mafiacorruption.give5.pl Open in urlscan Pro
213.189.52.246 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://capitalone.global/
Effective URL:
https://mafiacorruption.give5.pl/buzz.html?qid=ali
Submission: On August 26 via api (August 26th 2021, 7:05:48 am UTC) from US

Summary HTTP 128 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 32 IPs in 6 countries across 30 domains to perform 128 HTTP transactions. The main IP is 213.189.52.246, located in Poland and belongs to ECO-ATMAN-PL ECO-ATMAN-, PL. The main domain is mafiacorruption.give5.pl.
TLS certificate: Issued by R3 on August 11th 2021. Valid for: 3 months.

This is the only time mafiacorruption.give5.pl was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	72.52.178.23 72.52.178.23	32244 (LIQUIDWEB) (LIQUIDWEB)
2 2	173.192.101.24 173.192.101.24	36351 (SOFTLAYER) (SOFTLAYER)
1	2606:4700:303... 2606:4700:3036::ac43:9acc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:303... 2606:4700:3035::6815:625	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	213.189.52.246 213.189.52.246	57367 (ECO-ATMAN...) (ECO-ATMAN-PL ECO-ATMAN-)
2	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2606:4700:303... 2606:4700:3031::ac43:81ea	13335 (CLOUDFLAR...) (CLOUDFLARENET)
18	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a04:4e42:3::485 2a04:4e42:3::485	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:810::2008	15169 (GOOGLE) (GOOGLE)
15	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
21	104.19.135.78 104.19.135.78	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80e::200e	15169 (GOOGLE) (GOOGLE)
1	142.250.185.226 142.250.185.226	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::200a	15169 (GOOGLE) (GOOGLE)
21	2a00:1450:400... 2a00:1450:4001:829::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
2 3	2a00:1450:400... 2a00:1450:4001:82b::2004	15169 (GOOGLE) (GOOGLE)
1 3	13.224.96.37 13.224.96.37	16509 (AMAZON-02) (AMAZON-02)
1	2a0c:5c81:513... 2a0c:5c81:5139::2	55081 (24SHELLS) (24SHELLS)
1 1	2.19.35.65 2.19.35.65	16625 (AKAMAI-AS) (AKAMAI-AS)
2	104.109.78.125 104.109.78.125	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.16.199.73 104.16.199.73	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	109.206.188.82 109.206.188.82	50245 (SERVEREL-AS) (SERVEREL-AS)
1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
5 5	18.184.223.197 18.184.223.197	16509 (AMAZON-02) (AMAZON-02)
2 3	213.19.147.45 213.19.147.45	3356 (LEVEL3) (LEVEL3)
2 2	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
1	104.19.217.61 104.19.217.61	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	185.184.8.65 185.184.8.65	204995 (RTB-HOUSE...) (RTB-HOUSE-AMS)
1 1	35.156.165.31 35.156.165.31	16509 (AMAZON-02) (AMAZON-02)
2 2	76.223.111.131 76.223.111.131	16509 (AMAZON-02) (AMAZON-02)
1	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
1 1	62.149.0.72 62.149.0.72	15497 (COLOCALL ...) (COLOCALL Internet Data Center ColoCALL)
128	32

2 72.52.178.23 (United States)

ASN32244 (LIQUIDWEB, US)
PTR: lb01.parklogic.com

capitalone.global	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 173.192.101.24 (Dallas, United States) 2 redirects

ASN36351 (SOFTLAYER, US)
PTR: 18.65.c0ad.ip4.static.sl-reverse.com

mybetterdl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p237996.mybetterdl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3036::ac43:9acc (United States)

ASN13335 (CLOUDFLARENET, US)

654.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::6815:625 (United States)

ASN13335 (CLOUDFLARENET, US)

654.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.189.52.246 (Poland)

ASN57367 (ECO-ATMAN-PL ECO-ATMAN-, PL)
PTR: web37.mydevil.net

mafiacorruption.give5.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700:3031::ac43:81ea (United States)

ASN13335 (CLOUDFLARENET, US)

buzz.give5.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:3::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 104.19.135.78 (United States)

ASN13335 (CLOUDFLARENET, US)

jsc.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
servicer.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s-img.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2a00:1450:4001:829::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.224.96.37 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-224-96-37.zrh50.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a0c:5c81:5139::2 (London, United Kingdom)

ASN55081 (24SHELLS, US)

s.adtelligent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.19.35.65 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-19-35-65.deploy.static.akamaitechnologies.com

secure-assets.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.109.78.125 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-109-78-125.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.199.73 (United States)

ASN13335 (CLOUDFLARENET, US)

cm.idealmedia.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 109.206.188.82 (Netherlands) 1 redirects

ASN50245 (SERVEREL-AS, NL)
PTR: 109.206.188.82.serverel.net

sync.e-volution.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 18.184.223.197 (Frankfurt am Main, Germany) 5 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-184-223-197.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 213.19.147.45 (United Kingdom) 2 redirects

ASN3356 (LEVEL3, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.226 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.217.61 (United States)

ASN13335 (CLOUDFLARENET, US)

cm.lentainform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.184.8.65 (Amsterdam, Netherlands) 2 redirects

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-65.rtbhouse.net

creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.156.165.31 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-165-31.eu-central-1.compute.amazonaws.com

sonata-notifications.taptapnetworks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 76.223.111.131 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a97adde81b00f2ca4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 62.149.0.72 (Ukraine) 1 redirects

ASN15497 (COLOCALL Internet Data Center ColoCALL, UA)
PTR: 0-72.cc86365-03-tmp.cc.colocall.com

sync.adtelligent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
36	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	437 KB
21	mgid.com jsc.mgid.com c.mgid.com cdn.mgid.com servicer.mgid.com s-img.mgid.com cm.mgid.com	196 KB
16	doubleclick.net 2 redirects googleads.g.doubleclick.net cm.g.doubleclick.net	119 KB
13	give5.pl mafiacorruption.give5.pl buzz.give5.pl	220 KB
9	gstatic.com www.gstatic.com fonts.gstatic.com	137 KB
5	bidswitch.net 5 redirects x.bidswitch.net	2 KB
5	rubiconproject.com 1 redirects secure-assets.rubiconproject.com eus.rubiconproject.com pixel.rubiconproject.com token.rubiconproject.com	11 KB
5	googletagservices.com www.googletagservices.com	177 KB
5	google.com 2 redirects adservice.google.com www.google.com	2 KB
3	scorecardresearch.com 1 redirects sb.scorecardresearch.com	2 KB
3	googleapis.com fonts.googleapis.com	2 KB
2	adsrvr.org 2 redirects match.adsrvr.org	904 B
2	creativecdn.com 2 redirects creativecdn.com	687 B
2	1rx.io 2 redirects sync.1rx.io	743 B
2	adtelligent.com 1 redirects s.adtelligent.com sync.adtelligent.com	1 KB
2	google.de adservice.google.de	975 B
2	google-analytics.com www.google-analytics.com	20 KB
2	bootstrapcdn.com stackpath.bootstrapcdn.com	41 KB
2	654.pl 654.pl	2 KB
2	mybetterdl.com 2 redirects mybetterdl.com p237996.mybetterdl.com	1 KB
2	capitalone.global capitalone.global	13 KB
1	taptapnetworks.com 1 redirects sonata-notifications.taptapnetworks.com	311 B
1	lentainform.com cm.lentainform.com	496 B
1	unrulymedia.com sync.targeting.unrulymedia.com	395 B
1	e-volution.ai 1 redirects sync.e-volution.ai	463 B
1	idealmedia.io cm.idealmedia.io	413 B
1	googleadservices.com partner.googleadservices.com	655 B
1	googletagmanager.com www.googletagmanager.com	41 KB
1	jsdelivr.net cdn.jsdelivr.net	8 KB
1	jquery.com code.jquery.com	30 KB
128	30

	Domain	Requested by
21	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
15	pagead2.googlesyndication.com	mafiacorruption.give5.pl pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
14	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net capitalone.global
12	buzz.give5.pl	mafiacorruption.give5.pl code.jquery.com buzz.give5.pl
7	cm.mgid.com	jsc.mgid.com s.adtelligent.com
6	s-img.mgid.com
6	fonts.gstatic.com	fonts.googleapis.com
5	x.bidswitch.net	5 redirects
5	www.googletagservices.com	pagead2.googlesyndication.com googleads.g.doubleclick.net
4	cdn.mgid.com	mafiacorruption.give5.pl jsc.mgid.com
3	sb.scorecardresearch.com	1 redirects jsc.mgid.com
3	www.google.com	2 redirects tpc.googlesyndication.com
3	www.gstatic.com	googleads.g.doubleclick.net
3	fonts.googleapis.com	googleads.g.doubleclick.net
2	match.adsrvr.org	2 redirects
2	creativecdn.com	2 redirects
2	cm.g.doubleclick.net	2 redirects
2	sync.1rx.io	2 redirects
2	eus.rubiconproject.com	cm.mgid.com eus.rubiconproject.com
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	jsc.mgid.com	code.jquery.com jsc.mgid.com
2	stackpath.bootstrapcdn.com	mafiacorruption.give5.pl
2	654.pl	capitalone.global
2	capitalone.global	capitalone.global
1	sync.adtelligent.com	1 redirects
1	token.rubiconproject.com	eus.rubiconproject.com
1	sonata-notifications.taptapnetworks.com	1 redirects
1	cm.lentainform.com
1	sync.targeting.unrulymedia.com
1	pixel.rubiconproject.com
1	sync.e-volution.ai	1 redirects
1	cm.idealmedia.io
1	secure-assets.rubiconproject.com	1 redirects
1	s.adtelligent.com	cm.mgid.com
1	servicer.mgid.com	jsc.mgid.com
1	c.mgid.com	jsc.mgid.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	www.googletagmanager.com	buzz.give5.pl
1	cdn.jsdelivr.net	mafiacorruption.give5.pl
1	code.jquery.com	mafiacorruption.give5.pl
1	mafiacorruption.give5.pl	654.pl
1	p237996.mybetterdl.com	1 redirects
1	mybetterdl.com	1 redirects
128	45

This site contains links to these domains. Also see Links.

Domain
654.pl
ad.admitad.com
lead1.pl
widgets.mgid.com
www.mgid.com
herbeauty.co

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-29` - `2022-06-28`	a year	crt.sh
mafiacorruption.give5.pl R3	`2021-08-11` - `2021-11-09`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2020	`2021-04-30` - `2022-06-01`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-07-26` - `2021-10-18`	3 months	crt.sh
*.scorecardresearch.com Amazon	`2021-02-28` - `2022-03-29`	a year	crt.sh
s.adtelligent.com ZeroSSL ECC Domain Secure Site CA	`2021-08-05` - `2021-11-03`	3 months	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-04-01` - `2022-04-04`	a year	crt.sh
*.targeting.unrulymedia.com DigiCert SHA2 Secure Server CA	`2020-05-04` - `2022-05-09`	2 years	crt.sh

This page contains 18 frames:

Primary Page: https://mafiacorruption.give5.pl/buzz.html?qid=ali
Frame ID: C31340153FB1DC4A0206A29687EAB2A2
Requests: 61 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210823/r20190131/zrt_lookup.html
Frame ID: 55D048611BCB79487562627327715FBA
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76
Frame ID: 03A9AE39075CA3A7B6392015E10A4F21
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=6982997067&adk=3470165435&adf=3678850305&pi=t.ma~as.6982997067&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531519&bpp=1&bdt=124&idt=81&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280&correlator=4406628717669&frm=20&pv=1&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=409&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=s1TMwCZclE&p=https%3A//mafiacorruption.give5.pl&dtd=84
Frame ID: 3EB2906F8AE3925FE40B519169E247A4
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2455198909&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531520&bpp=1&bdt=125&idt=87&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280%2C350x280&correlator=4406628717669&frm=20&pv=1&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=713&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=C9hiiCusBy&p=https%3A//mafiacorruption.give5.pl&dtd=90
Frame ID: C86DC2F7391C638A222ABC1B8174B512
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&adk=1812271804&adf=3025194257&lmt=1629736217&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531531&bpp=1&bdt=135&idt=81&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280%2C350x280%2C350x280&nras=1&correlator=4406628717669&frm=20&pv=1&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=85
Frame ID: B13B34A90CF4177EA2F424B4ABAFE75B
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/UDeKqTBFYaEY2ioWtDs_l49rHnl3Z0jd0o7HlKSj4tA.js
Frame ID: 7383C56217A268A9B39EBEF31BDDA596
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/UDeKqTBFYaEY2ioWtDs_l49rHnl3Z0jd0o7HlKSj4tA.js
Frame ID: 945A85F1F849AC281D3FD9D207361A5A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: AD97C364B2419919DFE332163BF355AF
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210823/r20110914/zrt_lookup.html?fsb=1
Frame ID: 2F897DACB166109CF1F6C3782E8C2FFB
Requests: 10 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/UDeKqTBFYaEY2ioWtDs_l49rHnl3Z0jd0o7HlKSj4tA.js
Frame ID: C6F3F8566C8891389955B73235AFA530
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 53ED5D32A434CA76DB444EAEADA4CBD8
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/UDeKqTBFYaEY2ioWtDs_l49rHnl3Z0jd0o7HlKSj4tA.js
Frame ID: 1AD98AB1C9C2BB170AE07FAF1209FEDC
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 9AFD6350D991380539CCDDD6373B4128
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 305102379DAEB82A2F47BE6D6F2D85A1
Requests: 1 HTTP requests in this frame

Frame: https://cm.mgid.com/i-noref.js?cbuster=1629961532739114144882
Frame ID: 9D3807EC673A5BE359E07DBAF63BDD2A
Requests: 1 HTTP requests in this frame

Frame: https://s.adtelligent.com/sync.html?aid=658327
Frame ID: 4E2A2720B7CC653C1B38953DCB54088F
Requests: 2 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=eu
Frame ID: 46D8E9ADE3B6033D4F06608281EE4685
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Buzz news

Page URL History Show full URLs

http://capitalone.global/ Page URL
http://capitalone.global/page/bouncy.php?&bpae=GbhGcz%2BnwqZ6jksUIcEsJXDA8g8%2BmuYvUMQ%2BVByY%2BHwznK... Page URL
https://mybetterdl.com/aS/feedclick?s=Un8YNmzNixqSbY2K8QcC8_ZKRsqpyl7xjjuP12McpDrFWIcgvNCIfp5tV7Jmg... HTTP 302
https://p237996.mybetterdl.com/adServe/domainClick?ai=tMxzWfm12LrPIBZz0TcdsdKId4yj9-6uyS7f39TXWRZiVhOf6x9Ls... HTTP 302
https://654.pl/Dff9dW1C?keyword=capitalone.global+&cost=0.0007&external_id=86892993821&crea... Page URL
https://654.pl/gateway.php?frm=dm&token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJodH... Page URL
https://mafiacorruption.give5.pl/buzz.html?qid=ali Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /react.*\.js/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

comScore (Analytics) Expand

Overall confidence: 100%
Detected patterns

html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i

Page Statistics

128
Requests

98 %
HTTPS

50 %
IPv6

30
Domains

45
Subdomains

32
IPs

6
Countries

1459 kB
Transfer

3258 kB
Size

8
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://654.pl/znrb6S

Search URL Search Domain Scan URL

URL: https://ad.admitad.com/g/mai1uhgx16fcd8151f01004ed038cb/
Title: Visit site

Search URL Search Domain Scan URL

URL: https://lead1.pl/p/zQqi/h27e/q3xr
Title: Visit site

Search URL Search Domain Scan URL

URL: https://ad.admitad.com/g/mx19yq7dtcfcd8151f01410fff306a/
Title: Visit site

Search URL Search Domain Scan URL

URL: https://widgets.mgid.com/?utm_source=mafiacorruption.give5.pl&utm_medium=referral&utm_campaign=widgets&utm_content=853142
Title:

Search URL Search Domain Scan URL

URL: https://www.mgid.com/services/privacy-policy
Title:

Search URL Search Domain Scan URL

URL: https://herbeauty.co/en/relationships/9-sure-hints-your-ex-wants-you-back/

Search URL Search Domain Scan URL

URL: https://herbeauty.co/entertainment/heartwarming-father-daughter-illustrations-by-soosh/

Search URL Search Domain Scan URL

URL: https://herbeauty.co/en/lifestyle/workouts-according-to-your-zodiac-sign/

Search URL Search Domain Scan URL

URL: https://herbeauty.co/en/beauty/viral-74-year-old-fitness-lover-defies-aging/

Search URL Search Domain Scan URL

URL: https://herbeauty.co/en/beauty/5-things-everyone-should-know-about-teeth-whitening/

Search URL Search Domain Scan URL

URL: https://herbeauty.co/en/home/16-cleaning-and-hygiene-tips-to-help-keep-the-covid-19-virus-out-of-your-home/

Search URL Search Domain Scan URL

URL: https://654.pl/rMZs3KSL

Search URL Search Domain Scan URL

URL: https://654.pl/hNdBjFTy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://capitalone.global/ Page URL
http://capitalone.global/page/bouncy.php?&bpae=GbhGcz%2BnwqZ6jksUIcEsJXDA8g8%2BmuYvUMQ%2BVByY%2BHwznKC4mXWn6RvI5gkW0BVw9ntBVGOek7yNYsnAY1UTk1BGrza7Nc8FKK%2FKAmiyW06tlnVDRSkxtWP%2FRHCh1bOCtTTVjTcHiYthA3icveq3EBc0wU1cgh2rzhc6mxgUmDVar9tsqRNDbqevXoKcSEuc1Aq8%2BRHaZVgZ6FXJSBsA%2F0rGaHmaU5B7diKU%2B1TM7lYLaikeVw5awdX4H2sJB0TNRyA2dstpGyDDTt17R%2FhCqSv9ON%2FyplKYjBtZ%2BS0t65oGHIT1trC9kyVqXQ1HCXzEMj9oJzepLN48AKDgvhOOmNQD9uiYytGw2zwk5Idoho1BifI4Vq%2F%2BIDayGObXqrtAiUKSFZ25IfaEwTokH1HxEVvg5Qj4TN46rkNlEIFjnXVxANqYKnPsTMaBHYImmeepORifXxxUZr%2FW5EoS%2BkXl6iQUSpBnfW5xx9ptC7DkOmoBpOPNNrRZD8WGbjTT3R8s53GvWmVtWLEZzzWoa5H8M%2BtLbn92FYGbHqAldPErJaSDiWKyn%2BnZfnQPOyw8RrnWm%2FuOhGX2HpPcqaKFB4lkhSdR%2Feso6mO8JAu6xVK4zSMsCazu%2FWpr3P3ZkakPXhlCgdWQfIpvw3%2BQKWFvzfv8HWm5RmCJArFUbkhmtaot5%2BiEsG8%2BlhD98VzV8b6ufATzkd26eS0xlMbC%2BL4ohfPCV%2B9y%2FjNw76H%2FzB57dzz3CdYBJABcc%2Bh2ubo9K2%2BFrLNYaDlP2fCYxqUGUeTZkj%2BGU0C5jEX01kcZKuXD0FBO2BPIQbmRvk91QIloc7TKfITo5I9MLRNP2H8m4Nc5PajHaO0Pj8%2FM%2F5NvjYE8zRxrYR3%2BcdBt0NmsuuyMDGzpLYAYYDn1Uxty1oQF%2FPowsDpxYogo0oe8ZPkX%2FzQAe82p2sKLZjT22mEl6E6VUpx4HeZQC8dTapOpkA%2BzIIiHnQeZDkyNN07bNREaOzb%2BcUg%2BUIooWi3Xjx1HB%2Fhx1CFst1sCDcwnB2PnhjC3%2Bth4J4NvejmsBRrgdy0rNNxPa%2F%2BjDu6C1QINLdaTp5R%2Fzqld3xwhqqamcV3%2BGDAeCvRlVGKwDfAMsKAJZY7GDuhtDJiMbdJPXv0QrcF22MBU5Bd5qoc3fraVuGMYuRWbrKi58tHVAHeXKWVM6BTEUxgYts3ImBxIhOhPEOQQ14ZD1ikcHiSZi%2Bd%2FmPmwjQ%2F9a%2F%2FoZFwMEec5WnCOU4tYC%2BboLaOwHCiWrbvOum62DKFGx5%2BUYSB8ljk5fO4O29Uwg963kfF6Yhizj4DGw%2B1mlbGAuWTxBAEiqMC6WBiny6gO4VrJpw7IZ9HYSUccCNHeOy4sa2pxBOyJhN7d2czyU%2BTm%2FGGD8tY9ut4QDOpRPAIYF1LVgKwcNmreIJ7SDx67HN1vKIsb0mcq0UgUtiFKZArkianjpRJ9nf1143eIUZOjP4etrsON6sV2en3rWk8mzugFdRQONqij46tjEFSoxHrY7dX1AfkDgFKS4agcUeMTIYHZTIT0MBcOiMWDysRePTRYhjAboqm%2BVYU1PnNcfN%2B5d%2FwhhbPUGUsoAc4D7fD8UbcViuDrZofoHYSRAKmE6YnFYrWWtetfNolA%2FwPikOGYqbaK%2BqFYK8RTO2kZPidsL8xPnVPdb%2FNUerswiJuYjmxJQ7jtIgL2ZeUL0V5zEIFEUTUI7RQ0XRd6EIPAjaMZsqTq4Hh5WX4VQqBKPesMttPvU0PeASd9aRn7iRRY%2F66EssLJlPJw5NlQkoY5b94tR%2BZmbKIcfCQ7ZPonTLmHk7qHd7nF%2F4CQCh1KEWOdNuqrxkok2tYTPZgYb8%2BNa9lVikKR2W%2BV9vmYd3hgXUqk6wA1lITc3d2oiqF4kd6YqrR2qc1Ys05UtDhzNPsx5f4mOjuaRBYL%2Ff5U7IyTCxP8bTVNCZJC%2FLDuogjq5uG%2FLX%2B93QWvA4SG5Cw%2FZZcm2ojDKvnpU0YIWIRVjr8JmI0eBe1lNRQ9SogiVwgoSzeq3cHTax6clxPp4blZ45Ca3BtpwEzqfg%3D%3D&redirectType=js&inIframe=false&inPopUp=false Page URL
https://mybetterdl.com/aS/feedclick?s=Un8YNmzNixqSbY2K8QcC8_ZKRsqpyl7xjjuP12McpDrFWIcgvNCIfp5tV7JmgQXznIFjje5HrPodK7X5QIc3n0hfs9IVa7UGQ57WzBF2cznwvxdiymVNjhYRq2NAfQ6SiUnMKG1xv31r6HPqc5_T5XfmENYXbWzNNl6RGTsBSkn3TAU5FotHoy107TgHEQpUkXV12WKOatMIRbA5iC6PcA5y8sQWc6HDVpq-MI5lMLPdaXzJyFke-dAyUGXaQZMzt_l7j8CyDJI6nTgdgBcDHIkRgObaQoQfYWXhr1vBFF8_-8LqiUDPtlOk8LKlCKJRoaxtedH9f8MCZ1XK5EKK4AGa2t-LMllRMEHr59KH1-0vd8SYG6SP1bfpnQoT6glcc77RU83RTmpguNXD3g130a_MeJcU0I7FDJYW9DOX_KiRtFNfPZCoLBnqD3g58iIMEzVshVjpdjxIGE8VXTukECvVM7pQ_gl1fT-J4G4-1uBm_mdvwVSNbBXdSOZC0pzwsCd9T0Ue7Q2JmeCVGx2zrNS1Fcn8uCko8k6NpdNOMSk5fsmvhdXzZmiqnR2tMnkqOpXSzqulcbtM8E3Y5lCh27LoGfl5XI23IcmPbQi9RLEwNOZ5rTcv2xTeleyhTODuteJEhkmIuk_Wj8TewlUX2vyxyqyIxAwk0W8b_W8xmNRFBbeTyHukTvNB0RGdel1ianuJCf0ElhFPEaaHNoeQo7gFphRq2nPFeT9BFqSiE266_N-22Tm96yNjBt7BRIX1U8GVeqx2LCvebVM7dkK8RwV1BT0KItmD-gPFsP-kbze75smuGKEuKHORQsvM0h5mjKy_4YCOub6YT3jPKTQD_Vab2_jnd8jNLu4jOyxK59ih1oJ8Q7hKvcll-MEWtgdnjL61RJhJZl275x2dfbtC2R0Tx-pOd4bnpk4zfWP64glZJp7w-efTE9JYnFpaS-6nC0d3yoJoPpptHQizu5i0-06qQ_66cDnxFymS2zSzkH7h8R3jd6QQOM3SYL79lOJqOXoDY4UBF8QSOrbjEbq5e-2-THs-oNc9isrIt7bEAS11WtOb80l_ZaH5KjaiXMbO7mYdKiWU3z9H-3uz5Zt3HaJbzIrK5N9EmlDaB7tSj71nxBZbuPpufgYxIEoB2FTxDZW6g141J0FUMOCtRPh07PhXmretIozc1AbS0PSXZp0Vx7N5t9vxBGk_cvFOjY7Csy3CjqQFwkjn-RAf2xO4PsqDVVGBMf9Vi2L-4COsWdTlIP5ptT_pYiqviLmPDB-mlurwQfKHErECUHEIh0HQWoMpnhUho-ILETSQRlba90mfFfllQJaXH28P35YX0UlhKhY1t3oiSbWVZxuc11aRIeqdiKFjERw4KZMktY8_yal7xfODo3Q_3p4rzocdy2aoo3PohfWRZST5SoVjnaODi7oCqYpNbw871w943NjP-JFA0tSVl6xq8k68wNh9UemP5fSfzHG8ZcRingtw_af89is7u-DnF10bJsH1SbwuDg-i5b4t0FfN-T69w8zPi-QLJ3XM_O9654LGIxV2e1cjGw HTTP 302
https://p237996.mybetterdl.com/adServe/domainClick?ai=tMxzWfm12LrPIBZz0TcdsdKId4yj9-6uyS7f39TXWRZiVhOf6x9LsO2-THs-oNc9isrIt7bEAS11WtOb80l_ZQdKVP0eju0oaoBBNH-RY4fF5y4haVYAvAb3-ESHG0JHg2RvEwrk2epbC7U30TJp2VIF_UqDQ88czxYZhQRDHKOTj8_fQz1wp-vaI8tzj08RekntYE_IAqFingtw_af89is7u-DnF10brBZwfnlpzJmY6HePUk-qNbh1LRR9gB9GIi_4VzxZferVCW9UoLTzK2_T5x_FGAdpIKKNlj9I1Bp0zkQJR4Qsl-RCaNkT3qyOnwM9sZtI20k3QkkpNB0KG6OIZhD5UZ8zUEpDz_87JciBp9n2wO8e3QXL0tt9b_p24Wg6c98G2nieKTEQPOdaBRbRh5WhN0Axej_wmAiUbeoWBGu3Yx722HW3MQ4Jbibrn4ECi1r5St36NVYLtl8wPGWSQsQHXjql&ui=Un8YNmzNixqSbY2K8QcC8_NVAecEZg52IaIc3yOo5HLVf6apCZdC5jMd-m8zsN5HIU3SAdtP2316Nk6Z9MQZDW2hqTYXjjBIaH3ugQviGQJkx4MA9YyhPQ&si=1&oref=ac7bc52f3bdcdc01311f1d0cab78bea9&optunit=o3PohfWRZST5SoVjnaODi-VjWAICLixU&rb=9MD8j-wl9rc&rr=1&abtg=0 HTTP 302
https://654.pl/Dff9dW1C?keyword=capitalone.global+&cost=0.0007&external_id=86892993821&creative_id=@@CREATIVE-ID@@&ad_campaign_id=AdSense+MGID&source=433982748 Page URL
https://654.pl/gateway.php?frm=dm&token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJodHRwczpcL1wvbWFmaWFjb3JydXB0aW9uLmdpdmU1LnBsXC9idXp6Lmh0bWw_cWlkPWFsaSJ9.MbEBhpRhYnoEeVL1J715MX03FhQfLXEJ-SitVD91JBo Page URL
https://mafiacorruption.give5.pl/buzz.html?qid=ali Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://mybetterdl.com/aS/feedclick?s=Un8YNmzNixqSbY2K8QcC8_ZKRsqpyl7xjjuP12McpDrFWIcgvNCIfp5tV7JmgQXznIFjje5HrPodK7X5QIc3n0hfs9IVa7UGQ57WzBF2cznwvxdiymVNjhYRq2NAfQ6SiUnMKG1xv31r6HPqc5_T5XfmENYXbWzNNl6RGTsBSkn3TAU5FotHoy107TgHEQpUkXV12WKOatMIRbA5iC6PcA5y8sQWc6HDVpq-MI5lMLPdaXzJyFke-dAyUGXaQZMzt_l7j8CyDJI6nTgdgBcDHIkRgObaQoQfYWXhr1vBFF8_-8LqiUDPtlOk8LKlCKJRoaxtedH9f8MCZ1XK5EKK4AGa2t-LMllRMEHr59KH1-0vd8SYG6SP1bfpnQoT6glcc77RU83RTmpguNXD3g130a_MeJcU0I7FDJYW9DOX_KiRtFNfPZCoLBnqD3g58iIMEzVshVjpdjxIGE8VXTukECvVM7pQ_gl1fT-J4G4-1uBm_mdvwVSNbBXdSOZC0pzwsCd9T0Ue7Q2JmeCVGx2zrNS1Fcn8uCko8k6NpdNOMSk5fsmvhdXzZmiqnR2tMnkqOpXSzqulcbtM8E3Y5lCh27LoGfl5XI23IcmPbQi9RLEwNOZ5rTcv2xTeleyhTODuteJEhkmIuk_Wj8TewlUX2vyxyqyIxAwk0W8b_W8xmNRFBbeTyHukTvNB0RGdel1ianuJCf0ElhFPEaaHNoeQo7gFphRq2nPFeT9BFqSiE266_N-22Tm96yNjBt7BRIX1U8GVeqx2LCvebVM7dkK8RwV1BT0KItmD-gPFsP-kbze75smuGKEuKHORQsvM0h5mjKy_4YCOub6YT3jPKTQD_Vab2_jnd8jNLu4jOyxK59ih1oJ8Q7hKvcll-MEWtgdnjL61RJhJZl275x2dfbtC2R0Tx-pOd4bnpk4zfWP64glZJp7w-efTE9JYnFpaS-6nC0d3yoJoPpptHQizu5i0-06qQ_66cDnxFymS2zSzkH7h8R3jd6QQOM3SYL79lOJqOXoDY4UBF8QSOrbjEbq5e-2-THs-oNc9isrIt7bEAS11WtOb80l_ZaH5KjaiXMbO7mYdKiWU3z9H-3uz5Zt3HaJbzIrK5N9EmlDaB7tSj71nxBZbuPpufgYxIEoB2FTxDZW6g141J0FUMOCtRPh07PhXmretIozc1AbS0PSXZp0Vx7N5t9vxBGk_cvFOjY7Csy3CjqQFwkjn-RAf2xO4PsqDVVGBMf9Vi2L-4COsWdTlIP5ptT_pYiqviLmPDB-mlurwQfKHErECUHEIh0HQWoMpnhUho-ILETSQRlba90mfFfllQJaXH28P35YX0UlhKhY1t3oiSbWVZxuc11aRIeqdiKFjERw4KZMktY8_yal7xfODo3Q_3p4rzocdy2aoo3PohfWRZST5SoVjnaODi7oCqYpNbw871w943NjP-JFA0tSVl6xq8k68wNh9UemP5fSfzHG8ZcRingtw_af89is7u-DnF10bJsH1SbwuDg-i5b4t0FfN-T69w8zPi-QLJ3XM_O9654LGIxV2e1cjGw HTTP 302
https://p237996.mybetterdl.com/adServe/domainClick?ai=tMxzWfm12LrPIBZz0TcdsdKId4yj9-6uyS7f39TXWRZiVhOf6x9LsO2-THs-oNc9isrIt7bEAS11WtOb80l_ZQdKVP0eju0oaoBBNH-RY4fF5y4haVYAvAb3-ESHG0JHg2RvEwrk2epbC7U30TJp2VIF_UqDQ88czxYZhQRDHKOTj8_fQz1wp-vaI8tzj08RekntYE_IAqFingtw_af89is7u-DnF10brBZwfnlpzJmY6HePUk-qNbh1LRR9gB9GIi_4VzxZferVCW9UoLTzK2_T5x_FGAdpIKKNlj9I1Bp0zkQJR4Qsl-RCaNkT3qyOnwM9sZtI20k3QkkpNB0KG6OIZhD5UZ8zUEpDz_87JciBp9n2wO8e3QXL0tt9b_p24Wg6c98G2nieKTEQPOdaBRbRh5WhN0Axej_wmAiUbeoWBGu3Yx722HW3MQ4Jbibrn4ECi1r5St36NVYLtl8wPGWSQsQHXjql&ui=Un8YNmzNixqSbY2K8QcC8_NVAecEZg52IaIc3yOo5HLVf6apCZdC5jMd-m8zsN5HIU3SAdtP2316Nk6Z9MQZDW2hqTYXjjBIaH3ugQviGQJkx4MA9YyhPQ&si=1&oref=ac7bc52f3bdcdc01311f1d0cab78bea9&optunit=o3PohfWRZST5SoVjnaODi-VjWAICLixU&rb=9MD8j-wl9rc&rr=1&abtg=0 HTTP 302
https://654.pl/Dff9dW1C?keyword=capitalone.global+&cost=0.0007&external_id=86892993821&creative_id=@@CREATIVE-ID@@&ad_campaign_id=AdSense+MGID&source=433982748

Request Chain 84

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 96

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 115

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=mgid&endpoint=eu HTTP 301
https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=eu

Request Chain 117

https://sync.e-volution.ai/34b9aae5baa016b251b9fc488f4a97cd.gif?puid=l7qw3wucxO50 HTTP 302
https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-pashadv&gdpr=&gdpr_consent=&us_privacy=

Request Chain 118

https://x.bidswitch.net/sync?dsp_id=303&user_id=l7qw3wucxO50 HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=303&user_id=l7qw3wucxO50 HTTP 302
https://sync.1rx.io/usersync/bidswitch/3081098c-451d-44a0-9e1e-baf982559549?gdpr=&gdpr_consent= HTTP 302
https://sync.1rx.io/usersync/bidswitch/3081098c-451d-44a0-9e1e-baf982559549?zcc=1&dspret=0&cb=1629961533172 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-d5d5e6cf-0935-4811-b5af-e8b7cba0806d-003

Request Chain 119

https://cm.g.doubleclick.net/pixel?google_nid=marketgid&google_cm=&google_ula={guid}&google_hm=bDdxdzN3dWN4TzUw&muidn=l7qw3wucxO50 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=marketgid&google_cm=&google_ula={guid}&google_hm=bDdxdzN3dWN4TzUw&muidn=l7qw3wucxO50&google_tc= HTTP 302
https://cm.mgid.com/google?muidn=l7qw3wucxO50&google_ula={guid},5&google_gid=CAESELoyKX4xff9XvtN_fpNDjS0&google_cver=1

Request Chain 121

https://creativecdn.com/cm-notify?pi=mgid HTTP 302
https://creativecdn.com/cm-notify?pi=mgid&tc=1 HTTP 302
https://cm.mgid.com/m?cdsp=501037&c=WWSeQ5pRZwevty3Cpv4z&pi=mgid&tc=1

Request Chain 122

https://x.bidswitch.net/sync?ssp=mgid HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=mgid HTTP 302
https://sonata-notifications.taptapnetworks.com/web/cookie/bidswitch/sync?bidswitch_ssp_id=mgid&bsw_custom_parameter=3081098c-451d-44a0-9e1e-baf982559549&gdpr=&gdpr_consent=&gdpr_pd= HTTP 302
https://x.bidswitch.net/sync?dsp_id=413&ssp=mgid&user_id=csonata_782c9d42-7c8c-4c09-9293-ab8cfa158b51&bsw_param=3081098c-451d-44a0-9e1e-baf982559549&expires=10 HTTP 302
https://cm.mgid.com/m?cdsp=433145&c=3081098c-451d-44a0-9e1e-baf982559549&gdpr=&gdpr_consent=&us_privacy=

Request Chain 123

https://match.adsrvr.org/track/cmf/generic?ttd_pid=omn67hl&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=omn67hl&ttd_tpi=1 HTTP 302
https://cm.mgid.com/m?cdsp=371158&c=a9a9e4c1-1b0b-43c3-856e-15d1a99e3043&ttl=1632553533

Request Chain 126

https://sb.scorecardresearch.com/b?c1=7&c2=15208452&c3=110&ns__t=1629961533024&ns_c=UTF-8&cv=3.5&c8=Buzz%20news&c7=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&c9=https%3A%2F%2F654.pl%2F HTTP 302
https://sb.scorecardresearch.com/b2?c1=7&c2=15208452&c3=110&ns__t=1629961533024&ns_c=UTF-8&cv=3.5&c8=Buzz%20news&c7=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&c9=https%3A%2F%2F654.pl%2F

Request Chain 132

https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fcm.mgid.com%2Fm%3Fcdsp%3D617666%26c%3D%7Buid%7D HTTP 302
https://cm.mgid.com/m?cdsp=617666&c=7c476c232232dc4b

128 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
capitalone.global/ 7 KB
7 KB 1747ms
1579ms Document
text/html 72.52.178.23
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: http://capitalone.global/
Protocol: HTTP/1.1
Server: 72.52.178.23 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: lb01.parklogic.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 / PHP/5.4.16
Resource Hash: dfa6b17abf29dd5bd1056e11260e71d6f40610726af868d5a9d43228594d5771

Request headers

Host: capitalone.global
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 26 Aug 2021 07:05:27 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
X-Powered-By: PHP/5.4.16
Content-Length: 7228
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK bouncy.php Show response
capitalone.global/page/ 5 KB
5 KB 1419ms
1392ms Document
text/html 72.52.178.23
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: http://capitalone.global/page/bouncy.php?&bpae=GbhGcz%2BnwqZ6jksUIcEsJXDA8g8%2BmuYvUMQ%2BVByY%2BHwznKC4mXWn6RvI5gkW0BVw9ntBVGOek7yNYsnAY1UTk1BGrza7Nc8FKK%2FKAmiyW06tlnVDRSkxtWP%2FRHCh1bOCtTTVjTcHiYthA3icveq3EBc0wU1cgh2rzhc6mxgUmDVar9tsqRNDbqevXoKcSEuc1Aq8%2BRHaZVgZ6FXJSBsA%2F0rGaHmaU5B7diKU%2B1TM7lYLaikeVw5awdX4H2sJB0TNRyA2dstpGyDDTt17R%2FhCqSv9ON%2FyplKYjBtZ%2BS0t65oGHIT1trC9kyVqXQ1HCXzEMj9oJzepLN48AKDgvhOOmNQD9uiYytGw2zwk5Idoho1BifI4Vq%2F%2BIDayGObXqrtAiUKSFZ25IfaEwTokH1HxEVvg5Qj4TN46rkNlEIFjnXVxANqYKnPsTMaBHYImmeepORifXxxUZr%2FW5EoS%2BkXl6iQUSpBnfW5xx9ptC7DkOmoBpOPNNrRZD8WGbjTT3R8s53GvWmVtWLEZzzWoa5H8M%2BtLbn92FYGbHqAldPErJaSDiWKyn%2BnZfnQPOyw8RrnWm%2FuOhGX2HpPcqaKFB4lkhSdR%2Feso6mO8JAu6xVK4zSMsCazu%2FWpr3P3ZkakPXhlCgdWQfIpvw3%2BQKWFvzfv8HWm5RmCJArFUbkhmtaot5%2BiEsG8%2BlhD98VzV8b6ufATzkd26eS0xlMbC%2BL4ohfPCV%2B9y%2FjNw76H%2FzB57dzz3CdYBJABcc%2Bh2ubo9K2%2BFrLNYaDlP2fCYxqUGUeTZkj%2BGU0C5jEX01kcZKuXD0FBO2BPIQbmRvk91QIloc7TKfITo5I9MLRNP2H8m4Nc5PajHaO0Pj8%2FM%2F5NvjYE8zRxrYR3%2BcdBt0NmsuuyMDGzpLYAYYDn1Uxty1oQF%2FPowsDpxYogo0oe8ZPkX%2FzQAe82p2sKLZjT22mEl6E6VUpx4HeZQC8dTapOpkA%2BzIIiHnQeZDkyNN07bNREaOzb%2BcUg%2BUIooWi3Xjx1HB%2Fhx1CFst1sCDcwnB2PnhjC3%2Bth4J4NvejmsBRrgdy0rNNxPa%2F%2BjDu6C1QINLdaTp5R%2Fzqld3xwhqqamcV3%2BGDAeCvRlVGKwDfAMsKAJZY7GDuhtDJiMbdJPXv0QrcF22MBU5Bd5qoc3fraVuGMYuRWbrKi58tHVAHeXKWVM6BTEUxgYts3ImBxIhOhPEOQQ14ZD1ikcHiSZi%2Bd%2FmPmwjQ%2F9a%2F%2FoZFwMEec5WnCOU4tYC%2BboLaOwHCiWrbvOum62DKFGx5%2BUYSB8ljk5fO4O29Uwg963kfF6Yhizj4DGw%2B1mlbGAuWTxBAEiqMC6WBiny6gO4VrJpw7IZ9HYSUccCNHeOy4sa2pxBOyJhN7d2czyU%2BTm%2FGGD8tY9ut4QDOpRPAIYF1LVgKwcNmreIJ7SDx67HN1vKIsb0mcq0UgUtiFKZArkianjpRJ9nf1143eIUZOjP4etrsON6sV2en3rWk8mzugFdRQONqij46tjEFSoxHrY7dX1AfkDgFKS4agcUeMTIYHZTIT0MBcOiMWDysRePTRYhjAboqm%2BVYU1PnNcfN%2B5d%2FwhhbPUGUsoAc4D7fD8UbcViuDrZofoHYSRAKmE6YnFYrWWtetfNolA%2FwPikOGYqbaK%2BqFYK8RTO2kZPidsL8xPnVPdb%2FNUerswiJuYjmxJQ7jtIgL2ZeUL0V5zEIFEUTUI7RQ0XRd6EIPAjaMZsqTq4Hh5WX4VQqBKPesMttPvU0PeASd9aRn7iRRY%2F66EssLJlPJw5NlQkoY5b94tR%2BZmbKIcfCQ7ZPonTLmHk7qHd7nF%2F4CQCh1KEWOdNuqrxkok2tYTPZgYb8%2BNa9lVikKR2W%2BV9vmYd3hgXUqk6wA1lITc3d2oiqF4kd6YqrR2qc1Ys05UtDhzNPsx5f4mOjuaRBYL%2Ff5U7IyTCxP8bTVNCZJC%2FLDuogjq5uG%2FLX%2B93QWvA4SG5Cw%2FZZcm2ojDKvnpU0YIWIRVjr8JmI0eBe1lNRQ9SogiVwgoSzeq3cHTax6clxPp4blZ45Ca3BtpwEzqfg%3D%3D&redirectType=js&inIframe=false&inPopUp=false
Requested by: Host: capitalone.global
URL: http://capitalone.global/
Protocol: HTTP/1.1
Server: 72.52.178.23 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: lb01.parklogic.com
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 / PHP/5.4.16
Resource Hash: 4d4a216b27e5b887e2cdcfaa32f4b7a50bbaee4f65bc190b6cd731b05975d936

Request headers

Host: capitalone.global
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://capitalone.global/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: http://capitalone.global/

Response headers

Date: Thu, 26 Aug 2021 07:05:29 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
X-Powered-By: PHP/5.4.16
Content-Length: 5314
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H2

200

Dff9dW1C Show response
654.pl/
Redirect Chain

https://mybetterdl.com/aS/feedclick?s=Un8YNmzNixqSbY2K8QcC8_ZKRsqpyl7xjjuP12McpDrFWIcgvNCIfp5tV7JmgQXznIFjje5HrPodK7X5QIc3n0hfs9IVa7UGQ57WzBF2cznwvxdiymVNjhYRq2NAfQ6SiUnMKG1xv31r6HPqc5_T5XfmENYXbWz...
https://p237996.mybetterdl.com/adServe/domainClick?ai=tMxzWfm12LrPIBZz0TcdsdKId4yj9-6uyS7f39TXWRZiVhOf6x9LsO2-THs-oNc9isrIt7bEAS11WtOb80l_ZQdKVP0eju0oaoBBNH-RY4fF5y4haVYAvAb3-ESHG0JHg2RvEwrk2epbC7U...
https://654.pl/Dff9dW1C?keyword=capitalone.global+&cost=0.0007&external_id=86892993821&creative_id=@@CREATIVE-ID@@&ad_campaign_id=AdSense+MGID&source=433982748

320 B
1 KB

162ms
137ms

Document
text/html

2606:4700:3036::ac43:9acc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://654.pl/Dff9dW1C?keyword=capitalone.global+&cost=0.0007&external_id=86892993821&creative_id=@@CREATIVE-ID@@&ad_campaign_id=AdSense+MGID&source=433982748

Requested by

Host: capitalone.global
URL: http://capitalone.global/page/bouncy.php?&bpae=GbhGcz%2BnwqZ6jksUIcEsJXDA8g8%2BmuYvUMQ%2BVByY%2BHwznKC4mXWn6RvI5gkW0BVw9ntBVGOek7yNYsnAY1UTk1BGrza7Nc8FKK%2FKAmiyW06tlnVDRSkxtWP%2FRHCh1bOCtTTVjTcHiYthA3icveq3EBc0wU1cgh2rzhc6mxgUmDVar9tsqRNDbqevXoKcSEuc1Aq8%2BRHaZVgZ6FXJSBsA%2F0rGaHmaU5B7diKU%2B1TM7lYLaikeVw5awdX4H2sJB0TNRyA2dstpGyDDTt17R%2FhCqSv9ON%2FyplKYjBtZ%2BS0t65oGHIT1trC9kyVqXQ1HCXzEMj9oJzepLN48AKDgvhOOmNQD9uiYytGw2zwk5Idoho1BifI4Vq%2F%2BIDayGObXqrtAiUKSFZ25IfaEwTokH1HxEVvg5Qj4TN46rkNlEIFjnXVxANqYKnPsTMaBHYImmeepORifXxxUZr%2FW5EoS%2BkXl6iQUSpBnfW5xx9ptC7DkOmoBpOPNNrRZD8WGbjTT3R8s53GvWmVtWLEZzzWoa5H8M%2BtLbn92FYGbHqAldPErJaSDiWKyn%2BnZfnQPOyw8RrnWm%2FuOhGX2HpPcqaKFB4lkhSdR%2Feso6mO8JAu6xVK4zSMsCazu%2FWpr3P3ZkakPXhlCgdWQfIpvw3%2BQKWFvzfv8HWm5RmCJArFUbkhmtaot5%2BiEsG8%2BlhD98VzV8b6ufATzkd26eS0xlMbC%2BL4ohfPCV%2B9y%2FjNw76H%2FzB57dzz3CdYBJABcc%2Bh2ubo9K2%2BFrLNYaDlP2fCYxqUGUeTZkj%2BGU0C5jEX01kcZKuXD0FBO2BPIQbmRvk91QIloc7TKfITo5I9MLRNP2H8m4Nc5PajHaO0Pj8%2FM%2F5NvjYE8zRxrYR3%2BcdBt0NmsuuyMDGzpLYAYYDn1Uxty1oQF%2FPowsDpxYogo0oe8ZPkX%2FzQAe82p2sKLZjT22mEl6E6VUpx4HeZQC8dTapOpkA%2BzIIiHnQeZDkyNN07bNREaOzb%2BcUg%2BUIooWi3Xjx1HB%2Fhx1CFst1sCDcwnB2PnhjC3%2Bth4J4NvejmsBRrgdy0rNNxPa%2F%2BjDu6C1QINLdaTp5R%2Fzqld3xwhqqamcV3%2BGDAeCvRlVGKwDfAMsKAJZY7GDuhtDJiMbdJPXv0QrcF22MBU5Bd5qoc3fraVuGMYuRWbrKi58tHVAHeXKWVM6BTEUxgYts3ImBxIhOhPEOQQ14ZD1ikcHiSZi%2Bd%2FmPmwjQ%2F9a%2F%2FoZFwMEec5WnCOU4tYC%2BboLaOwHCiWrbvOum62DKFGx5%2BUYSB8ljk5fO4O29Uwg963kfF6Yhizj4DGw%2B1mlbGAuWTxBAEiqMC6WBiny6gO4VrJpw7IZ9HYSUccCNHeOy4sa2pxBOyJhN7d2czyU%2BTm%2FGGD8tY9ut4QDOpRPAIYF1LVgKwcNmreIJ7SDx67HN1vKIsb0mcq0UgUtiFKZArkianjpRJ9nf1143eIUZOjP4etrsON6sV2en3rWk8mzugFdRQONqij46tjEFSoxHrY7dX1AfkDgFKS4agcUeMTIYHZTIT0MBcOiMWDysRePTRYhjAboqm%2BVYU1PnNcfN%2B5d%2FwhhbPUGUsoAc4D7fD8UbcViuDrZofoHYSRAKmE6YnFYrWWtetfNolA%2FwPikOGYqbaK%2BqFYK8RTO2kZPidsL8xPnVPdb%2FNUerswiJuYjmxJQ7jtIgL2ZeUL0V5zEIFEUTUI7RQ0XRd6EIPAjaMZsqTq4Hh5WX4VQqBKPesMttPvU0PeASd9aRn7iRRY%2F66EssLJlPJw5NlQkoY5b94tR%2BZmbKIcfCQ7ZPonTLmHk7qHd7nF%2F4CQCh1KEWOdNuqrxkok2tYTPZgYb8%2BNa9lVikKR2W%2BV9vmYd3hgXUqk6wA1lITc3d2oiqF4kd6YqrR2qc1Ys05UtDhzNPsx5f4mOjuaRBYL%2Ff5U7IyTCxP8bTVNCZJC%2FLDuogjq5uG%2FLX%2B93QWvA4SG5Cw%2FZZcm2ojDKvnpU0YIWIRVjr8JmI0eBe1lNRQ9SogiVwgoSzeq3cHTax6clxPp4blZ45Ca3BtpwEzqfg%3D%3D&redirectType=js&inIframe=false&inPopUp=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3036::ac43:9acc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

559fc40752edc05768e854e55a99a68d04d96caf7c5e6dbda12b1fcb7af7873a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: 654.pl
:scheme: https
:path: /Dff9dW1C?keyword=capitalone.global+&cost=0.0007&external_id=86892993821&creative_id=@@CREATIVE-ID@@&ad_campaign_id=AdSense+MGID&source=433982748
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: http://capitalone.global/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: http://capitalone.global/page/bouncy.php?&bpae=GbhGcz%2BnwqZ6jksUIcEsJXDA8g8%2BmuYvUMQ%2BVByY%2BHwznKC4mXWn6RvI5gkW0BVw9ntBVGOek7yNYsnAY1UTk1BGrza7Nc8FKK%2FKAmiyW06tlnVDRSkxtWP%2FRHCh1bOCtTTVjTcHiYthA3icveq3EBc0wU1cgh2rzhc6mxgUmDVar9tsqRNDbqevXoKcSEuc1Aq8%2BRHaZVgZ6FXJSBsA%2F0rGaHmaU5B7diKU%2B1TM7lYLaikeVw5awdX4H2sJB0TNRyA2dstpGyDDTt17R%2FhCqSv9ON%2FyplKYjBtZ%2BS0t65oGHIT1trC9kyVqXQ1HCXzEMj9oJzepLN48AKDgvhOOmNQD9uiYytGw2zwk5Idoho1BifI4Vq%2F%2BIDayGObXqrtAiUKSFZ25IfaEwTokH1HxEVvg5Qj4TN46rkNlEIFjnXVxANqYKnPsTMaBHYImmeepORifXxxUZr%2FW5EoS%2BkXl6iQUSpBnfW5xx9ptC7DkOmoBpOPNNrRZD8WGbjTT3R8s53GvWmVtWLEZzzWoa5H8M%2BtLbn92FYGbHqAldPErJaSDiWKyn%2BnZfnQPOyw8RrnWm%2FuOhGX2HpPcqaKFB4lkhSdR%2Feso6mO8JAu6xVK4zSMsCazu%2FWpr3P3ZkakPXhlCgdWQfIpvw3%2BQKWFvzfv8HWm5RmCJArFUbkhmtaot5%2BiEsG8%2BlhD98VzV8b6ufATzkd26eS0xlMbC%2BL4ohfPCV%2B9y%2FjNw76H%2FzB57dzz3CdYBJABcc%2Bh2ubo9K2%2BFrLNYaDlP2fCYxqUGUeTZkj%2BGU0C5jEX01kcZKuXD0FBO2BPIQbmRvk91QIloc7TKfITo5I9MLRNP2H8m4Nc5PajHaO0Pj8%2FM%2F5NvjYE8zRxrYR3%2BcdBt0NmsuuyMDGzpLYAYYDn1Uxty1oQF%2FPowsDpxYogo0oe8ZPkX%2FzQAe82p2sKLZjT22mEl6E6VUpx4HeZQC8dTapOpkA%2BzIIiHnQeZDkyNN07bNREaOzb%2BcUg%2BUIooWi3Xjx1HB%2Fhx1CFst1sCDcwnB2PnhjC3%2Bth4J4NvejmsBRrgdy0rNNxPa%2F%2BjDu6C1QINLdaTp5R%2Fzqld3xwhqqamcV3%2BGDAeCvRlVGKwDfAMsKAJZY7GDuhtDJiMbdJPXv0QrcF22MBU5Bd5qoc3fraVuGMYuRWbrKi58tHVAHeXKWVM6BTEUxgYts3ImBxIhOhPEOQQ14ZD1ikcHiSZi%2Bd%2FmPmwjQ%2F9a%2F%2FoZFwMEec5WnCOU4tYC%2BboLaOwHCiWrbvOum62DKFGx5%2BUYSB8ljk5fO4O29Uwg963kfF6Yhizj4DGw%2B1mlbGAuWTxBAEiqMC6WBiny6gO4VrJpw7IZ9HYSUccCNHeOy4sa2pxBOyJhN7d2czyU%2BTm%2FGGD8tY9ut4QDOpRPAIYF1LVgKwcNmreIJ7SDx67HN1vKIsb0mcq0UgUtiFKZArkianjpRJ9nf1143eIUZOjP4etrsON6sV2en3rWk8mzugFdRQONqij46tjEFSoxHrY7dX1AfkDgFKS4agcUeMTIYHZTIT0MBcOiMWDysRePTRYhjAboqm%2BVYU1PnNcfN%2B5d%2FwhhbPUGUsoAc4D7fD8UbcViuDrZofoHYSRAKmE6YnFYrWWtetfNolA%2FwPikOGYqbaK%2BqFYK8RTO2kZPidsL8xPnVPdb%2FNUerswiJuYjmxJQ7jtIgL2ZeUL0V5zEIFEUTUI7RQ0XRd6EIPAjaMZsqTq4Hh5WX4VQqBKPesMttPvU0PeASd9aRn7iRRY%2F66EssLJlPJw5NlQkoY5b94tR%2BZmbKIcfCQ7ZPonTLmHk7qHd7nF%2F4CQCh1KEWOdNuqrxkok2tYTPZgYb8%2BNa9lVikKR2W%2BV9vmYd3hgXUqk6wA1lITc3d2oiqF4kd6YqrR2qc1Ys05UtDhzNPsx5f4mOjuaRBYL%2Ff5U7IyTCxP8bTVNCZJC%2FLDuogjq5uG%2FLX%2B93QWvA4SG5Cw%2FZZcm2ojDKvnpU0YIWIRVjr8JmI0eBe1lNRQ9SogiVwgoSzeq3cHTax6clxPp4blZ45Ca3BtpwEzqfg%3D%3D&redirectType=js&inIframe=false&inPopUp=false

Response headers

date: Thu, 26 Aug 2021 07:05:29 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, must-revalidate,post-check=0,pre-check=0
expires: 0
last-modified: Thu, 26 Aug 2021 07:04:44 GMT
pragma: no-cache
set-cookie: _subid=1unr3k161273d0ce3b0f;Expires=Sunday, 26-Sep-2021 07:04:44 GMT;Max-Age=2678400;Path=/ _token=uuid_1unr3k161273d0ce3b0f_1unr3k161273d0ce3b0f61273d0ce476e1.37190180;Expires=Sunday, 26-Sep-2021 07:04:44 GMT;Max-Age=2678400;Path=/ ec87d=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjEyN1wiOjE2Mjk5NjE0ODR9LFwiY2FtcGFpZ25zXCI6e1wiOTlcIjoxNjI5OTYxNDg0fSxcInRpbWVcIjoxNjI5OTYxNDg0fSJ9.KKh-J8oA0u1AYEf2x5-pdWwtX1_LS3vLQbb2Rbh38Xc;Expires=Friday, 21-Apr-2073 14:09:28 GMT;Max-Age=1630047884;Path=/
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fSTJW3w%2BW9EL6hyebiHjR3bsXEuM5JE7ntVwZ1KBxhczUXqvR0ByrIRqJlLcrO7FiKwiF%2BfXJmIQsW16qTff9WLctgkv%2FWA9Qu19vTOS9EewrB%2Fj%2BYPn01E9Nzpx5V5atQmIbrc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 684b3649afd84e5c-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

server: nginx
date: Thu, 26 Aug 2021 07:05:29 GMT
content-length: 0
set-cookie: rhid=79467238739; Max-Age=15552000; Expires=Tue, 22-Feb-2022 07:05:29 GMT; Domain=mybetterdl.com; Path=/; SameSite=None; secure; loi=ad_1119079_off_564072_aff_90013_cid_237996-CAPITALONE.GLOBAL_ts_1629961529; Max-Age=3600; Expires=Thu, 26-Aug-2021 08:05:29 GMT; Domain=mybetterdl.com; Path=/; SameSite=None; secure;
location: https://654.pl/Dff9dW1C?keyword=capitalone.global+&cost=0.0007&external_id=86892993821&creative_id=@@CREATIVE-ID@@&ad_campaign_id=AdSense+MGID&source=433982748

GET
H2 200 gateway.php
654.pl/ 314 B
844 B 168ms
154ms Document
text/html 2606:4700:3035::6815:625
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://654.pl/gateway.php?frm=dm&token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJodHRwczpcL1wvbWFmaWFjb3JydXB0aW9uLmdpdmU1LnBsXC9idXp6Lmh0bWw_cWlkPWFsaSJ9.MbEBhpRhYnoEeVL1J715MX03FhQfLXEJ-SitVD91JBo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::6815:625 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/7.3.15

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: 654.pl
:scheme: https
:path: /gateway.php?frm=dm&token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJodHRwczpcL1wvbWFmaWFjb3JydXB0aW9uLmdpdmU1LnBsXC9idXp6Lmh0bWw_cWlkPWFsaSJ9.MbEBhpRhYnoEeVL1J715MX03FhQfLXEJ-SitVD91JBo
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://654.pl/Dff9dW1C?keyword=capitalone.global+&cost=0.0007&external_id=86892993821&creative_id=@@CREATIVE-ID@@&ad_campaign_id=AdSense+MGID&source=433982748
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://654.pl/Dff9dW1C?keyword=capitalone.global+&cost=0.0007&external_id=86892993821&creative_id=@@CREATIVE-ID@@&ad_campaign_id=AdSense+MGID&source=433982748

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.3.15
last-modified: Thu, 26 Aug 2021 07:04:46 GMT
cache-control: no-cache, no-store, must-revalidate,post-check=0,pre-check=0
pragma: no-cache
expires: 0
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bM0DjHEQUmBDwdIwfiF8HG6vEyHsY6PDLeFHayLQyaEh9R6HpMdT0yz8SVrvEOq8qepgKh0Wk%2FVEF9nLxfWeOXSxYxxFqCqTUB6VH7K2E8y53i4K3a1gQ1y%2Fa%2BAd73S85%2BzMZPU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 684b3650e9452c2a-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 Primary Request buzz.html Show response
mafiacorruption.give5.pl/ 7 KB
2 KB 208ms
68ms Document
text/html 213.189.52.246
ECO-ATMAN-PL ECO-...

General

Check archive.org

Show headers Download Go to

Full URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali
Requested by: Host: 654.pl
URL: https://654.pl/gateway.php?frm=dm&token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJodHRwczpcL1wvbWFmaWFjb3JydXB0aW9uLmdpdmU1LnBsXC9idXp6Lmh0bWw_cWlkPWFsaSJ9.MbEBhpRhYnoEeVL1J715MX03FhQfLXEJ-SitVD91JBo
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.189.52.246 , Poland, ASN57367 (ECO-ATMAN-PL ECO-ATMAN-, PL),
Reverse DNS: web37.mydevil.net
Software: nginx /
Resource Hash: 20e710297e7b5612ef924477653bd97f9a437e3ebaefd4d49efd78c1768cf383

Request headers

:method: GET
:authority: mafiacorruption.give5.pl
:scheme: https
:path: /buzz.html?qid=ali
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://654.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://654.pl/

Response headers

server: nginx
date: Thu, 26 Aug 2021 07:05:31 GMT
content-type: text/html
accept-ranges: bytes
last-modified: Mon, 23 Aug 2021 16:30:17 GMT
etag: W/"6123cd19-1b47"
content-encoding: gzip

GET
H2 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/ 156 KB
25 KB 31ms
15ms Stylesheet
text/css 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css

Requested by

Host: mafiacorruption.give5.pl
URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://mafiacorruption.give5.pl
Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601
age: 239389
cdn-cachedat: 08/03/2021 15:16:56
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cdn-proxyver: 1.0
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:09 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: b5d5130d81b0e7b5ebd02af82050a068
cf-ray: 684b365358254a9e-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 core.js Show response
buzz.give5.pl/js/ 178 B
462 B 48ms
22ms Script
application/javascript 2606:4700:3031::ac43:81ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://buzz.give5.pl/js/core.js
Requested by: Host: mafiacorruption.give5.pl
URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:81ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f66d6d09c6d53dbbe999a017d272955497783df2171eed16f9824bd4cd6cbac

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3202
cf-polished: origSize=468
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Sat, 26 Dec 2020 15:22:32 GMT
server: cloudflare
etag: W/"5fe75538-1d4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dYtBD%2Bff6s1ACoid6%2Ft%2B9RTVwnBrlKpB3kgVW0jU5DxCxue7%2BtlTR3LkPYB0rjTCC%2B4EJMaJpgYcSwGxxAji5fXnfdSZrz1C2AAdIzKBTvRBQKzbqMc4TdvEp6cfvCX%2BoK5rTwMUxtCHeUvx"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 684b36536c0f4e20-FRA
cf-bgj: minify

GET
H2 200 a1.jpg
buzz.give5.pl/img/ 31 KB
32 KB 45ms
20ms Image
image/jpeg 2606:4700:3031::ac43:81ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://buzz.give5.pl/img/a1.jpg
Requested by: Host: mafiacorruption.give5.pl
URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:81ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e97d196c37c1bd5825cd9396829015633198f120ad647b9a6f5789306118770f

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3202
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 32013
last-modified: Sat, 28 Mar 2020 09:17:41 GMT
server: cloudflare
etag: "5e7f1635-7d0d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ujm3aArVGkyDCB5W3JUinyekoMrdNH587mtDpg8PM%2BDVtKxX1oYSNqC1O5IsG7SWIt6%2F6UAHAbwua%2FqUlbdUhOjy2AsS5jTeBSPcXn%2FSOKbgUHkQiIWtT7W%2BsWzUQ1rXByk%2BoURvMswtzQji"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 684b36536c104e20-FRA

GET
H3-29 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 139 KB
49 KB 55ms
54ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: mafiacorruption.give5.pl
URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

db0036b2374adbe7d918022156b9ce51374aaa2741d9aa43062eb395cfeb2928

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49969
x-xss-protection: 0
server: cafe
etag: 16663589297142999461
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 26 Aug 2021 07:05:31 GMT

GET
H2 200 a2.jpg
buzz.give5.pl/img/ 45 KB
45 KB 39ms
14ms Image
image/jpeg 2606:4700:3031::ac43:81ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://buzz.give5.pl/img/a2.jpg
Requested by: Host: mafiacorruption.give5.pl
URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:81ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e7885d40f3264fc1c0d85a9174dee55aeb78a8ebe1a4cfc454b7f65126499f9e

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3202
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 45736
last-modified: Tue, 29 Dec 2020 14:51:45 GMT
server: cloudflare
etag: "5feb4281-b2a8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CxUfG81jjLVW09Z4lvStS3oEOD%2F%2B2feOLzGxr4DZR0rC0tgyoQsKWER2uVQL%2Bod66t14l3VfuguodESCh8HIMO9Bhl73K87eaA3Xtel2r%2BrzTHxnlvf4z8FNW3feiRduyphrxvWX4lc9EteP"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 684b36536c124e20-FRA

GET
H2 200 a3.jpg
buzz.give5.pl/img/ 58 KB
58 KB 46ms
21ms Image
image/jpeg 2606:4700:3031::ac43:81ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://buzz.give5.pl/img/a3.jpg
Requested by: Host: mafiacorruption.give5.pl
URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:81ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dde24cb7904b96f77b5cd22744fb531ef188aeb1d46034d12a05abb17b4fe91e

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3202
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 59391
last-modified: Thu, 26 Mar 2020 10:03:35 GMT
server: cloudflare
etag: "5e7c7df7-e7ff"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8DriSpWUAvfO0V3hn8AP9A7O98JB3b%2FcsqDxhAZ0tsqdGmlKYxerOI34dlfaoicxJz8nVP2J4Yl4tWhicU5ajZeI2AXaLYYR%2BBBBNDnUxNju5FsljojAff43M62cevAgNHe0%2FJUQHNFDMg3s"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 684b36536c134e20-FRA

GET
H2 200 jquery-3.4.1.min.js Show response
code.jquery.com/ 86 KB
30 KB 26ms
9ms Script
application/javascript 2001:4de0:ac18::1:a:3b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.4.1.min.js
Requested by: Host: mafiacorruption.give5.pl
URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: gzip
last-modified: Wed, 01 May 2019 21:14:27 GMT
server: nginx
etag: W/"5cca0c33-15851"
vary: Accept-Encoding
x-hw: 1629961531.dop221.fr8.t,1629961531.cds248.fr8.hc,1629961531.cds236.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30638

GET
H2 200 popper.min.js Show response
cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/ 21 KB
8 KB 20ms
6ms Script
application/javascript 2a04:4e42:3::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js

Requested by

Host: mafiacorruption.give5.pl
URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:3::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://mafiacorruption.give5.pl
Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 339479
x-jsd-version: 1.16.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 7510
etag: W/"5309-YvI45zNIx3656GVCan0bfeI8uy0"
x-served-by: cache-fra19146-FRA
x-jsd-version-type: version
date: Thu, 26 Aug 2021 07:05:31 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/ 59 KB
16 KB 33ms
19ms Script
application/javascript 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js

Requested by

Host: mafiacorruption.give5.pl
URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://mafiacorruption.give5.pl
Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601, 617, 617
age: 239389
cdn-cachedat: 2021-08-02 20:41:18
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:09 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 768175ac69b9b8f6eda8e21ca2409db5
cf-ray: 684b365358284a9e-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 ads.js Show response
buzz.give5.pl/js/ 108 B
405 B 45ms
21ms Script
application/javascript 2606:4700:3031::ac43:81ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://buzz.give5.pl/js/ads.js
Requested by: Host: mafiacorruption.give5.pl
URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:81ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17580c0d86278594ab917e09006107e451ce37c1aa8c3cbccbc095d3a96bc367

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3202
cf-polished: origSize=111
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Tue, 24 Mar 2020 09:22:53 GMT
server: cloudflare
etag: W/"5e79d16d-6f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2IFWX56PJWq4hH9uyDpfb8rX8bKWPNfjYih%2B0iyz0AnSM0G%2B9FBhtXoWoUk%2BDQgkdBk6xMGw%2FaPxDWyLTDCWf%2BNwzYqSiNd%2BHtFb3FwFu3g44vTafWxVgW25SWn1AErpgUsVrA5PJDMDbc5Q"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 684b36536c164e20-FRA
cf-bgj: minify

GET
H2 200 buzzcore.js Show response
buzz.give5.pl/js/ 6 KB
2 KB 37ms
13ms Script
application/javascript 2606:4700:3031::ac43:81ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://buzz.give5.pl/js/buzzcore.js
Requested by: Host: mafiacorruption.give5.pl
URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:81ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 64e2dba31f78b874b8954afc77c62e12eec615835861d10d42592e2745bd8d72

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3202
cf-polished: origSize=9397
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Sat, 02 Jan 2021 10:48:04 GMT
server: cloudflare
etag: W/"5ff04f64-24b5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zWdo5fVfaa8T%2BqrxeWPfaVUILZpYamzQrKc0%2FDv6zK%2FB3Pk6ZMred%2BO8AVPRgbwfgK4dTlBB5OoO4CzGb17q7a2PSQ18AuDUtsIabrUOAFeMAkjP5G4zgDzqFWNIBskiNWiEvGOyQW4xDUgI"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 684b36536c154e20-FRA
cf-bgj: minify

GET
H3-29 200 buzz_ali.js Show response
buzz.give5.pl/js/ 47 KB
11 KB 152ms
140ms Script
application/javascript 2606:4700:3031::ac43:81ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://buzz.give5.pl/js/buzz_ali.js?_=1629961531471
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.4.1.min.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:81ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ef6d55b70dbb8831f081f2b1501c3765f4ac5eac3b17a6beec56ab3fdbcec9c

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 23 Aug 2021 16:27:49 GMT
server: cloudflare
etag: W/"6123cc85-ba98"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aTLPcMH4rWgoTFhH7Czjj%2Fi%2BWY3GvxlJq0zQfW9Ig2NyqZu69dBvRGv1KkXRWlHCs9kW8ctclDurRv1HNRqliIgY8ZxWTwmbFbIazSm52XWArPlYj5nhctSEdUZrW4vvK3D74wJIFc6j9Frz"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 684b3653f9f34e44-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H3-29 200 mafiacorruption.give5.pl.js Show response
buzz.give5.pl/js/domain/ 298 B
798 B 24ms
13ms Script
application/javascript 2606:4700:3031::ac43:81ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://buzz.give5.pl/js/domain/mafiacorruption.give5.pl.js
Requested by: Host: buzz.give5.pl
URL: https://buzz.give5.pl/js/buzzcore.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:81ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e070e656e40406177347b878179c4814ff3879184eb180d8c7d498e7212396b

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3202
cf-polished: origSize=320
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Mon, 30 Mar 2020 16:28:26 GMT
server: cloudflare
etag: W/"5e821e2a-140"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PuVDAg2uQJsQkv4NrMEkxm7KdQoaq14Qxih9CW9e1SZcGn%2FiH81731AZrxfmcE%2F93qrnXjPCyzYkjgOyGC7BCI5VlRLszGruJN2ZJASjVF5PZmcokfbYrvhbNZNKUcuKdBOg%2F0t5vXz6iFGQ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 684b3653f9f04e44-FRA
cf-bgj: minify

GET
H3-29 200 adsbygoogle.js Show response
buzz.give5.pl/js/ 117 B
653 B 106ms
96ms Script
application/javascript 2606:4700:3031::ac43:81ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://buzz.give5.pl/js/adsbygoogle.js?_=1629961531472
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.4.1.min.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:81ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 26113d04732be9552fe52b6e082b686f3e49f25a513f4c5add3daab5bb514a4a

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 14 Jul 2020 09:16:38 GMT
server: cloudflare
etag: W/"5f0d77f6-75"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lokoYWVRqrI%2BQ%2FPpGJRHVcPvHETJW6BF7e1HrZ%2BQcRFzoyehu1tj0ar9pHXSZoQpGiaOuJiGLnKPum5QHn8wUW6Vcas4LtLVlo6%2FjKZq87TMFrrEb1NgUeeMb7CvN1HY1ipGFXFdCIoxBKdl"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 684b3653f9eb4e44-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 101 KB
41 KB 41ms
21ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-161423566-1

Requested by

Host: buzz.give5.pl
URL: https://buzz.give5.pl/js/buzzcore.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c304d2c250579b036878a82e8576e1ca7148d0b266715ec0b95dd732d827f3e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41181
x-xss-protection: 0
last-modified: Thu, 26 Aug 2021 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 26 Aug 2021 07:05:31 GMT

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/ 252 KB
93 KB 31ms
31ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2152692467987994&plah=mafiacorruption.give5.pl

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b0cdd883ba5aba9619606b07e5354d7a7d02c613f16304b2be6f14382142a7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95603
x-xss-protection: 0
server: cafe
etag: 14975429524352139583
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 26 Aug 2021 07:05:31 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210823/r20190131/ Frame 55D0 10 KB
5 KB 25ms
6ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210823/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210823/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mafiacorruption.give5.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://mafiacorruption.give5.pl/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 25 Aug 2021 20:25:52 GMT
expires: Wed, 08 Sep 2021 20:25:52 GMT
content-type: text/html; charset=UTF-8
etag: 13836150016441684253
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4591
x-xss-protection: 0
age: 38379
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 mafiacorruption.give5.pl.853142.js Show response
jsc.mgid.com/m/a/ 2 KB
1 KB 115ms
54ms Script
text/javascript 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jsc.mgid.com/m/a/mafiacorruption.give5.pl.853142.js?_=1629961531473
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.4.1.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b70b802dad5dd23e53d9cc781b7ecb387050437d787b5b5e0d97dc241ecc5dc

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: br
cf-cache-status: HIT
age: 7129
last-modified: Wed, 11 Aug 2021 13:27:45 GMT
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-amz-request-id: CAWY6DNE9XFF4CE5
x-amz-id-2: LnuAvKcxgXYPUCo/oCtsfzHNxlykbHGttLPnCnTIFrvT7tQKAqgoBzlYlkL8sRbMXShLYMPZ4fU=
cf-bgj: minify
server: cloudflare
etag: W/"6b522fe3658ed68994bf7d9763b30aae"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=10800
cf-ray: 684b36549c71f13e-ARN
expires: Thu, 26 Aug 2021 10:05:31 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-161423566-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 5340
date: Thu, 26 Aug 2021 05:36:31 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Thu, 26 Aug 2021 07:36:31 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 198 B
655 B 194ms
76ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=mafiacorruption.give5.pl&callback=_gfp_s_&client=ca-pub-2152692467987994

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2152692467987994&plah=mafiacorruption.give5.pl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

1d0551e363afefd6951fe31040426315c8b652243eb8a3d7f7d7fb90adc4a258

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 190
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 34ms
15ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=mafiacorruption.give5.pl

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 35ms
16ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=mafiacorruption.give5.pl

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 03A9 79 KB
26 KB 549ms
548ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3566239f708924b682583e234d3f553fcc75a68ba4e08c5091823d77ef0afd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mafiacorruption.give5.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://mafiacorruption.give5.pl/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 26 Aug 2021 07:05:32 GMT
server: cafe
content-length: 27036
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 26-Aug-2021 07:20:31 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 26 Aug 2021 07:05:32 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 44ms
26ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

99f6048e026a358bcd25087b08a35840836764c0c3a97cd18569a0dab3263b7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629718286636491"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27620
x-xss-protection: 0
expires: Thu, 26 Aug 2021 07:05:31 GMT

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3EB2 82 KB
27 KB 516ms
515ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=6982997067&adk=3470165435&adf=3678850305&pi=t.ma~as.6982997067&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531519&bpp=1&bdt=124&idt=81&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280&correlator=4406628717669&frm=20&pv=1&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=409&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=s1TMwCZclE&p=https%3A//mafiacorruption.give5.pl&dtd=84

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

537b9ea1abe69f9a4e6ac18049d2b491130508a79e6aa0189a04d04fc38838a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=6982997067&adk=3470165435&adf=3678850305&pi=t.ma~as.6982997067&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531519&bpp=1&bdt=124&idt=81&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280&correlator=4406628717669&frm=20&pv=1&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=409&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=s1TMwCZclE&p=https%3A//mafiacorruption.give5.pl&dtd=84
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mafiacorruption.give5.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://mafiacorruption.give5.pl/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 26 Aug 2021 07:05:32 GMT
server: cafe
content-length: 27180
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 26-Aug-2021 07:20:31 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 26 Aug 2021 07:05:32 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C86D 79 KB
26 KB 262ms
262ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2455198909&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531520&bpp=1&bdt=125&idt=87&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280%2C350x280&correlator=4406628717669&frm=20&pv=1&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=713&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=C9hiiCusBy&p=https%3A//mafiacorruption.give5.pl&dtd=90

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

679c31610427ca3a919aab0bb8c0b44fcd28979f729cc31ab3e291e574d4be2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2455198909&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531520&bpp=1&bdt=125&idt=87&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280%2C350x280&correlator=4406628717669&frm=20&pv=1&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=713&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=C9hiiCusBy&p=https%3A//mafiacorruption.give5.pl&dtd=90
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mafiacorruption.give5.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://mafiacorruption.give5.pl/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 26 Aug 2021 07:05:31 GMT
server: cafe
content-length: 27018
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 26-Aug-2021 07:20:31 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 26 Aug 2021 07:05:31 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B13B 90 KB
29 KB 543ms
541ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&adk=1812271804&adf=3025194257&lmt=1629736217&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531531&bpp=1&bdt=135&idt=81&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280%2C350x280%2C350x280&nras=1&correlator=4406628717669&frm=20&pv=1&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=85

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5396b1b62e8910a59dd8a4b4d8d2db164118bca833415ffd309f10efdcb2df41

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2152692467987994&output=html&adk=1812271804&adf=3025194257&lmt=1629736217&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531531&bpp=1&bdt=135&idt=81&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280%2C350x280%2C350x280&nras=1&correlator=4406628717669&frm=20&pv=1&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=4&uci=a!4&fsb=1&dtd=85
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mafiacorruption.give5.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://mafiacorruption.give5.pl/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 26 Aug 2021 07:05:32 GMT
server: cafe
content-length: 29830
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 26-Aug-2021 07:20:31 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 26 Aug 2021 07:05:32 GMT
cache-control: private

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 13ms
13ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=953352534&t=pageview&_s=1&dl=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&dr=https%3A%2F%2F654.pl%2F&ul=en-us&de=UTF-8&dt=Buzz%20news&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAAC~&jid=1588973829&gjid=172432120&cid=1417987516.1629961532&tid=UA-161423566-1&_gid=646436137.1629961532&_r=1&gtm=2ou8n0&z=53494169

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://mafiacorruption.give5.pl
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 mafiacorruption.give5.pl.853142.es6.js Show response
jsc.mgid.com/m/a/ 230 KB
65 KB 90ms
60ms Script
text/javascript 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jsc.mgid.com/m/a/mafiacorruption.give5.pl.853142.es6.js
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/m/a/mafiacorruption.give5.pl.853142.js?_=1629961531473
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1572aa8681bd55ad45761b32225431e257f7040bdba813e640923ed86983e47e

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: br
cf-cache-status: HIT
age: 7129
last-modified: Wed, 11 Aug 2021 13:27:46 GMT
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-amz-request-id: CAWS8V21PAP6GGWN
x-amz-id-2: PkiMmrkXEe+etL9PtCa3GZtoi7rJhi7JqAgByZMs0jcwyRKxM70xyYAM4GpMW+6MGo0Z6tO0ewE=
cf-bgj: minify
server: cloudflare
etag: W/"e5a7a233d06e24d1a44c649a79ac5c79"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=10800
cf-ray: 684b36554f5e1669-ARN
expires: Thu, 26 Aug 2021 10:05:31 GMT

GET
H3-29 200 nordvpn.jpg
buzz.give5.pl/img/ 33 KB
33 KB 18ms
17ms Image
image/jpeg 2606:4700:3031::ac43:81ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://buzz.give5.pl/img/nordvpn.jpg
Requested by: Host: mafiacorruption.give5.pl
URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:81ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 86ab251908c708f9554bea7d86a239bc5767582dd54349b65d546c03ce278c60

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3201
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 33692
last-modified: Sun, 03 Jan 2021 11:50:08 GMT
server: cloudflare
etag: "5ff1af70-839c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MXKoUOAaJxaP2MAjUnYEao2YpsKf5jz5HZLNgm%2FpTnBOFNZUet8SEkbXhMjRui9WmcOE%2B0uAztVPxzKLuPcAvNqRV733dLD8xMxmD8VVLUZ%2FVnL80VnLPD2nCipCSqVt4p4QtUI9oi6fC7Py"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 684b36550c094e44-FRA

GET
H3-29 200 rusvpnlogo.webp
buzz.give5.pl/img/ 21 KB
21 KB 24ms
23ms Image
image/webp 2606:4700:3031::ac43:81ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://buzz.give5.pl/img/rusvpnlogo.webp
Requested by: Host: mafiacorruption.give5.pl
URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:81ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 891b8a6960eb7823a2a952f71c0946adb44548b169616f7c846355f767218a4b

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3201
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 21100
last-modified: Sat, 02 Jan 2021 12:08:59 GMT
server: cloudflare
etag: "5ff0625b-526c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5ig42lBixbrsKVHcAqLIpHlOJX1BuwzCwHK1Tl7CsFUL5pV%2BzvfwtuYmAsx4k7hxcPGnaAgfBk%2FgUeP3m%2BapPJlULGIDqevkuY2Pq9Jy4xTZTwkCYsQE%2Bujlqg%2F32q2AfmU0s95az2zRd1vD"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 684b36550c0b4e44-FRA

GET
H3-29 200 nordpass.png
buzz.give5.pl/img/ 12 KB
13 KB 12ms
11ms Image
image/png 2606:4700:3031::ac43:81ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://buzz.give5.pl/img/nordpass.png
Requested by: Host: mafiacorruption.give5.pl
URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:81ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d4150eb301ce09dde890f20a68175f547dccfc5a71daff184cb2f180b89fd98

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3201
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 12251
last-modified: Sun, 03 Jan 2021 12:10:57 GMT
server: cloudflare
etag: "5ff1b451-2fdb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qs1K0xWmhgciBUKWVNmRwUVLbB4LNUKJN8mqw59veYVWomTbiZYYbTDGFBbl0kWu6Dx8SByXkvRttsQ%2BCysNfCmFRuJBwGpq0qX7hII8t8zNDLp%2Fc7oWK9C8Ll2trBQ96GLx09sxGr%2B6OGbj"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 684b36550c0c4e44-FRA

GET
H2 200 css
fonts.googleapis.com/ Frame C86D 6 KB
1 KB 36ms
16ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2455198909&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531520&bpp=1&bdt=125&idt=87&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280%2C350x280&correlator=4406628717669&frm=20&pv=1&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=713&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=C9hiiCusBy&p=https%3A//mafiacorruption.give5.pl&dtd=90

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fbe1583d8642d89d0c349b00c0125e485dd55976282165a6b5f2d29ea9d44549

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 26 Aug 2021 06:00:14 GMT
server: ESF
date: Thu, 26 Aug 2021 07:05:31 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 26 Aug 2021 07:05:31 GMT

GET
H3-29 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/ Frame C86D 1 KB
857 B 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5d1f3a4ee5a02abdbc66a11aad769dd81cbe4d07f0b3799ff0940ad7b7d6cc1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:59:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 357
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 830
x-xss-protection: 0
server: cafe
etag: 3558876194914413708
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Sep 2021 06:59:34 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210823/r20110914/ Frame C86D 18 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47b2e4e5ae504cbefc5c71d8bab25c4571c65321f1009411150b689dcc2901f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:31:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2066
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7645
x-xss-protection: 0
server: cafe
etag: 13200147268341533873
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Sep 2021 06:31:05 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/ Frame C86D 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:55:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 574
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Sep 2021 06:55:57 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C86D 124 KB
37 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2dc00e6c10812518e5f101fdeef7624851e0431b4931d80e64470b576800f041

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:31 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629718280506303"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38186
x-xss-protection: 0
expires: Thu, 26 Aug 2021 07:05:31 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/ Frame C86D 14 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dbb80dcea54f7729198af5e295a98e3cacc3a66a7c308cda48625042944170b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:15:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3017
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6213
x-xss-protection: 0
server: cafe
etag: 5878208181763659450
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Sep 2021 06:15:14 GMT

GET
H2 200 550517e8bc13b6c9510094b6b7001d9c.js Show response
www.gstatic.com/mysidia/ Frame C86D 26 KB
11 KB 26ms
7ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/550517e8bc13b6c9510094b6b7001d9c.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5469740595a44003b8884f40783d63ac3c9b57e1a00ad6f29c4fff55153717de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 23:06:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28760
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10776
x-xss-protection: 0
last-modified: Wed, 25 Aug 2021 22:05:13 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 23 Nov 2021 23:06:11 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame C86D 0
0 31ms
31ms Fetch
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C1_pHOz0nYei7JpHs3wP0lZmICfyAu-Jk3rvuwocOiZTN2pMOEAEg187oI2CVAqABofzU2gPIAQmoAwHIA8sEqgTbAU_QX5PEfy3PjndXL4eODbtfYW_p-fgJei2_LyqCBURNZAqy9rvK-rjp4z1PJtxvdYjl-eWq0BjIL6YLQ32eJrg84hlPvHYRkWGXVdV3T8ph6cd97EYfMtkeYUDI-lzdsAav3H0l_2x2xx2IhE1eaHIqIAg80YUKm3xMFe9UuxQSx3YuFi7q2pGV_nGa8-ZVUIT1-FU7kOUYsQfOSKwu6iGugTPLMsdpjrRWnm8xPgtklWGl89KQFd_zXlxatF0A2LyF7MaVqvwpyA0GvK2EI3zb4WxdzzQbcnGZ98AErMiQ6dMDkgUECAQYAZIFBAgFGASgBi6AB8eDqyWoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4b2AcA8gcEEOSyKdIICQiA4YAQEAEYH4AKAcgLAdgTDIgUBdAVAZgWAYAXAbIXHAoaCAASFHB1Yi0yMTUyNjkyNDY3OTg3OTk0GAA&sigh=DBxr7rXJH-Q&template_id=484

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2455198909&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531520&bpp=1&bdt=125&idt=87&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280%2C350x280&correlator=4406628717669&frm=20&pv=1&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=713&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=C9hiiCusBy&p=https%3A//mafiacorruption.give5.pl&dtd=90
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 26 Aug 2021 07:05:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 26 Aug 2021 07:05:31 GMT

GET
H3-29 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/4702500289304768779/ Frame C86D 13 KB
13 KB 6ms
6ms Image
image/jpeg 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4702500289304768779/downsize_200k_v1?w=400&h=209

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

178b08d38997b470a47248453473bbe29db6721047d4934b9171a2917a3bd580

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 20 Aug 2021 07:41:07 GMT
x-content-type-options: nosniff
age: 516264
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13105
x-xss-protection: 0
last-modified: Thu, 05 Aug 2021 22:04:49 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 20 Aug 2022 07:41:07 GMT

GET
DATA 200
OK truncated
/ Frame C86D 221 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C86D 0
20 B 27ms
26ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=jca&jc=26&version=r20210823&sample=0.01

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/load_preloaded_resource_fy2019.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame C86D 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 59c5dd4913c822924a2928874327b21b1d41283d1984b4029bd459fd0968ee90

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame C86D 15 KB
16 KB 26ms
6ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 03:00:34 GMT
x-content-type-options: nosniff
age: 187497
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Aug 2022 03:00:34 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame C86D 15 KB
15 KB 28ms
11ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 08:57:53 GMT
x-content-type-options: nosniff
age: 166058
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15732
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Aug 2022 08:57:53 GMT

GET
H3-29 200 UDeKqTBFYaEY2ioWtDs_l49rHnl3Z0jd0o7HlKSj4tA.js Show response
pagead2.googlesyndication.com/bg/ Frame 7383 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/UDeKqTBFYaEY2ioWtDs_l49rHnl3Z0jd0o7HlKSj4tA.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50378aa9304561a118da2a16b43b3f978f6b1e79776748ddd28ec794a4a3e2d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 20:02:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39775
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13427
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 15:08:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Aug 2022 20:02:36 GMT

GET
H2 200 / Show response
c.mgid.com/pv/ 0
281 B 169ms
161ms Script
text/plain 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.mgid.com/pv/?pv=5&cbuster=1629961532119933585372&uniqId=0288e&niet=4g&nisd=false&jsv=es6&ref=https%3A%2F%2F654.pl%2F&cxurl=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&pr=654.pl&lu=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&sessionId=61273d3c-0d0c5&pageView=1&pvid=17b814732d89cd8bb48&site=555901&implVersion=11&dpr=1
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/m/a/mafiacorruption.give5.pl.853142.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:32 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 684b3657eacff13e-ARN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H3-29 200 css
fonts.googleapis.com/ Frame 3EB2 4 KB
617 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=6982997067&adk=3470165435&adf=3678850305&pi=t.ma~as.6982997067&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531519&bpp=1&bdt=124&idt=81&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280&correlator=4406628717669&frm=20&pv=1&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=409&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=s1TMwCZclE&p=https%3A//mafiacorruption.give5.pl&dtd=84

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

abc1bbfb097cfaf4715fe823adb40881f8ed35a943692d5c037945c2fcc56340

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 26 Aug 2021 05:33:21 GMT
server: ESF
date: Thu, 26 Aug 2021 07:05:32 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 26 Aug 2021 07:05:32 GMT

GET
H3-29 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/ Frame 3EB2 1 KB
857 B 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5d1f3a4ee5a02abdbc66a11aad769dd81cbe4d07f0b3799ff0940ad7b7d6cc1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:59:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 358
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 830
x-xss-protection: 0
server: cafe
etag: 3558876194914413708
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Sep 2021 06:59:34 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210823/r20110914/ Frame 3EB2 18 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47b2e4e5ae504cbefc5c71d8bab25c4571c65321f1009411150b689dcc2901f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:31:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2067
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7645
x-xss-protection: 0
server: cafe
etag: 13200147268341533873
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Sep 2021 06:31:05 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/ Frame 3EB2 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:55:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 575
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Sep 2021 06:55:57 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3EB2 124 KB
37 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2dc00e6c10812518e5f101fdeef7624851e0431b4931d80e64470b576800f041

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:32 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629718280506303"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38186
x-xss-protection: 0
expires: Thu, 26 Aug 2021 07:05:32 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/ Frame 3EB2 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dbb80dcea54f7729198af5e295a98e3cacc3a66a7c308cda48625042944170b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:15:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3018
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6213
x-xss-protection: 0
server: cafe
etag: 5878208181763659450
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Sep 2021 06:15:14 GMT

GET
H3-29 200 bf370751b3c301aa27eddd739f5e1f7e.js Show response
www.gstatic.com/mysidia/ Frame 3EB2 26 KB
11 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/bf370751b3c301aa27eddd739f5e1f7e.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e12ca129385ec88177c0fb34c59fd33dd1cd5d4f6531eb1b0b44cab8c3167ac6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 07:56:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83316
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10800
x-xss-protection: 0
last-modified: Thu, 19 Aug 2021 09:42:07 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 23 Nov 2021 07:56:56 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 3EB2 0
0 29ms
29ms Fetch
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cm7LFOz0nYabZJZD13gOW7b2gBPLeuuJkhrDl4owO07Lq4bwhEAEg187oI2CVAqABofzU2gPIAQmoAwHIA8sEqgTWAU_QdcVZ5QT0JNMmhT8ZGu8SMGKDEkajOP6pi_FPVUldjjiNeTkQ_xBUqifpUocR9dcb5_lk0_hhO1StHWpeX310L9tgKezPMY3p1_wQ_K2QpK1YUAx9nkLQX9ZAL_6MEAjaL6k0iEClRlZpVdDgIaeRb4WJoeThdb6RyM7BMxSmEOlCM5cFdTfFmSxAyUiIhINsInKbHUmQ7Ia57lY7mToipJN3LE4nh2MODaUfG4oV-Xq7Px4yqtnJ3-hZNoqKNIPgQg5IW-dVyCPaBJaL8wONTDicB5fABN2yhdTHA5IFBAgEGAGSBQQIBRgEoAYugAfHg6slqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G9gHAPIHBRDgoJgB0ggJCIDhgBAQARgfgAoByAsBuBOIJ9gTDIgUA9AVAZgWAYAXAbIXHAoaCAASFHB1Yi0yMTUyNjkyNDY3OTg3OTk0GAA&sigh=FBdHyH5xG5g&template_id=5000

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=6982997067&adk=3470165435&adf=3678850305&pi=t.ma~as.6982997067&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531519&bpp=1&bdt=124&idt=81&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&prev_fmts=350x280&correlator=4406628717669&frm=20&pv=1&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=409&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=s1TMwCZclE&p=https%3A//mafiacorruption.give5.pl&dtd=84
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 26 Aug 2021 07:05:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/5016084772785612863/ Frame 3EB2 11 KB
11 KB 10ms
6ms Image
image/jpeg 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5016084772785612863/downsize_200k_v1?w=400&h=209

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e3e51c55a0daedacf1e55971617ef30e90c4ecaf357927795c84e61aacbbb7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 20 Aug 2021 07:16:03 GMT
x-content-type-options: nosniff
age: 517769
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10903
x-xss-protection: 0
last-modified: Thu, 05 Aug 2021 22:18:20 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 20 Aug 2022 07:16:03 GMT

GET
DATA 200
OK truncated
/ Frame 3EB2 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 042f46d8f218d56174a24125e07f66072d66236f2c0c6fa6c2edee0d5f8ad5df

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 MGID_plus.svg
cdn.mgid.com/images/logos/ 2 KB
1 KB 40ms
39ms Image
image/svg+xml 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/logos/MGID_plus.svg
Requested by: Host: mafiacorruption.give5.pl
URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 741932350156677164b36a1506347cfd558bc502310bd1d50e246d454c4c1131

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:32 GMT
content-encoding: br
cf-cache-status: HIT
age: 1069
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-amz-request-id: B9201827F81D32DC
x-amz-id-2: oKgOzNf5arXSuLpawmQDb8wF7AHHBYdedIxY85YAn8qIfNXdz81xtOQ1yH8O6og8UfPiWO7QqMs=
last-modified: Tue, 23 Feb 2021 16:22:15 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1614097325/ctime:1614097325/gid:0/gname:root/md5:f7525f3a5f32c6f4a8e9867e9f57ab45/mode:33206/mtime:1614097325/uid:0/uname:root
etag: W/"f7525f3a5f32c6f4a8e9867e9f57ab45"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 684b36584b95f13e-ARN
expires: Fri, 27 Aug 2021 07:05:32 GMT

GET
H2 200 Adchoices.svg
cdn.mgid.com/images/logos/ 836 B
905 B 36ms
35ms Image
image/svg+xml 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/logos/Adchoices.svg
Requested by: Host: mafiacorruption.give5.pl
URL: https://mafiacorruption.give5.pl/buzz.html?qid=ali
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7992a4430843ef8b4bbae534358be3193aa1ae9c78f273e8e8a70b6af1244ac5

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:32 GMT
content-encoding: br
cf-cache-status: HIT
age: 1069
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-amz-request-id: 1D76EA8A206ECCA7
x-amz-id-2: lDknoZ+PjBnoUXPCB23wx2Qe85exuRo8TYxKWQhUypnILC9L/y8Csv7mWGGtYjTXsNVPMSG83Fo=
last-modified: Wed, 17 Feb 2021 18:15:53 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1613585745/ctime:1613585745/gid:0/gname:root/md5:7d59364b7ed2df3f02507c9f92560df9/mode:33206/mtime:1613585745/uid:0/uname:root
etag: W/"7d59364b7ed2df3f02507c9f92560df9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 684b36584b96f13e-ARN
expires: Fri, 27 Aug 2021 07:05:32 GMT

GET
DATA 200
OK truncated
/ Frame 3EB2 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 77b973ec02ed9f8f49e68a50b14d1715f7991c56b3a3d7820fe7e2f60c41a0f2

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 3EB2 16 KB
16 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 12:23:16 GMT
x-content-type-options: nosniff
age: 153736
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Aug 2022 12:23:16 GMT

GET
H3-29 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 3EB2 15 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 06:52:18 GMT
x-content-type-options: nosniff
age: 173594
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Aug 2022 06:52:18 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 03A9 3 KB
578 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

86004aba5435fd4a14892a5f47e53a870f8e8b815b33737be419bee2bef6080e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 26 Aug 2021 05:55:11 GMT
server: ESF
date: Thu, 26 Aug 2021 07:05:32 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 26 Aug 2021 07:05:32 GMT

GET
H3-29 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/ Frame 03A9 1 KB
857 B 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5d1f3a4ee5a02abdbc66a11aad769dd81cbe4d07f0b3799ff0940ad7b7d6cc1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:59:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 358
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 830
x-xss-protection: 0
server: cafe
etag: 3558876194914413708
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Sep 2021 06:59:34 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210823/r20110914/ Frame 03A9 18 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47b2e4e5ae504cbefc5c71d8bab25c4571c65321f1009411150b689dcc2901f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:31:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2067
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7645
x-xss-protection: 0
server: cafe
etag: 13200147268341533873
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Sep 2021 06:31:05 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/ Frame 03A9 2 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:55:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 575
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Sep 2021 06:55:57 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 03A9 124 KB
37 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2dc00e6c10812518e5f101fdeef7624851e0431b4931d80e64470b576800f041

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:32 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629718280506303"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38186
x-xss-protection: 0
expires: Thu, 26 Aug 2021 07:05:32 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/ Frame 03A9 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dbb80dcea54f7729198af5e295a98e3cacc3a66a7c308cda48625042944170b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:15:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3018
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6213
x-xss-protection: 0
server: cafe
etag: 5878208181763659450
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Sep 2021 06:15:14 GMT

GET
H3-29 200 bf370751b3c301aa27eddd739f5e1f7e.js Show response
www.gstatic.com/mysidia/ Frame 03A9 26 KB
11 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/bf370751b3c301aa27eddd739f5e1f7e.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e12ca129385ec88177c0fb34c59fd33dd1cd5d4f6531eb1b0b44cab8c3167ac6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 07:56:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83316
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10800
x-xss-protection: 0
last-modified: Thu, 19 Aug 2021 09:42:07 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 23 Nov 2021 07:56:56 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 03A9 0
0 29ms
29ms Fetch
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=ClOyCOz0nYcOvJY_z3wPX1JuYCPLeuuJkhrDl4owO07Lq4bwhEAEg187oI2CVAqABofzU2gPIAQGoAwHIA8sEqgTTAU_Qg1wSvMCRTWqYVHgvCHwhwjjAhWx26v2fRKCbm2UYkaJ-npn8LN4_bFJr_IRmOhuIYOtL_91IhUQ0-2IEJQWOZGK2XueTzLK9lGuXvGNH1MgB28yJOLG1lnduabyzdPnA6ZP5C4r-CZQMH3A84oStvmteg2Be4VIIuOFKhEr4seS9NPcUFBUTp5yoDFpwq4-VwfxeFHAynjSeSZStOa4xXB1jrbSdFzXOZKQ7tFekcDoY6JNHE55HF89cZuwh8YwfHvHCu4n-84JJHxjnMaxLfTDABN2yhdTHA5IFBAgEGAGSBQQIBRgEgAfHg6slqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G9gHAfIHBBCrzj3SCAkIgOGAEBABGB-ACgHICwHYEwyIFAPQFQGYFgGAFwGyFxwKGggAEhRwdWItMjE1MjY5MjQ2Nzk4Nzk5NBgA&sigh=vwDQTSkkPco

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 26 Aug 2021 07:05:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 UDeKqTBFYaEY2ioWtDs_l49rHnl3Z0jd0o7HlKSj4tA.js Show response
pagead2.googlesyndication.com/bg/ Frame 945A 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/UDeKqTBFYaEY2ioWtDs_l49rHnl3Z0jd0o7HlKSj4tA.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50378aa9304561a118da2a16b43b3f978f6b1e79776748ddd28ec794a4a3e2d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 20:02:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39776
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13427
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 15:08:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Aug 2022 20:02:36 GMT

GET
H3-29 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/ 145 KB
52 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202108240101/reactive_library_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1de99147afacbb50162e8573f613c879dba94f7d96387cbf2e69d761d1537e0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53273
x-xss-protection: 0
server: cafe
etag: 11300002193737632522
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 26 Aug 2021 07:05:32 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame AD97 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn4nNEny-7owNupBA8aCoptUU-SbyoP3QACSYTizzlNKcy8wdvJk0qS8g8YNB0; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 26 Aug 2021 06:42:58 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1354
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 03A9 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7dce1ae5b03c92ed89e637a3375d6cb35447f5295d389d04d8c5b36cd49da325

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v35/ Frame 03A9 21 KB
21 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v35/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 22:35:34 GMT
x-content-type-options: nosniff
age: 116998
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21660
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 00:01:04 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Aug 2022 22:35:34 GMT

GET
H3-29 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v35/ Frame 03A9 21 KB
21 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v35/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 00:01:15 GMT
x-content-type-options: nosniff
age: 111857
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21424
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 00:00:52 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Aug 2022 00:01:15 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 29ms
15ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=mafiacorruption.give5.pl

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 26 Aug 2021 07:05:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 26ms
23ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=mafiacorruption.give5.pl

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 26 Aug 2021 07:05:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210823/r20110914/ Frame 2F89 10 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210823/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210823/r20110914/zrt_lookup.html?fsb=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mafiacorruption.give5.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn4nNEny-7owNupBA8aCoptUU-SbyoP3QACSYTizzlNKcy8wdvJk0qS8g8YNB0; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://mafiacorruption.give5.pl/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 25 Aug 2021 17:30:04 GMT
expires: Wed, 08 Sep 2021 17:30:04 GMT
content-type: text/html; charset=UTF-8
etag: 13836150016441684253
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4591
x-xss-protection: 0
age: 48928
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame AD97
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

39ms
39ms

Document
text/html

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn4nNEny-7owNupBA8aCoptUU-SbyoP3QACSYTizzlNKcy8wdvJk0qS8g8YNB0; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 26 Aug 2021 07:05:32 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Thu, 26-Aug-2021 08:05:32 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 26 Aug 2021 07:05:32 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 26 Aug 2021 07:05:32 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 UDeKqTBFYaEY2ioWtDs_l49rHnl3Z0jd0o7HlKSj4tA.js Show response
pagead2.googlesyndication.com/bg/ Frame C6F3 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/UDeKqTBFYaEY2ioWtDs_l49rHnl3Z0jd0o7HlKSj4tA.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2152692467987994&output=html&h=280&slotname=1318854264&adk=2078529032&adf=2772626519&pi=t.ma~as.1318854264&w=350&fwrn=4&fwrnh=100&lmt=1629736217&rafmt=1&psa=0&format=350x280&url=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1629961531514&bpp=5&bdt=119&idt=59&shv=r20210823&mjsv=m202108240101&ptt=9&saldr=aa&abxe=1&correlator=4406628717669&frm=20&pv=2&ga_vid=1417987516.1629961532&ga_sid=1629961532&ga_hid=953352534&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1005&ady=105&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44747621%2C31062297&oid=2&pvsid=1531204449574376&ref=https%3A%2F%2F654.pl%2F&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&fsb=1&xpc=thodNbuAX4&p=https%3A//mafiacorruption.give5.pl&dtd=76

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50378aa9304561a118da2a16b43b3f978f6b1e79776748ddd28ec794a4a3e2d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 20:02:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39776
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13427
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 15:08:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Aug 2022 20:02:36 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 2F89 0
0 29ms
29ms Fetch
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CKRugOz0nYf_GJpKFjuwP76qB4AHy3rriZNOlgp-pDtOy6uG8IRABINfO6CNglQKgAaH81NoDyAECqAMByAPJBKoE1wFP0Ceqv54KB14vcmevEOTuSxDIrHUe12bX7ISBH0UXbMZ6ivDINVmGkD7-JUi_F-5UU4iZQHxv1kzwksP_OPA1a1kG8Y1A3IqFQKpz7T7HV09R0tthHGbAFrYwSpZ5gfRMLOebZw5HuJbgioO2U0We-I-EFN2gbudqhmv9ryuq5E72P33vQjeU_kwcvVErZNN3yG_qeUEuHum9Bnb53Hok5xjnjPiNPHFEuGZ9dQAzjGbLYAEYqIYYvsOn3pFPOQb6p34qZsElqU1qK9mbDlh1tJUIGUAmgMAE3bKF1McDkgUECAQYAZIFBAgFGASgBgKAB8eDqyWoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4b2AcB8gcEEPy0QtIICQiA4YAQEAEYH4AKAcgLAdgTDNAVAZgWAYAXAbIXHAoaCAASFHB1Yi0yMTUyNjkyNDY3OTg3OTk0GAA&sigh=IzD47wjeKhw

Requested by

Host: capitalone.global
URL: http://capitalone.global/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20210823/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 26 Aug 2021 07:05:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210823/r20110914/ Frame 2F89 18 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210823/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47b2e4e5ae504cbefc5c71d8bab25c4571c65321f1009411150b689dcc2901f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:31:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2067
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7645
x-xss-protection: 0
server: cafe
etag: 13200147268341533873
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Sep 2021 06:31:05 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/ Frame 2F89 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210823/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:55:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 575
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Sep 2021 06:55:57 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2F89 124 KB
37 KB 31ms
31ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210823/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2dc00e6c10812518e5f101fdeef7624851e0431b4931d80e64470b576800f041

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:32 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629718280506303"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38186
x-xss-protection: 0
expires: Thu, 26 Aug 2021 07:05:32 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/ Frame 2F89 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210823/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dbb80dcea54f7729198af5e295a98e3cacc3a66a7c308cda48625042944170b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:15:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3018
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6213
x-xss-protection: 0
server: cafe
etag: 5878208181763659450
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Sep 2021 06:15:14 GMT

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/ Frame 2F89 26 KB
11 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210823/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210823/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ab783786340c2aaf033912cd129fe073a72bf80430e55c330416a0f3ae7fb7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:02:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3808
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10785
x-xss-protection: 0
server: cafe
etag: 3905591444419844499
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Sep 2021 06:02:04 GMT

GET
H3-29 200 10495384981165535132
tpc.googlesyndication.com/simgad/ Frame 2F89 60 KB
60 KB 9ms
8ms Image
image/png 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10495384981165535132?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qllTBjPCAvohehWhdUz9BnriI3uuA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210823/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

401a5a77555d836fc3d9ef6ad40b130aa24248887cc1177d798496d06cd1dcc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 24 Aug 2021 21:12:47 GMT
x-content-type-options: nosniff
last-modified: Fri, 23 Jul 2021 22:49:58 GMT
server: sffe
age: 121965
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61557
x-xss-protection: 0
expires: Wed, 24 Aug 2022 21:12:47 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 53ED 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210823/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/html/r20210823/r20110914/zrt_lookup.html?fsb=1
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn4nNEny-7owNupBA8aCoptUU-SbyoP3QACSYTizzlNKcy8wdvJk0qS8g8YNB0; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/html/r20210823/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 26 Aug 2021 06:42:58 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1354
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 2F89 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 092ce13e042b4e6397fbfd3e70e5ebb357091b5255792ba532230d63e52264f5

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 32ms
18ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210823&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cf2e6b28d3e4ef62b7090068670af0db9f831ba21cf2cfc18fd71eb7f45131e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 26 Aug 2021 07:05:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8649
x-xss-protection: 0

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 53ED
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

39ms
38ms

Document
text/html

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210823/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn4nNEny-7owNupBA8aCoptUU-SbyoP3QACSYTizzlNKcy8wdvJk0qS8g8YNB0; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 26 Aug 2021 07:05:32 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Thu, 26-Aug-2021 08:05:32 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 26 Aug 2021 07:05:32 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 26 Aug 2021 07:05:32 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 UDeKqTBFYaEY2ioWtDs_l49rHnl3Z0jd0o7HlKSj4tA.js Show response
pagead2.googlesyndication.com/bg/ Frame 1AD9 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/UDeKqTBFYaEY2ioWtDs_l49rHnl3Z0jd0o7HlKSj4tA.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210823/r20110914/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50378aa9304561a118da2a16b43b3f978f6b1e79776748ddd28ec794a4a3e2d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 20:02:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39776
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13427
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 15:08:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Aug 2022 20:02:36 GMT

GET
H2 200 1 Show response
servicer.mgid.com/853142/ 5 KB
2 KB 71ms
69ms Script
application/x-javascript 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://servicer.mgid.com/853142/1?pv=5&cbuster=1629961532593190610543&uniqId=0288e&niet=4g&nisd=false&jsv=es6&w=730&h=686&cols=3&ref=https%3A%2F%2F654.pl%2F&cxurl=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&pr=654.pl&lu=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&sessionId=61273d3c-0d0c5&pageView=1&pvid=17b814732d89cd8bb48&implVersion=11&dpr=1
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/m/a/mafiacorruption.give5.pl.853142.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ef4a2cbbbcff84b09b9f6fa8fd8e0ccb42435b8209684cb873a900d7c0a8d4d

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:32 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: application/x-javascript; charset=utf-8
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 684b365acfa0f13e-ARN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 31ms
30ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Thu, 26 Aug 2021 07:05:32 GMT

GET
H2 200 MGID_plus.svg
cdn.mgid.com/images/logos/ 2 KB
1 KB 40ms
40ms Image
image/svg+xml 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/logos/MGID_plus.svg
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/m/a/mafiacorruption.give5.pl.853142.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 741932350156677164b36a1506347cfd558bc502310bd1d50e246d454c4c1131

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:32 GMT
content-encoding: br
cf-cache-status: HIT
age: 1069
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-amz-request-id: B9201827F81D32DC
x-amz-id-2: oKgOzNf5arXSuLpawmQDb8wF7AHHBYdedIxY85YAn8qIfNXdz81xtOQ1yH8O6og8UfPiWO7QqMs=
last-modified: Tue, 23 Feb 2021 16:22:15 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1614097325/ctime:1614097325/gid:0/gname:root/md5:f7525f3a5f32c6f4a8e9867e9f57ab45/mode:33206/mtime:1614097325/uid:0/uname:root
etag: W/"f7525f3a5f32c6f4a8e9867e9f57ab45"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 684b365b5885f13e-ARN
expires: Fri, 27 Aug 2021 07:05:32 GMT

GET
H2 200 Adchoices.svg
cdn.mgid.com/images/logos/ 836 B
774 B 43ms
43ms Image
image/svg+xml 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/logos/Adchoices.svg
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/m/a/mafiacorruption.give5.pl.853142.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7992a4430843ef8b4bbae534358be3193aa1ae9c78f273e8e8a70b6af1244ac5

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:32 GMT
content-encoding: br
cf-cache-status: HIT
age: 1069
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-amz-request-id: 1D76EA8A206ECCA7
x-amz-id-2: lDknoZ+PjBnoUXPCB23wx2Qe85exuRo8TYxKWQhUypnILC9L/y8Csv7mWGGtYjTXsNVPMSG83Fo=
last-modified: Wed, 17 Feb 2021 18:15:53 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1613585745/ctime:1613585745/gid:0/gname:root/md5:7d59364b7ed2df3f02507c9f92560df9/mode:33206/mtime:1613585745/uid:0/uname:root
etag: W/"7d59364b7ed2df3f02507c9f92560df9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 684b365b5888f13e-ARN
expires: Fri, 27 Aug 2021 07:05:32 GMT

GET
H2 200 aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMTAvMTAxOTI0LzUzMGNjOTMwNzlkYzcwMmExZWY1MGFhNGQ4MTZlZGNhLmpwZw.webp
s-img.mgid.com/g/8193523/492x328/0x139x564x376/ 33 KB
34 KB 187ms
127ms Image
image/webp 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/8193523/492x328/0x139x564x376/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMTAvMTAxOTI0LzUzMGNjOTMwNzlkYzcwMmExZWY1MGFhNGQ4MTZlZGNhLmpwZw.webp?v=1629961532-ex3a2upX2nLrkW35xC4PfUXW2eqSqeLW1SzxjjxbXUg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 366ab66d665a9d29fb428c5b9c77acf1adfd319318b283c70b0a26b8bf8ccdb0

Request headers

Origin: https://mafiacorruption.give5.pl
Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:32 GMT
cf-cache-status: HIT
last-modified: Tue, 11 May 2021 12:04:26 GMT
x-mg-request-uuid: 8afde393-a172-4a85-91f1-2d616a77f1b2
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 684b365bb917f13e-ARN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 34164
server: cloudflare

GET
H2 200 aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMTAvMTAxOTI0LzMwZTFkZDE0NjhhNDUxMjZkNWQzM2RhNjYxODI5ZTRhLmpwZWc.webp
s-img.mgid.com/g/8164901/492x328/0x65x849x566/ 14 KB
14 KB 176ms
116ms Image
image/webp 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/8164901/492x328/0x65x849x566/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMTktMTAvMTAxOTI0LzMwZTFkZDE0NjhhNDUxMjZkNWQzM2RhNjYxODI5ZTRhLmpwZWc.webp?v=1629961532-EkPoqjjZzGN-GefQhwOJtV2SU45peVC7xlF-SmaYDkU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02ef66b1e382dc94c0a75f7fee02d17c0421830f47d55899ba57bbdabaf8b5f1

Request headers

Origin: https://mafiacorruption.give5.pl
Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:32 GMT
cf-cache-status: HIT
last-modified: Tue, 11 May 2021 11:20:32 GMT
x-mg-request-uuid: 16ffed65-a71c-4be8-ab7b-82dedbcfcb7d
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 684b365bc91af13e-ARN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 14470
server: cloudflare

GET
H2 200 aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDcvMTAxOTI0LzlmYTIzMDQ1MzdhMzUwMmEwZjcxM2U5MTVmMjlkNmE1LnBuZw.webp
s-img.mgid.com/g/8164914/492x328/0x267x552x368/ 11 KB
11 KB 225ms
164ms Image
image/webp 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/8164914/492x328/0x267x552x368/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDcvMTAxOTI0LzlmYTIzMDQ1MzdhMzUwMmEwZjcxM2U5MTVmMjlkNmE1LnBuZw.webp?v=1629961532-BJGh_4kXQFjJLS3NPZGWvOsyqTs-X0oal_LwtwIrqyE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6a7925cc7b40a9ac25b0c24578d98ad8548e5bf82cb7da9e91b1dbe59a53d0fa

Request headers

Origin: https://mafiacorruption.give5.pl
Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:32 GMT
cf-cache-status: HIT
last-modified: Tue, 11 May 2021 11:02:57 GMT
x-mg-request-uuid: 58924de2-65d9-49c5-bb02-2a59fc8d4d97
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 684b365bc921f13e-ARN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 10752
server: cloudflare

GET
H2 200 aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDUvMTAxOTI0LzVmMmU3MmQ2MWFmMTA4NmQ2MzFlMGZmNDlkNjg1NGUwLmpwZWc.webp
s-img.mgid.com/g/8164864/492x328/0x172x1025x683/ 21 KB
21 KB 229ms
169ms Image
image/webp 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/8164864/492x328/0x172x1025x683/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDUvMTAxOTI0LzVmMmU3MmQ2MWFmMTA4NmQ2MzFlMGZmNDlkNjg1NGUwLmpwZWc.webp?v=1629961532-SytrLS5MOuxkHDDEJU085d2dZ7jYPDRA7t4pSX8G9Q0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5387531155b5f950374d7f691a43849be93464af096a4df0b3b7725d0fb7ac70

Request headers

Origin: https://mafiacorruption.give5.pl
Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:32 GMT
cf-cache-status: HIT
last-modified: Tue, 11 May 2021 11:35:59 GMT
x-mg-request-uuid: fd68e2c6-b79a-496a-91b9-c00545752b3a
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 684b365bc922f13e-ARN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 21426
server: cloudflare

GET
H2 200 aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDIvMTAxOTI0L2ZkNzY2MWU0NDcxOTUxMTUxODVlZGNlZjI0MWVjZWRkLnBuZw.webp
s-img.mgid.com/g/8164849/492x328/0x131x607x404/ 18 KB
18 KB 213ms
154ms Image
image/webp 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/8164849/492x328/0x131x607x404/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDIvMTAxOTI0L2ZkNzY2MWU0NDcxOTUxMTUxODVlZGNlZjI0MWVjZWRkLnBuZw.webp?v=1629961532-YRaH5mx3iPNXVQha9Fqc-Qjk8CdGTkCgnXfcBPLshXY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16d2eac72467e8931e76a59088381521c469cd08de7884eb65442a9a7744256b

Request headers

Origin: https://mafiacorruption.give5.pl
Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:32 GMT
cf-cache-status: HIT
last-modified: Tue, 11 May 2021 11:26:37 GMT
x-mg-request-uuid: d733a342-3744-4136-99a8-660a10c9fb59
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 684b365bc923f13e-ARN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 18512
server: cloudflare

GET
H2 200 aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDUvMTAxOTI0LzA2ZWM0NWZkMzdjZmYxNTI4MzVjNjEzMDMxMmE5NjYxLmpwZWc.webp
s-img.mgid.com/g/8164884/492x328/0x0x1001x667/ 21 KB
22 KB 153ms
94ms Image
image/webp 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/8164884/492x328/0x0x1001x667/aHR0cDovL2ltZ2hvc3RzLmNvbS90LzIwMjAtMDUvMTAxOTI0LzA2ZWM0NWZkMzdjZmYxNTI4MzVjNjEzMDMxMmE5NjYxLmpwZWc.webp?v=1629961532-dpNFB0UvCsFj9ZDnTjnmGs8mZhnIRwg7K5WELrARwfU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d51819a214b74682293c64f46e3bb0e75719377b01b5fd7559aca850f9eadcb

Request headers

Origin: https://mafiacorruption.give5.pl
Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:32 GMT
cf-cache-status: HIT
last-modified: Tue, 11 May 2021 11:49:11 GMT
x-mg-request-uuid: 828a0c6a-a557-4334-81fa-da4675036f9b
age: 78779
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 684b365bc926f13e-ARN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 21452
server: cloudflare

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 9AFD 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mafiacorruption.give5.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://mafiacorruption.give5.pl/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Thu, 26 Aug 2021 07:02:52 GMT
expires: Fri, 26 Aug 2022 07:02:52 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 160
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 3051 783 B
958 B 15ms
15ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d79030be3fbff28215738effda75a2cb4d6c4fac5899b342771f03e6f69d57f5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-uUd47Rtue1+5jqDDRzkkNw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://mafiacorruption.give5.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://mafiacorruption.give5.pl/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Thu, 26 Aug 2021 07:05:32 GMT
date: Thu, 26 Aug 2021 07:05:32 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-uUd47Rtue1+5jqDDRzkkNw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 UDeKqTBFYaEY2ioWtDs_l49rHnl3Z0jd0o7HlKSj4tA.js Show response
pagead2.googlesyndication.com/bg/ Frame 9AFD 35 KB
14 KB 24ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/UDeKqTBFYaEY2ioWtDs_l49rHnl3Z0jd0o7HlKSj4tA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50378aa9304561a118da2a16b43b3f978f6b1e79776748ddd28ec794a4a3e2d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 25 Aug 2021 20:02:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39776
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13427
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 15:08:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Aug 2022 20:02:36 GMT

GET
H2 200 i.js Show response
cm.mgid.com/ 1 KB
977 B 64ms
56ms Script
application/javascript 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.mgid.com/i.js?&cbuster=1629961532727164450947
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/m/a/mafiacorruption.give5.pl.853142.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 56bd0fe66b829d19b66d5af4f12a2384d11f58af97799f7c2bc2a099b8ed019a

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:32 GMT
content-encoding: br
cf-cache-status: DYNAMIC
x-mg-request-uuid: f2cc2d21-9b9f-41fd-9528-59b42ddc512b
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: application/javascript
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 684b365ba8fff13e-ARN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
server: cloudflare

GET
H2 200 i-noref.js Show response
cm.mgid.com/ Frame 9D38 19 B
334 B 102ms
101ms Script
application/javascript 104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.mgid.com/i-noref.js?cbuster=1629961532739114144882
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/m/a/mafiacorruption.give5.pl.853142.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 31a2141f6b680b8ec183d8de67eaae2ac43bee3ccee46235e0c988761615210c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:32 GMT
content-encoding: br
cf-cache-status: DYNAMIC
x-mg-request-uuid: ba5dd8a8-88a4-4ed0-9543-1e01519a5afa
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: application/javascript
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 684b365bb90bf13e-ARN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
server: cloudflare

GET
H2 200 beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 182ms
59ms Script
application/javascript 13.224.96.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/m/a/mafiacorruption.give5.pl.853142.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.96.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-96-37.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 06:54:51 GMT
content-encoding: gzip
etag: W/"1827f116c73f319409b97f10b8a58ade"
last-modified: Fri, 26 Feb 2021 14:35:05 GMT
server: AmazonS3
age: 641
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 6b0e09b8a7d995016df1513b4b11c17e.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: 4MBWV2DhFpMc1TLSFrOLvLO-MqmjWbWniZgnWSe970Ca301Gl93o5A==

GET
H/1.1 200
OK sync.html Show response
s.adtelligent.com/ Frame 4E2A 1 KB
892 B 1183ms
754ms Document
text/html 2a0c:5c81:5139::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adtelligent.com/sync.html?aid=658327
Requested by: Host: cm.mgid.com
URL: https://cm.mgid.com/i.js?&cbuster=1629961532727164450947
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5139::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: VertaMedia 1.0 /
Resource Hash: 16e04bdf6c116d4ad9220245c02b90483beaee2275b489e27d687f3b519d382e

Request headers

Host: s.adtelligent.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://mafiacorruption.give5.pl/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://mafiacorruption.give5.pl/

Response headers

Server: VertaMedia 1.0
Date: Thu, 26 Aug 2021 07:05:32 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 600
Access-Control-Allow-Origin: https://mafiacorruption.give5.pl
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Encoding: gzip

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 46D8
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=mgid&endpoint=eu
https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=eu

281 B
554 B

151ms
50ms

Document
text/html

104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=eu
Requested by: Host: cm.mgid.com
URL: https://cm.mgid.com/i.js?&cbuster=1629961532727164450947
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://mafiacorruption.give5.pl/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://mafiacorruption.give5.pl/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 23 Feb 2021 20:47:52 GMT
ETag: "402b0-119-5bc0708346e00"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 26 Aug 2021 07:05:33 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=eu
Date: Thu, 26 Aug 2021 07:05:32 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H2 200 /
cm.idealmedia.io/setmuidn/ 0
413 B 127ms
66ms Image
image/gif 104.16.199.73
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.idealmedia.io/setmuidn/?muidf=l7qw3wucxO50
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.199.73 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:32 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 684b365cc8741699-ARN
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif

GET
H/1.1

204
No Content

sync.php
pixel.rubiconproject.com/exchange/
Redirect Chain

https://sync.e-volution.ai/34b9aae5baa016b251b9fc488f4a97cd.gif?puid=l7qw3wucxO50
https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-pashadv&gdpr=&gdpr_consent=&us_privacy=

0
239 B

226ms
66ms

Image
image/gif

69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-pashadv&gdpr=&gdpr_consent=&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
Content-Type: image/gif

Redirect headers

Pragma: no-cache
Date: Thu, 26 Aug 2021 07:05:32 GMT
Server: nginx
Transfer-Encoding: chunked
Location: https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-pashadv&gdpr=&gdpr_consent=&us_privacy=
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Expires: 0

GET
H2

200

RX-d5d5e6cf-0935-4811-b5af-e8b7cba0806d-003
sync.targeting.unrulymedia.com/csync/
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=303&user_id=l7qw3wucxO50
https://x.bidswitch.net/ul_cb/sync?dsp_id=303&user_id=l7qw3wucxO50
https://sync.1rx.io/usersync/bidswitch/3081098c-451d-44a0-9e1e-baf982559549?gdpr=&gdpr_consent=
https://sync.1rx.io/usersync/bidswitch/3081098c-451d-44a0-9e1e-baf982559549?zcc=1&dspret=0&cb=1629961533172
https://sync.targeting.unrulymedia.com/csync/RX-d5d5e6cf-0935-4811-b5af-e8b7cba0806d-003

43 B
395 B

153ms
47ms

Image
image/gif

213.19.147.45
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-d5d5e6cf-0935-4811-b5af-e8b7cba0806d-003
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.45 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:33 GMT
server: Tengine
content-length: 43
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

location: https://sync.targeting.unrulymedia.com/csync/RX-d5d5e6cf-0935-4811-b5af-e8b7cba0806d-003
pragma: no-cache
date: Thu, 26 Aug 2021 07:05:33 GMT
cache-control: no-store, no-cache, must-revalidate
server: Tengine
content-type: text/html
expires: 0

GET
H3-29

200

google
cm.mgid.com/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=marketgid&google_cm=&google_ula={guid}&google_hm=bDdxdzN3dWN4TzUw&muidn=l7qw3wucxO50
https://cm.g.doubleclick.net/pixel?google_nid=marketgid&google_cm=&google_ula={guid}&google_hm=bDdxdzN3dWN4TzUw&muidn=l7qw3wucxO50&google_tc=
https://cm.mgid.com/google?muidn=l7qw3wucxO50&google_ula={guid},5&google_gid=CAESELoyKX4xff9XvtN_fpNDjS0&google_cver=1

0
369 B

66ms
66ms

Image
text/plain

104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.mgid.com/google?muidn=l7qw3wucxO50&google_ula={guid},5&google_gid=CAESELoyKX4xff9XvtN_fpNDjS0&google_cver=1
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:33 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: text/plain
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 684b365e18ee1669-ARN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:33 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.mgid.com/google?muidn=l7qw3wucxO50&google_ula={guid},5&google_gid=CAESELoyKX4xff9XvtN_fpNDjS0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 327
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
cm.lentainform.com/setmuidn/ 0
496 B 127ms
59ms Image
image/gif 104.19.217.61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.lentainform.com/setmuidn/?muidf=l7qw3wucxO50
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.217.61 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:32 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 684b365cfb371695-ARN
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H3-29

200

m
cm.mgid.com/
Redirect Chain

https://creativecdn.com/cm-notify?pi=mgid
https://creativecdn.com/cm-notify?pi=mgid&tc=1
https://cm.mgid.com/m?cdsp=501037&c=WWSeQ5pRZwevty3Cpv4z&pi=mgid&tc=1

43 B
506 B

61ms
61ms

Image
image/gif

104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.mgid.com/m?cdsp=501037&c=WWSeQ5pRZwevty3Cpv4z&pi=mgid&tc=1
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:33 GMT
cf-cache-status: DYNAMIC
x-mg-request-uuid: 691461d6-95c1-4aa7-9be1-574f32bcc1a4
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: image/gif
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 684b365e08ae1669-ARN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
server: cloudflare

Redirect headers

location: https://cm.mgid.com/m?cdsp=501037&c=WWSeQ5pRZwevty3Cpv4z&pi=mgid&tc=1
pragma: no-cache
date: Thu, 26 Aug 2021 07:05:33 GMT, Thu, 26 Aug 2021 07:05:33 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

m
cm.mgid.com/
Redirect Chain

https://x.bidswitch.net/sync?ssp=mgid
https://x.bidswitch.net/ul_cb/sync?ssp=mgid
https://sonata-notifications.taptapnetworks.com/web/cookie/bidswitch/sync?bidswitch_ssp_id=mgid&bsw_custom_parameter=3081098c-451d-44a0-9e1e-baf982559549&gdpr=&gdpr_consent=&gdpr_pd=
https://x.bidswitch.net/sync?dsp_id=413&ssp=mgid&user_id=csonata_782c9d42-7c8c-4c09-9293-ab8cfa158b51&bsw_param=3081098c-451d-44a0-9e1e-baf982559549&expires=10
https://cm.mgid.com/m?cdsp=433145&c=3081098c-451d-44a0-9e1e-baf982559549&gdpr=&gdpr_consent=&us_privacy=

43 B
522 B

59ms
58ms

Image
image/gif

104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.mgid.com/m?cdsp=433145&c=3081098c-451d-44a0-9e1e-baf982559549&gdpr=&gdpr_consent=&us_privacy=
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:33 GMT
cf-cache-status: DYNAMIC
x-mg-request-uuid: 6e45f39f-cbee-4c76-bcc6-f0a19ecea587
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: image/gif
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 684b365efabd1669-ARN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
server: cloudflare

Redirect headers

location: //cm.mgid.com/m?cdsp=433145&c=3081098c-451d-44a0-9e1e-baf982559549&gdpr=&gdpr_consent=&us_privacy=
date: Thu, 26 Aug 2021 07:05:33 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3-29

200

m
cm.mgid.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=omn67hl&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=omn67hl&ttd_tpi=1
https://cm.mgid.com/m?cdsp=371158&c=a9a9e4c1-1b0b-43c3-856e-15d1a99e3043&ttl=1632553533

43 B
506 B

65ms
65ms

Image
image/gif

104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.mgid.com/m?cdsp=371158&c=a9a9e4c1-1b0b-43c3-856e-15d1a99e3043&ttl=1632553533
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:33 GMT
cf-cache-status: DYNAMIC
x-mg-request-uuid: 82e0bee3-1eb0-4c1e-a948-9e83413636a8
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: image/gif
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 684b365e597f1669-ARN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
server: cloudflare

Redirect headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:33 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.mgid.com/m?cdsp=371158&c=a9a9e4c1-1b0b-43c3-856e-15d1a99e3043&ttl=1632553533
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 205

GET
H3-29 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 61ms
60ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gda_r20210823&jk=1531204449574376&bg=!6uml6a3NAAYXVutgF1Y7ACkAdvg8WoESP1MHaVwZe1fX7ZzYFzW-K8M9bjgnjSAqX-4wftNPF45DYwIAAABsUgAAAApoAQcKARSFCH1IQ16j0JzaSlwAfy2EIInxMXfJn-FkfcnOyF0WWwvMFNU00T8GMgUFzqBm9c8AI2foSk7FZtXMQ5GOzuFhZxT3FNPWEvPx0z5Kvc_WC8XdCF2ZbBxUFEtZVlWm-NdvTr36J3rZSUX3pQ85ATzDXowpBDsCIKQfcgIuADMhHcFgQCdFq8PeWmznRBedkbaKupLcnhtxUZnqAonUVWbFzghQSzSYHFj4FrrTvDG8vs1cPB1O-gtqQ9wFCCmKYT7qd5vYjVvWsTx7lqjIzxuqy2IrQFPxa_esfE7VOR9yOgIZ1KPOQAigqmVT65soXiwZHfXl9XJzdzgSWZGZzrNe7YsEEQYGLuiUr_TewDRm82HoBimZAndx0q3su0cHMwP5P7jJPHG9QpjzrXfYMwGmzarABAFMkytavLHQ7mA-rG-jrUynscDM-XjtC9CiZJvo0HRah3coIVatr1x7sepyiArxCiBRgq9L3Kg36uY6hORDgdZPSlccrK1qmYAMLqec4MULmR9U7zV6qP9pbZ6Jztfbgn_e3Gzjhe9x1q8pfIa-omVW0SVtk94tU5ZcUjnOJbdiJS9C6xChHQpANPE2Ec9m8G_JelCnvmFJQfBYjona5PnUe4IezGhBQXNZdl_eie4dyYz4pPsm7_qDBGOr8vYhYYJ7NxajLAHVmtKDPrXO_UAoobLj3PVOh8VcrRsRj0J14Hs4tqONiYWapllp-NRmZgVNYKF8niaUvtAfYL14ebMVEIQaEa9f3wGtvtPxM9oMrQ7NYoeD5MFLqnSPs1g4hZrWH1Gz_K0n6Hn-wCqc4KOxOfviUaSsX4yZRxGf9Lvej6dY40l3cNLJkLxkKO_XYh7U0552KFzul_S7DXB7Wb-Phz4gT5D3v0S4Z1HOXemwEfvQpc70vFn922YKWz_78M18sJUeVl7BHBf64Tj-5kShzQY_qawWItY5jhmItbDPr6KIct1JWYtVSqJ5Y2J__TFY4GFWbznZp4fIASz5J2J6v9u2sBu-hBlantI1Ar8pS1vmIMcnO-mJkwWCOrfwvITxFGpHFjDsiMSq-O715IvXgw-BVfO5YmnskP2DyJezU9WMEbDPAlyp85x0_h4WjK6vIVWp_p0Oh-UW0pCNu3f-HNamkCeGaYd1Fj9-NWDb6htWRbQfRSE1C_vRTeiSbJ6fLf3EW6CPVCu3kpZ8D4sv2PT-KUAAB14_
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C86D 42 B
64 B 29ms
28ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssHCz2S2LTGG10U2GyBa6Vbq4lnKPC-kv_gFIGcJHQSHEX6k8JJIUVirofN2JF28cn83VPndLepY-jh2C5z0AGwLFGt5AWmV1kyb4tmSUjfbMABo9TwAbKSm5VBYw&sai=AMfl-YTH4AwNjwm4lDkwhdcctJSyT8oewv7MBb29xVx32oet2ACKcdg5HvSl2-eUnNfFuwiAQKjFn4xj6Gg6&sig=Cg0ArKJSzN4hkYfV9BEIEAE&id=lidar2&mcvt=1001&p=713,1005,993,1355&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20210823&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=2078529032&rs=2&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1629961531610&rpt=363&msd=0&r=v&speed=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=7&c2=15208452&c3=110&ns__t=1629961533024&ns_c=UTF-8&cv=3.5&c8=Buzz%20news&c7=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&c9=https%3A%2F%2F65...
https://sb.scorecardresearch.com/b2?c1=7&c2=15208452&c3=110&ns__t=1629961533024&ns_c=UTF-8&cv=3.5&c8=Buzz%20news&c7=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&c9=https%3A%2F%2F6...

64 B
330 B

67ms
66ms

Image
image/gif

13.224.96.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=7&c2=15208452&c3=110&ns__t=1629961533024&ns_c=UTF-8&cv=3.5&c8=Buzz%20news&c7=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&c9=https%3A%2F%2F654.pl%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.96.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-96-37.zrh50.r.cloudfront.net
Software: /
Resource Hash: 831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd

Request headers

Referer: https://mafiacorruption.give5.pl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 26 Aug 2021 07:05:33 GMT
via: 1.1 6b0e09b8a7d995016df1513b4b11c17e.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
etag: W/"40-jHLN3x5dWpBzaQm4lkBmDWvrjrg"
x-cache: Miss from cloudfront
content-type: image/gif; charset=utf-8
content-length: 64
x-amz-cf-id: 9Z6_zu9Y4sLGdOh-0cYjkrWtFTUs7aWjzdY4W2vxzV3no6V6jxgvMA==

Redirect headers

date: Thu, 26 Aug 2021 07:05:33 GMT
via: 1.1 6b0e09b8a7d995016df1513b4b11c17e.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
vary: Accept
x-cache: Miss from cloudfront
content-type: text/plain; charset=utf-8
location: https://sb.scorecardresearch.com/b2?c1=7&c2=15208452&c3=110&ns__t=1629961533024&ns_c=UTF-8&cv=3.5&c8=Buzz%20news&c7=https%3A%2F%2Fmafiacorruption.give5.pl%2Fbuzz.html%3Fqid%3Dali&c9=https%3A%2F%2F654.pl%2F
content-length: 227
x-amz-cf-id: nIPdbJTv8JVYSdzvmKOlB78Lcl9YFnT0EZGi6nXnz1MuqDPuB0secw==

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 46D8 31 KB
10 KB 54ms
54ms Script
text/html 104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=eu
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 8b7ca7e21770e52204d1de755a825de2bb57af04e3a2e911baf18ed104206eeb

Request headers

Referer: https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 26 Aug 2021 07:05:33 GMT
Content-Encoding: gzip
Last-Modified: Tue, 24 Aug 2021 22:28:27 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=73931
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9358
Expires: Fri, 27 Aug 2021 03:37:44 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 46D8 284 B
536 B 205ms
50ms Image
image/jpg 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=mgid&endpoint=eu
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Content-Type: image/jpg

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3EB2 42 B
64 B 30ms
29ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst-Q4vomZcUihKA2NTnCGrpjix2HEb-dIqlD4EoJlMNSeB7RC9Lo3wUHrqGEC0Pht7UDCLOsIV4BYS-bvtd6o7lkQ7Vcvu1_As51sxhUGtadciolFJcsSAEOG9sVg&sai=AMfl-YQd0nV31hgcvI5zHVF9CD0m3jrFTik-detcK1R1KmwBsMMGycXiKc3WA_FqJtiCC5opayE7ptKNzyUE&sig=Cg0ArKJSzIZxF_zI4XJSEAE&id=lidar2&mcvt=1001&p=409,1005,689,1355&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20210823&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=3470165435&rs=2&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1629961531604&dlt=518&rpt=672&msd=0&r=v&speed=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 03A9 42 B
64 B 30ms
29ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsunGZFB0Ncvtpp8T90JKFDTdCCyrbhdwuu0MnAosL6I-YpvA1UDtKX09Bs1ZO922NQJL9LiLIFiPBZ8rO06l5R90MIetUxHYKSlH6-AkEUxPlIHZ-AdvMib1MFgOA&sai=AMfl-YTts45T7PEGaGd67O4tXQ0LHI8k3To2GaTD-WNtZDIbW0hWYo87oGfctdL5Bt6OBC5-1CIUMEXlR6FW&sig=Cg0ArKJSzGH5adJzjhxEEAE&id=lidar2&mcvt=1001&p=105,1005,385,1355&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20210823&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=2078529032&rs=2&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1629961531591&dlt=283&rpt=845&msd=0&r=v&speed=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2F89 42 B
64 B 30ms
29ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuXyhenL2wRt5MQ-nU_hI-zeKLgVg1Tp-1ggLxYls_5358yg_TX6NiedwEukW9HI3_iprJsAEQzHQh3YIfr5g354t-p5Lfn6zSyG8pH_BPnrKQJtGYHe4QK17qbIA&sai=AMfl-YTDpyjWTccDa_yYuRn68QvtYcUUpG5Qth0JFcg8Qq3T-1AR8l-7eLZy3Il6qdzAqQk2nvkps2HnGWbQ&sig=Cg0ArKJSzBzAbUnqkNSxEAE&id=lidar2&mcvt=1000&p=1106,298,1230,1303&mtos=109,794,1000,1143,1273&tos=109,685,206,143,130&v=20210823&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=4&adk=1812271801&rs=2&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1629961532419&dlt=5&rpt=147&msd=0&r=v&speed=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

m
cm.mgid.com/ Frame 4E2A
Redirect Chain

https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fcm.mgid.com%2Fm%3Fcdsp%3D617666%26c%3D%7Buid%7D
https://cm.mgid.com/m?cdsp=617666&c=7c476c232232dc4b

43 B
503 B

61ms
61ms

Image
image/gif

104.19.135.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.mgid.com/m?cdsp=617666&c=7c476c232232dc4b
Requested by: Host: s.adtelligent.com
URL: https://s.adtelligent.com/sync.html?aid=658327
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.135.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer: https://s.adtelligent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Aug 2021 07:05:34 GMT
cf-cache-status: DYNAMIC
x-mg-request-uuid: fe6c85ce-e210-492b-87a8-40b5e1a4f3dc
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: image/gif
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 684b36670c6af13e-ARN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
server: cloudflare

Redirect headers

Location: https://cm.mgid.com/m?cdsp=617666&c=7c476c232232dc4b
Date: Thu, 26 Aug 2021 07:05:33 GMT
Server: VertaMedia 1.0
Etag: 7c476c232232dc4b
Content-Length: 0

Verdicts & Comments Add Verdict or Comment

129 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-20 06:07:37	Name: IDE Value: AHWqTUn4nNEny-7owNupBA8aCoptUU-SbyoP3QACSYTizzlNKcy8wdvJk0qS8g8YNB0
.give5.pl/	1970-01-19 20:47:27	Name: _gid Value: GA1.2.646436137.1629961532
mafiacorruption.give5.pl/	1969-12-31 23:59:59	Name: MarketGidStorage Value: %7B%220%22%3A%7B%22svspr%22%3A%22https%3A%2F%2F654.pl%2F%22%2C%22svsds%22%3A1%2C%22TejndEEDj%22%3A%22S98d378gN%22%7D%2C%22C853142%22%3A%7B%22page%22%3A1%7D%7D
.doubleclick.net/	1970-01-19 20:46:02	Name: test_cookie Value: CheckForPermission
.give5.pl/	1970-01-19 20:46:01	Name: _gat_gtag_UA_161423566_1 Value: 1
.doubleclick.net/	1970-01-19 20:46:05	Name: DSID Value: NO_DATA
.give5.pl/	1970-01-20 06:07:37	Name: __gads Value: ID=6531e1274761fa21-222bbb96b6c900d7:T=1629961531:RT=1629961531:S=ALNI_MZXAkPUTGTEbCYBaIoekKvxy_L9uQ
.give5.pl/	1970-01-20 14:17:13	Name: _ga Value: GA1.2.1417987516.1629961532

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	debug	URL: https://jsc.mgid.com/m/a/mafiacorruption.give5.pl.853142.es6.js(Line 1) Message: [object HTMLImageElement]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

654.pl
adservice.google.com
adservice.google.de
buzz.give5.pl
c.mgid.com
capitalone.global
cdn.jsdelivr.net
cdn.mgid.com
cm.g.doubleclick.net
cm.idealmedia.io
cm.lentainform.com
cm.mgid.com
code.jquery.com
creativecdn.com
eus.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
jsc.mgid.com
mafiacorruption.give5.pl
match.adsrvr.org
mybetterdl.com
p237996.mybetterdl.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.rubiconproject.com
s-img.mgid.com
s.adtelligent.com
sb.scorecardresearch.com
secure-assets.rubiconproject.com
servicer.mgid.com
sonata-notifications.taptapnetworks.com
stackpath.bootstrapcdn.com
sync.1rx.io
sync.adtelligent.com
sync.e-volution.ai
sync.targeting.unrulymedia.com
token.rubiconproject.com
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
x.bidswitch.net
104.109.78.125
104.16.199.73
104.19.135.78
104.19.217.61
109.206.188.82
13.224.96.37
142.250.184.226
142.250.185.226
173.192.101.24
18.184.223.197
185.184.8.65
2.19.35.65
2001:4de0:ac18::1:a:3b
213.189.52.246
213.19.147.45
2606:4700:3031::ac43:81ea
2606:4700:3035::6815:625
2606:4700:3036::ac43:9acc
2606:4700::6812:bcf
2a00:1450:4001:802::2003
2a00:1450:4001:808::2002
2a00:1450:4001:80e::200e
2a00:1450:4001:80f::2002
2a00:1450:4001:80f::200a
2a00:1450:4001:810::2008
2a00:1450:4001:813::200a
2a00:1450:4001:827::200e
2a00:1450:4001:828::2002
2a00:1450:4001:829::2001
2a00:1450:4001:82a::2003
2a00:1450:4001:82b::2004
2a00:1450:4001:831::2003
2a04:4e42:3::485
2a0c:5c81:5139::2
35.156.165.31
62.149.0.72
69.173.144.138
69.173.144.165
72.52.178.23
76.223.111.131
02ef66b1e382dc94c0a75f7fee02d17c0421830f47d55899ba57bbdabaf8b5f1
042f46d8f218d56174a24125e07f66072d66236f2c0c6fa6c2edee0d5f8ad5df
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
092ce13e042b4e6397fbfd3e70e5ebb357091b5255792ba532230d63e52264f5
0e070e656e40406177347b878179c4814ff3879184eb180d8c7d498e7212396b
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
0ef4a2cbbbcff84b09b9f6fa8fd8e0ccb42435b8209684cb873a900d7c0a8d4d
1572aa8681bd55ad45761b32225431e257f7040bdba813e640923ed86983e47e
16d2eac72467e8931e76a59088381521c469cd08de7884eb65442a9a7744256b
16e04bdf6c116d4ad9220245c02b90483beaee2275b489e27d687f3b519d382e
17580c0d86278594ab917e09006107e451ce37c1aa8c3cbccbc095d3a96bc367
178b08d38997b470a47248453473bbe29db6721047d4934b9171a2917a3bd580
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d
1d0551e363afefd6951fe31040426315c8b652243eb8a3d7f7d7fb90adc4a258
1de99147afacbb50162e8573f613c879dba94f7d96387cbf2e69d761d1537e0b
1ef6d55b70dbb8831f081f2b1501c3765f4ac5eac3b17a6beec56ab3fdbcec9c
1f66d6d09c6d53dbbe999a017d272955497783df2171eed16f9824bd4cd6cbac
20e710297e7b5612ef924477653bd97f9a437e3ebaefd4d49efd78c1768cf383
26113d04732be9552fe52b6e082b686f3e49f25a513f4c5add3daab5bb514a4a
2dc00e6c10812518e5f101fdeef7624851e0431b4931d80e64470b576800f041
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
31a2141f6b680b8ec183d8de67eaae2ac43bee3ccee46235e0c988761615210c
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
366ab66d665a9d29fb428c5b9c77acf1adfd319318b283c70b0a26b8bf8ccdb0
3e3e51c55a0daedacf1e55971617ef30e90c4ecaf357927795c84e61aacbbb7c
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
401a5a77555d836fc3d9ef6ad40b130aa24248887cc1177d798496d06cd1dcc9
47b2e4e5ae504cbefc5c71d8bab25c4571c65321f1009411150b689dcc2901f5
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
4d4a216b27e5b887e2cdcfaa32f4b7a50bbaee4f65bc190b6cd731b05975d936
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
50378aa9304561a118da2a16b43b3f978f6b1e79776748ddd28ec794a4a3e2d0
537b9ea1abe69f9a4e6ac18049d2b491130508a79e6aa0189a04d04fc38838a8
5387531155b5f950374d7f691a43849be93464af096a4df0b3b7725d0fb7ac70
5396b1b62e8910a59dd8a4b4d8d2db164118bca833415ffd309f10efdcb2df41
5469740595a44003b8884f40783d63ac3c9b57e1a00ad6f29c4fff55153717de
559fc40752edc05768e854e55a99a68d04d96caf7c5e6dbda12b1fcb7af7873a
56bd0fe66b829d19b66d5af4f12a2384d11f58af97799f7c2bc2a099b8ed019a
59c5dd4913c822924a2928874327b21b1d41283d1984b4029bd459fd0968ee90
5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548
5d1f3a4ee5a02abdbc66a11aad769dd81cbe4d07f0b3799ff0940ad7b7d6cc1a
5d4150eb301ce09dde890f20a68175f547dccfc5a71daff184cb2f180b89fd98
613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155
64e2dba31f78b874b8954afc77c62e12eec615835861d10d42592e2745bd8d72
679c31610427ca3a919aab0bb8c0b44fcd28979f729cc31ab3e291e574d4be2a
6a7925cc7b40a9ac25b0c24578d98ad8548e5bf82cb7da9e91b1dbe59a53d0fa
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
741932350156677164b36a1506347cfd558bc502310bd1d50e246d454c4c1131
77b973ec02ed9f8f49e68a50b14d1715f7991c56b3a3d7820fe7e2f60c41a0f2
7992a4430843ef8b4bbae534358be3193aa1ae9c78f273e8e8a70b6af1244ac5
7ab783786340c2aaf033912cd129fe073a72bf80430e55c330416a0f3ae7fb7d
7b70b802dad5dd23e53d9cc781b7ecb387050437d787b5b5e0d97dc241ecc5dc
7dce1ae5b03c92ed89e637a3375d6cb35447f5295d389d04d8c5b36cd49da325
831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd
86004aba5435fd4a14892a5f47e53a870f8e8b815b33737be419bee2bef6080e
86ab251908c708f9554bea7d86a239bc5767582dd54349b65d546c03ce278c60
891b8a6960eb7823a2a952f71c0946adb44548b169616f7c846355f767218a4b
8b7ca7e21770e52204d1de755a825de2bb57af04e3a2e911baf18ed104206eeb
99f6048e026a358bcd25087b08a35840836764c0c3a97cd18569a0dab3263b7b
9b0cdd883ba5aba9619606b07e5354d7a7d02c613f16304b2be6f14382142a7b
9d51819a214b74682293c64f46e3bb0e75719377b01b5fd7559aca850f9eadcb
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
a3566239f708924b682583e234d3f553fcc75a68ba4e08c5091823d77ef0afd9
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
abc1bbfb097cfaf4715fe823adb40881f8ed35a943692d5c037945c2fcc56340
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee
c304d2c250579b036878a82e8576e1ca7148d0b266715ec0b95dd732d827f3e2
c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cf2e6b28d3e4ef62b7090068670af0db9f831ba21cf2cfc18fd71eb7f45131e0
d79030be3fbff28215738effda75a2cb4d6c4fac5899b342771f03e6f69d57f5
db0036b2374adbe7d918022156b9ce51374aaa2741d9aa43062eb395cfeb2928
dbb80dcea54f7729198af5e295a98e3cacc3a66a7c308cda48625042944170b9
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dde24cb7904b96f77b5cd22744fb531ef188aeb1d46034d12a05abb17b4fe91e
dfa6b17abf29dd5bd1056e11260e71d6f40610726af868d5a9d43228594d5771
e12ca129385ec88177c0fb34c59fd33dd1cd5d4f6531eb1b0b44cab8c3167ac6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7885d40f3264fc1c0d85a9174dee55aeb78a8ebe1a4cfc454b7f65126499f9e
e97d196c37c1bd5825cd9396829015633198f120ad647b9a6f5789306118770f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fbe1583d8642d89d0c349b00c0125e485dd55976282165a6b5f2d29ea9d44549
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

mafiacorruption.give5.pl Open in urlscan Pro 213.189.52.246 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

128 Requests

98 %HTTPS

50 %IPv6

30 Domains

45 Subdomains

32 IPs

6 Countries

1459 kBTransfer

3258 kBSize

8 Cookies

14 Outgoing links

Page URL History

Redirected requests

128 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

mafiacorruption.give5.pl Open in urlscan Pro
213.189.52.246 Public Scan

Screenshot
Live screenshot

Full Image

128
Requests

98 %
HTTPS

50 %
IPv6

30
Domains

45
Subdomains

32
IPs

6
Countries

1459 kB
Transfer

3258 kB
Size

8
Cookies

128 HTTP transactions
6 data transactions