
6	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 163	217 KB
6	google.com 2 redirects adservice.google.com — Cisco Umbrella Rank: 64 www.google.com — Cisco Umbrella Rank: 2	2 KB
5	casalemedia.com 3 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 530	4 KB
5	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 39	4 KB
4	pubmatic.com 4 redirects image6.pubmatic.com — Cisco Umbrella Rank: 565	2 KB
3	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 226	3 KB
3	google.co.uk adservice.google.co.uk — Cisco Umbrella Rank: 5401	1 KB
2	rubiconproject.com 2 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 318	924 B
2	openx.net rtb.openx.net — Cisco Umbrella Rank: 1434	486 B
2	rlcdn.com 2 redirects id.rlcdn.com — Cisco Umbrella Rank: 553	575 B
2	quantserve.com cms.quantserve.com — Cisco Umbrella Rank: 1043	929 B
2	myvisualiq.net 1 redirects t.myvisualiq.net — Cisco Umbrella Rank: 1384	1 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 137	83 KB
1	innovid.com ag.innovid.com — Cisco Umbrella Rank: 1394	297 B
1	everesttech.net 1 redirects pixel.everesttech.net — Cisco Umbrella Rank: 3003	376 B
1	agkn.com 1 redirects d.agkn.com — Cisco Umbrella Rank: 536	761 B
1	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 252	90 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 102	3 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 773	646 B
1	yandex.ru clck.yandex.ru — Cisco Umbrella Rank: 41090	429 B
1	i.ua r.i.ua — Cisco Umbrella Rank: 173037	3 KB
1	admitad.com www.admitad.com
1	zenaps.com 1 redirects www.zenaps.com — Cisco Umbrella Rank: 19202	719 B
1	pubmedya.net 1 redirects pubmedya.net — Cisco Umbrella Rank: 231355	549 B
1	pp.ua 1 redirects webcache.pp.ua — Cisco Umbrella Rank: 215337	355 B
1	mystat-in.net 1 redirects 040510111616.c.mystat-in.net	314 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 58	48 KB
1	cpa.com.ua cpa.com.ua
1	yandex.net info.maps.yandex.net
1	meteoprog.ua www.meteoprog.ua — Cisco Umbrella Rank: 903601	171 B
1	caddy.com.ua caddy.com.ua
0	novostimira.biz Failed g.novostimira.biz Failed
0	bigmir.net Failed c.bigmir.net Failed
0	admaster.net Failed a1.admaster.net Failed
179	39

	Domain	Requested by
41	tpc.googlesyndication.com	googleads.g.doubleclick.net tpc.googlesyndication.com pagead2.googlesyndication.com
23	pagead2.googlesyndication.com	legas.com.ua pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
20	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com legas.com.ua
20	legas.com.ua	10 redirects legas.com.ua
13	cm.g.doubleclick.net	3 redirects googleads.g.doubleclick.net
13	www.google-analytics.com	legas.com.ua www.google-analytics.com www.googletagmanager.com
6	www.googletagservices.com	googleads.g.doubleclick.net
5	dsum-sec.casalemedia.com	3 redirects googleads.g.doubleclick.net
5	www.gstatic.com	googleads.g.doubleclick.net
5	fonts.googleapis.com	googleads.g.doubleclick.net tpc.googlesyndication.com
4	image6.pubmatic.com	4 redirects
3	ib.adnxs.com	2 redirects googleads.g.doubleclick.net
3	www.google.com	2 redirects tpc.googlesyndication.com
3	static.doubleclick.net	googleads.g.doubleclick.net
3	stats.g.doubleclick.net	www.google-analytics.com
3	adservice.google.com	pagead2.googlesyndication.com
3	adservice.google.co.uk	pagead2.googlesyndication.com
2	pixel.rubiconproject.com	2 redirects
2	rtb.openx.net	googleads.g.doubleclick.net
2	id.rlcdn.com	2 redirects
2	cms.quantserve.com	googleads.g.doubleclick.net
2	t.myvisualiq.net	1 redirects googleads.g.doubleclick.net
2	googleads4.g.doubleclick.net	googleads.g.doubleclick.net
2	fonts.gstatic.com	fonts.googleapis.com
2	connect.facebook.net	legas.com.ua connect.facebook.net
1	ag.innovid.com	googleads.g.doubleclick.net
1	pixel.everesttech.net	1 redirects
1	d.agkn.com	1 redirects
1	s0.2mdn.net	googleads.g.doubleclick.net
1	www.facebook.com	connect.facebook.net
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	clck.yandex.ru	legas.com.ua
1	r.i.ua	legas.com.ua
1	www.admitad.com	legas.com.ua
1	www.zenaps.com	1 redirects
1	pubmedya.net	1 redirects
1	webcache.pp.ua	1 redirects
1	040510111616.c.mystat-in.net	1 redirects
1	www.googletagmanager.com	legas.com.ua
1	cpa.com.ua	legas.com.ua
1	info.maps.yandex.net	legas.com.ua
1	www.meteoprog.ua	legas.com.ua
1	caddy.com.ua	legas.com.ua
0	g.novostimira.biz Failed	legas.com.ua
0	c.bigmir.net Failed	legas.com.ua
0	a1.admaster.net Failed	legas.com.ua
179	46

This site contains links to these domains. Also see Links.

Domain
caddy.com.ua
salutes.com.ua
forum.legas.com.ua
www.meteoprog.ua
mytop-in.net
www.i.ua
banner.kiev.ua
www.novostimira.com.ua
clck.yandex.ru

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-02-24` - `2023-02-24`	a year	crt.sh
caddy.com.ua R3	`2022-04-03` - `2022-07-02`	3 months	crt.sh
meteoprog.ua R3	`2022-03-12` - `2022-06-10`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
core-jams-info.maps.yandex.net Yandex CA	`2022-01-21` - `2022-07-12`	6 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-02-01` - `2022-05-02`	3 months	crt.sh
i.ua R3	`2022-04-07` - `2022-07-06`	3 months	crt.sh
clck.yandex.ru GlobalSign ECC OV SSL CA 2018	`2022-04-07` - `2022-09-08`	5 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
*.google.co.uk GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
*.innovid.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2022-03-15` - `2023-04-15`	a year	crt.sh

This page contains 24 frames:

Primary Page: https://legas.com.ua/
Frame ID: 739BA68D8D278FE1CF1256D6E04E049B
Requests: 53 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20190131/zrt_lookup.html
Frame ID: 52EE67D0A61BE0BC93EF64B74803FF46
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1486316043&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918327&bpp=17&bdt=1171&idt=308&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&correlator=4380143763487&frm=20&pv=2&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=396&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RfrZYwemlw&p=https%3A//legas.com.ua&dtd=322
Frame ID: B9E11B2C66D404CA74E446E6297DE2BC
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1365725250&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918349&bpp=5&bdt=1194&idt=306&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=1032&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YHWotiKRlR&p=https%3A//legas.com.ua&dtd=309
Frame ID: 48ABC6DA85DA60CAD851ECA06A346768
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=600&slotname=3398747635&adk=240658524&adf=1605720054&pi=t.ma~as.3398747635&w=160&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918370&bpp=14&bdt=1215&idt=291&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384%2C2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1179&ady=2309&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=pzb5QUoDbc&p=https%3A//legas.com.ua&dtd=294
Frame ID: 018F618FC31A1BD016C3C38F97755BBC
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=250&slotname=8161031849&adk=4210853449&adf=3405296861&pi=t.ma~as.8161031849&w=300&lmt=1650870918&psa=0&format=300x250&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918518&bpp=3&bdt=1363&idt=159&shv=r20220420&mjsv=m202204190101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2642460384%2C2642460384%2C3398747635&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1109&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&fsb=1&xpc=zqzDMw8gVB&p=https%3A//legas.com.ua&dtd=161
Frame ID: 2DD5704B482132A5D8B5C77E9BF10511
Requests: 7 HTTP requests in this frame

Frame: https://www.facebook.com/v2.0/plugins/like.php?action=like&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df216d379c35035%26domain%3Dlegas.com.ua%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flegas.com.ua%252Ff858ae3527b9%26relation%3Dparent.parent&container_width=300&href=http%3A%2F%2Flegas.com.ua%2F&layout=standard&locale=en_US&sdk=joey&share=true&show_faces=true&width=230
Frame ID: FB045476C29F85DB42436F222AE71E74
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/index.html
Frame ID: 499DE9181D2A13CC16ADE93DC9002282
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: C4667BB0AA492DD1C8078C6406747418
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 9DBFD5B5E29A63DFA42E03C442388BD5
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/d_XgMe7_8DX3JscHlpumBxzOcHqlAtWKp75Cu0r3_I4.js
Frame ID: 35048DE99102EC281E9006E1B7573018
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/d_XgMe7_8DX3JscHlpumBxzOcHqlAtWKp75Cu0r3_I4.js
Frame ID: 6895F8CC56A24456CA54626C40EBF98C
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/d_XgMe7_8DX3JscHlpumBxzOcHqlAtWKp75Cu0r3_I4.js
Frame ID: DCCC1EB847C29F02FBAB6D060307B2A1
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&adk=1812271804&adf=3025194257&lmt=1650870919&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Flegas.com.ua%2F&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870919855&bpp=1&bdt=2700&idt=1&shv=r20220420&mjsv=m202204190101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd4e11a67766aa393-223e6c6d81cd00c5%3AT%3D1650870918%3ART%3D1650870918%3AS%3DALNI_Mbw0eghOq8-rEKfSYmM-KKFwubGCQ&prev_fmts=300x250&prev_slotnames=2642460384%2C2642460384%2C3398747635&nras=1&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&psts=AGkb-H-4BzVi6JeHyFQwSh59ILbDqCmnoRlnUkN576sKw7NJrpzHj_cmbucF5cqFSh8FHk2RglpeGa8uq9AnJP8%2CAGkb-H_0SJ8ID_zNYxuYt1TYNR2qww0cQhLdLO0nbjLysd637m405DKb2wowDsMn1pq1MqkCqZfBgKrqdcBA1N0%2CAGkb-H_uSYH96b5l1hMiPzg0Jy3nBm0Nw17t_YK4mIYFtDroilIr6vkCIIOwDy7XhepibJzfzYVC-CNtbU97kh8%2CAGkb-H_xEFJsS1V0xEcH-Db82JEREZu7xXFQgu6G-D7eJtNDDBWec7ZIgKbOX7HMyuuO7JRU3jX3ooROrR8Qgl8w&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=5&uci=a!5&fsb=1&dtd=7
Frame ID: DF032C7E6B281CE75AF4BF959D7A9116
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: F71A60E7608D7BEDDE0D57DB36DFAA31
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 05CC7C4D882E8D22FEB66AFC9F8BE700
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1
Frame ID: 7AF13F61648B4482D9E96515AAB9CBEC
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1
Frame ID: 50DD77B19C4B8D8E5523D58A24DD7CD2
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPxZBCR7Z4BGPrH9MUBMAE&v=APEucNVE_yhyZ-qWfMnxRbBPrhCRf0p9xIariDjoAsAxxXro8vMvubMF5Db8aPyPxVbkbu9mijLk_KHBf-dyoJ0YCaQDJem0AvT6LCKLZXCGHF3W8iSvoRFZxTwM6jyVetVdwD9HCltTuxAsg01jajZ3T9HEcqZ6PD6hRN_2TBS0knmR4HyyusU
Frame ID: F4650B79BA125CBF0C534CE6602D4D87
Requests: 5 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Frame ID: 87EFAC97CBB7A58141D62BF013BE6841
Requests: 7 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: B975F2E75384E407A5DD46C465E9854F
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 0BE1B72BCD8B8F3A71A90C20FBD390A1
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: C3B8285C90D6DCF0B5C47BD1A9920AB5
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/d_XgMe7_8DX3JscHlpumBxzOcHqlAtWKp75Cu0r3_I4.js
Frame ID: F133850F62773B691507C16DD2B64B27
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Правовой портал

Page URL History Show full URLs

http://legas.com.ua/ HTTP 301
https://legas.com.ua/ HTTP 302
https://legas.com.ua/ Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/pagead/show_ads\.js

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

179
Requests

84 %
HTTPS

52 %
IPv6

39
Domains

46
Subdomains

34
IPs

8
Countries

2433 kB
Transfer

5101 kB
Size

33
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: http://caddy.com.ua/magazin/category/view/5.html

Search URL Search Domain Scan URL

URL: http://salutes.com.ua/
Title: Наш магазин

Search URL Search Domain Scan URL

URL: http://forum.legas.com.ua/
Title: ФОРУМ

Search URL Search Domain Scan URL

URL: http://caddy.com.ua/magazin/product/view/5/282.html
Title: Toyota Celica (3000 грн)www.caddy.com.ua

Search URL Search Domain Scan URL

URL: http://www.meteoprog.ua/ua/weather/Kyiv/

Search URL Search Domain Scan URL

URL: http://mytop-in.net/

Search URL Search Domain Scan URL

URL: http://www.i.ua/
Title:

Search URL Search Domain Scan URL

URL: http://forum.legas.com.ua/index.php?topic=403.0
Title: Продажа Suzuki SX4 2007го года в хорошем состоянии, один владелец

Search URL Search Domain Scan URL

URL: http://forum.legas.com.ua/index.php?topic=402.0
Title: А какой сейчас механизм продажи авто?

Search URL Search Domain Scan URL

URL: http://banner.kiev.ua/
Title: Украинская Баннерная Сеть

Search URL Search Domain Scan URL

URL: http://www.novostimira.com.ua/
Title: Новости

Search URL Search Domain Scan URL

URL: https://clck.yandex.ru/redir/dtype=stred/pid=30/cid=1531/*http://maps.yandex.ru/kiev_traffic

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://legas.com.ua/ HTTP 301
https://legas.com.ua/ HTTP 302
https://legas.com.ua/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://legas.com.ua/css/style.css HTTP 302
https://legas.com.ua/css/style.css

Request Chain 1

https://legas.com.ua/js/jquery-1.4.2.min.js HTTP 302
https://legas.com.ua/js/jquery-1.4.2.min.js

Request Chain 2

https://legas.com.ua/images/logo.jpg HTTP 302
https://legas.com.ua/images/logo.jpg

Request Chain 3

https://legas.com.ua/images/ad/caddy_seats_new2.gif HTTP 302
https://legas.com.ua/images/ad/caddy_seats_new2.gif

Request Chain 6

https://legas.com.ua/images/poll.jpg HTTP 302
https://legas.com.ua/images/poll.jpg

Request Chain 7

https://legas.com.ua/images/arrow.jpg HTTP 302
https://legas.com.ua/images/arrow.jpg

Request Chain 16

https://legas.com.ua/images/bg.jpg HTTP 302
https://legas.com.ua/images/bg.jpg

Request Chain 17

https://legas.com.ua/images/menu_bg.jpg HTTP 302
https://legas.com.ua/images/menu_bg.jpg

Request Chain 18

https://040510111616.c.mystat-in.net/?i040510111616&t4&g27&w1600&c24&r&v3&j0 HTTP 301
https://webcache.pp.ua/w HTTP 302
https://pubmedya.net/to2/goldsmiths.co.uk/ HTTP 307
https://www.zenaps.com/rclick.php?mid=2174&c_len=2592000&c_ts=1650869169&c_cnt=632098%7C0%7C0%7C1650869169%7Cb46e5352388cdef8e93920864ad277e0%7Caw%7C0&ir=636e4460-c463-11ec-9b3a-22623ec29485&pr=https%3A%2F%2Fwww.admitad.com%2Fen%2F%26awc%3D2174_1650869169_ccd3c17e79678ec69f00454158c9a034&bId=HLEX_626643b121b760.37725545&cookie=1&c_d=zenaps.com HTTP 302
https://www.admitad.com/en/&awc=2174_1650869169_ccd3c17e79678ec69f00454158c9a034

Request Chain 84

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 85

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 150

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM2EbsE9eQJMYgp49LUW0Cg&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM2EbsE9eQJMYgp49LUW0Cg&google_cver=1&C=1

Request Chain 151

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YmZKieU5keGjyYxLZmaylAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM2EbsE9eQJMYgp49LUW0Cg&google_cver=1

Request Chain 152

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEFjhH_7FUp4K-qIbUEtNRgM&google_cver=1

Request Chain 153

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDAzMTMzMTUwNTQ0ODUzMzg2NA%3D%3D

Request Chain 159

https://t.myvisualiq.net/impression_pixel?r=1907923788&et=i&ago=212&ao=795&aca=27459952&si=6033200&ci=168801357&pi=332048446&ad=524088361&advt=4662460&chnl=-7&vndr=115&sz=8913&u=16626492143|27478160|ABAjH0ixIp4KCZ7wd4YoxjhdoHiN&pt=i HTTP 302
https://t.myvisualiq.net/ul_cb/impression_pixel?r=1907923788&et=i&ago=212&ao=795&aca=27459952&si=6033200&ci=168801357&pi=332048446&ad=524088361&advt=4662460&chnl=-7&vndr=115&sz=8913&u=16626492143|27478160|ABAjH0ixIp4KCZ7wd4YoxjhdoHiN&pt=i

Request Chain 165

https://d.agkn.com/pixel/2175/?google_gid=CAESECKFdqfi_YWjC1CPHiDY0jg&google_cver=1&google_push=AYg5qPI3-eeWufAq_2XLsERVlmV57QOyFn_TfcJ5yYMqcihYjdSId2ScT8E75rIDiix7ZLSX5Q6JNPIjAs6h1zFvy9rXX8Xq444ypQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPI3-eeWufAq_2XLsERVlmV57QOyFn_TfcJ5yYMqcihYjdSId2ScT8E75rIDiix7ZLSX5Q6JNPIjAs6h1zFvy9rXX8Xq444ypQ&google_hm=Q0FFU0VDS0ZkcWZpX1lXakMxQ1BIaURZMGpn

Request Chain 166

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPK927M-mqz41YJDvTWw0mnwSskM7mxGF33Mu_bH5CP14OJNUQ16NWWtkVgLQqC3Mo9K1YDMr4QjII_GgN9pkbSw35V1Q0kNJw&google_gid=CAESEIwasnc9-HH7EAxRvialKCs&google_cver=1 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCImVmZMGEgUI6AcQAEIASnJnb29nbGVfcHVzaD1BWWc1cVBLOTI3TS1tcXo0MVlKRHZUV3cwbW53U3NrTTdteEdGMzNNdV9iSDVDUDE0T0pOVVExNk5XV3RrVmdMUXFDM01vOUsxWURNcjRRaklJX0dnTjlwa2JTdzM1VjFRMGtOSnc HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwQXU5MlJ5VTFVOVMzamNhSnlwRUhOVUw3aUJKQ2xPVjU5NlAtVUM4NEIxOA==&google_push

Request Chain 168

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJa9woaldd6ICga8rOeboUM&google_cver=1&google_push=AYg5qPISeckRG-mIuz3F0WFNWnY9XdC2PBpYdMQdjBa9QmV1ebAziCUG2f3cco_LC88VBcrOr65ZUj1sdpWBRn_5pYJq3xfDg-bfiA HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJa9woaldd6ICga8rOeboUM&google_cver=1&google_push=AYg5qPISeckRG-mIuz3F0WFNWnY9XdC2PBpYdMQdjBa9QmV1ebAziCUG2f3cco_LC88VBcrOr65ZUj1sdpWBRn_5pYJq3xfDg-bfiA&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=RPb2EI7sTDKzvFbxyfjkqA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPISeckRG-mIuz3F0WFNWnY9XdC2PBpYdMQdjBa9QmV1ebAziCUG2f3cco_LC88VBcrOr65ZUj1sdpWBRn_5pYJq3xfDg-bfiA

Request Chain 169

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEM6otkUSk1B7F9yV6PbmVY4&google_cver=1&google_push=AYg5qPKFWhToWfbh7Xhun2xhAg1IjGcejVg29oeCQQcas5_4-7MCuUfYkfN7nZR9fPZztkYfWptM8mtq22MIJaHl_HL9sFFQcM6qwg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDJFRFg3N0MtMTQtSzRYSQ==&google_push=AYg5qPKFWhToWfbh7Xhun2xhAg1IjGcejVg29oeCQQcas5_4-7MCuUfYkfN7nZR9fPZztkYfWptM8mtq22MIJaHl_HL9sFFQcM6qwg

Request Chain 170

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig

Request Chain 174

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPIDlHil6Lxhg8HioUVwR19qxIuEqTLd2P54HQazm0UQJmz4czaHWVe_oeKJpAjcX2MKIJI-pzRA5jM6DnfCMarAuEPIIGWP&google_gid=CAESEJVoL9y0xZiZYuacudRKnyw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WW1aS2lRQUFBWFdLQFhyMQ&google_push=AYg5qPIDlHil6Lxhg8HioUVwR19qxIuEqTLd2P54HQazm0UQJmz4czaHWVe_oeKJpAjcX2MKIJI-pzRA5jM6DnfCMarAuEPIIGWP

Request Chain 176

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJa9woaldd6ICga8rOeboUM&google_cver=1&google_push=AYg5qPLS8GXqnOwaYvwYLeDmPO4WdK3eIU9LoSv65X9VU3T7bWoQ9cOoJXe9oEu2KlY2Z-ezPs4TQnrKpJIwGI1wuozOH5Q9ljg HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJa9woaldd6ICga8rOeboUM&google_cver=1&google_push=AYg5qPLS8GXqnOwaYvwYLeDmPO4WdK3eIU9LoSv65X9VU3T7bWoQ9cOoJXe9oEu2KlY2Z-ezPs4TQnrKpJIwGI1wuozOH5Q9ljg&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=3k57nZ8PRpWl9hJ8TWAW7A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLS8GXqnOwaYvwYLeDmPO4WdK3eIU9LoSv65X9VU3T7bWoQ9cOoJXe9oEu2KlY2Z-ezPs4TQnrKpJIwGI1wuozOH5Q9ljg

Request Chain 177

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEM6otkUSk1B7F9yV6PbmVY4&google_cver=1&google_push=AYg5qPLRZZknmlvpcB1lQzZ_qH8T_iCvlsjsOGQ9V1gGy4FfO_jgvtiE-BbkSrh_2XP_iMtMj0ic3CemipGIEXozsYuGqqoLH82v HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDJFRFg3N0QtMVEtM05NUw==&google_push=AYg5qPLRZZknmlvpcB1lQzZ_qH8T_iCvlsjsOGQ9V1gGy4FfO_jgvtiE-BbkSrh_2XP_iMtMj0ic3CemipGIEXozsYuGqqoLH82v

Request Chain 178

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL

179 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
legas.com.ua/
Redirect Chain

http://legas.com.ua/
https://legas.com.ua/
https://legas.com.ua/

100 KB
18 KB

614ms
614ms

Document
text/html

2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://legas.com.ua/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 1e893ce4c04b3015064e72f36693d58780537025b9053a19214d82be399286ee

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache, no-store
cf-cache-status: DYNAMIC
cf-ray: 7015495c88483762-MXP
content-encoding: br
content-type: text/html; charset=utf-8
date: Mon, 25 Apr 2022 07:15:17 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: -1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y8NylGWRkBPh3CW0VijBisF49B2ufm8lw8fuheqtvcsubuCspppvvp83CgZplkCRh16fikVF5%2Ft9Yx4Zo20uLaCC8ZgpEcFRjqU1j2ywZPq0XGOAZdWaw9DBi4O6tjSK5Bdv3zvzn6bwfxY%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-aspnet-version: 2.0.50727
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 7015495a0ca23762-MXP
date: Mon, 25 Apr 2022 07:15:16 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: /
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wpslNgY8Os2WulC78GRZf%2BCwzHzGUjVAE%2FZWRd%2BXWokeuHR23fuEMLWPgsis%2FRG3wC6KhYuIb8efg6WJaKE43bjfyaHZoEadxQFeH7BvANSaSSLNJVwGjeOZdKj9zUjgi07E2fvfNx49X5w%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H3

200

style.css
legas.com.ua/css/
Redirect Chain

https://legas.com.ua/css/style.css
https://legas.com.ua/css/style.css

5 KB
1 KB

366ms
365ms

Stylesheet
text/css

2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://legas.com.ua/css/style.css
Requested by: Host: legas.com.ua
URL: https://legas.com.ua/
Protocol: H3
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 64f4ced5d55df1d2b68756fbeffafd50b5d09c3ad7703f89a0660269a4ea3a54

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:17 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-powered-by-plesk: PleskWin
last-modified: Mon, 04 Jan 2021 23:58:33 GMT
server: cloudflare
etag: W/"f6485582f5e2d61:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jwaKFPEZ4aKrfb24ekNA09mhsX5rJXxyMwPBY9k9w1JSHlAcUVwnQF9wH0e9T9udTDvwZJW1og4tDGt7GHnNHuUuQeGdqQyFGUl%2BZJiWaqpbCX297zUXY%2Bnl7CPICmrmHjMiH2ZY79A2M3w%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 70154962deab83b4-MXP

Redirect headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:17 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hPHOoN3YSFC9gUrpFw%2FSwuGCY4e7mUEIIPUluO64eJGJlIVu6sNi%2B3VYuNILYJeGwh9gWE%2BPXIp7IJFNJZzbxpvFfMVVwOfz0ARGO7wOoi5Cisf4dnciqOkVg7un3Fcxv08Pw5i3qYTL4iA%3D"}],"group":"cf-nel","max_age":604800}
location: /css/style.css
cache-control: max-age=14400
cf-ray: 7015496078a583b4-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3

200

jquery-1.4.2.min.js Show response
legas.com.ua/js/
Redirect Chain

https://legas.com.ua/js/jquery-1.4.2.min.js
https://legas.com.ua/js/jquery-1.4.2.min.js

87 KB
28 KB

675ms
675ms

Script
application/javascript

2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://legas.com.ua/js/jquery-1.4.2.min.js
Requested by: Host: legas.com.ua
URL: https://legas.com.ua/
Protocol: H3
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 8d61bc67c5b06bbd0e0787fc1e661c2fb58ba72c46b7b05ca3ee94c20e599130

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:18 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-powered-by-plesk: PleskWin
last-modified: Mon, 04 Jan 2021 23:59:05 GMT
server: cloudflare
etag: W/"567c5795f5e2d61:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V0WxRxonYJveFjtAqS16VX%2Fb1tCUgqKNbu820vuZha9gxctTJScHsu7Aii6BNe4ewOZQ04%2FMR36%2FF6gHmTAorX2NElnQyGsqHbYpvHPspR1ygDzp6PuD1e8%2FC3nH4szzkQ3cHWqyB1hhHM4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 70154962deb483b4-MXP

Redirect headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:17 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=scGSz3N7l5PVuurLh6KeXZLMDWa2pYYp9GedN16oCdcvnReJTC%2FP1mqqUV5hXSKMNnLlVysg5iDwZdUS8DYx%2BqZ9lO8SgMIeCbPh79hGuHxIOyS5PIRia1A6SggH7NdnSpMLLZ3aAdhqWcs%3D"}],"group":"cf-nel","max_age":604800}
location: /js/jquery-1.4.2.min.js
cache-control: max-age=14400
cf-ray: 7015496088a883b4-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3

200

logo.jpg
legas.com.ua/images/
Redirect Chain

https://legas.com.ua/images/logo.jpg
https://legas.com.ua/images/logo.jpg

30 KB
30 KB

522ms
522ms

Image
image/jpeg

2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://legas.com.ua/images/logo.jpg
Requested by: Host: legas.com.ua
URL: https://legas.com.ua/
Protocol: H3
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 79d43d860bcaf8b62c343669b1c7c7acf20a83d0a35ade74f875c8157e71bbd4

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:19 GMT
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 30504
x-powered-by-plesk: PleskWin
last-modified: Mon, 04 Jan 2021 23:58:58 GMT
server: cloudflare
etag: "1fa77791f5e2d61:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7POZz%2BU1Mbi9xLTzvmFL9uKnWOrbjiXgMY6qwEtsdsMPVy%2BCsg8Q8yjb7AVuF3XhD5LnLMqa2re9YNalLIMZjz%2FQ54Qu%2BcG0taBz3vku%2Bb269Bmqj5W15RD%2BrvlIzAIpEDfxYVzfyXg1A7Y%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 70154969feec83b4-MXP

Redirect headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:18 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xc7g60xrzycuVKGBLwetvBRxTExtyi0NgC9RiDwCLZYAbsCeQPItnPGULnW1T6dpPUXTUaaMM4oXd90E3NIE2C04h4sasOB7lLm8ds88NSK5o2YwJopbhPVNbx%2FC1508trvng%2BMd%2FeJXFCs%3D"}],"group":"cf-nel","max_age":604800}
location: /images/logo.jpg
cache-control: max-age=14400
cf-ray: 70154967797483b4-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3

200

caddy_seats_new2.gif
legas.com.ua/images/ad/
Redirect Chain

https://legas.com.ua/images/ad/caddy_seats_new2.gif
https://legas.com.ua/images/ad/caddy_seats_new2.gif

69 KB
70 KB

665ms
665ms

Image
image/gif

2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://legas.com.ua/images/ad/caddy_seats_new2.gif
Requested by: Host: legas.com.ua
URL: https://legas.com.ua/
Protocol: H3
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 21583f7002df3434278d0ac87cde6b062999b39689e75945e152f8a5e75ef7fe

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:19 GMT
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 70616
x-powered-by-plesk: PleskWin
last-modified: Mon, 04 Jan 2021 23:59:03 GMT
server: cloudflare
etag: "beb02894f5e2d61:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GAo6NnCo813WLuaMQJl8lI3U4PSbU%2BrkyIPsRNNkPEWCuDCdo6dIjMJIK6oHMzEWmlEvTIqB8DQkFpfDZgvOIL%2FQTo7EGXwI%2Bb7E%2BnmzG%2FlkcHvHD9G6nysXTAS7QRF5NVVnr6ldKd%2BAZ4s%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 70154969feef83b4-MXP

Redirect headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:18 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WLeeY9X6yxS4OTYBeGOYB%2Fk6HGFaDnjAkc6GhwgK72%2FiSCm14ZstxmWe4SUbwtCJxrD5mRukPRapcvmhHs3FFtiQ1vQjWHb%2FF3anaMLK97s20CRGNtugLTeMlQP56hqgHuVduxRIyvR4S7o%3D"}],"group":"cf-nel","max_age":604800}
location: /images/ad/caddy_seats_new2.gif
cache-control: max-age=14400
cf-ray: 70154967898a83b4-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 404 TCEL-1.gif
caddy.com.ua/components/com_jshopping/files/img_products/ 0
0 304ms
72ms Image
text/html 31.131.16.29
VPS-UA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://caddy.com.ua/components/com_jshopping/files/img_products/TCEL-1.gif
Requested by: Host: legas.com.ua
URL: https://legas.com.ua/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 31.131.16.29 , Ukraine, ASN56851 (VPS-UA-AS, UA),
Reverse DNS: 29.16.131.31.uashared05.twinservers.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H2 500 /
www.meteoprog.ua/ua/informerget/ 0
171 B 171ms
66ms Image
text/html 49.12.116.255
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.meteoprog.ua/ua/informerget/?type=4&city[]=Kyiv&color=13659f&txtcolor=FFFF00
Requested by: Host: legas.com.ua
URL: https://legas.com.ua/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 49.12.116.255 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.255.116.12.49.clients.your-server.de
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:18 GMT
last-modified: Mon, 25 Apr 2022 07:15:18GMT
server: nginx
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
content-length: 0
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3

200

poll.jpg
legas.com.ua/images/
Redirect Chain

https://legas.com.ua/images/poll.jpg
https://legas.com.ua/images/poll.jpg

2 KB
2 KB

375ms
375ms

Image
image/jpeg

2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://legas.com.ua/images/poll.jpg
Requested by: Host: legas.com.ua
URL: https://legas.com.ua/
Protocol: H3
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: a6e648923be27227370e476a3fe1b29b7d43f486b80ffb409a04d7b6ef3909ca

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:19 GMT
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1616
x-powered-by-plesk: PleskWin
last-modified: Mon, 04 Jan 2021 23:58:59 GMT
server: cloudflare
etag: "6e56a791f5e2d61:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2hHo%2FGJI2VmvwfI%2FWRvrxZfhUsOLVRL9rUL2sEqdzcK3dNQA3Uoxrp%2Fpv1QOM43s8t32lS6QgOLu93pLZb3lvZGvFoUcq9%2F57obPszVActX%2F3D%2B76Yd2vYw5jZWZcztSsILqzkxK94Ib%2F5E%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 70154969eed283b4-MXP

Redirect headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:18 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KACcur8aTFWVk39M1b1ANTwhawYsQtBcsa2lB53vDkaJ13Hha2iW4zWa1LW%2Fs50LbPAfkDsZNEK9qJ9DLKVOKe0nnfKLtufSf0E8fwIRbwUTyMc0dFRW9Z69axAeYXDCeRuJ%2FLx2ES1oXfw%3D"}],"group":"cf-nel","max_age":604800}
location: /images/poll.jpg
cache-control: max-age=14400
cf-ray: 70154967898c83b4-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3

200

arrow.jpg
legas.com.ua/images/
Redirect Chain

https://legas.com.ua/images/arrow.jpg
https://legas.com.ua/images/arrow.jpg

349 B
935 B

373ms
372ms

Image
image/jpeg

2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://legas.com.ua/images/arrow.jpg
Requested by: Host: legas.com.ua
URL: https://legas.com.ua/
Protocol: H3
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 6edbf13af2f07f3ff6cf1b7ab649b8c6c28d247f2d7750a8593bd534de07d744

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:19 GMT
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 349
x-powered-by-plesk: PleskWin
last-modified: Mon, 04 Jan 2021 23:58:51 GMT
server: cloudflare
etag: "a7af18df5e2d61:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=evBJoWeOQlQ8Wny30MIihhNwAZUZ4mJnbzXRIPWVe9Vf7kDd3zeJuhPZJW99L5eF0RHKpwQhk3zod3SPoWMSWSXNM4PE2nrVyLod1eKMLREJnCXVjzUeuMv5qENntNcfILhLOZ5OrpeVTBU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 70154969feeb83b4-MXP

Redirect headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:18 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p6tnSRpDqrxuSpPYrdl76VsOIFhptgIWUQY0nGppUFA6CVo%2BDFgZvLp7j0yZwAPiUn6pjp%2FpSysPieABT4MNHlCCgWT7bNpsrIqz2jUXEeIXI3%2BeZyYsDvWD6Syp2gT%2BEipma4X7LJbe128%3D"}],"group":"cf-nel","max_age":604800}
location: /images/arrow.jpg
cache-control: max-age=14400
cf-ray: 70154967898d83b4-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ 101 KB
36 KB 170ms
59ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: legas.com.ua
URL: https://legas.com.ua/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9bf900225d59f39bf45ffe4405e7882ec9bd819c4e8d803d5754119491171f28

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36728
x-xss-protection: 0
server: cafe
etag: 9651460661575715305
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 25 Apr 2022 07:15:18 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 155 KB
53 KB 158ms
73ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: legas.com.ua
URL: https://legas.com.ua/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a8260e7ca21dcd8e2bd1d22ed5c43f3852ab635a30784a6cef09fceb9b45b354

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54373
x-xss-protection: 0
server: cafe
etag: 10362471899920920574
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 25 Apr 2022 07:15:18 GMT

GET
H2 404 current_traffic_150.gif
info.maps.yandex.net/traffic/kiev/ 0
0 380ms
95ms Image
text/html 2a02:6b8::130
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://info.maps.yandex.net/traffic/kiev/current_traffic_150.gif
Requested by: Host: legas.com.ua
URL: https://legas.com.ua/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6b8::130 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H2 404 script.js
cpa.com.ua/get_js/ 0
0 756ms
592ms Script
text/html 2606:4700:3033::6815:2c6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cpa.com.ua/get_js/script.js?aid=90
Requested by: Host: legas.com.ua
URL: https://legas.com.ua/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:2c6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 134 KB
48 KB 148ms
55ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-N2VDHS

Requested by

Host: legas.com.ua
URL: https://legas.com.ua/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f041b1e9de05df07f22b0701ea193fd0c160462a5666cb05874c11ac5b5dabf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:18 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48952
x-xss-protection: 0
last-modified: Mon, 25 Apr 2022 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 25 Apr 2022 07:15:18 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 127ms
42ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: legas.com.ua
URL: https://legas.com.ua/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4f85988a9efdb2a68411b6af7c91711acacbc4eeba06507db7d8dd879cea49a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: 6fX4mqSPCosLl+7Psgx4mA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 1685
x-fb-rlafr: 0
x-fb-debug: r2aDSzweB2DqKof7yf6e60t0s92faxrWRT54dkGOg/kGec49mbUh7gcMQMJTopP0vJ9wN+ingkDgseVwdhFBQg==
x-fb-trip-id: 917726464
x-fb-content-md5: 2313a00cc7f4612921267cf850b46f45
x-frame-options: DENY
date: Mon, 25 Apr 2022 07:15:18 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "67cb19f2c5801b91bda1caa5d7dd5d39"
timing-allow-origin: *
expires: Mon, 25 Apr 2022 07:28:19 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 133ms
41ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: legas.com.ua
URL: https://legas.com.ua/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 3487
date: Mon, 25 Apr 2022 06:17:11 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 25 Apr 2022 08:17:11 GMT

GET 155
a1.admaster.net/a/10507/ 0
0

GET
H3

200

bg.jpg
legas.com.ua/images/
Redirect Chain

https://legas.com.ua/images/bg.jpg
https://legas.com.ua/images/bg.jpg

374 B
966 B

367ms
367ms

Image
image/jpeg

2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://legas.com.ua/images/bg.jpg
Requested by: Host: legas.com.ua
URL: https://legas.com.ua/css/style.css
Protocol: H3
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: a86b3a844dad8b4c5673af644a74b9046f920772bfc75d0f5fa0704d19510d2e

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:19 GMT
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 374
x-powered-by-plesk: PleskWin
last-modified: Mon, 04 Jan 2021 23:58:53 GMT
server: cloudflare
etag: "4fb55d8ef5e2d61:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VO4Qsb6T%2FpSqSYp40YBNpJL1ARxylvor0Nhso1xgxf5X542QUVJ0MONfca6m3TDW%2BAJ1va1kBdkpSephd6%2F6g8zJId1gHJZCQFJCi7OVWkmPooR5ZHcLL%2FzV6DrTF3cnjkYkSjhkGFvfU6w%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 70154969fef483b4-MXP

Redirect headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:18 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lBYhzlMLxqE%2BWiglh14ohwBCffOhQx6n%2BMGHaZ9HulsVJCtUwd%2BckRKwxdVTr%2Fl%2FdgyqMtOUmHsG6GWQSxV8ce8niT3hRu5IdlUnfHX29%2FmyK1EQEMA0xREsTURbWCBD9OzGLy2vxrfcFX8%3D"}],"group":"cf-nel","max_age":604800}
location: /images/bg.jpg
cache-control: max-age=14400
cf-ray: 7015496799b183b4-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3

200

menu_bg.jpg
legas.com.ua/images/
Redirect Chain

https://legas.com.ua/images/menu_bg.jpg
https://legas.com.ua/images/menu_bg.jpg

1 KB
2 KB

384ms
383ms

Image
image/jpeg

2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://legas.com.ua/images/menu_bg.jpg
Requested by: Host: legas.com.ua
URL: https://legas.com.ua/css/style.css
Protocol: H3
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 720b21233cc3f5ac1443ecb48e8807913f0927ee4ffd04d805b76aa2b93bed2b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:19 GMT
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1106
x-powered-by-plesk: PleskWin
last-modified: Mon, 04 Jan 2021 23:58:59 GMT
server: cloudflare
etag: "c4928391f5e2d61:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XSInKUgV4Wp5sx2%2BsWCQH2QAzhDt%2F1epPgMfbIiePBpICve%2B1jgxNzBlKeyLRJp3k12%2BzhgjDSFJMtXyn8s6Hn3%2BbeShgVCpX4y4a27WkPuT5JPd6LwFjnblnAqWA94A27jCUsWhmWxzhQM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 70154969fef783b4-MXP

Redirect headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:18 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uR99nOfL4ZzPve6EO%2FBjM%2Bvoq7oThrNldtr%2BYrLlUQZ3H98tp3kU3qcTkacIxNWF0ea86hP9tS1AfLLpyaNM6lYedCU%2FoUJv4QZxqc97DbBtYzasbDw499yW%2B9O%2BkZw5ZAFo3k470ZhvR%2BE%3D"}],"group":"cf-nel","max_age":604800}
location: /images/menu_bg.jpg
cache-control: max-age=14400
cf-ray: 7015496799b083b4-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2

404

&awc=2174_1650869169_ccd3c17e79678ec69f00454158c9a034
www.admitad.com/en/
Redirect Chain

https://040510111616.c.mystat-in.net/?i040510111616&t4&g27&w1600&c24&r&v3&j0
https://webcache.pp.ua/w
https://pubmedya.net/to2/goldsmiths.co.uk/
https://www.zenaps.com/rclick.php?mid=2174&c_len=2592000&c_ts=1650869169&c_cnt=632098%7C0%7C0%7C1650869169%7Cb46e5352388cdef8e93920864ad277e0%7Caw%7C0&ir=636e4460-c463-11ec-9b3a-22623ec29485&pr=htt...
https://www.admitad.com/en/&awc=2174_1650869169_ccd3c17e79678ec69f00454158c9a034

0
0

308ms
204ms

Image
text/html

5.187.1.114
DE-FIRSTCOLO www....

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.admitad.com/en/&awc=2174_1650869169_ccd3c17e79678ec69f00454158c9a034
Requested by: Host: legas.com.ua
URL: https://legas.com.ua/
Protocol: H2
Server: 5.187.1.114 Frankfurt am Main, Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS: dsde333-3.fornex.org
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Redirect headers

Date: Mon, 25 Apr 2022 07:15:19 GMT
Allow: GET
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Location: https://www.admitad.com/en/&awc=2174_1650869169_ccd3c17e79678ec69f00454158c9a034
Connection: keep-alive
Awin-Akamai-Rule-Set: default
Node: Helix
Strict-Transport-Security: max-age=86400
Content-Length: 0

GET /
c.bigmir.net/ 0
0

GET
H2 200 s
r.i.ua/ 2 KB
3 KB 295ms
231ms Image
image/png 104.18.2.81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.i.ua/s?u66180&p62&n0.218353410188747&c1&d24&w1600&h1200&r/legas.com.ua/
Requested by: Host: legas.com.ua
URL: https://legas.com.ua/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.2.81 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8230ca5800520e093fdc5b864778f07f2e13704dad07ce0d49a41d903cd67dd

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:18 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: policyref="http://i.i.ua/w3c/p3p.xml", CP="NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA"
content-type: image/png
cache-control: no-cache, must-revalidate
cf-ray: 701549692c9d35fb-MAN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: 0

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204190101/ 304 KB
108 KB 67ms
66ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204190101/show_ads_impl_with_ama_fy2019.js?client=pub-8431813121812491&plah=legas.com.ua

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

08f599f1961f5059cac95e9002f85d899b105bf4a99ed2efd707c2809866540e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 110938
x-xss-protection: 0
server: cafe
etag: 2692660966515978640
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 25 Apr 2022 07:15:18 GMT

GET 1322
g.novostimira.biz/l/ 0
0

GET
H/1.1 200
Ok ya.ru
clck.yandex.ru/click/dtype=stred/pid=30/cid=1529/*http:// 43 B
429 B 285ms
93ms Image
image/gif 2a02:6b8::14
YNDX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://clck.yandex.ru/click/dtype=stred/pid=30/cid=1529/*http://ya.ru

Requested by

Host: legas.com.ua
URL: https://legas.com.ua/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::14 Moscow, Russian Federation, ASN208722 (YNDX, FI),

Reverse DNS

Software

Resource Hash

7e928161cd626935d39ff08188caa3f3a918811ca87194082dedf28b697ce6fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Cache-Control: no-cache
X-Content-Type-Options: nosniff
Connection: Keep-Alive
Content-Length: 43
X-XSS-Protection: 1; mode=block
Content-Type: image/gif

GET
H3 200 footer_bg.jpg
legas.com.ua/images/ 307 B
896 B 365ms
364ms Image
image/jpeg 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://legas.com.ua/images/footer_bg.jpg
Requested by: Host: legas.com.ua
URL: https://legas.com.ua/css/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 59729251e018160eeed443c848fa5fd802b40e984b5afe60560c3cbe9d7b4612

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:18 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 307
x-powered-by-plesk: PleskWin
last-modified: Mon, 04 Jan 2021 23:58:56 GMT
server: cloudflare
etag: "a93d4b90f5e2d61:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PRfYgshY2BzJtg1xVNKunEeVf9JTK45luSrs0jRC%2BzwqL8GUdKTOaeK3%2BKxfhp%2BCAc9q55OBQRom5JAOV%2FuGUDkfs87VQz8DbaYV6aS5ooe%2BzJlfR6sE8QZqrWE1U32cOadbeLnIW%2BvhRho%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 70154968dc9a83b4-MXP

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220420/r20190131/ Frame 52EE 10 KB
5 KB 133ms
41ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220420/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

340b20f9ff6d073c2fea911631d8a6e13af185d983cbe842ddca27df91d0f295

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://legas.com.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

age: 31134
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4398
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Apr 2022 22:36:24 GMT
etag: 14837630671339829333
expires: Sun, 08 May 2022 22:36:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 216 B
646 B 169ms
49ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=legas.com.ua&callback=_gfp_s_&client=ca-pub-8431813121812491

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204190101/show_ads_impl_with_ama_fy2019.js?client=pub-8431813121812491&plah=legas.com.ua

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

59a221c1514847acb74d0f88ef593de49b96081bfa21891ffab3ebd407e03327

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 202
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.co.uk/adsid/ 107 B
792 B 192ms
51ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=legas.com.ua

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 25 Apr 2022 07:15:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 153ms
49ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=legas.com.ua

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 25 Apr 2022 07:15:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B9E1 112 KB
34 KB 437ms
437ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1486316043&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918327&bpp=17&bdt=1171&idt=308&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&correlator=4380143763487&frm=20&pv=2&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=396&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RfrZYwemlw&p=https%3A//legas.com.ua&dtd=322

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

11b42e57527a15ef294417ce5e95fd812f284ffd07e44718ab6dca447aefe4c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://legas.com.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 34657
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 25 Apr 2022 07:15:19 GMT
expires: Mon, 25 Apr 2022 07:15:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 48AB 112 KB
34 KB 541ms
541ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1365725250&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918349&bpp=5&bdt=1194&idt=306&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=1032&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YHWotiKRlR&p=https%3A//legas.com.ua&dtd=309

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

73acf5938f57c9104a7410a78d9e0e66bdb2ea6e4f64da20f3b6b15aef18fa4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://legas.com.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 34500
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 25 Apr 2022 07:15:19 GMT
expires: Mon, 25 Apr 2022 07:15:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 018F 98 KB
32 KB 341ms
340ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=600&slotname=3398747635&adk=240658524&adf=1605720054&pi=t.ma~as.3398747635&w=160&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918370&bpp=14&bdt=1215&idt=291&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384%2C2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1179&ady=2309&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=pzb5QUoDbc&p=https%3A//legas.com.ua&dtd=294

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

08b51da2de11725222e8d34877e20b287ea792c1309432675caa5a6cc8d86445

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJ6zt7XVrvcCFYpG4AodP9kEEg&gqi=hkpmYrKYKvT33wO977jICQ&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://legas.com.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 32259
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CJ6zt7XVrvcCFYpG4AodP9kEEg&gqi=hkpmYrKYKvT33wO977jICQ&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 25 Apr 2022 07:15:18 GMT
expires: Mon, 25 Apr 2022 07:15:18 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 283 KB
81 KB 83ms
41ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=e17e1a8d8071c7be3e867cb0e9c80117

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7f651dc4c9e9cc057e1a6d312bdfbf399f20529534f9a5423cd6547521a71344

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://legas.com.ua/
Origin: https://legas.com.ua
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: 6kv/R6n4p2G0COBXBRKWAg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
expires: Tue, 25 Apr 2023 06:18:28 GMT
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 82870
x-fb-rlafr: 0
x-fb-debug: EvfNDiCJmYuP50P74SCNJ9TIhTaI2/C2fFui5vkxHadcN1HCsq10XDJ7I4TPHWZAmzF+JnTsIJ3/1F0VAd//wA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 1262f0ee149a4586987020a7c383d5c7
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 25 Apr 2022 07:15:18 GMT
x-frame-options: DENY
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "a44f3b1c015def216a93cfbb26924303"
timing-allow-origin: *
priority: u=3,i
access-control-expose-headers: X-FB-Content-MD5

POST
H3 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 130ms
47ms XHR
text/plain 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1064110860&t=pageview&_s=1&dl=https%3A%2F%2Flegas.com.ua%2F&ul=en-us&de=UTF-8&dt=%D0%9F%D1%80%D0%B0%D0%B2%D0%BE%D0%B2%D0%BE%D0%B9%20%D0%BF%D0%BE%D1%80%D1%82%D0%B0%D0%BB&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IAhAAEABAAAAAC~&jid=1814247869&gjid=529657225&cid=260435591.1650870919&tid=UA-9703351-1&_gid=958662493.1650870919&_r=1&_slc=1&z=452467552

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://legas.com.ua/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://legas.com.ua
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2DD5 77 KB
25 KB 574ms
490ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=250&slotname=8161031849&adk=4210853449&adf=3405296861&pi=t.ma~as.8161031849&w=300&lmt=1650870918&psa=0&format=300x250&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918518&bpp=3&bdt=1363&idt=159&shv=r20220420&mjsv=m202204190101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2642460384%2C2642460384%2C3398747635&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1109&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&fsb=1&xpc=zqzDMw8gVB&p=https%3A//legas.com.ua&dtd=161

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

be55470841d86fe004d59d3a2b256d493e5bf403b7ddd091603025224682831d

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=COy9vbXVrvcCFVY74Aod29UNrQ&gqi=hkpmYoKbMIv-3wPawp6YBA&layout=/sadbundle/%24csp%253Der3%24/15925164737160019968/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://legas.com.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 25645
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=COy9vbXVrvcCFVY74Aod29UNrQ&gqi=hkpmYoKbMIv-3wPawp6YBA&layout=/sadbundle/%24csp%253Der3%24/15925164737160019968/index.html
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 25 Apr 2022 07:15:19 GMT
expires: Mon, 25 Apr 2022 07:15:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
436 B 110ms
36ms XHR
text/plain 2a00:1450:400c:c06::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-9703351-1&cid=260435591.1650870919&jid=1814247869&gjid=529657225&_gid=958662493.1650870919&_u=IAhAAEAAAAAAAC~&z=364954317

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c06::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://legas.com.ua/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 25 Apr 2022 07:15:18 GMT
content-type: text/plain
access-control-allow-origin: https://legas.com.ua
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 like.php Show response
www.facebook.com/v2.0/plugins/ Frame FB04 0
3 KB 148ms
66ms Document
text/html 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.0/plugins/like.php?action=like&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df216d379c35035%26domain%3Dlegas.com.ua%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Flegas.com.ua%252Ff858ae3527b9%26relation%3Dparent.parent&container_width=300&href=http%3A%2F%2Flegas.com.ua%2F&layout=standard&locale=en_US&sdk=joey&share=true&show_faces=true&width=230

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=e17e1a8d8071c7be3e867cb0e9c80117

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://legas.com.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-length: 0
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-type: text/html;charset=utf-8
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 25 Apr 2022 07:15:19 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
priority: u=3,i
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
x-content-type-options: nosniff
x-fb-debug: 2onr9h+cHHNnyHra6UgMYYuxWY7AZ8eIyfi6OFP7YTxLwE9QtTj+Jy4dA1StVHqgetDeui8YqqUffhkBa+RCCQ==
x-xss-protection: 0

GET
H2 200 ssrh.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 018F 84 KB
30 KB 140ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/ssrh.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=600&slotname=3398747635&adk=240658524&adf=1605720054&pi=t.ma~as.3398747635&w=160&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918370&bpp=14&bdt=1215&idt=291&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384%2C2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1179&ady=2309&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=pzb5QUoDbc&p=https%3A//legas.com.ua&dtd=294

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b5312cb2f154f2bd64ee8746195a63df254d10bfd107a61eec3d5d38dd48bff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 24 Apr 2022 16:37:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52640
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30063
x-xss-protection: 0
server: cafe
etag: 16132151104434394549
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Mon, 25 Apr 2022 16:37:59 GMT

GET
H2 200 11975969522494152294_13331753041740865055.jpeg
static.doubleclick.net/dynamic/5/206838720/ Frame 018F 258 KB
259 KB 137ms
43ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/206838720/11975969522494152294_13331753041740865055.jpeg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d85e0b83efe834b6f45c0769e11e91d95a388136ad405d8aee07197e6ff7a820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 22 Apr 2022 17:50:53 GMT
x-content-type-options: nosniff
age: 221066
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 264205
x-xss-protection: 0
last-modified: Fri, 22 Apr 2022 08:02:23 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Apr 2023 17:50:53 GMT

GET
H3 200 774705069504779733_488193021970976636.jpeg
static.doubleclick.net/dynamic/5/206838720/ Frame 018F 265 KB
265 KB 126ms
43ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/206838720/774705069504779733_488193021970976636.jpeg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77f33b3638635f2ed92baa1b16db8654f69e6b39c0ec9d7e0c9ebb6a87cd5dbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 22 Apr 2022 16:45:12 GMT
x-content-type-options: nosniff
age: 225007
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 271795
x-xss-protection: 0
last-modified: Fri, 22 Apr 2022 08:01:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Apr 2023 16:45:12 GMT

GET
H3 200 12670658031093471203_18213550066902727067.jpeg
static.doubleclick.net/dynamic/5/206838720/ Frame 018F 270 KB
270 KB 131ms
47ms Image
image/jpeg 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/206838720/12670658031093471203_18213550066902727067.jpeg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de75f74c16ee260673a91f8253b007a4d454690220b5ed46379dd071518ea753

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 22 Apr 2022 16:38:28 GMT
x-content-type-options: nosniff
age: 225411
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 276542
x-xss-protection: 0
last-modified: Fri, 22 Apr 2022 08:01:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Apr 2023 16:38:28 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/ Frame 018F 19 KB
8 KB 139ms
55ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dc3f2293f6503ff6ee63c2a69421d235a0f7881a80d89dd407ec2f15eda63fdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 06:33:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2498
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7964
x-xss-protection: 0
server: cafe
etag: 4741051639382073774
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 06:33:41 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/ Frame 018F 3 KB
1 KB 144ms
70ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 05:27:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6474
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 05:27:25 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/ Frame 018F 15 KB
6 KB 139ms
65ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6808c7f1192e091f9e9b4e15e28fa2a8904117ba54c11e51fc8eb9d179733e1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 05:37:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5865
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6368
x-xss-protection: 0
server: cafe
etag: 1861550861606854559
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 05:37:34 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 018F 119 KB
36 KB 93ms
93ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36950
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1650454428054601"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 25 Apr 2022 07:15:19 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame B9E1 8 KB
1 KB 148ms
49ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1486316043&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918327&bpp=17&bdt=1171&idt=308&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&correlator=4380143763487&frm=20&pv=2&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=396&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RfrZYwemlw&p=https%3A//legas.com.ua&dtd=322

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8393b0f49cbaac879bc0a89a8d6fc918081a21fd4b13e5ae4416d2c1afbcca92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 25 Apr 2022 05:53:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 25 Apr 2022 07:15:19 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 25 Apr 2022 07:15:19 GMT

GET
H2 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/ Frame B9E1 2 KB
984 B 116ms
100ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:10:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 293
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 877
x-xss-protection: 0
server: cafe
etag: 13035868154101442325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:10:26 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame B9E1 0
0 83ms
83ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C5ITBhkpmYsTtKdqLx_AP7cSEoAXCibfhabzE3L63D5nj5bSEAhABIPnjvxlgu4aAgNAKoAGr68jFA8gBCakCCd0lCiWKtT6oAwHIA8sEqgTjAU_QsbnuHBW9WqeZuEp8SxFdyk8bNbpXBphI-QZoG54SpiOh0XvyOniNrUCZcbXLUmOuj92gKs45Qh2459ly21UNMa4bxUF6ZDYs3Rw0nCe08CRjL5xf3h7cIMJowocC0rtTMsXVVXYfWPQsevKw8fZEM_KILO9TqFNtKGq1ARIeJjXfNN11BBr9a4QP7Z5O4r_axBYQ0I_8TBFGtFTI3zk_-LEp07FdYKRCG6sjevrD6f8b9fCA-sI_0vvT-yKQ-3RsRnICY-IuFI8eEMxqMvfogmtAbfTY0IMv-8cBctURA74OwASapc_e_wOSBQQIBBgBkgUECAUYBKAGLoAHguuzMKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEM-HB9IICQiA4YAQEAEYH4AKAcgLAZgMuaquqYMEuBODBNgTDtAVAYAXAbIXHAoaCAASFHB1Yi04NDMxODEzMTIxODEyNDkxGAA&sigh=UwMzceINiyM&uach_m=[UACH]&template_id=515

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1486316043&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918327&bpp=17&bdt=1171&idt=308&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&correlator=4380143763487&frm=20&pv=2&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=396&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RfrZYwemlw&p=https%3A//legas.com.ua&dtd=322
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 25 Apr 2022 07:15:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Mon, 25 Apr 2022 07:15:19 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/ Frame B9E1 19 KB
8 KB 101ms
88ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a7d5c1bfe43c8beefab2fa059f4fcaa029fcbbace9a672aae1dfe1ffb7d6976c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 06:57:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1092
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8002
x-xss-protection: 0
server: cafe
etag: 5332015062585099865
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 06:57:07 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/ Frame B9E1 3 KB
1 KB 112ms
101ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 06:26:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2904
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 06:26:55 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B9E1 119 KB
37 KB 77ms
65ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36950
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1650454428054601"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 25 Apr 2022 07:15:19 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/ Frame B9E1 15 KB
6 KB 105ms
94ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:12:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6409
x-xss-protection: 0
server: cafe
etag: 15284592792851369840
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:12:10 GMT

GET
H2 200 3bde1d5944145a46a8b91d920db5ec4d.js Show response
www.gstatic.com/mysidia/ Frame B9E1 30 KB
13 KB 144ms
40ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/3bde1d5944145a46a8b91d920db5ec4d.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f748110cf8280254c6705d7cf18de8b04369c521d9db43e63897e531c283578d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 22 Apr 2022 10:34:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 247268
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12194
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 05:04:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 21 Jul 2022 10:34:11 GMT

GET
H2 200 7651774895797135129
tpc.googlesyndication.com/simgad/ Frame B9E1 3 KB
3 KB 111ms
102ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7651774895797135129?w=100&h=100

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5481a6df70d9dbaf53b9b031ca30febb0ad0e1526a44b9b838ff9ebbf3352fd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 23:06:50 GMT
x-content-type-options: nosniff
age: 374909
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3035
x-xss-protection: 0
last-modified: Thu, 05 Aug 2021 10:04:11 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 20 Apr 2023 23:06:50 GMT

GET
DATA 200
OK truncated
/ Frame B9E1 195 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9e34975a0a58f4262f18fc35a4a9efb9f9b3962b87772f8fa5c006d5b7bc3f57

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame B9E1 336 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: be3b15b1e68cf3e9278293d3b50491fe16c985e0ee5968852cac4fc062a7134e

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 css
fonts.googleapis.com/ Frame 48AB 8 KB
965 B 51ms
49ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1365725250&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918349&bpp=5&bdt=1194&idt=306&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=1032&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YHWotiKRlR&p=https%3A//legas.com.ua&dtd=309

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8393b0f49cbaac879bc0a89a8d6fc918081a21fd4b13e5ae4416d2c1afbcca92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 25 Apr 2022 05:56:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 25 Apr 2022 07:15:19 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 25 Apr 2022 07:15:19 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/ Frame 48AB 2 KB
904 B 147ms
70ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1365725250&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918349&bpp=5&bdt=1194&idt=306&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=1032&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YHWotiKRlR&p=https%3A//legas.com.ua&dtd=309

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:14:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 877
x-xss-protection: 0
server: cafe
etag: 13035868154101442325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:14:33 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/ Frame 48AB 19 KB
8 KB 117ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1365725250&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918349&bpp=5&bdt=1194&idt=306&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=1032&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YHWotiKRlR&p=https%3A//legas.com.ua&dtd=309

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a7d5c1bfe43c8beefab2fa059f4fcaa029fcbbace9a672aae1dfe1ffb7d6976c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:06:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 529
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8002
x-xss-protection: 0
server: cafe
etag: 5332015062585099865
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:06:30 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/ Frame 48AB 3 KB
1 KB 130ms
71ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1365725250&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918349&bpp=5&bdt=1194&idt=306&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=1032&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YHWotiKRlR&p=https%3A//legas.com.ua&dtd=309

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:12:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 171
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:12:28 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 48AB 119 KB
36 KB 57ms
55ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1365725250&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918349&bpp=5&bdt=1194&idt=306&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=1032&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YHWotiKRlR&p=https%3A//legas.com.ua&dtd=309

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36950
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1650454428054601"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 25 Apr 2022 07:15:19 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/ Frame 48AB 15 KB
6 KB 116ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1365725250&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918349&bpp=5&bdt=1194&idt=306&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=1032&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YHWotiKRlR&p=https%3A//legas.com.ua&dtd=309

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:12:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6409
x-xss-protection: 0
server: cafe
etag: 15284592792851369840
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:12:10 GMT

GET
H2 200 3c09399fce195357915a25abcce0a496.js Show response
www.gstatic.com/mysidia/ Frame 48AB 30 KB
12 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/3c09399fce195357915a25abcce0a496.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1365725250&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918349&bpp=5&bdt=1194&idt=306&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=1032&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YHWotiKRlR&p=https%3A//legas.com.ua&dtd=309

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd5dc39e7e8c3e52dd51f848aa140401de17ec1f545e4595b03923b1f836021a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 22 Apr 2022 07:48:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 257194
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12188
x-xss-protection: 0
last-modified: Wed, 20 Apr 2022 08:44:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 21 Jul 2022 07:48:45 GMT

GET
H3 200 7992607101044414614
tpc.googlesyndication.com/simgad/ Frame 018F 4 KB
4 KB 120ms
50ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7992607101044414614

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fb59dd732394f75e7af809d49406b1190e5b691b93829d57084f819fd2745d90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 24 Apr 2022 08:54:00 GMT
x-content-type-options: nosniff
age: 80479
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3628
x-xss-protection: 0
last-modified: Tue, 05 Mar 2019 08:15:54 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 24 Apr 2023 08:54:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 018F 0
0 84ms
84ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C-N6bhkpmYp7YKoqNgQe_spOQAdjP_ONp5ZXbm5sMrZjQzYAHEAEg-eO_GWC7hoCA0AqgAbC6odcDyAEJqQLq8IMTMh-yPqgDAcgDywSqBOABT9AuON8-rn89bUmTXEL34kpHjcFQagx3bKVSOycbShxF_9ybBtgs_VA6a7JRHxCWCbYki29_6lc0H0m9nEBx-k7uPZtzyMvMrELXZS5Y18hh2y9Aj2rllYmTTx_8KmMhoTigKwRBq2FHS2z-6WOqKuNbVXv3AMlJ2N8QZugG5zGdRvCWJcieyy_nygO8QbAK4oDqZ0300_mvu0eiG-BqpvDTPTskXQaGtDZ4bjUwb9Bo0WmPP3QKICblKoYAQKz_S5UGIEEhP5TCZ9q1xEPzb-v6qGcBakKAoGNQ9SydoXvABIKj5vSbA5IFBAgEGAGSBQQIBRgEoAYugAfn4dBiqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgHpr4b2AcA8gcEEPGwAtIICQiA4YAQEAEYH4AKAcgLAdgTDIgUBdAVAYAXAbIXHAoaCAASFHB1Yi04NDMxODEzMTIxODEyNDkxGAA&sigh=M8DjKB-IX6E&uach_m=[UACH]&template_id=494

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=600&slotname=3398747635&adk=240658524&adf=1605720054&pi=t.ma~as.3398747635&w=160&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918370&bpp=14&bdt=1215&idt=291&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384%2C2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1179&ady=2309&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=pzb5QUoDbc&p=https%3A//legas.com.ua&dtd=294
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 25 Apr 2022 07:15:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 48AB 0
0 83ms
83ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C_nm7hkpmYt3SKsiB7gP80obwDcKJt-FpvMTcvrcPmePltIQCEAEg-eO_GWC7hoCA0AqgAavryMUDyAEJqQIJ3SUKJYq1PqgDAcgDywSqBOABT9CzHWyiwYqA5Vdu736Sv4WKy4mko7mvdSYgaeeh1UXCASMwqm0fF-kLCnmI0t2MlmytviGK7qt0DRB0nKUXp0BMJ-Lp5z9Jn0I_aTBrArVqrlqEx_o-PZc-ez7JdsOIbOOF5xt7Se0zyML4-IYcATXyvuOx1JauecGP5JO5N6pHj0-DmrCeoUVZjTZji4eSPuQUo64sbmImjdZl-0YD_d3wxo1yluG7RdsUQIGZI3jSTMVoO2hu_QFCR8qs25xK6he8bmwktyAqhECY2JyFMVW9gKXsuOlOhsyuXg9jHp7ABJqlz97_A5IFBAgEGAGSBQQIBRgEoAYugAeC67MwqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQ8fcH0ggJCIDhgBAQARgfgAoByAsBmAy5qq6pgwS4E4ME2BMO0BUBgBcBshccChoIABIUcHViLTg0MzE4MTMxMjE4MTI0OTEYAA&sigh=TLM2z-UojCw&uach_m=[UACH]&template_id=515

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1365725250&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918349&bpp=5&bdt=1194&idt=306&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=1032&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YHWotiKRlR&p=https%3A//legas.com.ua&dtd=309

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1365725250&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918349&bpp=5&bdt=1194&idt=306&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=1032&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YHWotiKRlR&p=https%3A//legas.com.ua&dtd=309
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 25 Apr 2022 07:15:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 7651774895797135129
tpc.googlesyndication.com/simgad/ Frame 48AB 3 KB
3 KB 118ms
63ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7651774895797135129?w=100&h=100

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1365725250&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918349&bpp=5&bdt=1194&idt=306&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=1032&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YHWotiKRlR&p=https%3A//legas.com.ua&dtd=309

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5481a6df70d9dbaf53b9b031ca30febb0ad0e1526a44b9b838ff9ebbf3352fd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 23:06:50 GMT
x-content-type-options: nosniff
age: 374909
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3035
x-xss-protection: 0
last-modified: Thu, 05 Aug 2021 10:04:11 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 20 Apr 2023 23:06:50 GMT

GET
DATA 200
OK truncated
/ Frame 48AB 195 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9e34975a0a58f4262f18fc35a4a9efb9f9b3962b87772f8fa5c006d5b7bc3f57

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 48AB 336 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: be3b15b1e68cf3e9278293d3b50491fe16c985e0ee5968852cac4fc062a7134e

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame B9E1 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4494f7d040539a2d1be37f3c0959c7a145df4decd20a6d5ed860582b20f115fe

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v44/ Frame B9E1 28 KB
28 KB 137ms
41ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v44/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d210f7d18b1a67c12052541793c3fc63a9175ec1809b7988b9b9a13a4b50e16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 22:12:07 GMT
x-content-type-options: nosniff
age: 464592
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28276
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:33:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 19 Apr 2023 22:12:07 GMT

GET
H3 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/ Frame 499D 312 KB
30 KB 45ms
45ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/index.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=250&slotname=8161031849&adk=4210853449&adf=3405296861&pi=t.ma~as.8161031849&w=300&lmt=1650870918&psa=0&format=300x250&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918518&bpp=3&bdt=1363&idt=159&shv=r20220420&mjsv=m202204190101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2642460384%2C2642460384%2C3398747635&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1109&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&fsb=1&xpc=zqzDMw8gVB&p=https%3A//legas.com.ua&dtd=161

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7f96033a70aff3d3e2d1520b6c678141eb5b6189dfb95adbb8fe13b7006b2767

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 588008
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 31071
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Mon, 18 Apr 2022 11:55:11 GMT
expires: Tue, 18 Apr 2023 11:55:11 GMT
last-modified: Tue, 04 Jan 2022 14:31:38 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 2DD5 0
0 85ms
85ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CAdoFhkpmYuziMNb2gAfbq7foCrHGveJp9ZCj7NcPloLNhYgWEAEg-eO_GWC7hoCA0AqgAa6equkByAEJqQLq8IMTMh-yPqgDAcgDAqoE9AFP0H5cQu0swIZDiKzNr2ywg9kOD8ieoGeZEQtONdEX0QhYxleAMSC-PBp4RYoHjuDIKZpNjd0Z-NfPOUxHOYaURjp-ZVKqHwbPme46zwvw_3USJREnelmH_obQ2WY8eNXClVuyGurer8sBV63_x8A2m7huA_9YK_A-BIyL4YOBA3MHIDA-RFX4oLy4VCFSXHOqxH2aJHZqz0zLpmsiR5xJ0X2gMf-0G0X5zxzqZvSlGQOazTjV0TrtyYOeKLL0jIG2RDcPx9rgeYdDyLM7FFYXq-2nLYnb2qWo_BJ9WQrMcrKvVysHDn7xKeuUQ9FXAU-Cxy9kwATKoLrHgwSSBQQIBBgBkgUECAUYBKAGXYAHj9bt1gGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBCg_gTSCAkIgOGAEBABGB-ACgHICwHYEw3QFQGYFgGAFwGyFxwKGggAEhRwdWItODQzMTgxMzEyMTgxMjQ5MRgA&sigh=4_B5NwTLWRk&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=250&slotname=8161031849&adk=4210853449&adf=3405296861&pi=t.ma~as.8161031849&w=300&lmt=1650870918&psa=0&format=300x250&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918518&bpp=3&bdt=1363&idt=159&shv=r20220420&mjsv=m202204190101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2642460384%2C2642460384%2C3398747635&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1109&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&fsb=1&xpc=zqzDMw8gVB&p=https%3A//legas.com.ua&dtd=161
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 25 Apr 2022 07:15:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame C466 143 B
163 B 44ms
43ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=250&slotname=8161031849&adk=4210853449&adf=3405296861&pi=t.ma~as.8161031849&w=300&lmt=1650870918&psa=0&format=300x250&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918518&bpp=3&bdt=1363&idt=159&shv=r20220420&mjsv=m202204190101&ptt=9&saldr=aa&abxe=1&prev_slotnames=2642460384%2C2642460384%2C3398747635&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1109&ady=110&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&fsb=1&xpc=zqzDMw8gVB&p=https%3A//legas.com.ua&dtd=161
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

age: 520
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Mon, 25 Apr 2022 07:06:39 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/ Frame 2DD5 3 KB
1 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:12:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 171
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:12:28 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2DD5 119 KB
36 KB 56ms
56ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36950
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1650454428054601"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 25 Apr 2022 07:15:19 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9DBF 143 B
163 B 43ms
43ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=600&slotname=3398747635&adk=240658524&adf=1605720054&pi=t.ma~as.3398747635&w=160&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918370&bpp=14&bdt=1215&idt=291&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384%2C2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1179&ady=2309&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=pzb5QUoDbc&p=https%3A//legas.com.ua&dtd=294
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

age: 520
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Mon, 25 Apr 2022 07:06:39 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 48AB 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: da0f9bc45d484ad3199c9ea9e540ba186eb62fc67a59572ee6db9edc0cf003f6

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 018F 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 42859c5159f3f083541084eb8e578a04a68e805e012a916a045fa49ed9c4f4e4

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v44/ Frame 48AB 28 KB
28 KB 50ms
50ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v44/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d210f7d18b1a67c12052541793c3fc63a9175ec1809b7988b9b9a13a4b50e16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 22:12:07 GMT
x-content-type-options: nosniff
age: 464592
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28276
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:33:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 19 Apr 2023 22:12:07 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 499D 778 B
405 B 131ms
49ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Bodoni+Moda:regular

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5f3f03c5c1e5875c85a13e1bfae970de8ae3f773ed88856023f2f45ceed7611e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 25 Apr 2022 07:15:19 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 25 Apr 2022 07:15:19 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 25 Apr 2022 07:15:19 GMT

GET
H3 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 499D 16 KB
6 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 24 Apr 2022 23:28:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28012
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5866
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Mon, 25 Apr 2022 23:28:27 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 499D 26 KB
10 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 24 Apr 2022 16:13:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54100
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Mon, 25 Apr 2022 16:13:39 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/ Frame 2DD5 15 KB
6 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:12:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 189
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6409
x-xss-protection: 0
server: cafe
etag: 15284592792851369840
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:12:10 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame C466
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

162ms
162ms

Document
text/html

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 25 Apr 2022 07:15:19 GMT
expires: Mon, 25 Apr 2022 07:15:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 25 Apr 2022 07:15:19 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9DBF
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

83ms
83ms

Document
text/html

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 25 Apr 2022 07:15:19 GMT
expires: Mon, 25 Apr 2022 07:15:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 25 Apr 2022 07:15:19 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 d_XgMe7_8DX3JscHlpumBxzOcHqlAtWKp75Cu0r3_I4.js Show response
pagead2.googlesyndication.com/bg/ Frame 3504 35 KB
13 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/d_XgMe7_8DX3JscHlpumBxzOcHqlAtWKp75Cu0r3_I4.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77f5e031eefff035f726c707969ba6071cce707aa502d58aa7be42bb4af7fc8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 00:30:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24277
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13694
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Apr 2023 00:30:42 GMT

GET
H3 200 d_XgMe7_8DX3JscHlpumBxzOcHqlAtWKp75Cu0r3_I4.js Show response
pagead2.googlesyndication.com/bg/ Frame 6895 35 KB
13 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/d_XgMe7_8DX3JscHlpumBxzOcHqlAtWKp75Cu0r3_I4.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1365725250&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918349&bpp=5&bdt=1194&idt=306&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=1032&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YHWotiKRlR&p=https%3A//legas.com.ua&dtd=309

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77f5e031eefff035f726c707969ba6071cce707aa502d58aa7be42bb4af7fc8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 00:30:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24277
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13694
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Apr 2023 00:30:42 GMT

GET
DATA 200
OK truncated
/ Frame 2DD5 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 576567be309b25668eac042efdc762e3cbc09e884a788855e3392b28ba761d80

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Holiday.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/ Frame 499D 6 KB
6 KB 45ms
44ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/Holiday.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5585f5ae657fe411f3641a6b934cb2858e218fc1bc84dda9bfc4185e3a93aff

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 413884
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6053
x-xss-protection: 0
last-modified: Tue, 04 Jan 2022 14:31:38 GMT
server: sffe
date: Wed, 20 Apr 2022 12:17:15 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 20 Apr 2023 12:17:15 GMT

GET
H3 200 discount.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/ Frame 499D 6 KB
6 KB 43ms
42ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/discount.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b322d8ff5dc049967c30bcfbadb63588c92dd485bd13c17a66339128fd8c693d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 527436
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6099
x-xss-protection: 0
last-modified: Tue, 04 Jan 2022 14:31:38 GMT
server: sffe
date: Tue, 19 Apr 2022 04:44:43 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 19 Apr 2023 04:44:43 GMT

GET
H3 200 button.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/ Frame 499D 2 KB
992 B 48ms
46ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/button.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0679a65b48c25854894908d30cc2d15693ed3229e47a3e01bc83bfda7e963704

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 527436
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 958
x-xss-protection: 0
last-modified: Tue, 04 Jan 2022 14:31:38 GMT
server: sffe
date: Tue, 19 Apr 2022 04:44:43 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 19 Apr 2023 04:44:43 GMT

GET
H3 200 brand_logo_white.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/ Frame 499D 8 KB
4 KB 49ms
48ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/brand_logo_white.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c940e9e76f670f7ae6c5bae0af682586b3b177de87016e8047915b4ea933d398

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 527436
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4112
x-xss-protection: 0
last-modified: Tue, 04 Jan 2022 14:31:38 GMT
server: sffe
date: Tue, 19 Apr 2022 04:44:43 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 19 Apr 2023 04:44:43 GMT

GET
H3 200 brand_logo_black.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/ Frame 499D 8 KB
4 KB 48ms
46ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/brand_logo_black.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

591b656ce300ae27d8d9d13f43809c20da95c17a4827dce4f482c25eddb3c54b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 527436
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4116
x-xss-protection: 0
last-modified: Tue, 04 Jan 2022 14:31:38 GMT
server: sffe
date: Tue, 19 Apr 2022 04:44:43 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 19 Apr 2023 04:44:43 GMT

GET
H3 200 30-OFF.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/ Frame 499D 10 KB
4 KB 49ms
48ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/30-OFF.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

38b73be4412a92beaa005fbb5ea48d1facc4a18f523ae9e1af623673c415fa45

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 527436
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4243
x-xss-protection: 0
last-modified: Tue, 04 Jan 2022 14:31:38 GMT
server: sffe
date: Tue, 19 Apr 2022 04:44:43 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 19 Apr 2023 04:44:43 GMT

GET
H3 200 ENTIRE-COLLECTION.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/ Frame 499D 4 KB
1 KB 52ms
51ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/ENTIRE-COLLECTION.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be6c378422c57cf30aadfdc68684e6a62f0b02090be4ac29d6aa142eae71945a

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 588007
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1483
x-xss-protection: 0
last-modified: Tue, 04 Jan 2022 14:31:38 GMT
server: sffe
date: Mon, 18 Apr 2022 11:55:12 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 18 Apr 2023 11:55:12 GMT

GET
H3 200 Stars.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/ Frame 499D 1 KB
606 B 51ms
50ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/Stars.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5704164952bd3399f7cad16dade361d000cfa6eddfad64f3eafe7d196f8e310c

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 527436
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 572
x-xss-protection: 0
last-modified: Tue, 04 Jan 2022 14:31:38 GMT
server: sffe
date: Tue, 19 Apr 2022 04:44:43 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 19 Apr 2023 04:44:43 GMT

GET
H3 200 main-image.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/ Frame 499D 76 KB
77 KB 52ms
52ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15925164737160019968/main-image.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb0bb9342c84d0c74a20e1e2689255b64a9904b02425a074ca6626fea40f2d1b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 527436
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 78334
x-xss-protection: 0
last-modified: Tue, 04 Jan 2022 14:31:38 GMT
server: sffe
date: Tue, 19 Apr 2022 04:44:43 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 19 Apr 2023 04:44:43 GMT

GET
H3 200 d_XgMe7_8DX3JscHlpumBxzOcHqlAtWKp75Cu0r3_I4.js Show response
pagead2.googlesyndication.com/bg/ Frame DCCC 35 KB
13 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/d_XgMe7_8DX3JscHlpumBxzOcHqlAtWKp75Cu0r3_I4.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77f5e031eefff035f726c707969ba6071cce707aa502d58aa7be42bb4af7fc8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 00:30:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24277
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13694
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Apr 2023 00:30:42 GMT

GET
H3 200 integrator.js Show response
adservice.google.co.uk/adsid/ 107 B
122 B 136ms
50ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=legas.com.ua

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 25 Apr 2022 07:15:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 135ms
50ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=legas.com.ua

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 25 Apr 2022 07:15:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DF03 187 KB
54 KB 707ms
706ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&adk=1812271804&adf=3025194257&lmt=1650870919&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Flegas.com.ua%2F&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870919855&bpp=1&bdt=2700&idt=1&shv=r20220420&mjsv=m202204190101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd4e11a67766aa393-223e6c6d81cd00c5%3AT%3D1650870918%3ART%3D1650870918%3AS%3DALNI_Mbw0eghOq8-rEKfSYmM-KKFwubGCQ&prev_fmts=300x250&prev_slotnames=2642460384%2C2642460384%2C3398747635&nras=1&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&psts=AGkb-H-4BzVi6JeHyFQwSh59ILbDqCmnoRlnUkN576sKw7NJrpzHj_cmbucF5cqFSh8FHk2RglpeGa8uq9AnJP8%2CAGkb-H_0SJ8ID_zNYxuYt1TYNR2qww0cQhLdLO0nbjLysd637m405DKb2wowDsMn1pq1MqkCqZfBgKrqdcBA1N0%2CAGkb-H_uSYH96b5l1hMiPzg0Jy3nBm0Nw17t_YK4mIYFtDroilIr6vkCIIOwDy7XhepibJzfzYVC-CNtbU97kh8%2CAGkb-H_xEFJsS1V0xEcH-Db82JEREZu7xXFQgu6G-D7eJtNDDBWec7ZIgKbOX7HMyuuO7JRU3jX3ooROrR8Qgl8w&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=5&uci=a!5&fsb=1&dtd=7

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32a01afd3004b97009a9232a6f467afbe4a73483827be9438c959d1d5884daf4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://legas.com.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 55697
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 25 Apr 2022 07:15:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
10 KB 137ms
55ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220420&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3ce0d81da35d3928e41e55a88c63e4058a68bf8cc7417fd3413a7a7b9bccba7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 25 Apr 2022 07:15:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10507
x-xss-protection: 0

POST
H3 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
22 B 109ms
37ms XHR
text/plain 2a00:1450:400c:c06::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-9703351-1&cid=260435591.1650870919&jid=1525632505&gjid=2003821358&_gid=958662493.1650870919&_u=aCjAgEABAAAAAG~&z=126134100

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c06::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://legas.com.ua/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 25 Apr 2022 07:15:19 GMT
content-type: text/plain
access-control-allow-origin: https://legas.com.ua
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N2VDHS

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 3488
date: Mon, 25 Apr 2022 06:17:11 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 25 Apr 2022 08:17:11 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 47ms
47ms XHR
text/plain 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1064110860&t=timing&_s=1&dl=https%3A%2F%2Flegas.com.ua%2F&ul=en-us&de=UTF-8&dt=%D0%9F%D1%80%D0%B0%D0%B2%D0%BE%D0%B2%D0%BE%D0%B9%20%D0%BF%D0%BE%D1%80%D1%82%D0%B0%D0%BB&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&utc=Page%20Load%20Time&utv=Full%20Page%20Load&utl=4-5%20seconds&utt=4040&_u=aCjAAEABAAAAAG~&jid=1225372153&gjid=479557072&cid=260435591.1650870919&tid=UA-9703351-1&_gid=958662493.1650870919&_r=1&gtm=2wg4k0N2VDHS&z=1447684609

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://legas.com.ua/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://legas.com.ua
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 41ms
40ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1064110860&t=event&ni=1&_s=1&dl=https%3A%2F%2Flegas.com.ua%2F&ul=en-us&de=UTF-8&dt=%D0%9F%D1%80%D0%B0%D0%B2%D0%BE%D0%B2%D0%BE%D0%B9%20%D0%BF%D0%BE%D1%80%D1%82%D0%B0%D0%BB&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Page%20Load%20Time&ea=4-5%20seconds&el=%D0%9F%D1%80%D0%B0%D0%B2%D0%BE%D0%B2%D0%BE%D0%B9%20%D0%BF%D0%BE%D1%80%D1%82%D0%B0%D0%BB%20%3A%3A%20https%3A%2F%2Flegas.com.ua%2F&ev=4040&_u=aCjAgEABAAAAAC~&jid=1525632505&gjid=2003821358&cid=260435591.1650870919&tid=UA-9703351-1&_gid=958662493.1650870919&gtm=2wg4k0N2VDHS&z=213731478

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 06:32:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2598
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 41ms
41ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1064110860&t=timing&_s=1&dl=https%3A%2F%2Flegas.com.ua%2F&ul=en-us&de=UTF-8&dt=%D0%9F%D1%80%D0%B0%D0%B2%D0%BE%D0%B2%D0%BE%D0%B9%20%D0%BF%D0%BE%D1%80%D1%82%D0%B0%D0%BB&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&utc=Page%20Load%20Time&utv=DNS%20Lookup&utl=%3C%200.1%20second&utt=0&_u=aCjAAEABAAAAAG~&jid=&gjid=&cid=260435591.1650870919&tid=UA-9703351-1&_gid=958662493.1650870919&gtm=2wg4k0N2VDHS&z=232073077

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 06:32:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2598
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 41ms
41ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1064110860&t=timing&_s=1&dl=https%3A%2F%2Flegas.com.ua%2F&ul=en-us&de=UTF-8&dt=%D0%9F%D1%80%D0%B0%D0%B2%D0%BE%D0%B2%D0%BE%D0%B9%20%D0%BF%D0%BE%D1%80%D1%82%D0%B0%D0%BB&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&utc=Page%20Load%20Time&utv=TTFB&utl=0.5-1%20second&utt=613&_u=aCjAAEABAAAAAG~&jid=&gjid=&cid=260435591.1650870919&tid=UA-9703351-1&_gid=958662493.1650870919&gtm=2wg4k0N2VDHS&z=640746124

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 06:32:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2598
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 42ms
41ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1064110860&t=timing&_s=1&dl=https%3A%2F%2Flegas.com.ua%2F&ul=en-us&de=UTF-8&dt=%D0%9F%D1%80%D0%B0%D0%B2%D0%BE%D0%B2%D0%BE%D0%B9%20%D0%BF%D0%BE%D1%80%D1%82%D0%B0%D0%BB&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&utc=Page%20Load%20Time&utv=HTML%20Download&utl=0.2-0.5%20second&utt=445&_u=aCjAAEABAAAAAG~&jid=&gjid=&cid=260435591.1650870919&tid=UA-9703351-1&_gid=958662493.1650870919&gtm=2wg4k0N2VDHS&z=1007147211

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 06:32:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2598
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 42ms
41ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1064110860&t=timing&_s=1&dl=https%3A%2F%2Flegas.com.ua%2F&ul=en-us&de=UTF-8&dt=%D0%9F%D1%80%D0%B0%D0%B2%D0%BE%D0%B2%D0%BE%D0%B9%20%D0%BF%D0%BE%D1%80%D1%82%D0%B0%D0%BB&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&utc=Page%20Load%20Time&utv=Parsing&utl=1-2%20seconds&utt=1738&_u=aCjAAEABAAAAAG~&jid=&gjid=&cid=260435591.1650870919&tid=UA-9703351-1&_gid=958662493.1650870919&gtm=2wg4k0N2VDHS&z=1968594237

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 06:32:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2598
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 42ms
41ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1064110860&t=timing&_s=1&dl=https%3A%2F%2Flegas.com.ua%2F&ul=en-us&de=UTF-8&dt=%D0%9F%D1%80%D0%B0%D0%B2%D0%BE%D0%B2%D0%BE%D0%B9%20%D0%BF%D0%BE%D1%80%D1%82%D0%B0%D0%BB&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&utc=Page%20Load%20Time&utv=Rendering&utl=2-3%20seconds&utt=2258&_u=aCjAAEABAAAAAG~&jid=&gjid=&cid=260435591.1650870919&tid=UA-9703351-1&_gid=958662493.1650870919&gtm=2wg4k0N2VDHS&z=968098217

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 06:32:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2598
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 42ms
41ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1064110860&t=timing&_s=1&dl=https%3A%2F%2Flegas.com.ua%2F&ul=en-us&de=UTF-8&dt=%D0%9F%D1%80%D0%B0%D0%B2%D0%BE%D0%B2%D0%BE%D0%B9%20%D0%BF%D0%BE%D1%80%D1%82%D0%B0%D0%BB&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&utc=Page%20Load%20Time&utv=DOM%20Loaded%20and%20Parsed&utl=3-4%20seconds&utt=3109&_u=aCjAAEABAAAAAG~&jid=&gjid=&cid=260435591.1650870919&tid=UA-9703351-1&_gid=958662493.1650870919&gtm=2wg4k0N2VDHS&z=103681901

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 06:32:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2598
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 43ms
42ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1064110860&t=timing&_s=1&dl=https%3A%2F%2Flegas.com.ua%2F&ul=en-us&de=UTF-8&dt=%D0%9F%D1%80%D0%B0%D0%B2%D0%BE%D0%B2%D0%BE%D0%B9%20%D0%BF%D0%BE%D1%80%D1%82%D0%B0%D0%BB&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&utc=Resource%20Load%20Time&utv=logo.jpg&utl=2-3%20seconds&utt=2101&_u=aCjAAEABAAAAAG~&jid=&gjid=&cid=260435591.1650870919&tid=UA-9703351-1&_gid=958662493.1650870919&gtm=2wg4k0N2VDHS&z=405844290

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 06:32:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2598
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 43ms
42ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1064110860&t=timing&_s=1&dl=https%3A%2F%2Flegas.com.ua%2F&ul=en-us&de=UTF-8&dt=%D0%9F%D1%80%D0%B0%D0%B2%D0%BE%D0%B2%D0%BE%D0%B9%20%D0%BF%D0%BE%D1%80%D1%82%D0%B0%D0%BB&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&utc=Resource%20Load%20Time&utv=caddy_seats_new2.gif&utl=2-3%20seconds&utt=2262&_u=aCjAAEABAAAAAG~&jid=&gjid=&cid=260435591.1650870919&tid=UA-9703351-1&_gid=958662493.1650870919&gtm=2wg4k0N2VDHS&z=1346752886

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 06:32:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2598
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
22 B 56ms
36ms XHR
text/plain 2a00:1450:400c:c06::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-9703351-1&cid=260435591.1650870919&jid=1225372153&gjid=479557072&_gid=958662493.1650870919&_u=aCjAAEABAAAAAG~&z=2033461848

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c06::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://legas.com.ua/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 25 Apr 2022 07:15:19 GMT
content-type: text/plain
access-control-allow-origin: https://legas.com.ua
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 69ms
69ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 25 Apr 2022 07:15:20 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame F71A 13 KB
5 KB 41ms
41ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://legas.com.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 2984
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 25 Apr 2022 06:25:36 GMT
expires: Tue, 25 Apr 2023 06:25:36 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 05CC 783 B
534 B 135ms
50ms Document
text/html 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

5dadbbe5fefb44e2e7364431acb8f7f4bf3bc65e5ee6a46ce457a1ad81a0f9cb

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-NH22ibpqwGRCsJukPq0SDA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://legas.com.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-NH22ibpqwGRCsJukPq0SDA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 25 Apr 2022 07:15:20 GMT
expires: Mon, 25 Apr 2022 07:15:20 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 d_XgMe7_8DX3JscHlpumBxzOcHqlAtWKp75Cu0r3_I4.js Show response
pagead2.googlesyndication.com/bg/ Frame F71A 35 KB
13 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/d_XgMe7_8DX3JscHlpumBxzOcHqlAtWKp75Cu0r3_I4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77f5e031eefff035f726c707969ba6071cce707aa502d58aa7be42bb4af7fc8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 00:30:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24278
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13694
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Apr 2023 00:30:42 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 05CC 0
0 83ms
82ms Image
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220420&jk=3395523671827448&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame F71A 0
10 B 42ms
41ms Image
text/plain 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?65UU0Q
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2DD5 42 B
64 B 76ms
76ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsudMddCHKoA7aLJqSHE5AtNOS_iflmjNG3D8Hf5Zk55SgcgoWcn1-OnbuwYpcDVGXtohMxNn2ELEHUJv9W_KT8mzr69UqBKJWKyY4LwFYCMvWtx1xfACw&sai=AMfl-YRTdvz22ukQuXx5NV2kGT88toq72IQnSP2wKTdZCrJ5DOuWQ79XOeI9AV_rdpn3psy9ozQ9DypUA6fr&sig=Cg0ArKJSzEFarvsGL284EAE&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220420&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=2&adk=4210853449&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1650870918680&rpt=765&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame B9E1 0
0 86ms
86ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CktnWhkpmYsTtKdqLx_AP7cSEoAXCibfhabzE3L63D5nj5bSEAhABIPnjvxlgu4aAgNAKoAGr68jFA8gBCakCCd0lCiWKtT6oAwGqBOMBT9Cxue4cFb1ap5m4SnxLEV3KTxs1ulcGmEj5BmgbnhKmI6HRe_I6eI2tQJlxtctSY66P3aAqzjlCHbjn2XLbVQ0xrhvFQXpkNizdHDScJ7TwJGMvnF_eHtwgwmjChwLSu1MyxdVVdh9Y9Cx68rDx9kQz8ogs71OoU20oarUBEh4mNd803XUEGv1rhA_tnk7iv9rEFhDQj_xMEUa0VMjfOT_4sSnTsV1gpEIbqyN6-sPp_xv18ID6wj_S-9P7IpD7dGxGcgJj4i4Ujx4QzGoy9-iCa0Bt9NjQgy_7xwFy1REDvg7ABJqlz97_A5IFBAgEGAGSBQQIBRgEoAYugAeC67MwqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQz4cH0ggJCIDhgBAQARgfgAoByAsBmAy5qq6pgwS4E4ME2BMO0BUBgBcBshccChoIABIUcHViLTg0MzE4MTMxMjE4MTI0OTEYAA&sigh=on_SS6GV4k4&vt=1&template_id=515&uach_m=[UACH]&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1486316043&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918327&bpp=17&bdt=1171&idt=308&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&correlator=4380143763487&frm=20&pv=2&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=396&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=RfrZYwemlw&p=https%3A//legas.com.ua&dtd=322
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 25 Apr 2022 07:15:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B9E1 42 B
64 B 85ms
84ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsusdFnI1C9SbjvkMskfHTWFQjAkdTtsCmRtyxCuHriwhC7AFhh6_Ail7tlym_cMJw7RMTjuzXl0393YuIXS8yJ3NLT2os8P2_vRh9ESUtiWhRvDXQy7tO5sK2ReOgnqFMi0lAaLAylXf_Gb3c30tEsWyO2Km7eFWA&sai=AMfl-YQNIkSVzWO6lLhBSuBmUllaP4xhiUQfWn5CFwrU3aH8EdVIfUXwXTrqpLvKvgQXmTLMBHCRWiT5gRmY&sig=Cg0ArKJSzPCHpUzBUJIpEAE&id=lidar2&mcvt=1000&p=0,0,60,468&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220420&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=903195660&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&pay=1&rst=1650870918650&rpt=829&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 48AB 0
0 78ms
77ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CMeTrhkpmYt3SKsiB7gP80obwDcKJt-FpvMTcvrcPmePltIQCEAEg-eO_GWC7hoCA0AqgAavryMUDyAEJqQIJ3SUKJYq1PqgDAaoE4AFP0LMdbKLBioDlV27vfpK_hYrLiaSjua91JiBp56HVRcIBIzCqbR8X6QsKeYjS3YyWbK2-IYruq3QNEHScpRenQEwn4unnP0mfQj9pMGsCtWquWoTH-j49lz57Psl2w4hs44XnG3tJ7TPIwvj4hhwBNfK-47HUlq55wY_kk7k3qkePT4OasJ6hRVmNNmOLh5I-5BSjrixuYiaN1mX7RgP93fDGjXKW4btF2xRAgZkjeNJMxWg7aG79AUJHyqzbnErqF7xubCS3ICqEQJjYnIUxVb2Apey46U6GzK5eD2MensAEmqXP3v8DkgUECAQYAZIFBAgFGASgBi6AB4LrszCoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBDx9wfSCAkIgOGAEBABGB-ACgHICwGYDLmqrqmDBLgTgwTYEw7QFQGAFwGyFxwKGggAEhRwdWItODQzMTgxMzEyMTgxMjQ5MRgA&sigh=nC2TMwsTMog&vt=1&template_id=515&uach_m=[UACH]&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8431813121812491&output=html&h=60&slotname=2642460384&adk=903195660&adf=1365725250&pi=t.ma~as.2642460384&w=468&lmt=1650870918&url=https%3A%2F%2Flegas.com.ua%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1650870918349&bpp=5&bdt=1194&idt=306&shv=r20220420&mjsv=m202204190101&ptt=5&saldr=sa&abxe=1&prev_slotnames=2642460384&correlator=4380143763487&frm=20&pv=1&ga_vid=260435591.1650870919&ga_sid=1650870919&ga_hid=1064110860&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=537&ady=1032&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44762916%2C44761793%2C21065725&oid=2&pvsid=3395523671827448&pem=524&tmod=1946376951&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7Cn&abl=XS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=YHWotiKRlR&p=https%3A//legas.com.ua&dtd=309
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 25 Apr 2022 07:15:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 48AB 42 B
64 B 75ms
75ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuV6CegtzbjHKlxh0Mn2FKl8h_uEQ3rh8BQO3Uex9He_f7xgxwT1SOz9QX1RVuwNN4JgK7LvBXrfloc2olwhtIfyyZUMNWg8nf3UJ1Q4KpPHeJNLrr3Xjk1pIKzkCDAl4sa3Vr5Gb94TlA5vBCr4ZM1HWcaH2d_Uw&sai=AMfl-YTObc5XKeBQ_CsU3aqUtw3blunGvMYutn0S81JsK_rk-i-3p8CszsxSYfy4kRqG4HfBhCMW3sz7VCct&sig=Cg0ArKJSzBck8NRFUqgWEAE&id=lidar2&mcvt=1000&p=0,0,60,468&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220420&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=903195660&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&pay=1&rst=1650870918659&rpt=845&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204190101/ 145 KB
51 KB 73ms
72ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204190101/reactive_library_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c2eda2ba9987342dac2033a48dc3c5bb1d52b9b22f94e2a988c86c10c8fffa62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52694
x-xss-protection: 0
server: cafe
etag: 5187251834449154594
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Apr 2022 07:15:20 GMT

GET
H3 200 integrator.js Show response
adservice.google.co.uk/adsid/ 107 B
122 B 49ms
49ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=legas.com.ua

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 25 Apr 2022 07:15:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 49ms
49ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=legas.com.ua

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 25 Apr 2022 07:15:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/ Frame 7AF1 10 KB
4 KB 41ms
41ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

340b20f9ff6d073c2fea911631d8a6e13af185d983cbe842ddca27df91d0f295

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://legas.com.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

age: 31161
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4398
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Apr 2022 22:35:59 GMT
etag: 14837630671339829333
expires: Sun, 08 May 2022 22:35:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/ Frame 50DD 10 KB
4 KB 41ms
41ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

340b20f9ff6d073c2fea911631d8a6e13af185d983cbe842ddca27df91d0f295

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://legas.com.ua/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

age: 31161
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4398
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 24 Apr 2022 22:35:59 GMT
etag: 14837630671339829333
expires: Sun, 08 May 2022 22:35:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 css2
fonts.googleapis.com/ Frame 7AF1 4 KB
634 B 50ms
50ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 25 Apr 2022 05:58:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 25 Apr 2022 07:15:20 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 25 Apr 2022 07:15:20 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 7AF1 205 B
229 B 127ms
42ms Image
image/png 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 03:15:35 GMT
x-content-type-options: nosniff
age: 14385
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 25 Apr 2023 03:15:35 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 7AF1 604 B
628 B 135ms
50ms Image
image/png 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 06:43:04 GMT
x-content-type-options: nosniff
age: 1936
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 25 Apr 2023 06:43:04 GMT

GET
H3 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/elements/html/ Frame 7AF1 19 KB
8 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1240106b570dda5fdb8cf5e703d20b1068194eb2f18795e20fa85fcb96108fdb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:14:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 13275616604445095965
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:14:33 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame F465 624 B
297 B 53ms
52ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPxZBCR7Z4BGPrH9MUBMAE&v=APEucNVE_yhyZ-qWfMnxRbBPrhCRf0p9xIariDjoAsAxxXro8vMvubMF5Db8aPyPxVbkbu9mijLk_KHBf-dyoJ0YCaQDJem0AvT6LCKLZXCGHF3W8iSvoRFZxTwM6jyVetVdwD9HCltTuxAsg01jajZ3T9HEcqZ6PD6hRN_2TBS0knmR4HyyusU

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 25 Apr 2022 07:15:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 50DD 64 KB
31 KB 84ms
84ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BAirpRG-5qDL0zjo9clqAHn5I32mZOZKSOVwk-q_0A2iIX_TeId7uZtS4OUgKfXbMqryJck2iMbfjH9pWjaxMdzG8HhEqK8s42oehcZdRzXE9QFkQzYRMZ-UANGpeZanjo0PJPlboQpQ4sb4Fs4Uhz2CfBuw&dbm_d=AKAmf-B65OsHPK-RyW1lM6h6_dASEuOnH3EJwfq2U_q23hDFkCEwcQiLiK5bQMKLv6Au2f1x62Zls4NqJp1hkhnQjmid21DJxzieVe7MVUZlVbWQruCKmQs-_8Chgxe9MM2IJPVgLJ1P1DQvJuyvMrAK1bMkgayrRVPCItM8660vVnVZ4n_9RLseTe2VFptJBUQLe5Ch65k5QHsCZJVed10FbJvUNjdgolqNbBSnUESjBFcX0Jzb1Krtx-nPzE8jXqRa9YC4UFw7Xq9TgTj2nwcRxIvDuMGeveDqb10z6ZLCu7QWqwdqTQTadQIbrsxAeo5dWjFXRwPKvIpGk2afkYz1ZiD_J9zbartFEfVvmwzuXtbllWvE80l7z08acrQdqvbVIiQVCrpCBSlJ3vvDwB5C3llt5KG1tg-QIINpXKoQ7ut09IJYxLbn8Ay54rJgEPVZYVRSaIsQ43lDcdrx71yJPyQjZ3fuauNzQsdcH9kjL39H8x9lCE886fkQ1xpkOFRPUgDgbSQq65sn1jT9PHvplRS2ghRYC1S7EgQ85-HR5cx1e1AC2TFd8sxzCC_axVwPMEEjIx7x8thuZ7JOtNvjjiKkOZIFo-4bH8BkQe7kWd_YxWeumCnhRVbdDreyytSqiUzEHUSIDLuY8qf5ScNRU7QUSRSEBJzZTs7OgH_-z339miJJkuF1-1QHDXztxnXL0RdYC10QsCpEUO4txUzgjEd_NDZ2yLPzv--zOhryW5n6cJPzy5_pTO0BBKiSPhuhQdSCHo60E5i5EEQlYVd2ycjtZtdpSne96G0L_Ifl-Qnrjr0Byz_XPbFF3wdI8yVIRzC-3ox3sGLAce1jKz77NHfy0ZU1kxUbLlTVBJtB5-x4VHbOSOoEuCGvhrtduW0sxXPiE8i--voJUIL58lsuTBhjqAuzro-gr03z8m-iu97_EktNUTc18czUsPPwBOKQI39IGiThMIeeMp3gPj0Eg4PL6vhyaRMPN_EVHp5WdcG_Gv7giHUbAw8qftGkggsq18HiLbqYutW_xeqZVCvixZLCRC1tw0VfPHdRNS2bQHjqDn0P1aOsTb-f82CghedhFoSjrBdJyprFF9qT9UWNpGv2obuCslKRQAWqNvMRqelhoJYqFL_aIVO0tVx91UCNIGvjJFZiYjaQFKbTtCH-mYhlGGyLSIXS5Q1xpIpgeoCSSovi9vLFJq4aOCq37Ji9Gky_Vykuw5ykwVuHF9oLEXad9Z38gfc8NJib1UMQ4stEMX_VyG238INdf4o-c-_VBo4mZMZPygGAD22C-0sAL5qJl_z4LygP2TS_flx1ZcuIwvY0nwaK_BF6VHFUqw1bDBU7PX1CUTtu85LepgxZIoWyOMpJtWBrAkgPP2qb7qvPyFEQtkTJvmvqi0Lohh4eThv9aZuhR91bMEfN0lUkMj_SoC-_ZkHZMVRE9L7EorJBgbT8Hr0G87bhK2BRr1G1RNfr-4YmrRi_O0cxnV0HUtIZWQdQlhsq6pF2zLuIkxZfD0zacmV-jl3eqm_MbGKwc1XPJCabc-N8GP2QM6tRUXrCbB5HE1WWa7TckdOgqEBlY6xplVBfH-qInXj_YXcQ8Eq6T6zNM4DhniusVtVaQmuZ7iY38hPiMHzmVIrNAScHXPy3HJV2S5uEeUAKKaIKY6gA8q6RtvcfpVzMhvhu8-kTo8dZr-Cl9hqhgRNd2xHfGSM-zkbmNff4bUJeK2flGLEDgdWDl95itz9jMcHumDLW3sgZQ92VkdnlXTmc7hDmOSJ6Su59-Us4yBeja449mLl_hn7TpmSBKGoOb16Vrue4db0QRyfnHsxf4A017MvEfT47swcoxKmhzuy3vTLUZBbq6gQMEvPwk72VQuqq19aqa7jo-V1PC4Fw4BoiVG_o5pZarnC66tnWPKXbJCW42tY7NLB6HzwSsSnHNZ2H_F8WxwIPCjSNosM9LgMSpLQaxBdlCBCmFiHglKAXuXTfOYQ8rn9QmVG_fIDsQPsj0EKDRUJeuHhUlgEVBZYx0c6KPPd8-eZiORtBT_S4-ezcYwwIaiWqdNA52t9Ef65MVUGSHXaB4iZKSnvpdoowNYapW6ynK-CWgykdmO5Bgy43laYJB2u8Byzs159KancOm-RQz7mLOX_nvI1aABvsjAK-8zL9cMThModo_Palc4OKn3ioLEbsIfjCy-oCdrvt92mSbomzGnt4HB2OrtXfs5VyRltGOOu4pgXUFL9464CcJQdO3xKyBAdxBZNNeQOgm-9quNmk5SxFPnuU_2icPowErS4iSVyriQj7EQ0LR-2IUdIkDGTQZTyW678KHibFRpV0yiDoxmOoB_hyIRUM6pMUtYQS2ZIgXifCfZkhCg4oPoV6NR257t862mty6rd6H2j_hKru319Xt-kq0HuyWMfm0HA6wD8SZ4AQhWIfQ1QYj089bTpDpkeFA9e8cQOW1w5opD94JhSnZAZ8CyyYNDDObu82drBUGk3shWBcLS2Y9SeYh_9m5eK0J5B7wc5KCh_WgrpC0kFrAyM4ylQ6tuongaIZlAST0tnfQdibLjdJ1idqSadwVHwzrnJk3yC2gQKFR2rmoljRpEnVifK_QyoCay2_Lgtn1B52ZhY_ZSZadWC0ZnQCik3h1YKkqn0H69SqIWi7nqXelMMDHQ8DHkuRh1aE9QpAehzcrY6wLdvmpAv5yECHeNc_KVvd_xf3jTOQdp_WKH9QfbDg2tY2KZ8rNx0vOJfYXRm10Rm-j10rDas5m5zKs4N1z9VQ33LW4YPqaEp4ewqdahS6WIwzxGGSwbOkYc7Tw8_dtbEJlh4eXNN3gKAQTc-hsq2x_lLbcaZQlQkVYHl1aixVlBZUJCpCVlLUHoUEToWBWsMYKt_5LH-arG_t_Q9ObwoXgCFCsktkNXtMKkwxUQZnXSuFEq2s7aZHSLhen3neVRvuZ7oYsnR0F-XJQqR8r-Co4Kgogx3vcmHQufE6qW7ouf2SGUQyMjO8LsujAw-bxcZCvd5UsM0uxNpcg8eaLZpmNsrpOW9JP89-zCx4KlxjvQSNFtE8xDTzY9aq6jXC69_OmL8ohhBH0eC7r1jyeshN8rwCjPibCQ4leDzSnmYlgRrAlhKRpkK-rS0NUJwXQkgQS0OIntLpjTB3wxEQkpDl_ggmmRkD3H7A4IilaTUFO2xsDdjVkWnTTeJlO54PGgGGzveOzcg48VL48TUXsnYESTgfU33o7OyDSXzYgagIdbqN110wjd7Frygm4QzhNDgc7Pul8BQngREOF8uqDZjEjrh8oqiBT9apycPA6q_3kHfctiS9K3WeqVFu4WCDUN0ybQTFlGCCEpamuwIHLKy9nsakn3ZZDWQnbNyQQP8NabGDEHtrqOCYWf52nem6ej5S0J4EVyUmtdXssXJXmBect1wFWg6yn-t-y0tPFAnPakq0Ovux7agDA5sjgr7hBKCKi8OcdJKXHAjYZt4Lm5Wt0IVRLVeXNqhbyJkTpBwzT779Zv7at8TWzVzg6CFStjwlSk_Ic_aUViFS&cid=CAASJeRoD_SY1Oudaea2F9qa0_p40_n5SVlR3g6Qo78PtzYoYWaOeTI&rfl=1%2Chttps%253A%252F%252Flegas.com.ua%252F%240

Requested by

Host: legas.com.ua
URL: https://legas.com.ua/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0afa9b03f71bdee3755e69500e56d6eae3120719aa52a89d76d35e23389b2485

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32085
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 50DD 42 B
63 B 75ms
74ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AlDYrOOENSf0i_ddp8YA7_P7Gl6Ua5PUWJyVgfjxrfeeRGEJUoF6SHwLyerj_SkRkhEBRa2BaDGIA-1Tbe0wfxG6-7N5UZhSXERFb8Xa_6_jlQma4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/ Frame 50DD 3 KB
1 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:12:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 172
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:12:28 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 50DD 119 KB
36 KB 56ms
55ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36950
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1650454428054601"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 25 Apr 2022 07:15:20 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/ Frame 50DD 15 KB
6 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:12:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 190
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6409
x-xss-protection: 0
server: cafe
etag: 15284592792851369840
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:12:10 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 109ms
108ms Image
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220420&jk=3395523671827448&bg=!SkmlSQ3NAAYXWUUuN1k7ACkAdvg8Wgkm3JRGWLn05YSTMZI_nTBLMyoE-LAKCEYkRYhGJYtK90I5dAIAAABSUgAAAAJoAQeZApYnThtWyzp8AeXBLLW2pmVm0jMRAhY016cgm9_Vq98NEIo24jEvwdPSfYDSbfn_U5wUVH_k3ZNNPWUsC_NVPhO2Ho6DcgK0kfYEKYnDPoGbtbmwUth3WaJmkL4oCElq9e6lCbCY-rrySmCA78z3JsUQEKO0Xe9rnzSRjD8a64ylhRJi4dEDR0TsPqgerwSK964YmKT3yLwGez9jpPkFReTGyMe8LIT77PH9NEiojwQEGhJMtR8Azg8fWt-6PrtnMCxl0qfOtb5yV_j0TvkRmUiYlzhYK8_MhJrrCtpCo7HVa41OzUyJQbWg21BRG7UDxfbRFbnJlhzrWtWUpcGKVA4Fw4HR4omdMnm94el0KRjIY-TQmNyPvZhLfeLTKt8uVzYAcuZTOTqzUP-tiKhFU-StPM2VZAL1UE5JX1LV_q-a-Hocq6tTbBykTaoZ9cWKjxYiyRzOxo4zOPH8x8CX8OOrOhiAzjBakx7e7NZ4Vdaav4wIGcvnh7k89YHXf3a1FAPyCJY9Q1WPzI1g4e6DV-F1kBeGGIejzQbWq_KDk4mxz_QWtSiMYewDq0wHanAQuKyiCsljzXNOLcErMU50RPeb7Yx_1BgVD-aFaxuX7q0Sc50Fr4H-3bfuTVr96qbk1KyS6aNS0A3V6JDUClDyGuok36SArZ7bcwpVbA-XKFFQqAlwKYeo2msijykOQ12QqdrPieonR3R9KiTid8RBEznKBpKUCOEAwNuYLOBkMZfimZB7GBsbxUNnHTStiikwElD1Gf1xYil8GuBxbDGDs4Wc59Uk0fjzDLRnDLc-yRT01ISSYBToAcA_kfoaDXHbVWhQJj8h-81TcbQ_5PZjcI_SeEC7yTvJx0_PqiU7s9Z3SXM47Yer9A
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://legas.com.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H3 200 css
fonts.googleapis.com/ Frame 87EF 6 KB
670 B 50ms
49ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2cef3a9d0606aecfe2476867e61f76535b9bb5b8e9d31957cc9504cdd1e69396

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 25 Apr 2022 06:18:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 25 Apr 2022 07:15:20 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 25 Apr 2022 07:15:20 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/ Frame 87EF 2 KB
918 B 41ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:14:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 877
x-xss-protection: 0
server: cafe
etag: 13035868154101442325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:14:33 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/ Frame 87EF 19 KB
8 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a7d5c1bfe43c8beefab2fa059f4fcaa029fcbbace9a672aae1dfe1ffb7d6976c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:06:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 530
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8002
x-xss-protection: 0
server: cafe
etag: 5332015062585099865
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:06:30 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/ Frame 87EF 3 KB
1 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:12:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 172
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:12:28 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 87EF 119 KB
36 KB 57ms
56ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36950
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1650454428054601"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 25 Apr 2022 07:15:20 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/ Frame 87EF 15 KB
6 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220420/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:12:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 190
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6409
x-xss-protection: 0
server: cafe
etag: 15284592792851369840
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:12:10 GMT

GET
H3 200 3bde1d5944145a46a8b91d920db5ec4d.js Show response
www.gstatic.com/mysidia/ Frame 87EF 30 KB
12 KB 60ms
43ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/3bde1d5944145a46a8b91d920db5ec4d.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f748110cf8280254c6705d7cf18de8b04369c521d9db43e63897e531c283578d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 22 Apr 2022 10:34:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 247269
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12194
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 05:04:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 21 Jul 2022 10:34:11 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame F465
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM2EbsE9eQJMYgp49LUW0Cg&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM2EbsE9eQJMYgp49LUW0Cg&google_cver=1&C=1

43 B
1012 B

54ms
54ms

Image
image/gif

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM2EbsE9eQJMYgp49LUW0Cg&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPxZBCR7Z4BGPrH9MUBMAE&v=APEucNVE_yhyZ-qWfMnxRbBPrhCRf0p9xIariDjoAsAxxXro8vMvubMF5Db8aPyPxVbkbu9mijLk_KHBf-dyoJ0YCaQDJem0AvT6LCKLZXCGHF3W8iSvoRFZxTwM6jyVetVdwD9HCltTuxAsg01jajZ3T9HEcqZ6PD6hRN_2TBS0knmR4HyyusU
Protocol: HTTP/1.1
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Apr 2022 07:15:21 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 25 Apr 2022 07:15:21 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 25 Apr 2022 07:15:21 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM2EbsE9eQJMYgp49LUW0Cg&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Mon, 25 Apr 2022 07:15:21 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame F465
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YmZKieU5keGjyYxLZmaylAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM2EbsE9eQJMYgp49LUW0Cg&google_cver=1

43 B
892 B

63ms
62ms

Image
image/gif

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM2EbsE9eQJMYgp49LUW0Cg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPxZBCR7Z4BGPrH9MUBMAE&v=APEucNVE_yhyZ-qWfMnxRbBPrhCRf0p9xIariDjoAsAxxXro8vMvubMF5Db8aPyPxVbkbu9mijLk_KHBf-dyoJ0YCaQDJem0AvT6LCKLZXCGHF3W8iSvoRFZxTwM6jyVetVdwD9HCltTuxAsg01jajZ3T9HEcqZ6PD6hRN_2TBS0knmR4HyyusU
Protocol: HTTP/1.1
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Apr 2022 07:15:21 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 25 Apr 2022 07:15:21 GMT

Redirect headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:21 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEM2EbsE9eQJMYgp49LUW0Cg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame F465
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFjhH_7FUp4K-qIbUEtNRgM&google_cver=1

43 B
1020 B

112ms
60ms

Image
image/gif

37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFjhH_7FUp4K-qIbUEtNRgM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPxZBCR7Z4BGPrH9MUBMAE&v=APEucNVE_yhyZ-qWfMnxRbBPrhCRf0p9xIariDjoAsAxxXro8vMvubMF5Db8aPyPxVbkbu9mijLk_KHBf-dyoJ0YCaQDJem0AvT6LCKLZXCGHF3W8iSvoRFZxTwM6jyVetVdwD9HCltTuxAsg01jajZ3T9HEcqZ6PD6hRN_2TBS0knmR4HyyusU

Protocol

HTTP/1.1

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Apr 2022 07:15:21 GMT
X-Proxy-Origin: 217.138.196.102; 217.138.196.102; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 8ed06050-ae50-45b0-8dee-671f083fc3b0
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFjhH_7FUp4K-qIbUEtNRgM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F465
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDAzMTMzMTUwNTQ0ODUzMzg2NA%3D%3D

170 B
188 B

136ms
52ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDAzMTMzMTUwNTQ0ODUzMzg2NA%3D%3D

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 25 Apr 2022 07:15:21 GMT
X-Proxy-Origin: 217.138.196.102; 217.138.196.102; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 30ca0c65-901a-4767-8db1-d64640015c9f
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDAzMTMzMTUwNTQ0ODUzMzg2NA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220420/r20110914/ Frame 50DD 25 KB
10 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220420/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BAirpRG-5qDL0zjo9clqAHn5I32mZOZKSOVwk-q_0A2iIX_TeId7uZtS4OUgKfXbMqryJck2iMbfjH9pWjaxMdzG8HhEqK8s42oehcZdRzXE9QFkQzYRMZ-UANGpeZanjo0PJPlboQpQ4sb4Fs4Uhz2CfBuw&dbm_d=AKAmf-B65OsHPK-RyW1lM6h6_dASEuOnH3EJwfq2U_q23hDFkCEwcQiLiK5bQMKLv6Au2f1x62Zls4NqJp1hkhnQjmid21DJxzieVe7MVUZlVbWQruCKmQs-_8Chgxe9MM2IJPVgLJ1P1DQvJuyvMrAK1bMkgayrRVPCItM8660vVnVZ4n_9RLseTe2VFptJBUQLe5Ch65k5QHsCZJVed10FbJvUNjdgolqNbBSnUESjBFcX0Jzb1Krtx-nPzE8jXqRa9YC4UFw7Xq9TgTj2nwcRxIvDuMGeveDqb10z6ZLCu7QWqwdqTQTadQIbrsxAeo5dWjFXRwPKvIpGk2afkYz1ZiD_J9zbartFEfVvmwzuXtbllWvE80l7z08acrQdqvbVIiQVCrpCBSlJ3vvDwB5C3llt5KG1tg-QIINpXKoQ7ut09IJYxLbn8Ay54rJgEPVZYVRSaIsQ43lDcdrx71yJPyQjZ3fuauNzQsdcH9kjL39H8x9lCE886fkQ1xpkOFRPUgDgbSQq65sn1jT9PHvplRS2ghRYC1S7EgQ85-HR5cx1e1AC2TFd8sxzCC_axVwPMEEjIx7x8thuZ7JOtNvjjiKkOZIFo-4bH8BkQe7kWd_YxWeumCnhRVbdDreyytSqiUzEHUSIDLuY8qf5ScNRU7QUSRSEBJzZTs7OgH_-z339miJJkuF1-1QHDXztxnXL0RdYC10QsCpEUO4txUzgjEd_NDZ2yLPzv--zOhryW5n6cJPzy5_pTO0BBKiSPhuhQdSCHo60E5i5EEQlYVd2ycjtZtdpSne96G0L_Ifl-Qnrjr0Byz_XPbFF3wdI8yVIRzC-3ox3sGLAce1jKz77NHfy0ZU1kxUbLlTVBJtB5-x4VHbOSOoEuCGvhrtduW0sxXPiE8i--voJUIL58lsuTBhjqAuzro-gr03z8m-iu97_EktNUTc18czUsPPwBOKQI39IGiThMIeeMp3gPj0Eg4PL6vhyaRMPN_EVHp5WdcG_Gv7giHUbAw8qftGkggsq18HiLbqYutW_xeqZVCvixZLCRC1tw0VfPHdRNS2bQHjqDn0P1aOsTb-f82CghedhFoSjrBdJyprFF9qT9UWNpGv2obuCslKRQAWqNvMRqelhoJYqFL_aIVO0tVx91UCNIGvjJFZiYjaQFKbTtCH-mYhlGGyLSIXS5Q1xpIpgeoCSSovi9vLFJq4aOCq37Ji9Gky_Vykuw5ykwVuHF9oLEXad9Z38gfc8NJib1UMQ4stEMX_VyG238INdf4o-c-_VBo4mZMZPygGAD22C-0sAL5qJl_z4LygP2TS_flx1ZcuIwvY0nwaK_BF6VHFUqw1bDBU7PX1CUTtu85LepgxZIoWyOMpJtWBrAkgPP2qb7qvPyFEQtkTJvmvqi0Lohh4eThv9aZuhR91bMEfN0lUkMj_SoC-_ZkHZMVRE9L7EorJBgbT8Hr0G87bhK2BRr1G1RNfr-4YmrRi_O0cxnV0HUtIZWQdQlhsq6pF2zLuIkxZfD0zacmV-jl3eqm_MbGKwc1XPJCabc-N8GP2QM6tRUXrCbB5HE1WWa7TckdOgqEBlY6xplVBfH-qInXj_YXcQ8Eq6T6zNM4DhniusVtVaQmuZ7iY38hPiMHzmVIrNAScHXPy3HJV2S5uEeUAKKaIKY6gA8q6RtvcfpVzMhvhu8-kTo8dZr-Cl9hqhgRNd2xHfGSM-zkbmNff4bUJeK2flGLEDgdWDl95itz9jMcHumDLW3sgZQ92VkdnlXTmc7hDmOSJ6Su59-Us4yBeja449mLl_hn7TpmSBKGoOb16Vrue4db0QRyfnHsxf4A017MvEfT47swcoxKmhzuy3vTLUZBbq6gQMEvPwk72VQuqq19aqa7jo-V1PC4Fw4BoiVG_o5pZarnC66tnWPKXbJCW42tY7NLB6HzwSsSnHNZ2H_F8WxwIPCjSNosM9LgMSpLQaxBdlCBCmFiHglKAXuXTfOYQ8rn9QmVG_fIDsQPsj0EKDRUJeuHhUlgEVBZYx0c6KPPd8-eZiORtBT_S4-ezcYwwIaiWqdNA52t9Ef65MVUGSHXaB4iZKSnvpdoowNYapW6ynK-CWgykdmO5Bgy43laYJB2u8Byzs159KancOm-RQz7mLOX_nvI1aABvsjAK-8zL9cMThModo_Palc4OKn3ioLEbsIfjCy-oCdrvt92mSbomzGnt4HB2OrtXfs5VyRltGOOu4pgXUFL9464CcJQdO3xKyBAdxBZNNeQOgm-9quNmk5SxFPnuU_2icPowErS4iSVyriQj7EQ0LR-2IUdIkDGTQZTyW678KHibFRpV0yiDoxmOoB_hyIRUM6pMUtYQS2ZIgXifCfZkhCg4oPoV6NR257t862mty6rd6H2j_hKru319Xt-kq0HuyWMfm0HA6wD8SZ4AQhWIfQ1QYj089bTpDpkeFA9e8cQOW1w5opD94JhSnZAZ8CyyYNDDObu82drBUGk3shWBcLS2Y9SeYh_9m5eK0J5B7wc5KCh_WgrpC0kFrAyM4ylQ6tuongaIZlAST0tnfQdibLjdJ1idqSadwVHwzrnJk3yC2gQKFR2rmoljRpEnVifK_QyoCay2_Lgtn1B52ZhY_ZSZadWC0ZnQCik3h1YKkqn0H69SqIWi7nqXelMMDHQ8DHkuRh1aE9QpAehzcrY6wLdvmpAv5yECHeNc_KVvd_xf3jTOQdp_WKH9QfbDg2tY2KZ8rNx0vOJfYXRm10Rm-j10rDas5m5zKs4N1z9VQ33LW4YPqaEp4ewqdahS6WIwzxGGSwbOkYc7Tw8_dtbEJlh4eXNN3gKAQTc-hsq2x_lLbcaZQlQkVYHl1aixVlBZUJCpCVlLUHoUEToWBWsMYKt_5LH-arG_t_Q9ObwoXgCFCsktkNXtMKkwxUQZnXSuFEq2s7aZHSLhen3neVRvuZ7oYsnR0F-XJQqR8r-Co4Kgogx3vcmHQufE6qW7ouf2SGUQyMjO8LsujAw-bxcZCvd5UsM0uxNpcg8eaLZpmNsrpOW9JP89-zCx4KlxjvQSNFtE8xDTzY9aq6jXC69_OmL8ohhBH0eC7r1jyeshN8rwCjPibCQ4leDzSnmYlgRrAlhKRpkK-rS0NUJwXQkgQS0OIntLpjTB3wxEQkpDl_ggmmRkD3H7A4IilaTUFO2xsDdjVkWnTTeJlO54PGgGGzveOzcg48VL48TUXsnYESTgfU33o7OyDSXzYgagIdbqN110wjd7Frygm4QzhNDgc7Pul8BQngREOF8uqDZjEjrh8oqiBT9apycPA6q_3kHfctiS9K3WeqVFu4WCDUN0ybQTFlGCCEpamuwIHLKy9nsakn3ZZDWQnbNyQQP8NabGDEHtrqOCYWf52nem6ej5S0J4EVyUmtdXssXJXmBect1wFWg6yn-t-y0tPFAnPakq0Ovux7agDA5sjgr7hBKCKi8OcdJKXHAjYZt4Lm5Wt0IVRLVeXNqhbyJkTpBwzT779Zv7at8TWzVzg6CFStjwlSk_Ic_aUViFS&cid=CAASJeRoD_SY1Oudaea2F9qa0_p40_n5SVlR3g6Qo78PtzYoYWaOeTI&rfl=1%2Chttps%253A%252F%252Flegas.com.ua%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e66bfceb15a6ee125dff79826be02a07b766843e6c660edf55ec0c22d1a407c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:10:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 302
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9777
x-xss-protection: 0
server: cafe
etag: 12512753850102923420
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:10:18 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220420/r20110914/elements/html/ Frame 50DD 8 KB
3 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220420/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:13:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 130
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 09 May 2022 07:13:10 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 50DD 0
622 B 191ms
85ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst1G-NULs2XOxyfhu2BXs4jG6yOwpCyuYPfl-ul9Wqyr_c6SLLVDJfVjLDoICabizpaa68ThJYjSlHP9gocau1i_Kj2G34Fzja9NSCBUezaW49SwwwqrGtla57s7Y1STqh7RohilzXOxW76Y_KdGNKq_hc0meNvTvpoLhkQw4USVkOucKAKTh4i2qrE2CXG80lA_yUEvwRAye4tnm2zE3Nc2sq4gh0h2GAHzaUVNMisBkCpnJbH-jGHjrVPPxhNTKrjMiZCE1nolaYm45tiI0sZA63KHAAv46K3vDwpr4MmOuugWRWUT_jaq708Lk0dKnI_xWLq16CW0QdfcBUUHFXvvkWZWoDXrB2boufMXB8CMygW62vy-YujWKMa1hmW6oAXdVHSvdKYAfyRYKqMCj6ArOUKj_XUPtsPvq5foroVGY8v_TIqNxGygjU5MwaVLLjURxk5L8gT8v7z9RZyXavng57I0FdThveYee6KT6o32N5woAnjumSfOxD2AmIg6Zvx0uWFRkWthS3eHK5CkeHYtKH6-HSRmKUsO_npldOzdey1d61Cn5zxIV37P0I8LV15vnaGPXU4zJ2gbKtQbTwpHf2xomMZJRVBKGyuGGveGfXzPNQ8FeLFwJJEm6xITvNiz1AuIrh-yvJNmfbgtddDpFBRUlqGATP--blRkxJOmZtcfn3JTj-JnpRi3kxRyOz7nB0xhM3E1-KMHx4l8sz8akkL0CVS-2SWO0uNvMnAgCNhbcK4Fcv1JQwrRYUmlsFJzpkB-7Q2aImmxl3xlmDAS-aEj7A4kVGaVXCFpQmSy4u4ZteaxwlzpqMY1ZolpKhucSki07PaZWPKwUganVcr8steXajt8M8_LueJsaJ_Gr7XASYdfPqAuLRW2BLe548IvXE6wE9ELp-41qZLED15pTPUMore-QvmADlHnSBFKHdkXIu8lCPOko8XNMBmBk5k-n001mgy8cvEx_U61HB-AJNy9gO8EA4uzZJZAvQ9LtAMTlibYo5dJ5-kUWmOQM35xpNZYy8EESL5TyF9bfqMPtE2U3vTDouKc6LryTWHnUyWzW-3T5yEASiienHIdCuRQKw868i8r0uZdFOwJNt3KjW5ivYPU3G_6MROi-BKkYnPY4OIn8mlgaX8y24DKtGHlw_fA5Yip1lvJ1cKXxcigMlA7xS_bB5KTtVi239tRgxwS6lSt6l9GCQDaZjVCwwcqgp06-ufE7E8dY1IAey-5EgcZaXVAFYy6txokBWXX9dV0V8MenOZm2sf0QrW1O2GRs9ZvDfG0h7ZRfQ90d-ShFQ1kj6gCEw7LIFskyLVdtdvgfHabimQIMJKgIN4Z_XxTHQ&sai=AMfl-YTEqlgT-mnN6VpIvZnyd8Bo0k2SWnRas7tzmgm1hBhxuWHhHsrgsRF1v3_VO8DcKBBwyxiug9hVtTUvAnHG-MJIaSnmM98BukLIdfSmHD5SzATbQBMuQkwckof4mukpAJuRXUtOEYFaw5S4SEpmFKIONGDakDduhjdljLER3VNLPLCFdyVCVMkMjDcV3LZG88jvX0NzyZLiy9_o83qObk3w&sig=Cg0ArKJSzKekrCUqAufPEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cstd=0&cisv=r20220420.09044&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Mon, 25 Apr 2022 07:15:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 50DD 41 KB
15 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 15:03:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 403937
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Apr 2023 15:03:03 GMT

GET
H2 200 17872261737888034673
s0.2mdn.net/simgad/ Frame 50DD 90 KB
90 KB 161ms
42ms Image
image/gif 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/17872261737888034673

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29261f665b3d52d8501df978df5de2e5c8a05278f29a636199b822cab76ab92b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 14:19:20 GMT
x-content-type-options: nosniff
age: 406560
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 91974
x-xss-protection: 0
last-modified: Tue, 22 Mar 2022 11:42:57 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 20 Apr 2023 14:19:20 GMT

GET
H/1.1

200
OK

impression_pixel
t.myvisualiq.net/ul_cb/ Frame 50DD
Redirect Chain

https://t.myvisualiq.net/impression_pixel?r=1907923788&et=i&ago=212&ao=795&aca=27459952&si=6033200&ci=168801357&pi=332048446&ad=524088361&advt=4662460&chnl=-7&vndr=115&sz=8913&u=16626492143|2747816...
https://t.myvisualiq.net/ul_cb/impression_pixel?r=1907923788&et=i&ago=212&ao=795&aca=27459952&si=6033200&ci=168801357&pi=332048446&ad=524088361&advt=4662460&chnl=-7&vndr=115&sz=8913&u=16626492143|2...

43 B
573 B

166ms
165ms

Image
image/gif

52.8.151.228
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.myvisualiq.net/ul_cb/impression_pixel?r=1907923788&et=i&ago=212&ao=795&aca=27459952&si=6033200&ci=168801357&pi=332048446&ad=524088361&advt=4662460&chnl=-7&vndr=115&sz=8913&u=16626492143|27478160|ABAjH0ixIp4KCZ7wd4YoxjhdoHiN&pt=i
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1
Protocol: HTTP/1.1
Server: 52.8.151.228 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-8-151-228.us-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

access-control-allow-origin: *
Date: Mon, 25 Apr 2022 07:15:21 GMT
Cache-Control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://t.myvisualiq.net/ul_cb/impression_pixel?r=1907923788&et=i&ago=212&ao=795&aca=27459952&si=6033200&ci=168801357&pi=332048446&ad=524088361&advt=4662460&chnl=-7&vndr=115&sz=8913&u=16626492143|27478160|ABAjH0ixIp4KCZ7wd4YoxjhdoHiN&pt=i
Date: Mon, 25 Apr 2022 07:15:21 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B975 1 KB
749 B 41ms
40ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

age: 4896
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 25 Apr 2022 05:53:44 GMT
etag: 48472445140208031
expires: Tue, 26 Apr 2022 05:53:44 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0BE1 1 KB
749 B 41ms
40ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

age: 4896
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 25 Apr 2022 05:53:44 GMT
etag: 48472445140208031
expires: Tue, 26 Apr 2022 05:53:44 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C3B8 22 KB
8 KB 41ms
40ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 341251
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 21 Apr 2022 08:27:49 GMT
expires: Fri, 21 Apr 2023 08:27:49 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 50DD 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4610b3552560ead6a741b8e441523fe26c9557162fe2f26f9c78ba2ea617a900

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dpixel
cms.quantserve.com/ Frame B975 35 B
464 B 136ms
42ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEF15ubKZUwmkj3Tx4NudrCI&google_cver=1&google_push=AYg5qPIv_fJxMuY79ykT4DwDpOWk8XEd98wlLwCFnUMgirP9hZRHdyY_ELVRgCsaxV127PU_-vMTgB9UayNJES6rd2703gAlrADpqA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:21 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B975
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESECKFdqfi_YWjC1CPHiDY0jg&google_cver=1&google_push=AYg5qPI3-eeWufAq_2XLsERVlmV57QOyFn_TfcJ5yYMqcihYjdSId2ScT8E75rIDiix7ZLSX5Q6JNPIjAs6h1zFvy9rXX8Xq444ypQ
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPI3-eeWufAq_2XLsERVlmV57QOyFn_TfcJ5yYMqcihYjdSId2ScT8E75rIDiix7ZLSX5Q6JNPIjAs6h1zFvy9rXX8Xq444ypQ&google_hm=Q0FFU0VDS0ZkcWZpX1l...

170 B
188 B

51ms
51ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPI3-eeWufAq_2XLsERVlmV57QOyFn_TfcJ5yYMqcihYjdSId2ScT8E75rIDiix7ZLSX5Q6JNPIjAs6h1zFvy9rXX8Xq444ypQ&google_hm=Q0FFU0VDS0ZkcWZpX1lXakMxQ1BIaURZMGpn

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 25 Apr 2022 07:15:20 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPI3-eeWufAq_2XLsERVlmV57QOyFn_TfcJ5yYMqcihYjdSId2ScT8E75rIDiix7ZLSX5Q6JNPIjAs6h1zFvy9rXX8Xq444ypQ&google_hm=Q0FFU0VDS0ZkcWZpX1lXakMxQ1BIaURZMGpn
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B975
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPK927M-mqz41YJDvTWw0mnwSskM7mxGF33Mu_bH5CP14OJNUQ16NWWtkVgLQqC3Mo9K1YDMr4QjII_GgN9pkbSw35V1Q0kNJw&google_gid=CAESEIwasnc9-HH7EAxRvialKCs&g...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCImVmZMGEgUI6AcQAEIASnJnb29nbGVfcHVzaD1BWWc1cVBLOTI3TS1tcXo0MVlKRHZUV3cwbW53U3NrTTdteEdGMzNNdV9iSDVDUDE0T0pOVVExNk5XV3RrVmdMUXFDM01vOUsxWURNcjRRaklJX0dnTj...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwQXU5MlJ5VTFVOVMzamNhSnlwRUhOVUw3aUJKQ2xPVjU5NlAtVUM4NEIxOA==&google_push

170 B
188 B

61ms
61ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwQXU5MlJ5VTFVOVMzamNhSnlwRUhOVUw3aUJKQ2xPVjU5NlAtVUM4NEIxOA==&google_push

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 25 Apr 2022 07:15:21 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwQXU5MlJ5VTFVOVMzamNhSnlwRUhOVUw3aUJKQ2xPVjU5NlAtVUM4NEIxOA==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 dds
rtb.openx.net/sync/ Frame B975 43 B
351 B 115ms
33ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESECRrSxwwlt4tYXYIq-YnBIQ&google_cver=1&google_push=AYg5qPIdGdQCk19-yPSMtDQpHdRN9ko2mD9OUYSgqprr64lh_uasPJ7eVDBjVUoTkb6ZVXtQIo3psZvivkzUh_NwG1yZGQw3NbNFdQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:20 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: tddn8mjmphc6136dhm5rh9ap4jc4qftu

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B975
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=RPb2EI7sTDKzvFbxyfjkqA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

51ms
51ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=RPb2EI7sTDKzvFbxyfjkqA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPISeckRG-mIuz3F0WFNWnY9XdC2PBpYdMQdjBa9QmV1ebAziCUG2f3cco_LC88VBcrOr65ZUj1sdpWBRn_5pYJq3xfDg-bfiA

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=RPb2EI7sTDKzvFbxyfjkqA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPISeckRG-mIuz3F0WFNWnY9XdC2PBpYdMQdjBa9QmV1ebAziCUG2f3cco_LC88VBcrOr65ZUj1sdpWBRn_5pYJq3xfDg-bfiA
date: Mon, 25 Apr 2022 07:15:20 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B975
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEM6otkUSk1B7F9yV6PbmVY4&google_cver=1&google_push=AYg5qPKFWhToWfbh7Xhun2xhAg1IjGcejVg29oeCQQcas5_4-7MCuUfYkfN7nZR9fPZztkYfWpt...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDJFRFg3N0MtMTQtSzRYSQ==&google_push=AYg5qPKFWhToWfbh7Xhun2xhAg1IjGcejVg29oeCQQcas5_4-7MCuUfYkfN7nZR9fPZztkYfWptM8mtq22MIJaHl_HL9sFFQcM6qwg

170 B
188 B

59ms
59ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDJFRFg3N0MtMTQtSzRYSQ==&google_push=AYg5qPKFWhToWfbh7Xhun2xhAg1IjGcejVg29oeCQQcas5_4-7MCuUfYkfN7nZR9fPZztkYfWptM8mtq22MIJaHl_HL9sFFQcM6qwg

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDJFRFg3N0MtMTQtSzRYSQ==&google_push=AYg5qPKFWhToWfbh7Xhun2xhAg1IjGcejVg29oeCQQcas5_4-7MCuUfYkfN7nZR9fPZztkYfWptM8mtq22MIJaHl_HL9sFFQcM6qwg
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 78e3bdce5107450057bade54d54a0a7e
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame B975
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlN...

0
0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame B975 0
59 B 49ms
48ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K35vYVOA-qoXj_HNLhDpZmrO7Tgs2YWyEaDW1pIXvkCgQFqmyeZuGe282UtGcMZ4i7lZ_2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:20 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 d_XgMe7_8DX3JscHlpumBxzOcHqlAtWKp75Cu0r3_I4.js Show response
pagead2.googlesyndication.com/bg/ Frame F133 35 KB
13 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/d_XgMe7_8DX3JscHlpumBxzOcHqlAtWKp75Cu0r3_I4.js

Requested by

Host: legas.com.ua
URL: https://legas.com.ua/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77f5e031eefff035f726c707969ba6071cce707aa502d58aa7be42bb4af7fc8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 00:30:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24278
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13694
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Apr 2023 00:30:42 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 0BE1 35 B
465 B 102ms
41ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEF15ubKZUwmkj3Tx4NudrCI&google_cver=1&google_push=AYg5qPLMGMzKNmfuobO8A3kU1OSeWO7b6YyudYg6qHTiSm79HH2bq9jW-VjLNmI4eGbAZS2nQhI_ixuQ2D3KTfKAWEB3HQmvuyn8

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:21 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0BE1
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPIDlHil6Lxhg8HioUVwR19qxIuEqTLd2P54HQa...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WW1aS2lRQUFBWFdLQFhyMQ&google_push=AYg5qPIDlHil6Lxhg8HioUVwR19qxIuEqTLd2P54HQazm0UQJmz4czaHWVe_oeKJpAjcX2MKIJI-pzRA5jM6DnfCMarAuEPIIGWP

170 B
188 B

51ms
51ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WW1aS2lRQUFBWFdLQFhyMQ&google_push=AYg5qPIDlHil6Lxhg8HioUVwR19qxIuEqTLd2P54HQazm0UQJmz4czaHWVe_oeKJpAjcX2MKIJI-pzRA5jM6DnfCMarAuEPIIGWP

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WW1aS2lRQUFBWFdLQFhyMQ&google_push=AYg5qPIDlHil6Lxhg8HioUVwR19qxIuEqTLd2P54HQazm0UQJmz4czaHWVe_oeKJpAjcX2MKIJI-pzRA5jM6DnfCMarAuEPIIGWP
Date: Mon, 25 Apr 2022 07:15:21 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 dds
rtb.openx.net/sync/ Frame 0BE1 43 B
135 B 83ms
34ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESECRrSxwwlt4tYXYIq-YnBIQ&google_cver=1&google_push=AYg5qPKYaVLJuhUZxeZoP7KchxLfbmh7XSklQCzIrm0JJJFzwNQO2kmiS-cZFjAgF07tNVgCI881B6cahMqkjn_AOQM2PbUaZRUL
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:20 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 29j852764mkd3ir5ni9nknqc2rfh9vha

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0BE1
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=3k57nZ8PRpWl9hJ8TWAW7A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

52ms
52ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=3k57nZ8PRpWl9hJ8TWAW7A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLS8GXqnOwaYvwYLeDmPO4WdK3eIU9LoSv65X9VU3T7bWoQ9cOoJXe9oEu2KlY2Z-ezPs4TQnrKpJIwGI1wuozOH5Q9ljg

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=3k57nZ8PRpWl9hJ8TWAW7A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLS8GXqnOwaYvwYLeDmPO4WdK3eIU9LoSv65X9VU3T7bWoQ9cOoJXe9oEu2KlY2Z-ezPs4TQnrKpJIwGI1wuozOH5Q9ljg
date: Mon, 25 Apr 2022 07:15:21 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0BE1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEM6otkUSk1B7F9yV6PbmVY4&google_cver=1&google_push=AYg5qPLRZZknmlvpcB1lQzZ_qH8T_iCvlsjsOGQ9V1gGy4FfO_jgvtiE-BbkSrh_2XP_iMtMj0i...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDJFRFg3N0QtMVEtM05NUw==&google_push=AYg5qPLRZZknmlvpcB1lQzZ_qH8T_iCvlsjsOGQ9V1gGy4FfO_jgvtiE-BbkSrh_2XP_iMtMj0ic3CemipGIEXozsYuGqqoLH82v

170 B
188 B

58ms
58ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDJFRFg3N0QtMVEtM05NUw==&google_push=AYg5qPLRZZknmlvpcB1lQzZ_qH8T_iCvlsjsOGQ9V1gGy4FfO_jgvtiE-BbkSrh_2XP_iMtMj0ic3CemipGIEXozsYuGqqoLH82v

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:21 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDJFRFg3N0QtMVEtM05NUw==&google_push=AYg5qPLRZZknmlvpcB1lQzZ_qH8T_iCvlsjsOGQ9V1gGy4FfO_jgvtiE-BbkSrh_2XP_iMtMj0ic3CemipGIEXozsYuGqqoLH82v
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 78e3bdce5107450057bade54d54a0a7e
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 0BE1
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuD...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 0BE1 43 B
297 B 247ms
37ms Image
image/gif 2a05:d01c:1d8:8100:fcf5:ef31:f27f:f1a6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEIjaWpye_TFHJXcg7s4z-zc&google_cver=1&google_push=AYg5qPLQutMmv73acIkk62YjbYMXgN3jZ4H-k5UPldnNJQF-jDfPQUp1K8Q-DyCBDHtKBeyMBQroDccYis-qMOBe8K7X04ia45p9
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8100:fcf5:ef31:f27f:f1a6 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:21 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 0BE1 0
40 B 50ms
49ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LABXqxVVyUWtHZwiA09xiNnxvmNcaXEAPPVGSL94nszjXZcZQeBHCj__Vdt36XWsZN-Ug0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 07:15:21 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 d_XgMe7_8DX3JscHlpumBxzOcHqlAtWKp75Cu0r3_I4.js Show response
pagead2.googlesyndication.com/bg/ Frame C3B8 35 KB
13 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/d_XgMe7_8DX3JscHlpumBxzOcHqlAtWKp75Cu0r3_I4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77f5e031eefff035f726c707969ba6071cce707aa502d58aa7be42bb4af7fc8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 00:30:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24279
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13694
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Apr 2023 00:30:42 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 50DD 0
26 B 167ms
83ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 25 Apr 2022 07:15:21 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C3B8 0
20 B 76ms
76ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BF6hMiEpmYvOlMMaQ3gPo6aegCQAAAAA4AeAEAg&bg=!v7ylvPjNAAYXWUUuN1k7ACkAdvg8WkpAUzIFqgMMzMTMTAOcpGLRqH6wZCWysAlZbU_KCFRqMxwyvQIAAABTUgAAAAloAQeZAs9K3ToRRqlLMxG8315sL_oO_lO-HGmLzfq2KfwaKVpMTCH7bC1Euf9iodI9Dpldx4SIE73TN9vpEgTqYlYDHg7x1oTr27W-j4Sg3qQcNV8urGF3B5UlwyR1MYIjMgjAFZ7ocJTMhjLUqYluVAmOrdHpAjauy82auqM6MLbSXkYhT0Kf2B43_iY5kvCoOYBts0l4BwIK0cbGzpznwyRlLaWxz9V-2zodhYDXzip1p_AzA78UIr6jzOSh4d-2fibwi0tEbUq_mcxk2W8dB9-BXjQtYdONwR0tBCTe36L82j24mKJDhof5972mR6GxqOKB6uToUMdg2I9ORFoOZF1hD8FRlu3cbYgSabq4TBWF-FIGJs5koTzCRpe_bETqP_n4bDNEw8TXf2XMobTAxNvETyt-pmHpo19_p1UKSOya3B0klO_KosqbvyEHLMaA8yBlqJ07PAyXqnsLs27iw7GhHJEpGTJ80IPwMaay9UjXeuSif-t2fARUCpL9r3wQQldTzMjWxQEuhaKoojik1Zm2y6GunyBgyzA5b2d9gyDNwyZHdFOLrqHBLdndPS7afb8-hibHSuyfV6K30KEFhamsLRJVhiFLX8wmdCRukAV5p-6bD6FryIAjxG8NPkcwiDV7criMNn7mPjtVRFhHBXL0PAa0_uO2DI8SyBzVx0kOIfw0rQnmOsFWSsNcheamZauzxzPq-qQreu7zKbUYvPQ98Lq-ULW3S-hdvZ2GMIKfy3_UEaSsHeyXfKGBb01vPIWhNQK3WRWqiREWkpDsSGWUrqQ8gGxVfI8qMdVk99ggykf5hk5XCw8oKX_W4qc4CBDwhh_G_vDUngt2-OWxISMLOBn-QVMRVhVrlM2wzcV-zjIA_FnfjfiHvBIsf-CLmyRjprb8KZUrrYTwE1_f4OaXIS5jth8jWlntF36BIzjXjBN2r2CPNvfeVl75h8d3ruv0Sw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220420/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 50DD 42 B
64 B 81ms
81ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssptWJXPr3KmWbz9jWHWezW9oR4b8fVnZqF5CjNkJpJn4f0CFAp30as99hckKx9uZtpVX4Muc3_N6n8oMZfi8ragC6qJNePWuZlZn6BDaw419ik0V_KGQ&sai=AMfl-YRK8J4KT_FOdjStShBhiZlUqCxCg8ZDfgscFMiMEUGXYUnOKFuenpKhh9AIXltCdydZD3_mxnZdXJzwrvgMQbwYxDTkqBQHdDPxizWA1OawW1_ZROKfrISRlwUX&sig=Cg0ArKJSzIibZOwvCOhLEAE&cid=CAASJeRoD_SY1Oudaea2F9qa0_p40_n5SVlR3g6Qo78PtzYoYWaOeTI&id=lidar2&mcvt=1001&p=0,0,90,728&mtos=584,1001,1001,1001,1001&tos=584,417,0,0,0&v=20220420&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1650870920692&rpt=600&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 07:15:22 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: a1.admaster.net
URL: http://a1.admaster.net/a/10507/155?pos=0.09661571235738942

Domain: c.bigmir.net
URL: http://c.bigmir.net/?o1&v16854857&s16853252&t0&c1&n25395&w0&y0&d24&r1600

Domain: g.novostimira.biz
URL: http://g.novostimira.biz/l/1322?v=2751451

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL

Verdicts & Comments Add Verdict or Comment

223 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

33 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
legas.com.ua/	1969-12-31 23:59:59	Name: b Value: b
legas.com.ua/	1969-12-31 23:59:59	Name: iua Value: 1
.legas.com.ua/	1970-01-20 20:05:42	Name: _ga Value: GA1.3.260435591.1650870919
.legas.com.ua/	1970-01-20 02:35:57	Name: _gid Value: GA1.3.958662493.1650870919
.legas.com.ua/	1970-01-20 02:34:30	Name: _gat Value: 1
.yandex.ru/	1970-01-20 20:05:42	Name: i Value: 4Wu3+4a9X7yDLSlBgAbnhtsInuj/bI9QWLF7S10gDF3kIdw1EkOsdBk7CrAqlvQ4b0dtAvr4nVhdQCZlq5a6SPd6J2c=
.i.ua/	1970-01-20 02:34:32	Name: __cf_bm Value: 6jcsXrec4O6i7i3BCZxmrMXfZNMjcc7qvYdaTO5by.s-1650870918-0-AaZayux0c+scvh5dL/tyQ21pbQCao151GA6EIW0gsD/u4JiqgOUy/dVkdAfHdBNjiuVjSTplvtEzC89ehN3iM/Q=
.legas.com.ua/	1970-01-20 11:56:06	Name: __gads Value: ID=d4e11a67766aa393-223e6c6d81cd00c5:T=1650870918:RT=1650870918:S=ALNI_Mbw0eghOq8-rEKfSYmM-KKFwubGCQ
.doubleclick.net/	1970-01-20 11:56:06	Name: IDE Value: AHWqTUm5zikyC5P8RqDTd-5Q4v0Pk63oocmEl1WwbZMnTh7F_e6FTO-ygcIf9bfX8lg
.zenaps.com/	1970-01-20 03:17:41	Name: aw2174 Value: 632098\|0\|0\|1650869169\|b46e5352388cdef8e93920864ad277e0\|aw\|0
.zenaps.com/	1970-01-20 11:20:06	Name: bId Value: HLEX_626643b121b760.37725545
.doubleclick.net/	1970-01-20 02:34:34	Name: DSID Value: NO_DATA
.legas.com.ua/	1970-01-20 02:34:30	Name: _dc_gtm_UA-9703351-1 Value: 1
.legas.com.ua/	1970-01-20 02:34:30	Name: _gat_UA-9703351-1 Value: 1
.adnxs.com/	1970-01-20 04:44:06	Name: uuid2 Value: 4031331505448533864
.casalemedia.com/	1970-01-20 04:44:06	Name: CMPS Value: 708
.rlcdn.com/	1970-01-20 11:20:06	Name: rlas3 Value: tf54EobMfwjHPUmDcqDJ1cOUJNFWuWO1SKqLfiEluVc=
.quantserve.com/	1970-01-20 04:44:06	Name: d Value: EEMBCQH-JYEA
.quantserve.com/	1970-01-20 12:04:45	Name: mc Value: 62664a89-103be-35558-e67fc
.adnxs.com/	1970-01-20 04:44:06	Name: anj Value: dTM7k!M41.D>6NRF']wIg2C$Oj^_sC!]tbPl1M>e)ZlrFUfJ+tGXxoH@jf/[aUeezQ::EwF5^`HQ0o+o^@d>$VCU?PbpRzqF1`*b]e+)^ABJ
.agkn.com/	1970-01-20 11:20:06	Name: ab Value: 0001%3A5KLJM8eQO2AXnl24V0gdWJFjtbBGdCK7
.agkn.com/	1970-01-20 11:20:06	Name: u Value: C\|0CEAp-QcJKfkHCQAAAAAAAQ13AQCAAQpAAAAAAA
.casalemedia.com/	1970-01-20 02:35:57	Name: CMST Value: YmZKiWJmSokA
.casalemedia.com/	1970-01-20 11:20:06	Name: CMRUM3 Value: 2d62664a892760CAESEM2EbsE9eQJMYgp49LUW0Cg
.rlcdn.com/	1970-01-20 04:00:54	Name: pxrc Value: CImVmZMGEgUI6AcQABIGCOndKhAA
.innovid.com/	1970-01-20 04:44:06	Name: uuid Value: 424280f5-7906-4652-af25-fdbe314f9859-20220425 03:15:21
.casalemedia.com/	1970-01-20 11:20:06	Name: CMID Value: YmZKicMcIWZrfbq2Q8KO9AAA
.casalemedia.com/	1970-01-20 04:44:06	Name: CMPRO Value: 285
.myvisualiq.net/	1970-01-20 20:05:42	Name: tuuid Value: e53d98da-e375-440d-9b40-d8f7dd882086
.myvisualiq.net/	1970-01-20 20:05:42	Name: c Value: 1650870921
.myvisualiq.net/	1970-01-20 20:05:42	Name: tuuid_lu Value: 1650870921
.pubmatic.com/	1970-01-20 02:35:57	Name: KTPCACOOKIE Value: YES
.pubmatic.com/	1970-01-20 04:44:06	Name: KADUSERCOOKIE Value: DE4E7B9D-9F0F-4695-A5F6-127C4D6016EC

21 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://legas.com.ua/ Message: Mixed Content: The page at 'https://legas.com.ua/' was loaded over HTTPS, but requested an insecure element 'http://caddy.com.ua/components/com_jshopping/files/img_products/TCEL-1.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://legas.com.ua/ Message: Mixed Content: The page at 'https://legas.com.ua/' was loaded over HTTPS, but requested an insecure element 'http://www.meteoprog.ua/ua/informerget/?type=4&city[]=Kyiv&color=13659f&txtcolor=FFFF00'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	URL: https://legas.com.ua/(Line 52) Message: Mixed Content: The page at 'https://legas.com.ua/' was loaded over HTTPS, but requested an insecure script 'http://a1.admaster.net/a/10507/155?pos=0.09661571235738942'. This request has been blocked; the content must be served over HTTPS.
security	warning	URL: https://legas.com.ua/(Line 212) Message: Mixed Content: The page at 'https://legas.com.ua/' was loaded over HTTPS, but requested an insecure element 'http://caddy.com.ua/components/com_jshopping/files/img_products/TCEL-1.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://legas.com.ua/(Line 283) Message: Mixed Content: The page at 'https://legas.com.ua/' was loaded over HTTPS, but requested an insecure element 'http://www.meteoprog.ua/ua/informerget/?type=4&city[]=Kyiv&color=13659f&txtcolor=FFFF00'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://legas.com.ua/ Message: Mixed Content: The page at 'https://legas.com.ua/' was loaded over HTTPS, but requested an insecure element 'http://040510111616.c.mystat-in.net/?i040510111616&t4&g27&w1600&c24&r&v3&j0'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
javascript	warning	URL: https://legas.com.ua/(Line 382) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, http://c.bigmir.net/?o1&v16854857&s16853252&t0&c1&n25395&w0&y0&d24&r1600, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security	error	URL: https://legas.com.ua/(Line 382) Message: Mixed Content: The page at 'https://legas.com.ua/' was loaded over HTTPS, but requested an insecure script 'http://c.bigmir.net/?o1&v16854857&s16853252&t0&c1&n25395&w0&y0&d24&r1600'. This request has been blocked; the content must be served over HTTPS.
javascript	warning	URL: https://legas.com.ua/(Line 382) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, http://c.bigmir.net/?o1&v16854857&s16853252&t0&c1&n25395&w0&y0&d24&r1600, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security	warning	URL: https://legas.com.ua/ Message: Mixed Content: The page at 'https://legas.com.ua/' was loaded over HTTPS, but requested an insecure element 'http://r.i.ua/s?u66180&p62&n0.218353410188747&c1&d24&w1600&h1200&r/legas.com.ua/'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	URL: https://legas.com.ua/(Line 1181) Message: Mixed Content: The page at 'https://legas.com.ua/' was loaded over HTTPS, but requested an insecure frame 'http://banner.kiev.ua/cgi-bin/bi.cgi?h84092&6135204&1'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://legas.com.ua/(Line 1371) Message: Mixed Content: The page at 'https://legas.com.ua/' was loaded over HTTPS, but requested an insecure script 'http://g.novostimira.biz/l/1322?v=2751451'. This request has been blocked; the content must be served over HTTPS.
security	warning	URL: https://pagead2.googlesyndication.com/pagead/show_ads.js(Line 95) Message: Mixed Content: The page at 'https://legas.com.ua/' was loaded over HTTPS, but requested an insecure element 'http://clck.yandex.ru/click/dtype=stred/pid=30/cid=1529/*http://ya.ru'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	URL: https://legas.com.ua/(Line 1403) Message: Mixed Content: The page at 'https://legas.com.ua/' was loaded over HTTPS, but requested an insecure frame 'http://kurs.com.ua/informer/inf2?color=blue&rnd=1650870918368'. This request has been blocked; the content must be served over HTTPS.
network	error	URL: https://www.meteoprog.ua/ua/informerget/?type=4&city[]=Kyiv&color=13659f&txtcolor=FFFF00 Message: Failed to load resource: the server responded with a status of 500 ()
network	error	URL: https://caddy.com.ua/components/com_jshopping/files/img_products/TCEL-1.gif Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://info.maps.yandex.net/traffic/kiev/current_traffic_150.gif Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://cpa.com.ua/get_js/script.js?aid=90 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.admitad.com/en/&awc=2174_1650869169_ccd3c17e79678ec69f00454158c9a034 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKicMcIWZrfbq2Q8KO9AAAAR0AAAAB&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_cver=1&google_push=AYg5qPIqYpT0hitTYil3t7giewBq-VdgxzpuDGsh1DIn2T2C5Z_onUoTOml8Mg3GXzY1jsvPGSgXuBU8SHef8NKmkRkItbBG8CbL Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmZKifNEVY_TN1OdlQIz-wAAByEAAAIB&google_cver=1&google_gid=CAESEAkSsXMIHWEXhzBvtuTL8ho&google_push=AYg5qPIvYLJaqhF52b6TrRXSG7KljGdXTymlNpyLaxHXnLwLHB4rBh-QxXUR6l6K-EI8z0_h4SnsnY0Z93d-BWGe55qEOyBzIU-sig Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

040510111616.c.mystat-in.net
a1.admaster.net
adservice.google.co.uk
adservice.google.com
ag.innovid.com
c.bigmir.net
caddy.com.ua
clck.yandex.ru
cm.g.doubleclick.net
cms.quantserve.com
connect.facebook.net
cpa.com.ua
d.agkn.com
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
g.novostimira.biz
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
id.rlcdn.com
image6.pubmatic.com
info.maps.yandex.net
legas.com.ua
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.everesttech.net
pixel.rubiconproject.com
pubmedya.net
r.i.ua
rtb.openx.net
s0.2mdn.net
static.doubleclick.net
stats.g.doubleclick.net
t.myvisualiq.net
tpc.googlesyndication.com
webcache.pp.ua
www.admitad.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.meteoprog.ua
www.zenaps.com
a1.admaster.net
c.bigmir.net
cm.g.doubleclick.net
g.novostimira.biz
104.18.2.81
104.92.94.3
108.128.215.255
142.132.202.70
142.250.181.226
142.250.184.194
142.250.186.98
176.9.60.211
192.102.6.73
192.82.242.209
23.35.236.247
2606:4700:3033::6815:2c6c
2620:116:800d:21:8c6e:cf2c:8d6:9fb5
2a00:1450:4001:803::2006
2a00:1450:4001:80e::2002
2a00:1450:4001:80e::2006
2a00:1450:4001:810::2002
2a00:1450:4001:811::2002
2a00:1450:4001:812::2002
2a00:1450:4001:812::2003
2a00:1450:4001:812::200a
2a00:1450:4001:829::2008
2a00:1450:4001:82a::2004
2a00:1450:4001:82a::200e
2a00:1450:4001:82b::2003
2a00:1450:4001:82f::2001
2a00:1450:400c:c06::9a
2a02:6b8::130
2a02:6b8::14
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f12d:181:face:b00c:0:25de
2a05:d01c:1d8:8100:fcf5:ef31:f27f:f1a6
2a06:98c1:3120::7
3.120.51.47
31.131.16.29
35.227.252.103
35.244.174.68
37.252.172.249
49.12.116.255
5.187.1.114
52.8.151.228
69.173.144.165
0679a65b48c25854894908d30cc2d15693ed3229e47a3e01bc83bfda7e963704
08b51da2de11725222e8d34877e20b287ea792c1309432675caa5a6cc8d86445
08f599f1961f5059cac95e9002f85d899b105bf4a99ed2efd707c2809866540e
0afa9b03f71bdee3755e69500e56d6eae3120719aa52a89d76d35e23389b2485
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
11b42e57527a15ef294417ce5e95fd812f284ffd07e44718ab6dca447aefe4c7
1240106b570dda5fdb8cf5e703d20b1068194eb2f18795e20fa85fcb96108fdb
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1e893ce4c04b3015064e72f36693d58780537025b9053a19214d82be399286ee
21583f7002df3434278d0ac87cde6b062999b39689e75945e152f8a5e75ef7fe
28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9
29261f665b3d52d8501df978df5de2e5c8a05278f29a636199b822cab76ab92b
2cef3a9d0606aecfe2476867e61f76535b9bb5b8e9d31957cc9504cdd1e69396
32a01afd3004b97009a9232a6f467afbe4a73483827be9438c959d1d5884daf4
340b20f9ff6d073c2fea911631d8a6e13af185d983cbe842ddca27df91d0f295
38b73be4412a92beaa005fbb5ea48d1facc4a18f523ae9e1af623673c415fa45
42859c5159f3f083541084eb8e578a04a68e805e012a916a045fa49ed9c4f4e4
4494f7d040539a2d1be37f3c0959c7a145df4decd20a6d5ed860582b20f115fe
4610b3552560ead6a741b8e441523fe26c9557162fe2f26f9c78ba2ea617a900
4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f85988a9efdb2a68411b6af7c91711acacbc4eeba06507db7d8dd879cea49a5
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
5481a6df70d9dbaf53b9b031ca30febb0ad0e1526a44b9b838ff9ebbf3352fd8
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5704164952bd3399f7cad16dade361d000cfa6eddfad64f3eafe7d196f8e310c
576567be309b25668eac042efdc762e3cbc09e884a788855e3392b28ba761d80
591b656ce300ae27d8d9d13f43809c20da95c17a4827dce4f482c25eddb3c54b
59729251e018160eeed443c848fa5fd802b40e984b5afe60560c3cbe9d7b4612
59a221c1514847acb74d0f88ef593de49b96081bfa21891ffab3ebd407e03327
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5dadbbe5fefb44e2e7364431acb8f7f4bf3bc65e5ee6a46ce457a1ad81a0f9cb
5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f
5f3f03c5c1e5875c85a13e1bfae970de8ae3f773ed88856023f2f45ceed7611e
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
64f4ced5d55df1d2b68756fbeffafd50b5d09c3ad7703f89a0660269a4ea3a54
6808c7f1192e091f9e9b4e15e28fa2a8904117ba54c11e51fc8eb9d179733e1c
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6edbf13af2f07f3ff6cf1b7ab649b8c6c28d247f2d7750a8593bd534de07d744
720b21233cc3f5ac1443ecb48e8807913f0927ee4ffd04d805b76aa2b93bed2b
73acf5938f57c9104a7410a78d9e0e66bdb2ea6e4f64da20f3b6b15aef18fa4c
77f33b3638635f2ed92baa1b16db8654f69e6b39c0ec9d7e0c9ebb6a87cd5dbd
77f5e031eefff035f726c707969ba6071cce707aa502d58aa7be42bb4af7fc8e
79d43d860bcaf8b62c343669b1c7c7acf20a83d0a35ade74f875c8157e71bbd4
7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb
7d210f7d18b1a67c12052541793c3fc63a9175ec1809b7988b9b9a13a4b50e16
7e928161cd626935d39ff08188caa3f3a918811ca87194082dedf28b697ce6fd
7f651dc4c9e9cc057e1a6d312bdfbf399f20529534f9a5423cd6547521a71344
7f96033a70aff3d3e2d1520b6c678141eb5b6189dfb95adbb8fe13b7006b2767
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8393b0f49cbaac879bc0a89a8d6fc918081a21fd4b13e5ae4416d2c1afbcca92
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8d61bc67c5b06bbd0e0787fc1e661c2fb58ba72c46b7b05ca3ee94c20e599130
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b5312cb2f154f2bd64ee8746195a63df254d10bfd107a61eec3d5d38dd48bff
9bf900225d59f39bf45ffe4405e7882ec9bd819c4e8d803d5754119491171f28
9e34975a0a58f4262f18fc35a4a9efb9f9b3962b87772f8fa5c006d5b7bc3f57
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5585f5ae657fe411f3641a6b934cb2858e218fc1bc84dda9bfc4185e3a93aff
a6e648923be27227370e476a3fe1b29b7d43f486b80ffb409a04d7b6ef3909ca
a7d5c1bfe43c8beefab2fa059f4fcaa029fcbbace9a672aae1dfe1ffb7d6976c
a8260e7ca21dcd8e2bd1d22ed5c43f3852ab635a30784a6cef09fceb9b45b354
a86b3a844dad8b4c5673af644a74b9046f920772bfc75d0f5fa0704d19510d2e
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b322d8ff5dc049967c30bcfbadb63588c92dd485bd13c17a66339128fd8c693d
bb0bb9342c84d0c74a20e1e2689255b64a9904b02425a074ca6626fea40f2d1b
be3b15b1e68cf3e9278293d3b50491fe16c985e0ee5968852cac4fc062a7134e
be55470841d86fe004d59d3a2b256d493e5bf403b7ddd091603025224682831d
be6c378422c57cf30aadfdc68684e6a62f0b02090be4ac29d6aa142eae71945a
c2eda2ba9987342dac2033a48dc3c5bb1d52b9b22f94e2a988c86c10c8fffa62
c940e9e76f670f7ae6c5bae0af682586b3b177de87016e8047915b4ea933d398
d85e0b83efe834b6f45c0769e11e91d95a388136ad405d8aee07197e6ff7a820
da0f9bc45d484ad3199c9ea9e540ba186eb62fc67a59572ee6db9edc0cf003f6
dc3f2293f6503ff6ee63c2a69421d235a0f7881a80d89dd407ec2f15eda63fdd
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de75f74c16ee260673a91f8253b007a4d454690220b5ed46379dd071518ea753
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3ce0d81da35d3928e41e55a88c63e4058a68bf8cc7417fd3413a7a7b9bccba7
e66bfceb15a6ee125dff79826be02a07b766843e6c660edf55ec0c22d1a407c1
e8230ca5800520e093fdc5b864778f07f2e13704dad07ce0d49a41d903cd67dd
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce
f041b1e9de05df07f22b0701ea193fd0c160462a5666cb05874c11ac5b5dabf4
f748110cf8280254c6705d7cf18de8b04369c521d9db43e63897e531c283578d
fb59dd732394f75e7af809d49406b1190e5b691b93829d57084f819fd2745d90
fd5dc39e7e8c3e52dd51f848aa140401de17ec1f545e4595b03923b1f836021a

legas.com.ua Open in urlscan Pro 2a06:98c1:3120::7 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

179 Requests

84 %HTTPS

52 %IPv6

39 Domains

46 Subdomains

34 IPs

8 Countries

2433 kBTransfer

5101 kBSize

33 Cookies

12 Outgoing links

Page URL History

Redirected requests

179 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

legas.com.ua Open in urlscan Pro
2a06:98c1:3120::7 Public Scan

Screenshot
Live screenshot

Full Image

179
Requests

84 %
HTTPS

52 %
IPv6

39
Domains

46
Subdomains

34
IPs

8
Countries

2433 kB
Transfer

5101 kB
Size

33
Cookies

179 HTTP transactions
7 data transactions