sci-hub.mksa.top Open in urlscan Pro
2606:4700:3033::6815:35c2 Malicious Activity! Public Scan

URL: https://vk.com/sci_hub

URL: https://twitter.com/Sci_Hub

URL: https://www.facebook.com/sci.hub.org

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://sci-hub.mksa.top/ HTTP 301
https://sci-hub.mksa.top/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 37

https://counter.yadro.ru/hit;PLUSO?r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1 HTTP 302
https://counter.yadro.ru/hit;PLUSO?q;r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1

Request Chain 52

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEr6d1foupt2dOAVJRV0jEc&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEr6d1foupt2dOAVJRV0jEc&google_cver=1&C=1

Request Chain 53

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YL8QpMNhzCFllgkqECdM-AAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB7NKr8elJp5TsdU-PE9fOo&google_cver=1

Request Chain 54

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEFfsJ46xMTJnJaYHVmoHyLk&google_cver=1

Request Chain 55

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjQ4ODQ4NTc3MTAwNTE3MTgyMw%3D%3D

Request Chain 72

https://p1.ntvk1.ru/nps HTTP 302
https://optinder.com/cro

Request Chain 84

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB7NKr8elJp5TsdU-PE9fOo&google_cver=1

Request Chain 85

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YL8QpBn1a.82dyXwzKrNTAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB7NKr8elJp5TsdU-PE9fOo&google_cver=1&google_hm=2

Request Chain 86

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEPjVXrB4D8l5ZGIsfJY7i3A&google_cver=1

Request Chain 87

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjQ4ODQ4NTc3MTAwNTE3MTgyMw%3D%3D

Request Chain 129

https://groupelaposte.solution.weborama.fr/fcgi-bin/dispatch.fcgi?a.A=im&a.si=322&a.te=221447&a.he=1&a.wi=1&a.hr=p&gdpr=&gdpr_consent=&a.ra=[RANDOM] HTTP 302
https://groupelaposte.solution.weborama.fr/fcgi-bin/dispatch.fcgi?g.bo=OK&g.rn=944079&a.A=im&a.si=322&a.te=221447&a.he=1&a.wi=1&a.hr=p&gdpr=&gdpr_consent=&a.ra=[RANDOM] HTTP 302
https://laboutique.commander1.com/v3/?tcs=1491&rand=799840&chn=DisplayConqueteTrafic&src=NumberlyDisplay&cmp=2021_BNUM_TF_Mobilite_Trafic&med=&pub=&crtive=&vson=BNUM_TF_MOBILITE_PART_ALL-DEVICES_NativeAds_REEX-jour_TRAFIC_DV360&fmt=1x1&adgrp=&sem_kw=&aff_id=&aff_name=&url= HTTP 302
https://laboutique.commander1.com/v3/?firsttime=1&tcs=1491&rand=799840&chn=DisplayConqueteTrafic&src=NumberlyDisplay&cmp=2021_BNUM_TF_Mobilite_Trafic&med=&pub=&crtive=&vson=BNUM_TF_MOBILITE_PART_ALL-DEVICES_NativeAds_REEX-jour_TRAFIC_DV360&fmt=1x1&adgrp=&sem_kw=&aff_id=&aff_name=&url=

Request Chain 134

https://dmg.digitaltarget.ru/1/7210/i/i?i=134415495931432.364685246678284&c=tg:adcm_pc HTTP 302
https://dmg.digitaltarget.ru/1/7210/i/i?i=134415495931432.364685246678284&c=tg:adcm_pc&q=scc

Request Chain 135

https://dmg.digitaltarget.ru/1/6534/i/i?i=134415495931432.354863675427985&c=tg:adcm_pc HTTP 307
https://dmg.digitaltarget.ru/awg/custom/6534/i/i?call_source=awg&i=134415495931432.354863675427985&c=tg:adcm_pc HTTP 307
https://fnc.rt.ru/1/6532/i/i?i=Q6-t5IBXlnrNPSi7ik4S&c=tg:rds_6534 HTTP 302
https://fnc.rt.ru/1/6532/i/i?i=Q6-t5IBXlnrNPSi7ik4S&c=tg:rds_6534&q=scc HTTP 302
https://dmg.digitaltarget.ru/1/6533/i/i?i=715571001618453762141000000003215986&a=774&e=k5PbhZmoi55r5555K85z

Request Chain 136

https://dmg.digitaltarget.ru/1/1086/i/i?i=134415495931432.603328523202432&a=86&e=5EFC831F4710BF602E0BE28402376F4F&c=ss:86.up:5EFC831F4710BF602E0BE28402376F4F.sync:up.xdua:duSzgrzwjnNL9w9U_ZnuMRqm.xps:xpsBrifO7M9mIPtqMlz_Qagaw.xga:GA1_2_1087073187_1623134372.xgid:GA1_2_497852374_1623134372.dn:sci_hub__mksa__top.dn:mksa__top.adcm:hit.tg:adcmjs_init%20adcmjs_noorient HTTP 307
https://dmg.digitaltarget.ru/awg/custom/1086/i/i?call_source=awg&i=134415495931432.603328523202432&a=86&e=5EFC831F4710BF602E0BE28402376F4F&c=ss:86.up:5EFC831F4710BF602E0BE28402376F4F.sync:up.xdua:duSzgrzwjnNL9w9U_ZnuMRqm.xps:xpsBrifO7M9mIPtqMlz_Qagaw.xga:GA1_2_1087073187_1623134372.xgid:GA1_2_497852374_1623134372.dn:sci_hub__mksa__top.dn:mksa__top.adcm:hit.tg:adcmjs_init%20adcmjs_noorient HTTP 307
https://vk.com/rtrg?p=VK-RTRG-508637-cAEnY

Request Chain 137

https://dmg.digitaltarget.ru/1/1086/i/i?i=134415495931432.117959043278714&a=86&e=5EFC831F4710BF602E0BE28402376F4F&c=ss:86.up:5EFC831F4710BF602E0BE28402376F4F.sync:up.xdua:duSzgrzwjnNL9w9U_ZnuMRqm.xps:xpsBrifO7M9mIPtqMlz_Qagaw.xga:GA1_2_1087073187_1623134372.xgid:GA1_2_497852374_1623134372.dn:sci_hub__mksa__top.dn:mksa__top.adcm:hit.tg:adcmjs_noorient HTTP 307
https://dmg.digitaltarget.ru/awg/custom/1086/i/i?call_source=awg&i=134415495931432.117959043278714&a=86&e=5EFC831F4710BF602E0BE28402376F4F&c=ss:86.up:5EFC831F4710BF602E0BE28402376F4F.sync:up.xdua:duSzgrzwjnNL9w9U_ZnuMRqm.xps:xpsBrifO7M9mIPtqMlz_Qagaw.xga:GA1_2_1087073187_1623134372.xgid:GA1_2_497852374_1623134372.dn:sci_hub__mksa__top.dn:mksa__top.adcm:hit.tg:adcmjs_noorient HTTP 307
https://sync.bumlam.com/?src=amb2&uid=QdTshw7XVZxFsmx7gZvI HTTP 302
https://sync3.adsniper.ru/?src=ss1&s_data=CAEQABilofyFBlIF4-CkuQViFFFkVHNodzdYVlp4RnNteDdnWnZJ HTTP 302
https://sync3.adsniper.ru/?src=ss1&s_data=CAIQARilofyFBlIF4-CkuQViFFFkVHNodzdYVlp4RnNteDdnWnZJogEQSUTi7MgkEeum6QAlkMgkNw** HTTP 302
https://sync.bumlam.com/?src=amb2&s_data=CAIQABilofyFBmIUUWRUc2h3N1hWWnhGc214N2dadkmiARBJROLsyCQR66bpACWQyCQ3 HTTP 302
https://sync.bumlam.com/?src=amb2&s_data=CAIQARilofyFBmIUUWRUc2h3N1hWWnhGc214N2dadkmiARBJROLsyCQR66bpACWQyCQ3 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_cm&extra1=QdTshw7XVZxFsmx7gZvI&extra2=amber&extra3=ext HTTP 302
https://sync3.sniperlog.ru/?src=ggl&extra1=QdTshw7XVZxFsmx7gZvI&extra2=amber&extra3=ext&google_gid=CAESEBI-vYyXzNpcEnqB4sboSGw&google_cver=1 HTTP 301
https://sync.bumlam.com/?src=ggl&extra1=QdTshw7XVZxFsmx7gZvI&extra2=amber&extra3=ext&google_gid=CAESEBI-vYyXzNpcEnqB4sboSGw&google_cver=1 HTTP 302
https://an.yandex.ru/setud/adsniper/1D13A2FE9C3B706D?sign=903157723 HTTP 302
https://an.yandex.ru/setud/adsniper/1D13A2FE9C3B706D?redir-setuniq=1&sign=903157723

Request Chain 144

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

162 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
sci-hub.mksa.top/
Redirect Chain

http://sci-hub.mksa.top/
https://sci-hub.mksa.top/

29 KB
6 KB

570ms
553ms

Document
text/html

2606:4700:3033::6815:35c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sci-hub.mksa.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::6815:35c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84b5229d1afc0962f11d27c8875317a0d92da419a5e6e2cf0ad02934e6f943ab

Request headers

:method: GET
:authority: sci-hub.mksa.top
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding
expires: Tue, 08 Jun 2021 18:39:31 GMT
cache-control: max-age=43200 no-cache
x-cache: MISS MISS
cf-cache-status: DYNAMIC
cf-request-id: 0a8bf215a000002bb9f19e0000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ChipmRBsW5xO94ZtTfZp5vtmjyN0C3%2Fji6IYQLqPLTERqJuy2qLwF1%2BMFlfcGh%2BLEKzUG%2B9b9QarNE11ojY%2FVBm1tEtWg1ZbyNGSQueafs5IgKcEsTUP4jj2ClxULV3PK9mvXp8dzEu%2Fnw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 65c01f9c3da02bb9-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

Date: Tue, 08 Jun 2021 06:39:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Tue, 08 Jun 2021 07:39:31 GMT
Location: https://sci-hub.mksa.top/
cf-request-id: 0a8bf2157a00004e3ee8244000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=npOBKI5IIRSRUSZJJvX67de2HidgR47A7jIJybTu7CijGkH1az3rU09fLNDPMZB%2Bb3C1Ml8iA78KHAW3YERfFe5ekf9h0U%2BjAhPjBXaZoRHw40Bkk3kfa0yOPz2SHkg68YkNCp%2BWnVKGaw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 65c01f9bfa3e4e3e-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 jquery-3.1.1.min.js Show response
img.sci-hub.shop/scihub/ 85 KB
29 KB 41ms
23ms Script
application/javascript 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://img.sci-hub.shop/scihub/jquery-3.1.1.min.js
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255935
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a8bf217de00004e1302af0000000001
last-modified: Fri, 30 Nov 2018 04:24:28 GMT
server: cloudflare
etag: W/"5c00bb7c-152b5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=cHsGm%2BAUGpPpcP5iJ8RpYWBuWpHfCkZUwE9uzD%2Bphkfk6BQADCza8h34T%2FnU5otB9lNPhC7OFN7%2BsJ7tRC48KRhBXV3K7O8SImBLZmOZL19RiY%2Ba3lDwyuRuWmx3lq8GiPYoem6blC40%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 65c01f9fce5f4e13-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-ui.min.js Show response
img.sci-hub.shop/scihub/ 248 KB
63 KB 42ms
23ms Script
application/javascript 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://img.sci-hub.shop/scihub/jquery-ui.min.js
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255935
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a8bf217de00004e13360d8000000001
last-modified: Fri, 14 Dec 2018 08:14:20 GMT
server: cloudflare
etag: W/"5c13665c-3dee4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=roX6YVn2ygArks9bwOsmPNcIZEN2nQ2tzJXyMDD1U13tlcFZHOOB%2FOIU6CBUIwEvuxES9LVZVdBCebnBm3psO3GK7tpU7jzkHDoNYYg87kK3DTbdqRKEmGY96mqzaeDElY4DqTEheQF8hw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 65c01f9fce634e13-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 openapi.js Show response
img.sci-hub.shop/scihub/ 94 KB
22 KB 36ms
17ms Script
application/javascript 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://img.sci-hub.shop/scihub/openapi.js
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e319892f7f2a6e0a6790ff3274eaec39df67d671429aef64ae798ef6792b6fe3

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255935
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a8bf217de00004e132519e000000001
last-modified: Fri, 30 Nov 2018 04:24:44 GMT
server: cloudflare
etag: W/"5c00bb8c-1798d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=JkUDbA%2FyeNVJrUSgcSK3gvJo9QA62YLoGLOWvI%2F%2BafOG8K2khf%2FzSLYpx4qhjvlvO%2BORMhdDyM%2B09GkjJ7ZQNFlnYMxQuDTtl%2Fi0IbT3kdfDV6yC3vAf7SX4E4ZBUZ%2FNdAbIRZHlWXCnww%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 65c01f9fce674e13-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 medal.png
img.sci-hub.shop/scihub/ 22 KB
22 KB 27ms
15ms Image
image/png 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/medal.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8dd6c570e8d8c98ebe983228777f11a9f0e195c2d2f8298c034766ccd2d3087c

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255935
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 22275
cf-request-id: 0a8bf218050000e00377105000000001
last-modified: Fri, 30 Nov 2018 06:13:38 GMT
server: cloudflare
etag: "5c00d512-5703"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=RARMAMiMbKHAYXmHLAEB0H474M5oxPrXDTU7SgSYBLmMQcDlew4KZhptgXuRVuxSkx9lbep7RZu7AXXfZf5RVtRn%2FeKL4nfimRSSwzV3CNTMgmsbnKJWPqNHI0EBoFyKvY6Wg6gER495Vw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa00d42e003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 key_1.png
img.sci-hub.shop/scihub/ 8 KB
9 KB 18ms
18ms Image
image/png 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/key_1.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b225ff2e35c8db5378d2ac271c993cbdf6c900aceec3a3eee1c31421e4dc44a

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255935
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 8428
cf-request-id: 0a8bf218090000e0038cb87000000001
last-modified: Fri, 30 Nov 2018 06:13:40 GMT
server: cloudflare
etag: "5c00d514-20ec"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=J8aWH4wOixWMJUe2R9oI372b4hGV20axhPDmIE8GHAsvpJhzcZIAKPbndgW9Km3rabwBQ5Lm%2BrdDbvLeBdCc0MtO7LiwpJwlXjjGPJozzNnxN%2FN5PQbQ5AIGB%2Fgbb02Pk4mATwZYGmNx%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa00d4fe003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 61 KB
21 KB 106ms
32ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4d2ad1634d3edff68d97fc7108092f01c4735455af1fe4661f320b16c417f24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "896 / 673 of 1000 / last-modified: 1623111989"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21220
x-xss-protection: 0
expires: Tue, 08 Jun 2021 06:39:31 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 89 KB
35 KB 20ms
20ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-193456449-1

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1f959aec643be527644fb22122bbdee5c6980d3e7a15c817ec60798ba8a29306

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35965
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 08 Jun 2021 06:39:31 GMT

GET
H3-29 200 top-back.jpg
img.sci-hub.shop/scihub/ 184 KB
185 KB 17ms
17ms Image
image/jpeg 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/top-back.jpg
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a50dba2bfbbfe01d25c025c5ee5acb8ce80af1707fb3b50ce82ff434be6b98f

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255934
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 188646
cf-request-id: 0a8bf2181a0000e003e3808000000001
last-modified: Mon, 16 Sep 2019 12:17:02 GMT
server: cloudflare
etag: "5d7f7d3e-2e0e6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=D2Q6iqhfifwO1pDyeFr6S4hPwYiKHvxTmmga95xVNqZxQrAjeOwYi1%2FzqKNuVQZPzYVFVcV521SQ58vCp19wyzwThFBR3eXlWxGgxEVlDeW%2FYBsul0YcAy8nSeNxqReuak11LpKJ7B7nMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa02d82e003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 logo_en.png
img.sci-hub.shop/scihub/ 14 KB
15 KB 26ms
25ms Image
image/png 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/logo_en.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 454e4bc03b54bff4716e23ac8be68737dffd664ea64400effdc9ff4581e89586

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255934
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 14556
cf-request-id: 0a8bf218230000e00377107000000001
last-modified: Fri, 30 Nov 2018 05:56:38 GMT
server: cloudflare
etag: "5c00d116-38dc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=EMa3oXrCzz7g7wJhMmIiv66Zb4WmP5hLUMynOeuTMbBlp7Rxibus2lBt8%2FcYMnXuqxvvMpe1NsSzVGcR08ptPPtoToGJa%2BARkMc0e1COYweayrJCmJ3Clntd2DU54bw7Iy9NNarbHzB1cQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa03d96e003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 raven_1.png
img.sci-hub.shop/scihub/ 59 KB
59 KB 26ms
26ms Image
image/png 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/raven_1.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c976023edd17ce89501bb6a4cd50277b50fc4ef4045d61b52854da88d36cb202

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255934
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 60144
cf-request-id: 0a8bf218240000e003500ef000000001
last-modified: Fri, 30 Nov 2018 05:56:32 GMT
server: cloudflare
etag: "5c00d110-eaf0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=SpAKx44TEUNp%2BInQd1gM2s%2FiHK7HuvythjkhI%2BUE19XjK9cd7FFLWH%2BH50G%2Fe%2BnLa9lDuFx9k5aIX0HKTvSHPbv1SxeSjf9f63Vs%2F5411CdngKhNbgv8MZJ7OOdDqpY%2FcZ210xs3FMZG2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa03d99e003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 map.jpg
img.sci-hub.shop/scihub/ 54 KB
55 KB 31ms
30ms Image
image/jpeg 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/map.jpg
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14e6508482a47b942549d487294e164dbe8684e79a6a00410dfb966acffa9570

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255934
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 55605
cf-request-id: 0a8bf218240000e003510a4000000001
last-modified: Fri, 30 Nov 2018 05:56:52 GMT
server: cloudflare
etag: "5c00d124-d935"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=t6%2BscWnQxueuse03IUHjCSuJzqQAbKSUiXWvJcsVVHzo7AJkrjgVFCKat15xlqziw7lS2i4ql17pwoLywp4t2N%2FxJC8aC33pYekHh5kiR59ivgOBTYWI8onCDhu86OiAqy7yC0ZJPA5S%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa03d9be003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 about-marker_en.png
img.sci-hub.shop/scihub/ 3 KB
4 KB 31ms
31ms Image
image/png 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/about-marker_en.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b8e3e37a00f298198fe34abc7c237a0b3c21659f668e142dcf5bc467bae0de23

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255934
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 3361
cf-request-id: 0a8bf218240000e00394a6d000000001
last-modified: Fri, 30 Nov 2018 05:57:02 GMT
server: cloudflare
etag: "5c00d12e-d21"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=MdQayweSVwLa3RnnDVUh6zkymg0vX4Z%2BKVWuOExcO%2BR70%2BkFEmbgV07jANTr2cvc5zpNDS2EPDtdEZgWpD1roST57dSSRicux5YM3MvvEtR5i2qnM1K9CuCGXd%2B65pCkGW%2BwNpHq5crrfw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa03d9ce003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET AvenirLTW01-55Roman.woff2
img.sci-hub.shop/misc/fonts/ 0
0

GET
H3-29 200 quote.png
img.sci-hub.shop/scihub/ 1 KB
2 KB 26ms
26ms Image
image/png 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/quote.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f3abdf0859cf36c2821963a7266a955fd4bd5fe491f997d9d8dae3f3957cf75

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255934
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1068
cf-request-id: 0a8bf218470000e003510a6000000001
last-modified: Fri, 30 Nov 2018 05:57:12 GMT
server: cloudflare
etag: "5c00d138-42c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=1lHePm8qBo51va2%2FDbUIl%2BYNSQHv2IdCFcjQJ428BjmNaWoBFs%2Bv%2Bu4YyCh7wxUeN%2BbuXw0969UTFo4E8Ss1HH9%2BYvSE49cEC82dWap4aABhD8gkfozAHHGhsWSd77hcwAG4VU5ej8svig%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa07deee003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 quotenext_en.png
img.sci-hub.shop/scihub/ 1 KB
2 KB 14ms
13ms Image
image/png 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/quotenext_en.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 460b964d7227b7963094c56a6449ed520818785ccb2eb6ecfe8be595fee74232

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255934
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1087
cf-request-id: 0a8bf218480000e003ba81d000000001
last-modified: Fri, 30 Nov 2018 05:57:18 GMT
server: cloudflare
etag: "5c00d13e-43f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=EWtksCTqNDOxX4%2FlAobXNm8EJOMrElB%2Bpebu84LWk5s3JPB18KyUvg%2BUYzfqKgasNN%2BWSeA2x5rjmxWWsf2RwTSysnqhIWAiLXU%2BcE%2B85d4bmTjcECR6RnDIVBfApdUbrCa%2BYgQUTo9IcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa07df2e003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 pone.png
img.sci-hub.shop/scihub/ 2 KB
2 KB 14ms
14ms Image
image/png 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/pone.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 44e857b78e5b61610566603bed79bceb9a60415b2795cfdf907346cb026d2450

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255934
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1637
cf-request-id: 0a8bf218480000e0030b0af000000001
last-modified: Fri, 30 Nov 2018 05:57:24 GMT
server: cloudflare
etag: "5c00d144-665"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=OaJqQAv49eQomZENp9X%2FoxKrCHeK9M6sQ96KMH4332Bjt5MymF9vfT5kslq9E7bV1A%2BV3A9qFHW9RG4tAfXi1PK11RyW3KiKCFCJqIPbVkDlbz9vqpsmgsBE%2F%2F5qetYuYzoqK2oeRkm03w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa07df5e003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 ptwo.png
img.sci-hub.shop/scihub/ 4 KB
4 KB 16ms
16ms Image
image/png 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/ptwo.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c930cfd1a633df3f92e6104e291b65534f21a32f3e1fe1d4bfb3b5eb7df17c74

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255934
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 3907
cf-request-id: 0a8bf218480000e0037c088000000001
last-modified: Fri, 30 Nov 2018 05:57:30 GMT
server: cloudflare
etag: "5c00d14a-f43"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=YnFr1e16Zh4uFK1GVcouKuE2g8VSXT08dt1iidHcGs07oz%2FjI5hLmrFAc5%2FSlWkN%2BjtCp5xCGf%2BjF16jDbm8xACSTeYHpWhFbl2qNOykgoSWvQZ5juVRZ%2BArieZQfm8UIKeSA9HsrYnLfg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa07df6e003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 pthree.png
img.sci-hub.shop/scihub/ 4 KB
5 KB 14ms
13ms Image
image/png 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/pthree.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff03fb35159e9cc4104b52e40b4153040df127e8cbeb3a7f351a4951b0008c28

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255934
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 4278
cf-request-id: 0a8bf218480000e0033980e000000001
last-modified: Fri, 30 Nov 2018 05:57:36 GMT
server: cloudflare
etag: "5c00d150-10b6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=moNfWfZI63kDh8b5EwjLdnshi3i%2BGhyOxHRf7y45fxsLUD62KVACj4I2IZ36qcIvWkQ1xF2z2b5rSdoPBOkIA06vZes0cf6vVdGqYTDjKmOEfElMwa1nYD0AO8Ft%2FXid%2FW%2FKXe2OVXYfAQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa07df7e003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 people.jpg
img.sci-hub.shop/scihub/ 50 KB
51 KB 17ms
16ms Image
image/jpeg 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/people.jpg
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46dcb8cb7d4d80220baa300c65817e9a4a324c15ddb1e3955d222175eb6cf8c9

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255934
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 51212
cf-request-id: 0a8bf218490000e0035d0b9000000001
last-modified: Fri, 30 Nov 2018 05:57:56 GMT
server: cloudflare
etag: "5c00d164-c80c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=yASpS2fU4Mi3rr1MsNqxPCXCIvUANzqLaGNMxIV6iG92aAdb2N4YyeTKINQjUYPP6kD10XGs%2Bm8PHzwVFC%2BWpiTh1vT3sAQSFpCU%2BxtTKAcWO1%2BIsmaSNd1BG4O%2BiuA1KiibDZPjZxL3tw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa07df9e003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 join_en.png
img.sci-hub.shop/scihub/ 6 KB
7 KB 29ms
28ms Image
image/png 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/join_en.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3860c6aa1cdef6ed8bf7315bbfbdc1237d14f68ea2e7a55bcccb9e77662d1b7f

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255934
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 6197
cf-request-id: 0a8bf218490000e003a1830000000001
last-modified: Fri, 30 Nov 2018 05:58:24 GMT
server: cloudflare
etag: "5c00d180-1835"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ZwfCAC9C712HsaKLlfofEycfTBbtjcBTSpfBU3pkY4FogyMIJam4cMIebwruG5HI6EKdHtncQSZqkyjS7ryGNibsww88zAOisr%2FpA3fGGTfAihyREQV0X9zbOB56si9vw5GGqKKcHPMq8A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa07dfae003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 joinvk.png
img.sci-hub.shop/scihub/ 17 KB
18 KB 14ms
13ms Image
image/png 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/joinvk.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c065fb78b0e08dfcca754d46f64414bff72a17836b5da8f717e48423fd4e5952

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255934
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 17834
cf-request-id: 0a8bf218490000e003392aa000000001
last-modified: Fri, 30 Nov 2018 05:58:30 GMT
server: cloudflare
etag: "5c00d186-45aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Uux86jlG0NsC15WtsucIKE3%2BPT%2BJvJsCG9YE1Q%2FcLxu9IeB3c8ThysXoIISo24p%2FQdw%2F4rvoktgZNgsCHuiJLAVidouBT6sqjTIowC4%2FFSxWPw1FTVc%2FRKoSDT8VG7FwtH%2BAV%2Bs%2FHOCwuw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa07dfbe003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 jointwitter.png
img.sci-hub.shop/scihub/ 6 KB
6 KB 28ms
27ms Image
image/png 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/jointwitter.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f6720f9b1b728e80c6f618a5aac450c6f6df834dd8f0e8b4059ac78a90af7af

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255934
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 5751
cf-request-id: 0a8bf218490000e003de3ac000000001
last-modified: Fri, 30 Nov 2018 05:58:42 GMT
server: cloudflare
etag: "5c00d192-1677"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=uhz0%2FSaxNntMTy%2BikMZfQmb7Zk4Vi6uiIDTn%2BB9QZaNrpsEoMvg62KzudOddMfBOUCJO4mfnRPWcg221Hd9R0vLR%2B49iA0wwSHR2rugV5yoBQDoD0rJaDGC1sLtg6xArxX4rFu9HJ0pjrw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa07dfee003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 joinfacebook.png
img.sci-hub.shop/scihub/ 4 KB
5 KB 16ms
16ms Image
image/png 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.sci-hub.shop/scihub/joinfacebook.png
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dabaf1eee4ae1c1db524c66d6950221386ef064a71d29b9f799d1905d64456b6

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255934
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 4152
cf-request-id: 0a8bf2184a0000e0031882f000000001
last-modified: Fri, 30 Nov 2018 05:58:36 GMT
server: cloudflare
etag: "5c00d18c-1038"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ZMcN7ItcVOiuObbxEebddUcisSrvtXdU1Va2BalqCjc59AkstNyFZ%2BR3exBdp%2BOSYXw8PBicdJwMKCmdPQ%2B%2Fyh79LQjNhMI2aAjPOdV5CMMnYljm%2FXzJZigeTA0yjbSQcQ4HWX99vLtR%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 65c01fa07dffe003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3-29 200 pluso-like.js Show response
img.sci-hub.shop/scihub/ 41 KB
12 KB 28ms
28ms Script
application/javascript 2606:4700:3034::6815:9e6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://img.sci-hub.shop/scihub/pluso-like.js
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:9e6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 125ef9e8cac071be547016f215e726b1f17be04068441bb35847bf565c89e4c3

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:31 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255934
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a8bf218800000e003302c0000000001
last-modified: Fri, 30 Nov 2018 04:39:20 GMT
server: cloudflare
etag: W/"5c00bef8-a5cc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Rm8p6SkYfHQwQTk8BBuzDqoec5Ly9B89gDcntEr4J4lWfT4pKFZcfckD4lcknNtFe8wH8Ojl%2Bp6B6EZktgK8oNK7UITbiggBoTgItb0LQK4K2n6vphFloccXwJu%2BeL3ekcEl60Fzkx%2BXoQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 65c01fa0ce8ee003-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-193456449-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 5288
date: Tue, 08 Jun 2021 05:11:23 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Tue, 08 Jun 2021 07:11:23 GMT

GET
H3-29 200 pubads_impl_2021060701.js Show response
securepubads.g.doubleclick.net/gpt/ 318 KB
112 KB 63ms
32ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

094c1111eeb737673d376e2598c9abfad2c1dadeab91522940bbf5d2ff512a72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 07 Jun 2021 08:45:49 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 114129
x-xss-protection: 0
expires: Tue, 08 Jun 2021 06:39:32 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 28ms
13ms XHR
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=394410390&t=pageview&_s=1&dl=https%3A%2F%2Fsci-hub.mksa.top%2F&ul=en-us&de=UTF-8&dt=Sci-Hub&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1599528882&gjid=1125673495&cid=1087073187.1623134372&tid=UA-193456449-1&_gid=497852374.1623134372&_r=1&gtm=2ou621&z=33897698

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:32 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://sci-hub.mksa.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
85 B 16ms
16ms XHR
text/plain 2a00:1450:400c:c01::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-193456449-1&cid=1087073187.1623134372&jid=1599528882&gjid=1125673495&_gid=497852374.1623134372&_u=YEBAAUAAAAAAAC~&z=723704943

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c01::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 08 Jun 2021 06:39:32 GMT
content-type: text/plain
access-control-allow-origin: https://sci-hub.mksa.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
799 B 109ms
42ms Script
application/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=sci-hub.mksa.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 06:39:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
553 B 34ms
14ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=sci-hub.mksa.top

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 06:39:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
8 KB 924ms
924ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1743252454784325&correlator=1382540615881765&output=ldjh&impl=fifs&eid=31061039%2C31061224%2C31061385%2C31061143&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=22149012983%2Cycykh-ndd%2C970X90-01-sci-hub.mksa-ndd-ycykh&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=970x90&cookie_enabled=1&bc=31&abxe=1&lmt=1623134372&dt=1623134372155&dlt=1623134371784&idt=343&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=900&adks=1836978441&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsci-hub.mksa.top%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x0&msz=970x-1&ga_vid=1087073187.1623134372&ga_sid=1623134372&ga_hid=394410390&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

48a4c604e345a56099730adfa8b2e56d742c6ba0dc9e5313b55e8b0425673a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:33 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8156
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://sci-hub.mksa.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/safeframe/1-0-38/html/ 0
0 49ms
14ms Other
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
8 KB 290ms
290ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1743252454784325&correlator=1382540615881765&output=ldjh&impl=fifs&eid=31061039%2C31061224%2C31061385%2C31061143&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=22149012983%2Cycykh-ndd%2C336X280-01-sci-hub.mksa-ndd-ycykh&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=336x280&cookie_enabled=1&bc=31&abxe=1&lmt=1623134372&dt=1623134372158&dlt=1623134371784&idt=343&frm=20&biw=1600&bih=1200&oid=3&adxs=632&adys=1552&adks=2992418410&ucis=2&ifi=2&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsci-hub.mksa.top%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=528x334&msz=336x-1&ga_vid=1087073187.1623134372&ga_sid=1623134372&ga_hid=394410390&ga_fc=false&fws=0&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a83a369b2a7c17cba25341ddc66d6d93821c04a53673329bd87f481ffe969e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:32 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8200
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://sci-hub.mksa.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 472 B
283 B 1478ms
1477ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1743252454784325&correlator=1382540615881765&output=ldjh&impl=fifs&eid=31061039%2C31061224%2C31061385%2C31061143&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=22149012983%2Cycykh-ndd%2Czsy-01-sci-hub.mksa-ndd-ycykh&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50&fluid=height&cookie_enabled=1&bc=31&abxe=1&lmt=1623134372&dt=1623134372160&dlt=1623134371784&idt=343&frm=20&biw=1600&bih=1200&oid=3&adxs=426&adys=2192&adks=1528813087&ucis=3&ifi=3&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsci-hub.mksa.top%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=748x120&msz=0x0&ga_vid=1087073187.1623134372&ga_sid=1623134372&ga_hid=394410390&ga_fc=false&fws=0&ohw=0&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0c44e2a07c3cc9dac2670be3f1aac346bbaebfa51e5a1e96b3a6536eef331f85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:33 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 253
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://sci-hub.mksa.top
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 62 KB
15 KB 1148ms
1147ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1743252454784325&correlator=1382540615881765&output=ldjh&impl=fifs&eid=31061039%2C31061224%2C31061385%2C31061143&vrg=2021060701&ptt=17&sc=1&sfv=1-0-38&ecs=20210608&iu_parts=22149012983%2Cycykh-ndd%2Czsy-youtu01-sci-hub.mksa-ndd-ycykh&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50&fluid=height&cookie_enabled=1&bc=31&abxe=1&lmt=1623134372&dt=1623134372161&dlt=1623134371784&idt=343&frm=20&biw=1600&bih=1200&oid=3&adxs=430&adys=2192&adks=3809152490&ucis=4&ifi=4&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fsci-hub.mksa.top%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=748x120&msz=0x0&ga_vid=1087073187.1623134372&ga_sid=1623134372&ga_hid=394410390&ga_fc=false&fws=0&ohw=0&btvi=3&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

824.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

cafe /

Resource Hash

058b21033b33c43129ddf55e27b31a5a1962f03635a4b7312f2074fa7af51a34

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:33 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15021
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://sci-hub.mksa.top
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK process Show response
share.pluso.ru/ 119 B
466 B 223ms
57ms Script
application/javascript 37.200.67.210
SELECTEL

General

Check archive.org

Show headers Download Go to

Full URL

https://share.pluso.ru/process?act=counter&u=https%3A%2F%2Fsci-hub.mksa.top%2F&w=1600&h=1200&ref=&uid=5473046666911051876&k=HXZUbRUBTFgz7WvH&first=1

Requested by

Host: img.sci-hub.shop
URL: https://img.sci-hub.shop/scihub/pluso-like.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.200.67.210 , Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

03275db33f0d4b63b93e8ef6e162a368574b26fb11ac0af3c59b2c38935726b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 06:39:32 GMT
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 119
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK process Show response
share.pluso.ru/ 119 B
466 B 222ms
57ms Script
application/javascript 37.200.67.210
SELECTEL

General

Check archive.org

Show headers Download Go to

Full URL

https://share.pluso.ru/process?act=counter&u=https%3A%2F%2Fsci-hub.mksa.top%2F&w=1600&h=1200&ref=&uid=5473046666911051876&k=gWI3undefinedRbnQNs3iZXT

Requested by

Host: img.sci-hub.shop
URL: https://img.sci-hub.shop/scihub/pluso-like.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.200.67.210 , Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

03275db33f0d4b63b93e8ef6e162a368574b26fb11ac0af3c59b2c38935726b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 06:39:32 GMT
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 119
X-XSS-Protection: 1; mode=block

GET
H/1.1

200
OK

hit;PLUSO
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit;PLUSO?r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1
https://counter.yadro.ru/hit;PLUSO?q;r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1

43 B
496 B

67ms
67ms

Image
image/gif

88.212.201.210
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit;PLUSO?q;r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

88.212.201.210 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host210.rax.ru

Software

nginx/1.17.9 /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 06:39:32 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Cache-control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 07 Jun 2020 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 06:39:32 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Location: https://counter.yadro.ru/hit;PLUSO?q;r;s1600*1200*24;uhttps%3A//sci-hub.mksa.top/;hSci-Hub;1
Cache-control: no-cache
Connection: keep-alive
Content-Type: text/html
Content-Length: 32
Expires: Sun, 07 Jun 2020 21:00:00 GMT

GET
H/1.1 200
OK 06.png
share.pluso.ru/img/pluso-like/square/medium/ 23 KB
23 KB 260ms
95ms Image
image/png 37.200.67.210
SELECTEL

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://share.pluso.ru/img/pluso-like/square/medium/06.png

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.200.67.210 , Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

a88d699bbf9f25fa9a614e4af43982e1096bd9f918a3f5adcaace243ae5cfebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 06:39:32 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 13 Apr 2015 11:02:40 GMT
Server: nginx
ETag: "552ba250-5b8f"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 23439
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK plus.png
share.pluso.ru/img/ 2 KB
3 KB 220ms
54ms Image
image/png 37.200.67.210
SELECTEL

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://share.pluso.ru/img/plus.png

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.200.67.210 , Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

784eb14774a9a419af32c02c2d16cf197ef2701afc2ea65b58c3a574ed5458bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 06:39:32 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 13 Apr 2015 11:02:40 GMT
Server: nginx
ETag: "552ba250-98a"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 2442
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK kb.js Show response
kitbit.net/ 1 KB
2 KB 593ms
57ms Script
application/javascript 31.131.252.94
SELECTEL

General

Check archive.org

Show headers Download Go to

Full URL

https://kitbit.net/kb.js

Requested by

Host: img.sci-hub.shop
URL: https://img.sci-hub.shop/scihub/pluso-like.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.131.252.94 , Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

cc535244ed53f0e8598adb12ef18fe88ac5801d2eb1396a22389f1575e0b422d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 06:37:59 GMT
X-Content-Type-Options: nosniff
Server: nginx
ETag: H4P8XmC/EEeE4gsuT283Ag==
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CUR PSA OUR NOR"
Cache-Control: max-age=21600, private
Connection: keep-alive
Content-Type: application/javascript
X-XSS-Protection: 1; mode=block
Expires: Tue, 08 Jun 2021 12:37:59 GMT

GET
H3-29 200 container.html Show response
d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 89F6 6 KB
3 KB 21ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://sci-hub.mksa.top/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://sci-hub.mksa.top/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 08 Jun 2021 06:39:32 GMT
expires: Wed, 08 Jun 2022 06:39:32 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d8c7ce12428be733a9213b2fecae66db6950a933c276d68bf7c8271829a627d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:32 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066164336645"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28149
x-xss-protection: 0
expires: Tue, 08 Jun 2021 06:39:32 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 10 KB
8 KB 47ms
28ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021060701&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2035053ec07cdce1041598092cb9825c1659e552122c8682ebdaa95cfca1f83e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 06:39:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7900
x-xss-protection: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 5007 624 B
570 B 17ms
17ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQ1K6oAhij1sqeATAB&v=APEucNWkm9piEgPZLY8xTKWQ3dTg75-KHkR70DovPnSszUIEwer2UFAQoB12LqaQ_WihybWpQS194sPbQ81Tuu4OZb54iLpCYdZI1gNqyBHCTTseIHYrU3MKjV1-q3oMDaLskOp8BqRA8z2SDV2SpvC0m4v0CaQi26peSKLtze2EZJ1S_KmU-Ys

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CMXlgQEQ1K6oAhij1sqeATAB&v=APEucNWkm9piEgPZLY8xTKWQ3dTg75-KHkR70DovPnSszUIEwer2UFAQoB12LqaQ_WihybWpQS194sPbQ81Tuu4OZb54iLpCYdZI1gNqyBHCTTseIHYrU3MKjV1-q3oMDaLskOp8BqRA8z2SDV2SpvC0m4v0CaQi26peSKLtze2EZJ1S_KmU-Ys
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 08 Jun 2021 06:39:32 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUlBoUN59RDoAPDG_-f8CcoCCTrcUa8FYkbNYkXRD_jvEJ9ZrE1nkY3oqxHt; expires=Sun, 03-Jul-2022 06:39:32 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 08 Jun 2021 06:39:32 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame B4CB 43 KB
21 KB 44ms
43ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DIub4IQVv8qDz3Nm_mgH4PxHTeevcBN0SBOK7zDlgQWQz2i56zivkTgItHG69gvNT_TbAUT3Vfr58XkvhsCEw8QOo90y7br9AQ8WdnCaTA2-BtjmDqsRuYqMW18QEdkr64UGDPW1rQjCSU1SOhXl-FxGCaAA&dbm_d=AKAmf-BBJPFR_cdfSqHSho6lZV7JxqdTWI8cCm2yGfPM2tnA3eeBH4DzbFsqYs7WQ6cs5axLXTUxW85kmqnc1R09OfiJ4Du91NludCoOet51qR8BDaAkw3JD-2lKqvpmIEOre_6PwV2Xu-1TFFZ-g4IHt1D16EYrKfJGIxjv4C-NefIB86NTJ3FJ0zzeVzQc1GrRJR8A1B6LV9ZO1onUtvo5otxXHiUeA0am5xUQysijI5Pc9CqbHgigk7gDtu4oDOPVVcyBm14npfc8kPVywQD-unU4iz52doKlMr3HJh_-0X0Rief-ER4kOlB4_90YIfP89T_CIydWdzmF61M0OwjQEW-Us8MTyPLoiUuw_v-adnoTV0vFDQTwReESv-2cfdPbC2xq2EvVcDOgP5WAluB9zeaVjWpu0nbxjFrsuINHrK1hEOclTm--dmOCeUIxWY0VkXDvFBhwUWr-ecw393YWX6MWUYrwAIHxhvlY18tOS7_fa9mp341H5a0sASIsg5-vNlwFbMjAjg_G9R6AzS5ZIPNTWRbnrnuLXZzqF52-g_h6VdJ4Pkix5iso0WYhvBHrE7grWN_m8DRv_C70D65m1n10b0rPWAk8z7qrUms4mtLO81Ph1VZk82VgEBjRK3W1U5rod_qnEokImjTKxvyOYMVP5-p77wl3ObmAp0Fxy6URk9mVEKLEjvECyg6t4vXEYQWhSF4tT9-BUZ7PGBy8nCv4yL4wxZKKgmNhcEnQCJ6X313bYP8ItUudUqwdnHFezwghR5JDJVbm76xFrsIQelz-DRr7SpQo9BKjyi4JH2S6jqXLM6FDmIk4YcLKYXokb0Yo8mbEkRxhI6VWwAv1MFJGzB5opBrb6_gkggv37TupBM0I_B6T4KRoHlFPN5Bo7vDWHMIjjhpWoCgz2QrPsg8Bu8OSZmOggzVVcv0oTThEE1SBc7Imer3An0n-1y1UubZRHCdfjO0kxC6CPIzs_MdopXdPlCLW2XaYTcG5Qe_K0LzGOhvhQO7qL-bnYKnTw7OIfZhtoO6Xx__uU6HBJ2dyUrNJKCuNvg5KVcKYV9hlVX9mNOKMj3CGpfxrdxchIrZTloRckYl6yLtuiHGAy8bpWFtbPYr5PI68B4SUMnWsO0DK32_3QlHPIeJ26pF0BRnR8CtFg3voXWdBwP9DCtUhC5ja_R7ZAzsZg1Jm39t2sFBWeHT2LLQ4mTro7p0R6WDFS1v8OtUvU5c_nzu9x-Fv_ibcT43Vl0C4fP1TfskIR7nykOux1GvBOiwTQhwnw-IN0vfb1eS2UoXVqGN7uLN4ZORfodkL7ZNj_531_u9IF5sEBWUK3nFucF-e3Uw88zri3B96sWiDtO50V33SddXR4hwYIPTeYue3o8BD-vpFRJ90qSXGqyV59C1t5vg9aI1tcL90a9YmT3ny_1MJBtTXfkW02yvf-qiGd1vFLnA0Hq9ZCZFiSasf_SQVZa_5NmJkUXG-035WehM1lCodIt7JjRnMktuk-Dfu-zz4-2fMcv0zHLAfoNrQVVO1oOp7mlLz6UwdVHRivxo-5Vvob4-UDhm0MCQcZZd23Ffh3zhrjxNJaWAaEz7uswbu4pQZWTp9a29EvCUwUc0ptFzyJzSf9UctQv0ZSQ6aLILu2UfleP-eptQUc3JrMAXyxsJ_mKoptj23y_25EQUk2DeqTpYGr_o_88ZL9aI7rb20VYcOeZxtmL4XOjeg0d6-7j2gbFbxVYXAxfZ2CCLwEzl6KorhU-qvuIg1ohGbRDLX38H5N3UpOtz0pGCFUbakofbE4r9i-fn-FjfmZkrsEQY6vXiGOgd_j8hOiwg9_jqpJT7i1_lMfzrsASg3O2D6aUmjCfkaOJ6EjXNJffT85PktIbJL-5wQloe2TX718aSWB6JlCtWTAt_B86HXWFnjGdRWjme6yKtNvHaW32muTwTfPIgGMAdKZQyH1ngcKCILdWYlt30GKzzu9VOGNGyfDB3AWySAPQ9PlpOTsN9FKeBNnO_eQxgQN4XCfSpwxHCyCg4ctO5Mo0PYMPAl5cKLhAcZxwI1eyylZ8fbwKftFQf0_woiD3ftyXkxmJz78qlMhw9-C17wbH35rdJCQxoo76vWlEbunT8rHeBdaZ8z5_utfqljohghaz2taZV5Q4c4I7LP3Gxa5UDMIeVVMXf8WDqetpsWyyXpa_cuvrOVLh2WbawYcTDX0AK_W9mzVdqqn5wiF19d_sSAa-AeT46YX9sya7vyx9-46tlf7Tt2B5QNskTbd0ADW0vJZistz1nOfBGq4z5zlyyOMHnHkPHCCHDVZdW3GytO2qdGZFmH6hHgcu5BZ2cphMDfJUIl2BIcL4oYR2NW7CZf0fvTUNymK3SiJjZ6_1CVtEd1PaVXVjoT_yELbqBYMaxm0UUN9wTEn8wdVJ9D5TysC3t26fvQuykYf00F7iPQdUx7QfhnJftOmpAazyG5ZDJPQ2T-_HEIuH_lQ_X_Ot13JkZFZdzvC3Q9fuqHQAKp2cKP_oyPVXV4kwEHVgis6O2Sb2woCvAhiKmOhEUXqi_p64Q7R6dPtmQ8rxDk97oEV0Ay0zKDEG3T3jFDAo-5HBR7rZ072PUFqQnrshh-MDafaasLqJwmNexBHPq-miURcXWzQe-aivNFO9_fGceC7oJt0twe4xVa5y_lJbL-IXL3kSSOip8cmbLagaR_rEczVTr12JeoqUNZuly02PO0r9Q-qaamRqYZW0F1EdVez7uZ5ysXsVpg1asfQNZckQEWesyZk55nzULg9JAQ9imNXVbPM_thcvx1-nCAT7V13ST8MtdF-8da38AkQxmSQWIdJflgfMAht0fjzn8u5BZrzXz27Wz4STUIbyzLUgHQGsc83AmhNDuhcl2zHhsXn4VbZj0z-xmHxYu7DMQyEzHgsLQ8KjySpfDVjjJcNS6r2-D007KrPkRxfgbitA3mqGRUtgDjhMOHFJikXm7RGtiGek8AR7ZzPo8I9fBY6Ylbf1c_l65nqibwKDVNeeWIQeyW6occypVzzQRHhStq9fpx6UoN9ikX0x3x0J96CfKth3w0qyBtADyE2qKgv_x2R3UqEkgpAArVYtZzrBtnGjvuykt5H2kZC1ztOUbN_pBmnZ6cZ5yPwvQGE9-oQ1UrC2L0KzqjlySxD_fLcMZ5bL9AUM4zsGpWrYcaWdMmP-_lude5GHPV8JLkM65ho0_95Ux4&cid=CAASFeRoSPd2RDtMXQDZk_ujL-lX-LqDAA&rfl=2%2Chttps%253A%252F%252Fsci-hub.mksa.top%252F%240

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dcc157e1253af484c5e174713de301ffc3a790432c9fe24029d9a804bc7ba36d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21273
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/ Frame B4CB 2 KB
1 KB 27ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/window_focus_fy2019.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:34:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 302
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1316
x-xss-protection: 0
server: cafe
etag: 797314601362473214
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 06:34:30 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B4CB 122 KB
37 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f28c37beb838d695f95710805308cfe7f1fcc286bd744ab0184a23a10d5a4ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:32 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066169988846"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Tue, 08 Jun 2021 06:39:32 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/ Frame B4CB 13 KB
6 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:37:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 144
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5644
x-xss-protection: 0
server: cafe
etag: 16788636151609896382
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 06:37:08 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame B4CB 0
0 14ms
13ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSX3TV4QsTAlONyi1fdVa4RhDZAY-Qkv7z08NqOjFXXEGLxL_oD9s93OJNn1HG-B2Z2ztM2rKjkDlHEdE-suK9L55udAw
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame B4CB 42 B
498 B 33ms
14ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BaNpdqSxlFmD3lRZlpFubFgkuE2aejAP25hjNLe1XD7MpyzQ4w6CtUYBusoPUtWE3htUBB3eR00MERhLTffKjac2w9Ih7fxzk3njMITD0toPEM-DI

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 24ms
21ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Tue, 08 Jun 2021 06:39:32 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 5007
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEr6d1foupt2dOAVJRV0jEc&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEr6d1foupt2dOAVJRV0jEc&google_cver=1&C=1

43 B
1014 B

42ms
42ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEr6d1foupt2dOAVJRV0jEc&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQ1K6oAhij1sqeATAB&v=APEucNWkm9piEgPZLY8xTKWQ3dTg75-KHkR70DovPnSszUIEwer2UFAQoB12LqaQ_WihybWpQS194sPbQ81Tuu4OZb54iLpCYdZI1gNqyBHCTTseIHYrU3MKjV1-q3oMDaLskOp8BqRA8z2SDV2SpvC0m4v0CaQi26peSKLtze2EZJ1S_KmU-Ys
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 06:39:32 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 08 Jun 2021 06:39:32 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 06:39:32 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEr6d1foupt2dOAVJRV0jEc&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Tue, 08 Jun 2021 06:39:32 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 5007
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YL8QpMNhzCFllgkqECdM-AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB7NKr8elJp5TsdU-PE9fOo&google_cver=1

43 B
894 B

37ms
37ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB7NKr8elJp5TsdU-PE9fOo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQ1K6oAhij1sqeATAB&v=APEucNWkm9piEgPZLY8xTKWQ3dTg75-KHkR70DovPnSszUIEwer2UFAQoB12LqaQ_WihybWpQS194sPbQ81Tuu4OZb54iLpCYdZI1gNqyBHCTTseIHYrU3MKjV1-q3oMDaLskOp8BqRA8z2SDV2SpvC0m4v0CaQi26peSKLtze2EZJ1S_KmU-Ys
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 06:39:33 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 08 Jun 2021 06:39:33 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:33 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB7NKr8elJp5TsdU-PE9fOo&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 5007
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFfsJ46xMTJnJaYHVmoHyLk&google_cver=1

43 B
1020 B

53ms
23ms

Image
image/gif

185.33.223.178
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFfsJ46xMTJnJaYHVmoHyLk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMXlgQEQ1K6oAhij1sqeATAB&v=APEucNWkm9piEgPZLY8xTKWQ3dTg75-KHkR70DovPnSszUIEwer2UFAQoB12LqaQ_WihybWpQS194sPbQ81Tuu4OZb54iLpCYdZI1gNqyBHCTTseIHYrU3MKjV1-q3oMDaLskOp8BqRA8z2SDV2SpvC0m4v0CaQi26peSKLtze2EZJ1S_KmU-Ys

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.178 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 06:39:32 GMT
X-Proxy-Origin: 84.17.43.134; 84.17.43.134; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.223.42:80
AN-X-Request-Uuid: 8c292ac6-36a8-4890-a6d3-f05a12d7595b
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:32 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFfsJ46xMTJnJaYHVmoHyLk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 5007
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjQ4ODQ4NTc3MTAwNTE3MTgyMw%3D%3D

170 B
188 B

66ms
34ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjQ4ODQ4NTc3MTAwNTE3MTgyMw%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 06:39:32 GMT
X-Proxy-Origin: 84.17.43.134; 84.17.43.134; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.80:80
AN-X-Request-Uuid: 3f79c8ae-f6c1-407c-b5ad-b98321453567
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjQ4ODQ4NTc3MTAwNTE3MTgyMw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/ Frame B4CB 22 KB
8 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DIub4IQVv8qDz3Nm_mgH4PxHTeevcBN0SBOK7zDlgQWQz2i56zivkTgItHG69gvNT_TbAUT3Vfr58XkvhsCEw8QOo90y7br9AQ8WdnCaTA2-BtjmDqsRuYqMW18QEdkr64UGDPW1rQjCSU1SOhXl-FxGCaAA&dbm_d=AKAmf-BBJPFR_cdfSqHSho6lZV7JxqdTWI8cCm2yGfPM2tnA3eeBH4DzbFsqYs7WQ6cs5axLXTUxW85kmqnc1R09OfiJ4Du91NludCoOet51qR8BDaAkw3JD-2lKqvpmIEOre_6PwV2Xu-1TFFZ-g4IHt1D16EYrKfJGIxjv4C-NefIB86NTJ3FJ0zzeVzQc1GrRJR8A1B6LV9ZO1onUtvo5otxXHiUeA0am5xUQysijI5Pc9CqbHgigk7gDtu4oDOPVVcyBm14npfc8kPVywQD-unU4iz52doKlMr3HJh_-0X0Rief-ER4kOlB4_90YIfP89T_CIydWdzmF61M0OwjQEW-Us8MTyPLoiUuw_v-adnoTV0vFDQTwReESv-2cfdPbC2xq2EvVcDOgP5WAluB9zeaVjWpu0nbxjFrsuINHrK1hEOclTm--dmOCeUIxWY0VkXDvFBhwUWr-ecw393YWX6MWUYrwAIHxhvlY18tOS7_fa9mp341H5a0sASIsg5-vNlwFbMjAjg_G9R6AzS5ZIPNTWRbnrnuLXZzqF52-g_h6VdJ4Pkix5iso0WYhvBHrE7grWN_m8DRv_C70D65m1n10b0rPWAk8z7qrUms4mtLO81Ph1VZk82VgEBjRK3W1U5rod_qnEokImjTKxvyOYMVP5-p77wl3ObmAp0Fxy6URk9mVEKLEjvECyg6t4vXEYQWhSF4tT9-BUZ7PGBy8nCv4yL4wxZKKgmNhcEnQCJ6X313bYP8ItUudUqwdnHFezwghR5JDJVbm76xFrsIQelz-DRr7SpQo9BKjyi4JH2S6jqXLM6FDmIk4YcLKYXokb0Yo8mbEkRxhI6VWwAv1MFJGzB5opBrb6_gkggv37TupBM0I_B6T4KRoHlFPN5Bo7vDWHMIjjhpWoCgz2QrPsg8Bu8OSZmOggzVVcv0oTThEE1SBc7Imer3An0n-1y1UubZRHCdfjO0kxC6CPIzs_MdopXdPlCLW2XaYTcG5Qe_K0LzGOhvhQO7qL-bnYKnTw7OIfZhtoO6Xx__uU6HBJ2dyUrNJKCuNvg5KVcKYV9hlVX9mNOKMj3CGpfxrdxchIrZTloRckYl6yLtuiHGAy8bpWFtbPYr5PI68B4SUMnWsO0DK32_3QlHPIeJ26pF0BRnR8CtFg3voXWdBwP9DCtUhC5ja_R7ZAzsZg1Jm39t2sFBWeHT2LLQ4mTro7p0R6WDFS1v8OtUvU5c_nzu9x-Fv_ibcT43Vl0C4fP1TfskIR7nykOux1GvBOiwTQhwnw-IN0vfb1eS2UoXVqGN7uLN4ZORfodkL7ZNj_531_u9IF5sEBWUK3nFucF-e3Uw88zri3B96sWiDtO50V33SddXR4hwYIPTeYue3o8BD-vpFRJ90qSXGqyV59C1t5vg9aI1tcL90a9YmT3ny_1MJBtTXfkW02yvf-qiGd1vFLnA0Hq9ZCZFiSasf_SQVZa_5NmJkUXG-035WehM1lCodIt7JjRnMktuk-Dfu-zz4-2fMcv0zHLAfoNrQVVO1oOp7mlLz6UwdVHRivxo-5Vvob4-UDhm0MCQcZZd23Ffh3zhrjxNJaWAaEz7uswbu4pQZWTp9a29EvCUwUc0ptFzyJzSf9UctQv0ZSQ6aLILu2UfleP-eptQUc3JrMAXyxsJ_mKoptj23y_25EQUk2DeqTpYGr_o_88ZL9aI7rb20VYcOeZxtmL4XOjeg0d6-7j2gbFbxVYXAxfZ2CCLwEzl6KorhU-qvuIg1ohGbRDLX38H5N3UpOtz0pGCFUbakofbE4r9i-fn-FjfmZkrsEQY6vXiGOgd_j8hOiwg9_jqpJT7i1_lMfzrsASg3O2D6aUmjCfkaOJ6EjXNJffT85PktIbJL-5wQloe2TX718aSWB6JlCtWTAt_B86HXWFnjGdRWjme6yKtNvHaW32muTwTfPIgGMAdKZQyH1ngcKCILdWYlt30GKzzu9VOGNGyfDB3AWySAPQ9PlpOTsN9FKeBNnO_eQxgQN4XCfSpwxHCyCg4ctO5Mo0PYMPAl5cKLhAcZxwI1eyylZ8fbwKftFQf0_woiD3ftyXkxmJz78qlMhw9-C17wbH35rdJCQxoo76vWlEbunT8rHeBdaZ8z5_utfqljohghaz2taZV5Q4c4I7LP3Gxa5UDMIeVVMXf8WDqetpsWyyXpa_cuvrOVLh2WbawYcTDX0AK_W9mzVdqqn5wiF19d_sSAa-AeT46YX9sya7vyx9-46tlf7Tt2B5QNskTbd0ADW0vJZistz1nOfBGq4z5zlyyOMHnHkPHCCHDVZdW3GytO2qdGZFmH6hHgcu5BZ2cphMDfJUIl2BIcL4oYR2NW7CZf0fvTUNymK3SiJjZ6_1CVtEd1PaVXVjoT_yELbqBYMaxm0UUN9wTEn8wdVJ9D5TysC3t26fvQuykYf00F7iPQdUx7QfhnJftOmpAazyG5ZDJPQ2T-_HEIuH_lQ_X_Ot13JkZFZdzvC3Q9fuqHQAKp2cKP_oyPVXV4kwEHVgis6O2Sb2woCvAhiKmOhEUXqi_p64Q7R6dPtmQ8rxDk97oEV0Ay0zKDEG3T3jFDAo-5HBR7rZ072PUFqQnrshh-MDafaasLqJwmNexBHPq-miURcXWzQe-aivNFO9_fGceC7oJt0twe4xVa5y_lJbL-IXL3kSSOip8cmbLagaR_rEczVTr12JeoqUNZuly02PO0r9Q-qaamRqYZW0F1EdVez7uZ5ysXsVpg1asfQNZckQEWesyZk55nzULg9JAQ9imNXVbPM_thcvx1-nCAT7V13ST8MtdF-8da38AkQxmSQWIdJflgfMAht0fjzn8u5BZrzXz27Wz4STUIbyzLUgHQGsc83AmhNDuhcl2zHhsXn4VbZj0z-xmHxYu7DMQyEzHgsLQ8KjySpfDVjjJcNS6r2-D007KrPkRxfgbitA3mqGRUtgDjhMOHFJikXm7RGtiGek8AR7ZzPo8I9fBY6Ylbf1c_l65nqibwKDVNeeWIQeyW6occypVzzQRHhStq9fpx6UoN9ikX0x3x0J96CfKth3w0qyBtADyE2qKgv_x2R3UqEkgpAArVYtZzrBtnGjvuykt5H2kZC1ztOUbN_pBmnZ6cZ5yPwvQGE9-oQ1UrC2L0KzqjlySxD_fLcMZ5bL9AUM4zsGpWrYcaWdMmP-_lude5GHPV8JLkM65ho0_95Ux4&cid=CAASFeRoSPd2RDtMXQDZk_ujL-lX-LqDAA&rfl=2%2Chttps%253A%252F%252Fsci-hub.mksa.top%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5975f21c81bda9dfd465bc96ee93a336e22d160bed0054ef916a8392d5aa406

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:37:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 108
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8601
x-xss-protection: 0
server: cafe
etag: 12295082536333688880
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 06:37:44 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/elements/html/ Frame B4CB 8 KB
3 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:36:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 169
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 06:36:43 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame B4CB 0
566 B 94ms
40ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssfaYq65OuRJjxvikyCvRHRjLmrWj4FL-VpdJ0rVbLm3ax7IwPkjLVKgvMDQHXJWphcGABvVZnFqF1V7UfJTXH7nILaMC1bkdEmWtT0TonVwpVnPrPZQWivHIJZuqiAg6PPvGBiA3HiQQV0UcBDKSDacnRnmPnT4jelIYsIst1PJC_x-3P1-ltzAyt3QvTdayPF3p3iP3b8QiHRy_Jj_tu9XGkGwW1WMjeL9CLTtjsXqAcab7yxLfPQ1i-SzuplzP_CU5D1tqc__ZXB9L5QATZRnCkOs2DxHxOaMu75e90MuitI9-w1KT6__xPV6dDYJ--SAR1XtWKk9E5C9ODmVu9CovS1cIV7Hw31CV-7pjAL0z9OaDHXeE0E2C5gwNgtKGMWACicKEUpE7xBgryXvy737W5GcLOlCATgJmUf42kGg0dFubolaj9JLI0lUfR8jbz-EcLgIgefmGgQw2zriLn8iMnxWTTeVSDkAJ53owaTd37523CsvTQSKwTlSZ9IQEWTNta8VM-QWNjoyki3hGqELfmbdvONDGjCyZyhZM4Bnesfs0jPNWEfD2dvKccAq3YfefLKKLgRW9ZkKi0ExmXT69JVKfxdYSmdzYSkQy1X4kix1HU759M46i7Ogd_0v65CpicMbxeAfYnNlv0qUpteecfEfSE9gyyc2x1NSw92HQ7gGkBvS0kvBi29COYAQf2Gfq7lanoOf6ovV3sbFd0c8_h-KcxPyYH08PakrW6Aueuc2gxX2jZ8jQldJyB16c99zBjWRl2Fs6_v6Re1D6fI9K5j4eytqqd8ELChwnvr3RLAdVES3tXMS0y8FI0XjRqW7OnJbCTSpMK9sWck27NJBw6JTrI6g6j8OUapsy3fWkDOb_Yw_nl946k-Sa5N90ZTo9-fB3C-a3jLyKw4iqs1Lz5lko0pxxS3dJ9h3ZcKdrTZYoI2P1EHEbtXcowO3xyPHyP47OsJg7ONkvoxsuWtlxhM7IB_ROT5NpvbpU84M5Z972XV_ool7jhtLLIqEshojKlELY2uGiSWI9u0qQAHKpZYHLZCrJ-BQdx8o1jiB00ZyJT4-qjkmwyIYVKqagRxdOmpe587cSuwKMHE3rsKzk6Tv1Zyi9-YpVbGV3O2VQdidTyNTVnnza-LEd2szmduvYmw7dVOHRNZ8xDzL8tMieNbqUupdhOvyw_oCr6Yr6GYCOA4XmkY5iascxer2mPKv0UkjkKGJ-Gct6AC4q2y&sai=AMfl-YRhOwfkPQN9f9HwVdQzv0LSEoyHr673KxUWmrJw-bUmSfyap3gniidIRvWdxNed0jx54tyTDw6nww-IYK9w_bz90Gz50DCYYlxA62JoRD2OvRSN_d5FVbGSTL2hALlk5KBEF5ypWPgfOFnTPk3GQ69qChYx61KkBqsDRr4&sig=Cg0ArKJSzLeTcRIj_eMQEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210603.58596&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 08 Jun 2021 06:39:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame B4CB 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 13:05:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63226
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 Jun 2022 13:05:46 GMT

GET
H2 200 BDMC_Double_Instant_access_Google_GDN_300x250_FR.png
s0.2mdn.net/9504762/ Frame B4CB 10 KB
10 KB 27ms
6ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9504762/BDMC_Double_Instant_access_Google_GDN_300x250_FR.png

Requested by

Host: d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com
URL: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e5eadd7b84ff0c973b74b25e5ea4dfedc470420c7f0062425014e2f465ed855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 07:00:44 GMT
x-content-type-options: nosniff
last-modified: Fri, 26 Feb 2021 10:21:21 GMT
server: sffe
age: 85128
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9899
x-xss-protection: 0
expires: Tue, 08 Jun 2021 07:00:44 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/222/ Frame DDDA 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/222/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://sci-hub.mksa.top/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://sci-hub.mksa.top/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Tue, 08 Jun 2021 04:52:51 GMT
expires: Wed, 08 Jun 2022 04:52:51 GMT
last-modified: Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 6401
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 4C18 783 B
532 B 16ms
16ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f945e4e2e83b9ad0b32e50c0e6a5d2a845a4a752c9d0582070c5443c38a93ad3

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-mNLGKkFXPHj+dVB9YFuGig' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://sci-hub.mksa.top/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://sci-hub.mksa.top/

Response headers

expires: Tue, 08 Jun 2021 06:39:32 GMT
date: Tue, 08 Jun 2021 06:39:32 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-mNLGKkFXPHj+dVB9YFuGig' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8208 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 07 Jun 2021 13:05:46 GMT
expires: Tue, 07 Jun 2022 13:05:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 63226
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame B4CB 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ed84c50493d3767d3093644083f268aaf8136c33cdd08d6050dfbe22e7371cef

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame DDDA 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 13:15:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62634
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 07 Jun 2022 13:15:38 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame B4CB 0
60 B 34ms
33ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

824.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 08 Jun 2021 06:39:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame 8208 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 13:15:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62634
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 07 Jun 2022 13:15:38 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 17ms
16ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gpt_2021060701&jk=1743252454784325&bg=!ammlaS3NAAY6sG-_OrA7ACkAdvg8WktWcGbjJ713rAWDY5AB9onmv19h5SV0mH-kqXMPdFDZ3YJGXgIAAAClUgAAABNoAQcKAPKiRY79yYV9jglqqHX4P2d3zDDq-Q534y0yI-ODZZBTK3QmQDm4tx36AC2M1R6qzWmEvXBSuSlrT6zK-xb3zo0HC1iHhXdX3DXvd3zEqHcCAtK6J4wo2qiBlCZam1xIvd2wpZ34oqQ2S4t8KngbLTURJ_URMpubKbn5MhdA-JvNCkjewIJ8ch2CbAzpoSQWGa_-8DFKG-KCiR95TtrKjFZPbnOwFbSv45Zz-HGPDMEqHXfmFDDiQLCMAQHnGiYHxK46Mxfjx0Eb-vxaUsOvJ66-6r_psVWEWFXUQ6kUgGKDLuLb04w3RW6ujJR99Y5keQAnoJkCZF2GLFQzFQmGyYg4_1CCjYJszUR9h8PX4iWZtzaKH5OrHcTXn-VxmO_Uc8-QNuDW4j2UNkSo5-HURKMBMtXPGLOCA6B8zoC7S1zpeeHfD4-o0jBhrscyVEXYPAX3vuMuaHXmzSWy0E_86Da5N9MDWZCaBT8b-VK0DkqdPDKiLBftEJFokjpYrV0X_ZXDVFb8OhMUo_zgx-UThIdEXuv49tbe1e7Ca3BJi4rPp1HOWnG4O3k1vn8mFBQgj7NljM3C9UG-F0hOXdEEP-fYXRc68q5GFysTRWbOOfo30OpK8qB2xLa-R4LI317IiOtY80P5A3XtCf5WxUWHC-Q1w4dpcrEJhnELmLxuXJr711Mp5Z_MxNOF8584pqzet0U9xuYgVTCmdnr6tpoY6zH8UWxPfNimro1iHd9222AE7nJkJ3LP0wh1qWRUVm3Vi4NMSlnbny4mxNdh-yZpPQOIm-1s5nMP3BEcRCVGn_khhicSuxUvC7XUICBokOsA4pNh1krR2QGMgWioh79Bn-m_Epf_hDxGhOAPay35gWvSzO5vlqo_ct_4PUtKN3NIcqkBniPdMdl4HkDVPYWdgveHqRXzPTVesldTryGGvbXuRcLcAJerJqvA6DmLPkNLXWxF7NFGkNISoCJ_XAA2KjnNK-y7-ieiXUmb9BEE2risPblx4hdMmVie4KkSuncRvRHl-YxcKhfD3UyWUGG853eyY0OiqOgYHqawd-cdH5ZtQ-t5xlSFtMlLyJqc_S9_IVQt3lr3rBBLPG5anDal12ozVrB993-0SLmU12IH48DZDoCOez56cH4MGQ

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK adcm.js Show response
tag.digitaltarget.ru/ 3 KB
3 KB 201ms
66ms Script
application/javascript 185.15.175.134
SAFEDATA Uplinks

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.digitaltarget.ru/adcm.js
Requested by: Host: kitbit.net
URL: https://kitbit.net/kb.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.15.175.134 , Russian Federation, ASN43226 (SAFEDATA Uplinks, RU),
Reverse DNS
Software: nginx /
Resource Hash: 7c078e5032ba5da0fdf4e333ac30ad283aaa9de5d935e716c6fd7e1b5d4e9d2e

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 06:39:33 GMT
Last-Modified: Thu, 13 May 2021 10:40:41 GMT
Server: nginx
ETag: "609d0229-c11"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3089

GET
H/1.1 200
OK s.js Show response
kitbit.net/ 1 B
303 B 69ms
69ms Script
application/javascript 31.131.252.94
SELECTEL

General

Check archive.org

Show headers Download Go to

Full URL

https://kitbit.net/s.js?u=https%3A%2F%2Fsci-hub.mksa.top%2F

Requested by

Host: kitbit.net
URL: https://kitbit.net/kb.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.131.252.94 , Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

41b805ea7ac014e23556e98bb374702a08344268f92489a02f0880849394a1e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 06:37:59 GMT
X-Content-Type-Options: nosniff
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: no-cache
Connection: keep-alive
X-XSS-Protection: 1; mode=block
Expires: Tue, 08 Jun 2021 06:37:58 GMT

GET
H/1.1 200
OK h.gif
kitbit.net/ 43 B
537 B 127ms
57ms Image
image/gif 31.131.252.94
SELECTEL

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kitbit.net/h.gif?r=&s=1600*1200*24&u=https%3A//sci-hub.mksa.top/&h=Sci-Hub%26kbuid%3D5EFC831F4710BF602E0BE28402376F4F

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

31.131.252.94 , Russian Federation, ASN49505 (SELECTEL, RU),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 06:37:59 GMT
X-Content-Type-Options: nosniff
Server: nginx
ETag: H4P8XmC/EEeE4gsuT284Ag==
P3P: CP="NOI DSP COR NID CUR PSA OUR NOR"
Cache-Control: max-age=0, private, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 1; mode=block
Expires: Tue, 08 Jun 2021 06:37:59 GMT

GET
H2

200

cro
optinder.com/
Redirect Chain

https://p1.ntvk1.ru/nps
https://optinder.com/cro

0
555 B

45ms
21ms

Image
application/octet-stream

2606:4700:3035::ac43:c8d3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://optinder.com/cro
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:c8d3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:32 GMT
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bIZmIDrWP179nTcLKkaPsGxBJb2bhy3Yd6iK2%2BAkEEFnuTMI30zeAgsM228eSlxL2yHsMOhynI220j5SwLBe7cG48wIpSo1%2BBGDcVaWHW3Svi6h0G7X5MT63IWBJ3KPqp7X8wSoN"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
cf-ray: 65c01fa6fd810614-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a8bf21c5a00000614ed35a000000001

Redirect headers

x-77-nzt: AcO1ryxtgL+B
date: Tue, 08 Jun 2021 06:39:32 GMT
last-modified: Tue, 08 Jun 2021 06:39:31 GMT
server: CDN77-Turbo
x-77-nzt-ray: HZvieSnIKBc=
x-77-cache: MISS
content-type: text/html; charset=UTF-8
location: //optinder.com/cro
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0, post-check=0, pre-check=0
x-cache: MISS
x-77-pop: frankfurtDE
content-length: 0
x-request-id: 1235084467-2-1623134372.901
expires: Tue, 08 Jun 2021 06:39:31 GMT

GET
H/1.1 200
OK sud
ut9.rktch.com/ 88 B
88 B 194ms
65ms Image
image/png 89.108.97.2
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ut9.rktch.com/sud
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 89.108.97.2 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS: d50603.reg.regrucolo.ru
Software: nginx/1.18.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 06:39:32 GMT
Server: nginx/1.18.0
Connection: keep-alive
Content-Length: 88
Content-Type: image/png

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8208 0
20 B 15ms
15ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B86jhpBC_YIHFH4eOjuwP5paIgAgAAAAAOAHgBAI&bg=!b2ylbCjNAAY6sG-_OrA7ACkAdvg8WuXblqxU61tvzrjU6kR0r0RR1qA6IFt1Ilfi4VlpZS1HGVtBMgIAAACbUgAAAA1oAQeZAvxvfkfw-9tDdurAnn4Fk-97OvUD0FnK6A-ZNNXAgE6QaX7lzm-yP1mt45hElhqq6GQd3s_kOvRyZd8GpQBBpVsqLRc9VEaxL0qJy2d8IHlR2CLs9zFkvLU9_gxXk1i6Aa1puy--xl2VH3Z1KeO3xc5stBPBrurq5tu12o-pufxtbFOralbMLXxw2Zx7wUEhzCLnhPA0nqCjAt64SQJl8ud0naMYQbbHsro9dkScfBPdsT09lmXPPz3jFI0jj9QEce3geWWXjysFIZ3YvnQMTOta6Eyz_Af8EtBGLrabRpwxlyfU_nLHbnOqnHetpnw_XLLI3ZQyalyB2Q5KRr0Xn2WQ3hDRCK7YYOoVAYEd-Mepa2-zFQif8vrv_gk0RwvH00pQ74hKOTUhaCfO838UyHpVJaQw_2paWdsZngkyaFwLZnsInXJWGe52Ja50XgyxjJZx0hVpZvATp-ezWQgzM685QE6oppOuWzseO9sm2e8qQtmHj6IOdEroZlQyUPg7Y3LjfgBUBBeh3XmV4wVIxOPYBr_W2QnVqlEpCWYRGj9WoxYhLxWYETeXnn-hXbg77fRp72xbLsDFValTbV8h-QcfCZFs9vwQhO6ICiC50Qsy4ZzN40yhVPTwM4Mh-OAqiPsWzF3_mQvzhYX1NYvnazOg4s8XTgPFr09nZHkOyz57FYW-ceREvO24vhMCQIgDOr89yJJHKKZrfDOpCZ_Ue4MA73wuurwoEdj1S5r7MJD93tQ_ofQbUCmVtCOdcT7rbUnVN5Fi_IHKTqNmTw4cjiyiixvR3b17qtQwKhhyO3B9FYjmcq8ha-XyYLtJXiYi7MZ0pNFeI886UitefxeP1O_qgP-OpQrP-aOLxWI0uG-RbiPLs0KSAmY3ivaIzm5MNheZc2jty_zG7v8MCJOcjBl4QaOD8owcyeQsQg6CDwh8HIJFL7i8x4aT2vZIU2sN4n0F1bvu-CZktVOZ46ZaXucqA8kQMTRo6SIvHHzdcMZyntw8MOhqRqsasJOYjg

Requested by

Host: d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com
URL: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK processor.js Show response
tag.digitaltarget.ru/ 15 KB
16 KB 117ms
117ms Script
application/javascript 185.15.175.134
SAFEDATA Uplinks

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.digitaltarget.ru/processor.js?i=788529775870776
Requested by: Host: tag.digitaltarget.ru
URL: https://tag.digitaltarget.ru/adcm.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.15.175.134 , Russian Federation, ASN43226 (SAFEDATA Uplinks, RU),
Reverse DNS
Software: nginx /
Resource Hash: 5a0da3f86d0505c67db1fb2287ce92548014d4ba7969eb76b7f716a5d5009e8f

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 06:39:33 GMT
Last-Modified: Thu, 13 May 2021 10:40:42 GMT
Server: nginx
ETag: "609d022a-3da5"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15781

GET
H3-29 200 container.html Show response
d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 280A 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://sci-hub.mksa.top/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://sci-hub.mksa.top/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 08 Jun 2021 06:39:32 GMT
expires: Wed, 08 Jun 2022 06:39:32 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3CD9 624 B
299 B 20ms
18ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGJ2Rm6wBMAE&v=APEucNWhPpZ-Ki52ZqcUNVaq9dV90jKmEajFVG4uVCyo1aKur37VnU0oGx07SC9DNPRVTRbwhd801d-cZiuobhUMwq-46JEXRYGqXeofF6-B7P1Yj3qeW0Ff11c_ShmVjaXOrypk3EpDqlKiIAT7juCNxaMj6mK_CFTu-o2ziHO44kXfMJywaRQ

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CKfiYRCX9ucBGJ2Rm6wBMAE&v=APEucNWhPpZ-Ki52ZqcUNVaq9dV90jKmEajFVG4uVCyo1aKur37VnU0oGx07SC9DNPRVTRbwhd801d-cZiuobhUMwq-46JEXRYGqXeofF6-B7P1Yj3qeW0Ff11c_ShmVjaXOrypk3EpDqlKiIAT7juCNxaMj6mK_CFTu-o2ziHO44kXfMJywaRQ
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUllbh1Pl8R1flc1EFdeSjEbqLV_ouZOzcq2xHYS7zjdfZwlUttMmxk9Xh3rTy4; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 08 Jun 2021 06:39:33 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 08 Jun 2021 06:39:33 GMT

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2A5D 58 KB
24 KB 42ms
40ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cyj-elxK648N5bPS1ZKfp7j9WbBw6iiuE1p5CIfvE_V3jNwgDYdEJOsgPKXRk7pdkqAyo1Zy949n-s4QHDnzdgC8oYL5oRPEgxipCbA4C8PO2t0iGTuj2gan1k3Nc_WaS8-l7gwvrPbUiwojafiPIFYA0Z9g&dbm_d=AKAmf-BB0f2t3hlRUmmlJ2nuCsJDDtEmjVW90A9EBnGcD4-R5okgiVDJ-nFtfakmLx3bQFXJGaLfvjZQe2qGh24_yX6aASZ97loApUmdi8bg27aABN-rbUAmWnB5WM6Vq0Sp-GIEfQVwTPe627e5GSa59_wsNq6_UNDhR9Jwh1wMfbi5fM8vbpPKIYe-2YDcSPPI8I65oefJNlbiRLN3iYqcWiFqyqo-SeQTKIyqH_nxyFMtAg2aarW9OYp2z4pQCJRl43TuD6l9WEYhRJZJK9kS-3dFHXkQoT612bxtGklNtRh8oZcXRTCs1m7OLXPqx1clBbLqgeiWbeZaDxieASdHWXkcDkX9VBKswF5Bw2Ct1sK6TcCsI0AU4lc7uERLycjq3Io5mfQX_7SgUY9SQ7AMU4LqWAsx_2qJDy1wtOsatIvcWtouePCel0cE3eMi-gm7ZxesbXZHF7DAqPyIF0F7C8PmkM1rzOhOj7OZbQxy9x9DEYZoIaMWzhDVAvRMGYX8N7i6YH6bWNFZAFhrWX4Jm4LEd6Few0M94-MaNX2ozgARQfLjE3qkLQncsELZeZp3m9kn87m0IpoKCSfu_Ebh9zhGB7hZlrkw7ZSCJ4abdAH2uTGWluj1MY5DL5zF0OtySpXh4H8pLjbNXwRuqqfAXzICryDb3kwRdIzN3abw7j61pcYaKrZKT2-H5EW8sKUfDDEq3vVbh939t4YLxZ5eJ80YV868cyRYcqfGd8Fe7gPeA_Tb1FoBh1ggY9WxYM1TRhdFG7Px1ez2Zu7U8B71nj5fJidSeMKivqHNz5c_cqlKpoJILqmexVs8no5rXbLTdRF1fTG9MMAMqtvr2FRVU-N5a1LppAt8U0Xy1t0cz1DccMjqkPsY7l3gp3HYJWEocPdgJ-m9WM26tsPEgSHx2TAyVGyCBng4GcYsk1EMMb3WGQD1la1D8U0O5B0JCwtxyw8QnB3ZVUtqb1WlFhaSXULRSHCJ0xGjcc5hFXy8AUktR0l9_kKJRxgfn1-Zf69IEuJ5Azk9RgANJZ9ddMW8karK-XPkITAALNScsbEGlAH7NWehdc9Ix3_MeB-q-aIWV8RUEHPpl1VheukRYOfSGTTbFV3-yOF6u97On6A6gER_ffkjYEaE1WEORnEeTM9IWfcbBUar8KhjbTf2ZqwEX1YhjNS0ifuQKpnoHk-GOvYKLxbTNBgqGqZ56gnMgaGSUKcpqkjy1fRdRhu8MAIGhcODnPhBtmJGUaM-AUfx40cfnFthG5r7subNpYlRGtIopDUSzrnm0uBOB3-vlX3ZNg4CNfBH-a5jixQr9ji1teYTsM2nxz49LR8GCdtV_LWwhxAZ3HR-jbf1MzZmWKjgg5s1xD-9E3lrbNrQrmSuy3_nt-TPuD-MzFRzkyn3bE_8p6RWaDmOXkRBik9q0gN9RYvXQIWOVZ9NiP_p-GItLupLv7smB5aGps22nCXZOuu47CcYIvnWabthZ72tur8NGdPZMJ0L8TE5qLcjSLuPhGFjA9hT7BG3S_pDKfy584lp2Xb6XbzAxPNoU8lZ4opGFHRfujr3kQB0EXyWtLSTTu0THCCPlxtEt7MOXX64azU9jsWB_jHmaYjXkZ4nefNVj5hl7CO_dbQuZEs2Qqh2ZCYYfbuOV1-aa4xGmSKguoKlS56L7Ph56DvZpokluRzcJlpSqCwqb8pwWwa8zAX5iCJ5EOHabTALvCBPKiIM0Zp1_7iY1uYW2y7PTf6FBWm47TZarw3OE00xpsvJbxlmtGUDLboQaXcdi0x_Mf1x5_40m-lI2VhyE0Drqv-Omvt5tYziiiMHkl5_dm1i6TP8wtChmVJ4qilG4PAtKFh0IH0ZTBL1nuvSr5s25TzVpzPWjt20I0Lys7K5dE8hgyAvnTgNBgTEEZ89SqrWyhqeYOTHxfUB_ConxW2VC10DsZSSnsxSvoLwVA_nIbzge-fl7yad1OhGJJh1Z8_ExDlpQr0vIwsGyR6pK7KEY47n0H_dJYx89ZOmmXpNLw9jUjfhuq0rH7BtBW-9rMrvRGz0awP9a65oAAgKWNZqzK72Wb22U8p5hmZtoJNAKQDfBu86zcy_l9gh3BQX4rd3mei1MuoLmMe4n6OBSr9P8RVqkz0W8jNFrl8jFJnIKscr8pANqqysBAU3w6mwGTidZ4eAt2h00Ps-E9Whu4h0fIkxOzec0ppmLu1j_ec9KGaSatMMde2dBh1IK1OIJMDTD4ilYXPlLIzvpwCIP53dpCjF5FORM7ceVwI2VvtxbCTbe2OMcx89Zsa8Lqrmfxqpuqigh4V2GKfcE-Bj8f7CTPv8Q0HzkTbQ4aUlowFd_7ZewNWZ_jt--xcDgbYE0bzAuWmNloLDiKtgv05Cs_uXX0xeJhEWm5Q5_c8lPt2CYa5h2NKdA7RDumZFRICGOXCVBbJtTygAetqZTiGrsuFzfhXMURA1ZVkRDpcGOT8yHnJgxqnF5NcH2FnyDrYI8uqIJQ7epjjlj0teqh9fn2fNpt9DYeOrl_jbPOAQj_UiM8v3eMTsm9iZ31fVsOPJHZFwRaU3uUb6MUgi67HNTRx5qosuDozW4kJPIG8NddDgWsB302FSy75ZAda0UJFuiJ9olGayDtiytxAX_Znyxz81II6sbQ2g5qVRQ4TsB_jEQeF6IThTYjKimxcCxCagY8WwFe0lIO7eznOwT9O-f-CobgmKeetJTRp99sOrEtC65NtgUMOcvC55gX6h7fDNHgp_RTZ0bVyFLHDgXWyqv_RhFC53vV560ToobeWUrZFpCFdLYCyNIVJFF7_UoRINkmcOEIfHQpzGop9KDuXlOWhdHwRUvWRFjNWbENIP-VYAaAbaLZy2GJLvuTfSHeqvPc9HP4O_etnLS2wAm0odZ3_Wv_rkNkHVfChKEDcDX__BEKrv1p_ZYGn_poFXTdAdveiEqG32up_HwMtRm8f6hQEYRsvu8aAdEUlzAutYAzYgCxkZxLOCgPlALtzngrjHIT_lMueiLMzs1xaOB_xc4vDmg-NUB0hUHTS5W8lui7htBtHONHq46QRjA3hOKjRVmdhyQSggK8dcyyIhoZxxSqhIQdvedxpe2YXNQugbHGVHPhtlyZB1j9r-WIIjZJIKyfbN39qfNzhLzn0J0sJKVtaLDeTWyCkjoRs1F5sqWg&cid=CAASFeRo78aLyxI3AlD60kJQLCaBiYu1JQ&rfl=2%2Chttps%253A%252F%252Fsci-hub.mksa.top%252F%240

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8617169ca06e21af0df650a9ac3d2421f2ba572cbc90cf696316f06bdee305e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:33 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24149
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/ Frame 2A5D 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/window_focus_fy2019.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1ac43e9327c147dc04b1efcd475ba7e9d464e6504eaffb167d0412d339b39e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:28:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 652
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1316
x-xss-protection: 0
server: cafe
etag: 797314601362473214
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 06:28:41 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2A5D 122 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f28c37beb838d695f95710805308cfe7f1fcc286bd744ab0184a23a10d5a4ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:33 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1623066169988846"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Tue, 08 Jun 2021 06:39:33 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/ Frame 2A5D 13 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210603/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a677da8f32851941b090ee6e9294757cba154033200b20231b2a4ca7f62a820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:37:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 145
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5644
x-xss-protection: 0
server: cafe
etag: 16788636151609896382
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 06:37:08 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 2A5D 0
0 15ms
14ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSCoeC_WhmLaPtVod_fKhUdDhCUrXepb6NakAZNGZsjT6GkNvqTsCKLKyNfyZVYHPyFktcYwHUfSjj9NrnAsBm_KZno5w
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2A5D 42 B
63 B 16ms
15ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B821gaQecAUhrOSvLyxG6_hY9q4u_OHVNkhpQHOGTwwBQKuly__ItKP_OLXytgQ2xjMAYLE_v8h3iGVz_emqXn9rJ3ofc-RJA5lO3l1POXLmPVHBo

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3CD9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB7NKr8elJp5TsdU-PE9fOo&google_cver=1

43 B
1014 B

35ms
35ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB7NKr8elJp5TsdU-PE9fOo&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGJ2Rm6wBMAE&v=APEucNWhPpZ-Ki52ZqcUNVaq9dV90jKmEajFVG4uVCyo1aKur37VnU0oGx07SC9DNPRVTRbwhd801d-cZiuobhUMwq-46JEXRYGqXeofF6-B7P1Yj3qeW0Ff11c_ShmVjaXOrypk3EpDqlKiIAT7juCNxaMj6mK_CFTu-o2ziHO44kXfMJywaRQ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 06:39:33 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 08 Jun 2021 06:39:33 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:33 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB7NKr8elJp5TsdU-PE9fOo&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3CD9
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YL8QpBn1a.82dyXwzKrNTAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB7NKr8elJp5TsdU-PE9fOo&google_cver=1&google_hm=2

43 B
894 B

36ms
36ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB7NKr8elJp5TsdU-PE9fOo&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGJ2Rm6wBMAE&v=APEucNWhPpZ-Ki52ZqcUNVaq9dV90jKmEajFVG4uVCyo1aKur37VnU0oGx07SC9DNPRVTRbwhd801d-cZiuobhUMwq-46JEXRYGqXeofF6-B7P1Yj3qeW0Ff11c_ShmVjaXOrypk3EpDqlKiIAT7juCNxaMj6mK_CFTu-o2ziHO44kXfMJywaRQ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 06:39:33 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 08 Jun 2021 06:39:33 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:33 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEB7NKr8elJp5TsdU-PE9fOo&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3CD9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPjVXrB4D8l5ZGIsfJY7i3A&google_cver=1

43 B
1021 B

23ms
23ms

Image
image/gif

185.33.223.178
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPjVXrB4D8l5ZGIsfJY7i3A&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKfiYRCX9ucBGJ2Rm6wBMAE&v=APEucNWhPpZ-Ki52ZqcUNVaq9dV90jKmEajFVG4uVCyo1aKur37VnU0oGx07SC9DNPRVTRbwhd801d-cZiuobhUMwq-46JEXRYGqXeofF6-B7P1Yj3qeW0Ff11c_ShmVjaXOrypk3EpDqlKiIAT7juCNxaMj6mK_CFTu-o2ziHO44kXfMJywaRQ

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.178 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 06:39:33 GMT
X-Proxy-Origin: 84.17.43.134; 84.17.43.134; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.222.231:80
AN-X-Request-Uuid: 9d0ea5e7-215a-4ba1-a429-264f09bfb42b
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:33 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPjVXrB4D8l5ZGIsfJY7i3A&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3CD9
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjQ4ODQ4NTc3MTAwNTE3MTgyMw%3D%3D

170 B
188 B

34ms
34ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjQ4ODQ4NTc3MTAwNTE3MTgyMw%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 08 Jun 2021 06:39:33 GMT
X-Proxy-Origin: 84.17.43.134; 84.17.43.134; 824.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.40:80
AN-X-Request-Uuid: f658447c-5675-4c6f-a1fb-1387ef977f43
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjQ4ODQ4NTc3MTAwNTE3MTgyMw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 2A5D 111 KB
38 KB 21ms
7ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com
Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 19:05:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41668
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 08 Jun 2021 19:05:05 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/elements/html/ Frame 2A5D 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cyj-elxK648N5bPS1ZKfp7j9WbBw6iiuE1p5CIfvE_V3jNwgDYdEJOsgPKXRk7pdkqAyo1Zy949n-s4QHDnzdgC8oYL5oRPEgxipCbA4C8PO2t0iGTuj2gan1k3Nc_WaS8-l7gwvrPbUiwojafiPIFYA0Z9g&dbm_d=AKAmf-BB0f2t3hlRUmmlJ2nuCsJDDtEmjVW90A9EBnGcD4-R5okgiVDJ-nFtfakmLx3bQFXJGaLfvjZQe2qGh24_yX6aASZ97loApUmdi8bg27aABN-rbUAmWnB5WM6Vq0Sp-GIEfQVwTPe627e5GSa59_wsNq6_UNDhR9Jwh1wMfbi5fM8vbpPKIYe-2YDcSPPI8I65oefJNlbiRLN3iYqcWiFqyqo-SeQTKIyqH_nxyFMtAg2aarW9OYp2z4pQCJRl43TuD6l9WEYhRJZJK9kS-3dFHXkQoT612bxtGklNtRh8oZcXRTCs1m7OLXPqx1clBbLqgeiWbeZaDxieASdHWXkcDkX9VBKswF5Bw2Ct1sK6TcCsI0AU4lc7uERLycjq3Io5mfQX_7SgUY9SQ7AMU4LqWAsx_2qJDy1wtOsatIvcWtouePCel0cE3eMi-gm7ZxesbXZHF7DAqPyIF0F7C8PmkM1rzOhOj7OZbQxy9x9DEYZoIaMWzhDVAvRMGYX8N7i6YH6bWNFZAFhrWX4Jm4LEd6Few0M94-MaNX2ozgARQfLjE3qkLQncsELZeZp3m9kn87m0IpoKCSfu_Ebh9zhGB7hZlrkw7ZSCJ4abdAH2uTGWluj1MY5DL5zF0OtySpXh4H8pLjbNXwRuqqfAXzICryDb3kwRdIzN3abw7j61pcYaKrZKT2-H5EW8sKUfDDEq3vVbh939t4YLxZ5eJ80YV868cyRYcqfGd8Fe7gPeA_Tb1FoBh1ggY9WxYM1TRhdFG7Px1ez2Zu7U8B71nj5fJidSeMKivqHNz5c_cqlKpoJILqmexVs8no5rXbLTdRF1fTG9MMAMqtvr2FRVU-N5a1LppAt8U0Xy1t0cz1DccMjqkPsY7l3gp3HYJWEocPdgJ-m9WM26tsPEgSHx2TAyVGyCBng4GcYsk1EMMb3WGQD1la1D8U0O5B0JCwtxyw8QnB3ZVUtqb1WlFhaSXULRSHCJ0xGjcc5hFXy8AUktR0l9_kKJRxgfn1-Zf69IEuJ5Azk9RgANJZ9ddMW8karK-XPkITAALNScsbEGlAH7NWehdc9Ix3_MeB-q-aIWV8RUEHPpl1VheukRYOfSGTTbFV3-yOF6u97On6A6gER_ffkjYEaE1WEORnEeTM9IWfcbBUar8KhjbTf2ZqwEX1YhjNS0ifuQKpnoHk-GOvYKLxbTNBgqGqZ56gnMgaGSUKcpqkjy1fRdRhu8MAIGhcODnPhBtmJGUaM-AUfx40cfnFthG5r7subNpYlRGtIopDUSzrnm0uBOB3-vlX3ZNg4CNfBH-a5jixQr9ji1teYTsM2nxz49LR8GCdtV_LWwhxAZ3HR-jbf1MzZmWKjgg5s1xD-9E3lrbNrQrmSuy3_nt-TPuD-MzFRzkyn3bE_8p6RWaDmOXkRBik9q0gN9RYvXQIWOVZ9NiP_p-GItLupLv7smB5aGps22nCXZOuu47CcYIvnWabthZ72tur8NGdPZMJ0L8TE5qLcjSLuPhGFjA9hT7BG3S_pDKfy584lp2Xb6XbzAxPNoU8lZ4opGFHRfujr3kQB0EXyWtLSTTu0THCCPlxtEt7MOXX64azU9jsWB_jHmaYjXkZ4nefNVj5hl7CO_dbQuZEs2Qqh2ZCYYfbuOV1-aa4xGmSKguoKlS56L7Ph56DvZpokluRzcJlpSqCwqb8pwWwa8zAX5iCJ5EOHabTALvCBPKiIM0Zp1_7iY1uYW2y7PTf6FBWm47TZarw3OE00xpsvJbxlmtGUDLboQaXcdi0x_Mf1x5_40m-lI2VhyE0Drqv-Omvt5tYziiiMHkl5_dm1i6TP8wtChmVJ4qilG4PAtKFh0IH0ZTBL1nuvSr5s25TzVpzPWjt20I0Lys7K5dE8hgyAvnTgNBgTEEZ89SqrWyhqeYOTHxfUB_ConxW2VC10DsZSSnsxSvoLwVA_nIbzge-fl7yad1OhGJJh1Z8_ExDlpQr0vIwsGyR6pK7KEY47n0H_dJYx89ZOmmXpNLw9jUjfhuq0rH7BtBW-9rMrvRGz0awP9a65oAAgKWNZqzK72Wb22U8p5hmZtoJNAKQDfBu86zcy_l9gh3BQX4rd3mei1MuoLmMe4n6OBSr9P8RVqkz0W8jNFrl8jFJnIKscr8pANqqysBAU3w6mwGTidZ4eAt2h00Ps-E9Whu4h0fIkxOzec0ppmLu1j_ec9KGaSatMMde2dBh1IK1OIJMDTD4ilYXPlLIzvpwCIP53dpCjF5FORM7ceVwI2VvtxbCTbe2OMcx89Zsa8Lqrmfxqpuqigh4V2GKfcE-Bj8f7CTPv8Q0HzkTbQ4aUlowFd_7ZewNWZ_jt--xcDgbYE0bzAuWmNloLDiKtgv05Cs_uXX0xeJhEWm5Q5_c8lPt2CYa5h2NKdA7RDumZFRICGOXCVBbJtTygAetqZTiGrsuFzfhXMURA1ZVkRDpcGOT8yHnJgxqnF5NcH2FnyDrYI8uqIJQ7epjjlj0teqh9fn2fNpt9DYeOrl_jbPOAQj_UiM8v3eMTsm9iZ31fVsOPJHZFwRaU3uUb6MUgi67HNTRx5qosuDozW4kJPIG8NddDgWsB302FSy75ZAda0UJFuiJ9olGayDtiytxAX_Znyxz81II6sbQ2g5qVRQ4TsB_jEQeF6IThTYjKimxcCxCagY8WwFe0lIO7eznOwT9O-f-CobgmKeetJTRp99sOrEtC65NtgUMOcvC55gX6h7fDNHgp_RTZ0bVyFLHDgXWyqv_RhFC53vV560ToobeWUrZFpCFdLYCyNIVJFF7_UoRINkmcOEIfHQpzGop9KDuXlOWhdHwRUvWRFjNWbENIP-VYAaAbaLZy2GJLvuTfSHeqvPc9HP4O_etnLS2wAm0odZ3_Wv_rkNkHVfChKEDcDX__BEKrv1p_ZYGn_poFXTdAdveiEqG32up_HwMtRm8f6hQEYRsvu8aAdEUlzAutYAzYgCxkZxLOCgPlALtzngrjHIT_lMueiLMzs1xaOB_xc4vDmg-NUB0hUHTS5W8lui7htBtHONHq46QRjA3hOKjRVmdhyQSggK8dcyyIhoZxxSqhIQdvedxpe2YXNQugbHGVHPhtlyZB1j9r-WIIjZJIKyfbN39qfNzhLzn0J0sJKVtaLDeTWyCkjoRs1F5sqWg&cid=CAASFeRo78aLyxI3AlD60kJQLCaBiYu1JQ&rfl=2%2Chttps%253A%252F%252Fsci-hub.mksa.top%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:36:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 170
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 06:36:43 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/ Frame 2A5D 22 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210603/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5975f21c81bda9dfd465bc96ee93a336e22d160bed0054ef916a8392d5aa406

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:37:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 109
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8601
x-xss-protection: 0
server: cafe
etag: 12295082536333688880
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Jun 2021 06:37:44 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2A5D 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com
URL: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 13:05:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63227
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 Jun 2022 13:05:46 GMT

GET
DATA 200
OK truncated
/ Frame 2A5D 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ffeac65ef82061eeb2e33b39f4a996dbfd02bfa12e0505cfb205a41587fd5fad

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 9238 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 07 Jun 2021 13:05:46 GMT
expires: Tue, 07 Jun 2022 13:05:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 63227
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 moatad.js Show response
z.moatads.com/havasfrorangedcmdisplay758646212611/ Frame 2A5D 312 KB
105 KB 128ms
30ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/havasfrorangedcmdisplay758646212611/moatad.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: dffdd9b6e2957c7e83d586fe8f76e2dafa3855acfdb1cda8c9098074f5127c2a

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:33 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 09:53:51 GMT
server: AmazonS3
x-amz-request-id: 10TX8TBX4DP7TEQ1
etag: "42d45703fd6788947b8ec6e1fd17e452"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=28813
accept-ranges: bytes
content-length: 107119
x-amz-id-2: 9lOWYX8W8RiqMNCZsjHkRL8RJyS3WgNG0DZm6NZUREcgLyBJBAl6Iwg2pjbvmgalqFXsvO3iSro=

GET
H3-29 200 index.html Show response
s0.2mdn.net/8364571/1622764014399/ Frame 8376 6 KB
2 KB 20ms
6ms Document
text/html 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8364571/1622764014399/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55f5c456b1dd90b093056c3d0038cb4e1c3c215739f46b771c11eb93cfeb518f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /8364571/1622764014399/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 2288
date: Tue, 08 Jun 2021 06:01:06 GMT
expires: Wed, 09 Jun 2021 06:01:06 GMT
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=86400
age: 2307
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2A5D 0
24 B 86ms
44ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuuBx-wJA0si3zLYQRvrWHh96xAdytiGY0dst7lT2qHDXH0XFw33SIxBLUwo-qFuopaCcmGnpJjLWTyjjf68kj2SemrOPSdHYMUoRnTr5lYIACaWVXhwqkRBF2AtewHbXYa0wfJlUnh2L6aVOs7e-Ji0ybJohHrPaFQof1Cx-21hZN_D_NE4gqm0lPrIh0MoQqrqtut9XbnWyHVzMyIlnsX7fa-iUoaTtR42oNX0Smw_c-Yd6aHzKnszlC-UgP7q1pk6eDakmB2VKbe6OCTXawIPBhHX7RBqVmLi1cpd4m-YZUpytIp_ujDGvOIKAJBjwq-oEIbmBp4H2z70kGb6XtThbSLdOe9kcb8xIVq1YHHFLdv5il4iVR_Aa69jGzef747DqybzmIVRBi8lEXlgW4JjpCh2kH1tOPrmMuHF5JpIFH3uVZgUC3nsCq59InNrGpJg81jIpQYquFRsuoStU15azi4pY5Xis9pDTucX6gKKlaJ5-4sEgjLFyNJObdlDqTseIwxdLFFW0orhM43LkDe12hTRmuK2mRmzI1JlZ32CeJgYP3c7TK2vpGEsLOwCA0tx7dDf0BWw-JxdX80x72y39cBQ8t0ipJ097DLHs307eFPKA16vetenzvsX6iynichYF3h6zPa0tuktXjnR8TYaLpcX-nkOoGMfjaw8lDoRbSWP2mKxx-RbNaYmU8cJBcQJ_g3CoryFkyle7OkBtjeCUaR-zaD1MctuPAPpy7lw4z5krhN1KLH4aSXj-Y7qDCF6zYuhAB-Q_66fVSZq1bxTrLcEAUhICZo6wLWEoqj2CkhtVH5zFzVvd66jEfMciUR2CDluOvyRd_5tbmsGwm-QmcvvbcTdSeid-jmRSpAohGcoyGnHN6P0mqfBe5goLxlWP4dhzxJyGkvudK3G2cKp-Xpu_HJMRiecPvVO1Ps-hBYXq80OxDt__bPLJGrcEhssaizHvCoisZ0Tc27PA3-haDl3ISvv_TxlN0YmEtuNeVO_pzFeQco0_QGIHCWwIGyc_x9xgulypFiAkkIx8f2PKzN4Fde3sEym3BJNVCcHAHeF5z-Sp2p7nQaKqD7Q2zL0HuiTyJGXOzIVe63oloYfh_Gn4Rx1s_BAXCgSaVdqdvrt3lI8T3MMg4z1V_jMWnTgIi-DMZYkrFqAaXSdJPwWHBJJ1cH4dsaty9N5jrrp1XCEZ5CBdsm&sai=AMfl-YTWJFt8GcCw6MAaIU9Lc4lBXg6ZXXHHlZ1FBm8TSkNRn9hCYkg4ONCMCX1jM4n2izJvNhM2cN2EstffR0gk9f5dzwGUQCS2Zz9_m_243zdfCRLDe9L6lNUiA8Q5aTLIUZu1p01AhPOPYSrnbln0f3EOY7uZWnG_OCzJuRw&sig=Cg0ArKJSzLnx6lJSM4cEEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=61&cbvp=1&cstd=58&cisv=r20210603.69486&adurl=

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d7571dbb76fcbb0b66b67e2f44c2e6f0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 08 Jun 2021 06:39:33 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK extension_1086.js Show response
tag.digitaltarget.ru/extensions/ 732 B
976 B 81ms
80ms Script
application/javascript 185.15.175.134
SAFEDATA Uplinks

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.digitaltarget.ru/extensions/extension_1086.js?i=183422062931209
Requested by: Host: tag.digitaltarget.ru
URL: https://tag.digitaltarget.ru/adcm.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.15.175.134 , Russian Federation, ASN43226 (SAFEDATA Uplinks, RU),
Reverse DNS
Software: nginx /
Resource Hash: acde19dd39fd4b3b76819f21d622af86dcdf0cb00967a337a01005e8316ccb1f

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 06:39:33 GMT
Last-Modified: Thu, 13 May 2021 10:40:42 GMT
Server: nginx
ETag: "609d022a-2dc"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 732

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame 9238 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 07 Jun 2021 13:15:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62635
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 07 Jun 2022 13:15:38 GMT

GET
H3-29 200 styles.min.css
s0.2mdn.net/8364571/1622764014399/ Frame 8376 3 KB
1 KB 7ms
6ms Stylesheet
text/css 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8364571/1622764014399/styles.min.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c17e7ef00e88f4857472b531020c1dd653b16b643658c4cbc457dd8e28d57ea4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:26:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 779
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1246
x-xss-protection: 0
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 09 Jun 2021 06:26:34 GMT

GET
H3-29 200 txt.png
s0.2mdn.net/8364571/1622764014399/img/ Frame 8376 2 KB
2 KB 7ms
7ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764014399/img/txt.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a5336f2cfbcabb57a54472ed0a5d63fc606628f5f2b6282983b278b8c2dbb36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:01:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
age: 2307
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1662
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:01:06 GMT

GET
H3-29 200 visu.jpg
s0.2mdn.net/8364571/1622764014399/img/ Frame 8376 12 KB
12 KB 37ms
36ms Image
image/jpeg 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764014399/img/visu.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c3caf46e06568498065abadd81eaf62af2ac1327257ad250192a3d538f104f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:01:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
age: 2307
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11835
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:01:06 GMT

GET
H3-29 200 txt1.png
s0.2mdn.net/8364571/1622764014399/img/ Frame 8376 2 KB
2 KB 38ms
37ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764014399/img/txt1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f87d06259fa0a666104a20f8fe8aee01de59162b334f3fe26c5bc66a36cb78b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:01:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
age: 2307
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2368
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:01:06 GMT

GET
H3-29 200 txt2.png
s0.2mdn.net/8364571/1622764014399/img/ Frame 8376 892 B
914 B 38ms
36ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764014399/img/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a302210fafdcae6e8ad035d4f12a396948612e53eab149cbbb3e86858b914953

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:01:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
age: 2307
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 892
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:01:06 GMT

GET
H3-29 200 txt3.png
s0.2mdn.net/8364571/1622764014399/img/ Frame 8376 718 B
740 B 37ms
36ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764014399/img/txt3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91ebf56ab2090d6bc458ea4b019cc49937758018f24aadfb46c15779ea2f2268

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:01:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
age: 2307
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 718
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:01:06 GMT

GET
H3-29 200 txt4.png
s0.2mdn.net/8364571/1622764014399/img/ Frame 8376 911 B
933 B 37ms
35ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764014399/img/txt4.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7f848af97a87f1fc031a2cdff7502608e5578a395a05fe113181044520e10818

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:01:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
age: 2307
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 911
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:01:06 GMT

GET
H3-29 200 txt5.png
s0.2mdn.net/8364571/1622764014399/img/ Frame 8376 682 B
704 B 39ms
38ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764014399/img/txt5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84474a9d1bb26a12c6bd44827aa06fde008a3aef27598dc868b2f8bb0de5ee0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:01:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
age: 2307
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 682
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:01:06 GMT

GET
H3-29 200 check.png
s0.2mdn.net/8364571/1622764014399/img/ Frame 8376 175 B
197 B 39ms
37ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764014399/img/check.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d5a9b603cdc42c9fecaa13301e0af4cd00803755708e0a58ff998ce3f75d65e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:01:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
age: 2307
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 175
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:01:06 GMT

GET
H3-29 200 check1.png
s0.2mdn.net/8364571/1622764014399/img/ Frame 8376 196 B
218 B 39ms
37ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764014399/img/check1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2dc7d4db12f115339842bd32cd4327c1176365f2136eba7df34044529efab275

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:01:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
age: 2307
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 196
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:01:06 GMT

GET
H3-29 200 check2.png
s0.2mdn.net/8364571/1622764014399/img/ Frame 8376 175 B
197 B 38ms
37ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764014399/img/check2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

66a3fc4c166626833eb88597fb17f81f3f94b2995c2631494de294415cb9ab91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:01:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
age: 2307
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 175
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:01:06 GMT

GET
H3-29 200 txt7.png
s0.2mdn.net/8364571/1622764014399/img/ Frame 8376 2 KB
2 KB 38ms
36ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764014399/img/txt7.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37036c668c4a69645af017ea2130401c268f6986c40ba37b04e0c4c4fcd4ea62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:01:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
age: 2307
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1871
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:01:06 GMT

GET
H3-29 200 txt6.png
s0.2mdn.net/8364571/1622764014399/img/ Frame 8376 3 KB
3 KB 38ms
36ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764014399/img/txt6.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b0cb9f5e45a79b6716c08e24a65723d116cf7c6156be0b746dae25870359bb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:01:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
age: 2307
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3132
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:01:06 GMT

GET
H3-29 200 footer.png
s0.2mdn.net/8364571/1622764014399/img/ Frame 8376 895 B
917 B 38ms
36ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764014399/img/footer.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

26c95e3dcb34fd778f84fb631af1bf6bf37668430515753b3a4241f47ab8c91b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:01:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
age: 2307
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 895
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:01:06 GMT

GET
H3-29 200 picto.png
s0.2mdn.net/8364571/1622764014399/img/ Frame 8376 603 B
625 B 37ms
35ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764014399/img/picto.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

51cd3d6b06ac11ab0948a2ce832bf2b6101bfc47562bdc7fa0969933c158418d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:01:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
age: 2307
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 603
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:01:06 GMT

GET
H3-29 200 ml.png
s0.2mdn.net/8364571/1622764014399/img/ Frame 8376 6 KB
6 KB 39ms
37ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8364571/1622764014399/img/ml.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a19fba993bd6523faaa367f3e354109922a04b2e6ef5d2f33d3da2ae0c695017

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:01:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
age: 2307
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6538
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:01:06 GMT

GET
H3-29 200 scripts.min.js Show response
s0.2mdn.net/8364571/1622764014399/ Frame 8376 72 KB
27 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8364571/1622764014399/scripts.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8364571/1622764014399/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

489ef51ec1c86e94bf6b183e005af43e1d6bf4ead17f5eb6976e3df561967904

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8364571/1622764014399/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:01:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2307
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27741
x-xss-protection: 0
last-modified: Thu, 03 Jun 2021 23:46:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 09 Jun 2021 06:01:06 GMT

GET
DATA 200
OK truncated
/ Frame 8376 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 643ac89572093a4c907c1af802b3d354453c64d545dc3f1be1ce689046064511

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/022105242203000/ Frame 4F0C 191 KB
55 KB 30ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022105242203000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aac6884cfa8c9515797c7291c7f5ad73ea968306017387e028dbc5089e027ee2

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 553056
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55209
x-xss-protection: 0
server: sffe
date: Tue, 01 Jun 2021 21:01:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "7da48f12e8acf6ff"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 01 Jun 2022 21:01:57 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/022105242203000/v0/ Frame 4F0C 12 KB
5 KB 41ms
17ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022105242203000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8de063d7075aa9a9a68120f3eb37178e85777138d4154903a2d4b187b4a893d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 553056
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4568
x-xss-protection: 0
server: sffe
date: Tue, 01 Jun 2021 21:01:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "b435c2fa80137a0e"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 01 Jun 2022 21:01:57 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/022105242203000/v0/ Frame 4F0C 87 KB
27 KB 42ms
19ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022105242203000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

12993a139a46e15abb56308ef8656d80812fb748dfa88116ee6e20ad3494ae98

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 553056
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27371
x-xss-protection: 0
server: sffe
date: Tue, 01 Jun 2021 21:01:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "6687a81702b10306"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 01 Jun 2022 21:01:57 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/022105242203000/v0/ Frame 4F0C 4 KB
2 KB 44ms
21ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022105242203000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9de4196056e2ffb92e9e6eb78502d3ed77f71a1e8045434a907251ff0b998357

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 553056
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1521
x-xss-protection: 0
server: sffe
date: Tue, 01 Jun 2021 21:01:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5a9e085610d63d0a"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 01 Jun 2022 21:01:57 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/022105242203000/v0/ Frame 4F0C 41 KB
13 KB 41ms
18ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022105242203000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e53b8865f7f1e34e44d14f6ff8789dd7f421e7d3c69e48dab33188ff4d99f4e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 553056
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13132
x-xss-protection: 0
server: sffe
date: Tue, 01 Jun 2021 21:01:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "1bd5431ac5ac76b7"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 01 Jun 2022 21:01:57 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 4F0C 4 KB
690 B 17ms
16ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

abc1bbfb097cfaf4715fe823adb40881f8ed35a943692d5c037945c2fcc56340

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 06:14:52 GMT
server: ESF
date: Tue, 08 Jun 2021 06:39:33 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 08 Jun 2021 06:39:33 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 4F0C 4 KB
713 B 16ms
16ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&text=

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021060701.js?31061385

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

abc1bbfb097cfaf4715fe823adb40881f8ed35a943692d5c037945c2fcc56340

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 08 Jun 2021 06:11:44 GMT
server: ESF
date: Tue, 08 Jun 2021 06:39:33 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 08 Jun 2021 06:39:33 GMT

GET
DATA 200
OK truncated
/ Frame 4F0C 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cb504f75d509fc5898af1afe01d5050f1fc67a3fcfdb489f21937c98ddd20bed

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 gdR3mJEQPns3wGBu6BwDEYqkMS7bq5f3ho3mjjdDBL9WptCoUqzP9ojOnreDSWqTyaBBOHWTl1BOYqgVU3ghS5QnDU7vfLk=w1200-h1200-rj-pd-pc0x00e9e9e9
lh3.googleusercontent.com/proxy/ Frame 4F0C 206 KB
207 KB 31ms
7ms Image
image/jpeg 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh3.googleusercontent.com/proxy/gdR3mJEQPns3wGBu6BwDEYqkMS7bq5f3ho3mjjdDBL9WptCoUqzP9ojOnreDSWqTyaBBOHWTl1BOYqgVU3ghS5QnDU7vfLk=w1200-h1200-rj-pd-pc0x00e9e9e9

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

5eaf9bb5a7cff519a02c444a6a24eb8534d3c630b6bfd2dd608311cad7799940

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:29:50 GMT
x-content-type-options: nosniff
server: fife
age: 583
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="unnamed.jpg"
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 211073
x-xss-protection: 0
expires: Wed, 09 Jun 2021 06:29:50 GMT

GET
H3-29 200 10454751186257448899
s0.2mdn.net/simgad/ Frame 4F0C 33 KB
33 KB 11ms
9ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10454751186257448899

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1362270a37e40f6f8fa39aac7697ef003592cb23eac2a6b68775105462a627b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 02 Jun 2021 04:25:01 GMT
x-content-type-options: nosniff
age: 526472
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33464
x-xss-protection: 0
last-modified: Mon, 17 May 2021 07:58:58 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 02 Jun 2022 04:25:01 GMT

GET
H3-29 200 ad
googleads.g.doubleclick.net/dbm/ Frame 4F0C 42 B
63 B 28ms
27ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BEgGq4_RNkFRk9WAryUQSe5J9SMFO333QJ747p5Eb-NxznNrxm5y9mBBX1QZKU0r8_tygt147eHsSDko5IKugvJREPUKjsBWoq8RgaF0BCEd07uSjTrM74y-2_RXAkq5sMULiE5XNzg72q0I9m6gtuBjpr1A&dbm_d=AKAmf-BgC89lk-6cQ_CWYZzhGpRbzATHzbwlTmc11bECjVU_YSUu7vqBL10DbIX_0FVjBUBzG-akG0PTFmHwfcM2qvHeOKCeLnLqFwcz67kyLIwlZ4YbKsQzU9oqOuMJCp7tF1LaF4kcGQ81KTjaS4is--SGLcSAKh34Y-BBdIc1bFylkoEqBqECmqnCdExnYmKI9P--2mQUXuGOXQkQirbMo73r0ROP2YMYgrd0ovv69HqPO4nbh9cgAQqcN9b0eAURn7ybk_690b7ihvUiLqJF2dhtyLTpN4zjuTbYIv2w8OvWW80UEUguYO-pWEf1DoWlovTMvf7mOifGr6xDEHSYF60CXH4IGv_4b8zoACEz9sCjb1YRi-sjn87NvFX5GsxIT8Hk5UC_aMLDaX6d3P3VB1eQIkntozk1wAXAKfIO4Fp7FCSKS36ry1Bd1ZHTxeNTVBY4lDAQs5pdvGgoymJMMny748hlLkYN82ipaJ9hlK52tLCWQMJh_4tMFguvMHeRWvp0gxKV_CAmvU1rDQy2SfDJvUk3QSJKziWW2u6QuFRnC77Xe4oUCwbLJUsIYAv_iSUZ_fee32GkUtGJanq0xOINhWiMcpQZ7pCkBVTn7pi6JeP3LOkkrVGXbArB7aG6Kwh8Brnw-ODHXvvDoYNJwXPhM86J8AnRaM5h2EdnUnqXhA5GyBm-e17i-G9hl8Mrf4vaoRHtCDXmn-EmJJdnSGs-jgpwKWRfe0-Z9OEqQ7Yno-vA4LotZsreQoGEyF3QOuJp4f8FoJOPyvX5gvtXAKRaBCBFzlbfbxnoFgzZFDRJ_jq9m1bBMppkeK_OUZFS0RuHtb9cCF9oK7ZbKMFhfSjvOFAQoyHWi6n01N-Dwkxc3h03z9B5Am2gB-6aAY5bcV6-IhRMVAwOuRxNmi3O12_d76CRtORQQGaSdF1Q_JMKB3jhXyLwco-x77Z99NNY9PNkcjSnCLk5n89gkmdShYVT853DrhAMgxPLuR4m16A4eAoiW7lfEdWd94OHV33GnyojQS0A--TY6Ne0GxfjiRu-cGK5WyQkMgig72kGC5xy6a_0wyNEorGwRpc8MZuGBrv3OB_9ofPSh_F_zshXVzXffsVFSjL1GbwGZX98dSkWRpZxa4qINHHY1a2Tpitqr6GEqJsbS_hUogCdrfbea-uMvHbCbsLNTkex0eqBWdJS4pWHxRlZL10i5q4Mk71Z9TSIXYaq_0HG5QJOY7VIeQaOdtnLg3AY6mZuV84nO-Yk3s3yJL81rov0iu-M_I2RgiG5dyLHIv55EFEr-ppFUCqB0y-QU3xPd0vRw53LsWmr0QVDLTDePHpAEAo3lxMrpVffoOmAdJnhvaecjmWm6k2g2Yq2i4bR69pboO0WdXBIGBEXZg63pCB5lBCnw3fQUA0Dkc0mIgleu9J1Vgy4HoLVz8_UWzO2tfson8TAEDriklFe2BeAPkxWOnlKQnHVnOUz0F8_-n0ty6iUOF0_duxNlTCwgkoidKg9ebY_Q0nIDTzaaKI3AfCLHNb7k5MBLdlAxlwC7MmXclYfDOuaFHwb2zqY3WqcHWGLGubt5mip12C_kCvtgGMmWt-94vHFP8sCKjDugWtcH1jtsO8acp0YBBzncg_MKItyXB_-EkmDeclFRieICsrovZN3aEBCUpQimKOv7IP5huEdGv3apOk9IFLYzjbDQkTD5vsqz3SwK62GnA5UU0TSMeMZ795W9cKWI5_mzj3hoG3-Sfy8yAkQtFa6YGZhTjQ-SK2p2MB-cJCRG1XAEBMM3WPNXF2oVLP19hXTTq0PiJXiOyzVyexFJCwrs06FEO3n6gt6e7u9_O2E8RFd3as4MpjCfkUNCvKJqloMouFbMy9Kvl1mmrkUj1oyYA3jJJJUDjGjXMt4W-KPBwq9YLKfGWnxplz1Fi51NdPF4EOwZP2BxCor5qCzDLOyRLtoKOhFm2wDaFPcqZlP-jxFF4aFjd1dQPyV5skE0fNjlL_pa6bSq2zQdOPoTUnvhT5VHaE7cHSb6XVUWTHHOF4A2hbGLv2LbwaJt9nVgQfGcyReCbLGvw3_OyKvFedazGgwVCPGGuoIJlr1pbGzhbg5a-wvFCNZZAGCbO0BIuvv8HA7olVRvLoYTa5tVGoI-Q_ztnr0HCentLRnrR2DpQSDiS31BSNdgDh6OpvJoTMxAQNwuM3DLSDHBHvGQ_iZReNDTZnBcqAoky0KHeIhIahFPWMwNH_CRhyK6Dr4pdrqXqro5PNouZfVZJ1F6920uHaUi72MPtzesjgaKvAOf2DSRyAOjHqKhPVNORDWxpQNKA4z1DTqvZiZysBk87PQQFofmPyvUi1j9flPrTW1gb0dN4S0KVNkSY3UIfwqXT4habmalEwtaqE2kOPi7hGKGDcamr8u7oiRWddzs-PDF6hBR3nBY9v9K_7SfDFMnp3bQ25T8f42l9tomkn90n_oepznH_51GLvYwPHFl4a9x9PzYAAqV4uTwfQNeAzg2OkwnhLdzY8KNu8y9pu_qRkkcIDp_aXIu3pvw4HClILVCi_Gqbk5vRkopfadsa0YOxaFqiShU3qn9mDxeAYgjrxFfV2-yCGrup0arIUDX33Sy8x8mWOlFtdOaQwUDjaap1X-Ldt4MeHkT8b-4pP79fWr2jwcR1R1rSqwXAjPYgeCEFAucg4BfWGh3K-nuCjAziDhbgIr4XTd0lv1gLxB4MuKyz5uMxgYJ9bLFpD_m8m1GA4NnlLAC7ByX4vPnFBOTTCFB9Sh5Cbg_7fYB0SJI8l44fdrLlK4PYy0vriXRoy-eWKqOrmNyTcT7Ons6ttjtwA5Yay1O6wqwwtzb8QCtfGJE5KWrMVQ3p8SkmbniBHyQIf0SoZxwPGdrvrepnbHqpUQtA7x_tS2pjkMSriKDFFtMzujOnR-UPbJjeoGKKgZJopGEvHVRT4vRgxOTSUBmHeUf7I97PtVci3XF1JtUfBEP93V0HAfP3avLLWbm2vQtxlI6-jZTXumtqyiNR9Gkz4sQ5OaPu5zPpz2QdZOGRYV4n75VR3plF67ABcxyDVi-hR2s-9YFgyaCtXZhQRV-rAmUgCiJnyF23NHzAowCRl-n7u9Rn2rLQI0thz3_sLRLx6FRAno3znFEgqEnnCrSi8TT1HFHS7ixxzE2liBH2DVSOWI3aN-ebT-_7cGQxsiEQTzpK59Ct3oonAWPU_hG9_cbthKzh9LFj7JTXwcLaLwSns_53uWETPrgwmN4HYlSPy5oEsnTilCJvE9uqH5vMa4t5DLv28MCsNqEePgVjKobTUc1A7ULchzmj7wtRku1uKz1I54mhQuPykGgXDxAnLMGE0m_VjFT-StLMRLShNuNyRO5nkvMiSdTiedaC9oEOY2wpYHjlbbvVF27kDr7wdTUvWWMvh-4z72yUmHA65kMr35Ak3mMltES_aLBK1BJ4EH-eLFj723NhOkeNyQm3cCGhYljNI62alw9WAmR7jnn57FfdT-RYFQsRQl9IHNCFqbQQvGSBsSARH6Tnga_7sRKeN_4v1sdoDoykVKr6D1gvj_v70x9xZ9lFZicQqOmjYRO0M8uil-n9lR_3j_tKGwsxlc9dMKEIK8_4JOcBju5d5i1WJJFZ70Ts_4xEb0_7fik8vIS4wWOGZirZiF4z2ldUQwWdmCoRSUzgn6Y0cPvADYTlhF-_jASTLEDL0Nie_Vuz0sdrs0lXNDY89ToRTg&cid=CAASFeRo9JrTA50l01Rr2uCn4Z_oUK6ACg

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 i
mmtro.com/ Frame 4F0C 48 B
439 B 69ms
26ms Image
image/gif 195.66.82.41
MERCIS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mmtro.com/i?tagid=6572614-638f6d8a1331abf1db459f551b6e0219&idc=118499&rtgdsp=dv360&rtgoid=20169751&rtgpidc=&rtgaid=ABAjH0i84zcQl7YJ7psEsrlkg3pU&rtgseid=&rtgcpid=51240738&rtgcid=355452878&rtgexid=1&rtgpid=1&rtgsid=980029729630&rnd=1623134373066107&gdpr_consent=&u=https://sci-hub.mksa.top/
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 195.66.82.41 Paris, France, ASN197205 (MERCIS-AS, FR),
Reverse DNS: mmtro.com
Software: fdb141453c85e6bc89a824a70a7bfd71a273b947 /
Resource Hash: 2c366efc13702d5bf379b6d5d072ff66fe1d602a6c3185ddd6d6009390fea0f5

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:33 GMT
server: fdb141453c85e6bc89a824a70a7bfd71a273b947
p3p: policyref="https://mmtro.com/w3c/p3p_mmtro.xml", CP="ALL DSP LAW CUR TAIi PSAi PSDi IVAi IVDi OUR BUS UNI"
x-rid: 60bf10a530038363ec0d6e8a
cache-control: no-store, no-cache, private
content-type: image/gif
content-length: 48
expires: Wed, 23 Feb 2000 00:00:01 GMT

GET
H/1.1

200
OK

/
laboutique.commander1.com/v3/ Frame 4F0C
Redirect Chain

https://groupelaposte.solution.weborama.fr/fcgi-bin/dispatch.fcgi?a.A=im&a.si=322&a.te=221447&a.he=1&a.wi=1&a.hr=p&gdpr=&gdpr_consent=&a.ra=[RANDOM]
https://groupelaposte.solution.weborama.fr/fcgi-bin/dispatch.fcgi?g.bo=OK&g.rn=944079&a.A=im&a.si=322&a.te=221447&a.he=1&a.wi=1&a.hr=p&gdpr=&gdpr_consent=&a.ra=[RANDOM]
https://laboutique.commander1.com/v3/?tcs=1491&rand=799840&chn=DisplayConqueteTrafic&src=NumberlyDisplay&cmp=2021_BNUM_TF_Mobilite_Trafic&med=&pub=&crtive=&vson=BNUM_TF_MOBILITE_PART_ALL-DEVICES_Na...
https://laboutique.commander1.com/v3/?firsttime=1&tcs=1491&rand=799840&chn=DisplayConqueteTrafic&src=NumberlyDisplay&cmp=2021_BNUM_TF_Mobilite_Trafic&med=&pub=&crtive=&vson=BNUM_TF_MOBILITE_PART_AL...

0
1 KB

22ms
22ms

Image
text/html

13.36.187.171
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://laboutique.commander1.com/v3/?firsttime=1&tcs=1491&rand=799840&chn=DisplayConqueteTrafic&src=NumberlyDisplay&cmp=2021_BNUM_TF_Mobilite_Trafic&med=&pub=&crtive=&vson=BNUM_TF_MOBILITE_PART_ALL-DEVICES_NativeAds_REEX-jour_TRAFIC_DV360&fmt=1x1&adgrp=&sem_kw=&aff_id=&aff_name=&url=
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.36.187.171 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-36-187-171.eu-west-3.compute.amazonaws.com
Software: web /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: private
Date: Tue, 08 Jun 2021 06:39:33 GMT
Content-Encoding: gzip
Server: web
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=486000, pre-check=486000
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: text/html
Expires: Mon, 06 Sep 21 08:39:33 +0200

Redirect headers

Pragma: private
Date: Tue, 08 Jun 2021 06:39:33 GMT
Server: web
location: https://laboutique.commander1.com/v3/?firsttime=1&tcs=1491&rand=799840&chn=DisplayConqueteTrafic&src=NumberlyDisplay&cmp=2021_BNUM_TF_Mobilite_Trafic&med=&pub=&crtive=&vson=BNUM_TF_MOBILITE_PART_ALL-DEVICES_NativeAds_REEX-jour_TRAFIC_DV360&fmt=1x1&adgrp=&sem_kw=&aff_id=&aff_name=&url=
Transfer-Encoding: chunked
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=486000, pre-check=486000
Connection: keep-alive
Content-Type: text/html
Expires: Mon, 06 Sep 21 08:39:33 +0200

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 4F0C 0
0 38ms
37ms Image
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CAxxmpRC_YLuEBNWv3gPt36CwAcTEk_Zi88KUlfsN_IT27rAlEAEgtKPufmD7gYCAiAqgAYi-rbgByAEGqAMByAMKqgTmAU_QwmUZq3VSJSSy-ROgJP-nYiheH9zDSKJwRWBFs_SVqW-RalPeHfI6P0zDlYL0vPchW5flA97tcEY_cApodfLiVv9QjnS3uxZ9HyFtm37vGZMS3cQIWF5cDUhCc5-CSSTHunH7A5lpvjHM_qvXjajGAnsP5bi1XF25hTcsv6uylg9b04pHBfp3Ah7BEmqfLn5wfLkPVAHhHhtEoLSd9P2pDTa9EDYlfwKO4XgpQgDDn7KmXIfgv4BSehpMclk2cAA6L2Y5vQidzp-lAYF-Na-LibZhoZYxe1K0_MZ3SYpYkKZBkRBPwASBpaO-1gPgBAOIBeupyaUxkgUGCAMQARgDkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAY3gAfgwdLHAqgHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUb2AcB8gcKEP3hGBjOj7-pAdIICQiI4YAQEAEYHYAKA8gLAbATnNrWC8gT28v23APQEwDYEwOIFALYFAHQFQGAFwGyFxoKGAgAEhRwdWItNzAxNTIzNTEyMDkxNTc2OQ&sigh=mh64LC-Ygbg&cid=CAQSPwCNIrLMMBCqsgApWgFYvWVQ4_cCXArIaNJiIPx4DxHpfII-5v2EQ5EWW99JyPjVIjmcDdNE38RBtX3mCXQCZQ&template_id=509&vt=10
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.185.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s50-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 4F0C 0
0 16ms
15ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT59G_zwFAWIGl43pd-0tXyEwfOOFTcercE_Cg9numqdrI9gwG5hXFbz2yE_Noc7iDuVWn_TTC4eUNRJdMi-Ae9VNXXkQ
Requested by: Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 4F0C 2 KB
2 KB 11ms
10ms Image
image/png 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 07 Jun 2021 23:11:22 GMT
x-content-type-options: nosniff
server: cafe
age: 26891
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Tue, 08 Jun 2021 23:11:22 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 4F0C 295 B
319 B 11ms
10ms Image
image/png 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 07 Jun 2021 17:13:43 GMT
x-content-type-options: nosniff
server: cafe
age: 48350
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 08 Jun 2021 17:13:43 GMT

GET
H/1.1

204
No Content

i
dmg.digitaltarget.ru/1/7210/i/
Redirect Chain

https://dmg.digitaltarget.ru/1/7210/i/i?i=134415495931432.364685246678284&c=tg:adcm_pc
https://dmg.digitaltarget.ru/1/7210/i/i?i=134415495931432.364685246678284&c=tg:adcm_pc&q=scc

0
398 B

60ms
60ms

Image
text/plain

185.15.175.157
SAFEDATA Uplinks

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dmg.digitaltarget.ru/1/7210/i/i?i=134415495931432.364685246678284&c=tg:adcm_pc&q=scc
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.15.175.157 , Russian Federation, ASN43226 (SAFEDATA Uplinks, RU),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 06:39:33 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
P3P: policyref="http://dmg.digitaltarget.ru/p3p.xml", CP="NON NID PSAa PSDa OUR BUS COM NAV DEM STA PRE"

Redirect headers

Location: /1/7210/i/i?i=134415495931432.364685246678284&c=tg:adcm_pc&q=scc
Date: Tue, 08 Jun 2021 06:39:33 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
P3P: policyref="http://dmg.digitaltarget.ru/p3p.xml", CP="NON NID PSAa PSDa OUR BUS COM NAV DEM STA PRE"

GET
H/1.1

200
OK

i
dmg.digitaltarget.ru/1/6533/i/
Redirect Chain

https://dmg.digitaltarget.ru/1/6534/i/i?i=134415495931432.354863675427985&c=tg:adcm_pc
https://dmg.digitaltarget.ru/awg/custom/6534/i/i?call_source=awg&i=134415495931432.354863675427985&c=tg:adcm_pc
https://fnc.rt.ru/1/6532/i/i?i=Q6-t5IBXlnrNPSi7ik4S&c=tg:rds_6534
https://fnc.rt.ru/1/6532/i/i?i=Q6-t5IBXlnrNPSi7ik4S&c=tg:rds_6534&q=scc
https://dmg.digitaltarget.ru/1/6533/i/i?i=715571001618453762141000000003215986&a=774&e=k5PbhZmoi55r5555K85z

49 B
602 B

70ms
69ms

Image
image/gif

185.15.175.157
SAFEDATA Uplinks

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmg.digitaltarget.ru/1/6533/i/i?i=715571001618453762141000000003215986&a=774&e=k5PbhZmoi55r5555K85z

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.15.175.157 , Russian Federation, ASN43226 (SAFEDATA Uplinks, RU),

Reverse DNS

Software

nginx /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 08 Jun 2021 06:39:34 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: master-only
Request-Time: 6
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 64
X-XSS-Protection: 1; mode=block
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Server: nginx
X-Frame-Options: DENY
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Credentials: true

Redirect headers

Location: https://dmg.digitaltarget.ru/1/6533/i/i?i=715571001618453762141000000003215986&a=774&e=k5PbhZmoi55r5555K85z
Date: Tue, 08 Jun 2021 06:39:33 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
P3P: policyref="http://fnc.rt.ru/p3p.xml", CP="NON NID PSAa PSDa OUR BUS COM NAV DEM STA PRE"

GET
H2

200

rtrg
vk.com/
Redirect Chain

https://dmg.digitaltarget.ru/1/1086/i/i?i=134415495931432.603328523202432&a=86&e=5EFC831F4710BF602E0BE28402376F4F&c=ss:86.up:5EFC831F4710BF602E0BE28402376F4F.sync:up.xdua:duSzgrzwjnNL9w9U_ZnuMRqm.x...
https://dmg.digitaltarget.ru/awg/custom/1086/i/i?call_source=awg&i=134415495931432.603328523202432&a=86&e=5EFC831F4710BF602E0BE28402376F4F&c=ss:86.up:5EFC831F4710BF602E0BE28402376F4F.sync:up.xdua:d...
https://vk.com/rtrg?p=VK-RTRG-508637-cAEnY

49 B
446 B

183ms
66ms

Image
image/gif

87.240.190.78
VKONTAKTE-SPB-AS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://vk.com/rtrg?p=VK-RTRG-508637-cAEnY

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.240.190.78 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU),

Reverse DNS

srv78-190-240-87.vk.com

Software

kittenx / KPHP/7.4.107428

Resource Hash

2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 08 Jun 2021 06:39:33 GMT
content-encoding: gzip
x-frontend: front226206
server: kittenx
x-powered-by: KPHP/7.4.107428
strict-transport-security: max-age=15768000
content-type: image/gif
access-control-expose-headers: X-Frontend
cache-control: no-store
content-length: 65

Redirect headers

Date: Tue, 08 Jun 2021 06:39:33 GMT
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Server: nginx
X-Frame-Options: DENY
Access-Control-Allow-Methods: GET, POST, OPTIONS
Location: https://vk.com/rtrg?p=VK-RTRG-508637-cAEnY
X-XSS-Protection: 1; mode=block
X-Permitted-Cross-Domain-Policies: master-only
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 86400
Connection: keep-alive
Request-Time: 9
Content-Length: 0
X-Content-Type-Options: nosniff

GET
H2

404

1D13A2FE9C3B706D
an.yandex.ru/setud/adsniper/
Redirect Chain

https://dmg.digitaltarget.ru/1/1086/i/i?i=134415495931432.117959043278714&a=86&e=5EFC831F4710BF602E0BE28402376F4F&c=ss:86.up:5EFC831F4710BF602E0BE28402376F4F.sync:up.xdua:duSzgrzwjnNL9w9U_ZnuMRqm.x...
https://dmg.digitaltarget.ru/awg/custom/1086/i/i?call_source=awg&i=134415495931432.117959043278714&a=86&e=5EFC831F4710BF602E0BE28402376F4F&c=ss:86.up:5EFC831F4710BF602E0BE28402376F4F.sync:up.xdua:d...
https://sync.bumlam.com/?src=amb2&uid=QdTshw7XVZxFsmx7gZvI
https://sync3.adsniper.ru/?src=ss1&s_data=CAEQABilofyFBlIF4-CkuQViFFFkVHNodzdYVlp4RnNteDdnWnZJ
https://sync3.adsniper.ru/?src=ss1&s_data=CAIQARilofyFBlIF4-CkuQViFFFkVHNodzdYVlp4RnNteDdnWnZJogEQSUTi7MgkEeum6QAlkMgkNw**
https://sync.bumlam.com/?src=amb2&s_data=CAIQABilofyFBmIUUWRUc2h3N1hWWnhGc214N2dadkmiARBJROLsyCQR66bpACWQyCQ3
https://sync.bumlam.com/?src=amb2&s_data=CAIQARilofyFBmIUUWRUc2h3N1hWWnhGc214N2dadkmiARBJROLsyCQR66bpACWQyCQ3
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_cm&extra1=QdTshw7XVZxFsmx7gZvI&extra2=amber&extra3=ext
https://sync3.sniperlog.ru/?src=ggl&extra1=QdTshw7XVZxFsmx7gZvI&extra2=amber&extra3=ext&google_gid=CAESEBI-vYyXzNpcEnqB4sboSGw&google_cver=1
https://sync.bumlam.com/?src=ggl&extra1=QdTshw7XVZxFsmx7gZvI&extra2=amber&extra3=ext&google_gid=CAESEBI-vYyXzNpcEnqB4sboSGw&google_cver=1
https://an.yandex.ru/setud/adsniper/1D13A2FE9C3B706D?sign=903157723
https://an.yandex.ru/setud/adsniper/1D13A2FE9C3B706D?redir-setuniq=1&sign=903157723

43 B
113 B

62ms
62ms

Image
image/gif

2a02:6b8::90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/setud/adsniper/1D13A2FE9C3B706D?redir-setuniq=1&sign=903157723

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::90 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

ccb150b1878d5aa777543222f9e47636d4258687e3dd57e625988f09a96bda64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sci-hub.mksa.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:34 GMT
content-encoding: gzip
last-modified: Tue, 08 Jun 2021 06:39:34 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=windows-1251
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 08 Jun 2021 06:39:34 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Jun 2021 06:39:34 GMT
content-encoding: gzip
last-modified: Tue, 08 Jun 2021 06:39:34 GMT
strict-transport-security: max-age=31536000
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
location: https://an.yandex.ru/setud/adsniper/1D13A2FE9C3B706D?redir-setuniq=1&sign=903157723
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 08 Jun 2021 06:39:34 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2A5D 0
23 B 34ms
34ms Ping
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: sci-hub.mksa.top
URL: https://sci-hub.mksa.top/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS