www.profinance.ru Open in urlscan Pro
81.177.34.158 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://profinance.ru/
Effective URL:
https://www.profinance.ru/
Submission: On October 12 via manual (October 12th 2021, 4:32:59 pm UTC) from RU — Scanned from DE

Summary HTTP 258 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 54 IPs in 11 countries across 59 domains to perform 258 HTTP transactions. The main IP is 81.177.34.158, located in Moscow, Russian Federation and belongs to RTCOMM-AS, RU. The main domain is www.profinance.ru.
TLS certificate: Issued by R3 on October 12th 2021. Valid for: 3 months.

This is the only time www.profinance.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 43	81.177.34.158 81.177.34.158	8342 (RTCOMM-AS) (RTCOMM-AS)
2 9	178.154.131.215 178.154.131.215	13238 (YANDEX) (YANDEX)
3	77.88.55.55 77.88.55.55	13238 (YANDEX) (YANDEX)
23	142.250.74.194 142.250.74.194	15169 (GOOGLE) (GOOGLE)
1	81.177.34.136 81.177.34.136	8342 (RTCOMM-AS) (RTCOMM-AS)
1 5	217.69.133.145 217.69.133.145	47764 (MAILRU-AS...) (MAILRU-AS Mail.Ru)
3 13	93.158.134.119 93.158.134.119	13238 (YANDEX) (YANDEX)
2 9	96.46.186.57 96.46.186.57	7979 (SERVERS-COM) (SERVERS-COM)
1	142.250.185.200 142.250.185.200	15169 (GOOGLE) (GOOGLE)
2 3	88.212.201.210 88.212.201.210	39134 (UNITEDNET) (UNITEDNET)
2 24	87.250.250.90 87.250.250.90	13238 (YANDEX) (YANDEX)
2 19	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
1	93.158.134.118 93.158.134.118	13238 (YANDEX) (YANDEX)
3	178.250.2.130 178.250.2.130	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	185.184.8.65 185.184.8.65	204995 (RTB-HOUSE...) (RTB-HOUSE-AMS)
3 4	193.232.148.151 193.232.148.151	48061 (UMA-TECH-AS) (UMA-TECH-AS)
1	94.100.180.197 94.100.180.197	47764 (MAILRU-AS...) (MAILRU-AS Mail.Ru)
1	195.201.57.28 195.201.57.28	24940 (HETZNER-AS) (HETZNER-AS)
1 2	49.12.83.94 49.12.83.94	24940 (HETZNER-AS) (HETZNER-AS)
1	195.209.111.15 195.209.111.15	52007 (ADRIVER-AS) (ADRIVER-AS)
3	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
3	172.217.18.98 172.217.18.98	15169 (GOOGLE) (GOOGLE)
2	178.250.2.131 178.250.2.131	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	151.236.118.210 151.236.118.210	204720 (CDNETWORKS) (CDNETWORKS)
6 6	18.192.203.176 18.192.203.176	16509 (AMAZON-02) (AMAZON-02)
2 2	35.210.53.219 35.210.53.219	19527 (GOOGLE-2) (GOOGLE-2)
3 3	72.251.249.14 72.251.249.14	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
7 7	31.172.81.160 31.172.81.160	44066 (DE-FIRSTC...) (DE-FIRSTCOLO www.first-colo.net)
2 2	31.172.81.158 31.172.81.158	44066 (DE-FIRSTC...) (DE-FIRSTCOLO www.first-colo.net)
3	87.250.247.182 87.250.247.182	13238 (YANDEX) (YANDEX)
1 1	185.29.132.245 185.29.132.245	30419 (MEDIAMATH...) (MEDIAMATH-INC)
1	87.250.250.114 87.250.250.114	13238 (YANDEX) (YANDEX)
1 1	212.11.152.206 212.11.152.206	8901 (Moscow Ma...) (Moscow Mayors Office)
3 4	95.217.109.66 95.217.109.66	24940 (HETZNER-AS) (HETZNER-AS)
1	81.222.128.215 81.222.128.215	20597 (ELTEL-AS) (ELTEL-AS)
5 15	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
2 2	185.15.175.134 185.15.175.134	43226 (SAFEDATA ...) (SAFEDATA Uplinks)
2 2	80.64.106.147 80.64.106.147	20764 (RASCOM-AS...) (RASCOM-AS CJSC RASCOM ISP)
4 4	89.108.119.43 89.108.119.43	197695 (AS-REG) (AS-REG)
2 2	88.99.213.228 88.99.213.228	24940 (HETZNER-AS) (HETZNER-AS)
2 2	35.190.16.14 35.190.16.14	15169 (GOOGLE) (GOOGLE)
1 1	91.192.150.30 91.192.150.30	42481 (BEGUN-AS) (BEGUN-AS)
1 2	54.77.217.29 54.77.217.29	16509 (AMAZON-02) (AMAZON-02)
1	37.18.16.16 37.18.16.16	205675 (HYBRID-AS) (HYBRID-AS)
1 2	194.226.130.229 194.226.130.229	52016 (TNSMSK-) (TNSMSK-)
2 2	148.251.129.43 148.251.129.43	24940 (HETZNER-AS) (HETZNER-AS)
1 1	78.46.16.13 78.46.16.13	24940 (HETZNER-AS) (HETZNER-AS)
5	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
5	77.88.21.179 77.88.21.179	13238 (YANDEX) (YANDEX)
25	142.250.186.33 142.250.186.33	15169 (GOOGLE) (GOOGLE)
1 3	23.37.42.132 23.37.42.132	16625 (AKAMAI-AS) (AKAMAI-AS)
2	142.250.185.193 142.250.185.193	15169 (GOOGLE) (GOOGLE)
12	142.250.185.70 142.250.185.70	15169 (GOOGLE) (GOOGLE)
2	142.250.185.74 142.250.185.74	15169 (GOOGLE) (GOOGLE)
2	142.250.186.106 142.250.186.106	15169 (GOOGLE) (GOOGLE)
4 11	172.217.23.100 172.217.23.100	15169 (GOOGLE) (GOOGLE)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1	63.33.106.135 63.33.106.135	16509 (AMAZON-02) (AMAZON-02)
2 3	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
6	172.217.18.99 172.217.18.99	15169 (GOOGLE) (GOOGLE)
2	178.250.0.157 178.250.0.157	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	51.89.9.254 51.89.9.254	16276 (OVH) (OVH)
2 4	184.30.20.241 184.30.20.241	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	37.252.172.38 37.252.172.38	29990 (ASN-APPNEX) (ASN-APPNEX)
1	82.145.213.8 82.145.213.8	39832 (NO-OPERA) (NO-OPERA)
1	142.250.185.166 142.250.185.166	15169 (GOOGLE) (GOOGLE)
1	76.223.111.131 76.223.111.131	16509 (AMAZON-02) (AMAZON-02)
2 2	66.155.71.149 66.155.71.149	13768 (COGECO-PEER1) (COGECO-PEER1)
2 2	213.155.156.185 213.155.156.185	1299 (TWELVE99 ...) (TWELVE99 Twelve99)
2 2	35.186.253.211 35.186.253.211	15169 (GOOGLE) (GOOGLE)
1 1	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	18.156.0.31 18.156.0.31	16509 (AMAZON-02) (AMAZON-02)
3	142.250.185.131 142.250.185.131	15169 (GOOGLE) (GOOGLE)
258	54

43 81.177.34.158 (Moscow, Russian Federation) 2 redirects

ASN8342 (RTCOMM-AS, RU)

profinance.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.profinance.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 178.154.131.215 (Russian Federation) 2 redirects

ASN13238 (YANDEX, RU)
PTR: static.yandex.net

yastatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 77.88.55.55 (Russian Federation)

ASN13238 (YANDEX, RU)
PTR: yandex.ru

yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 142.250.74.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 81.177.34.136 (Moscow, Russian Federation)

ASN8342 (RTCOMM-AS, RU)

informers.forexpf.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 217.69.133.145 (Russian Federation) 1 redirects

ASN47764 (MAILRU-AS Mail.Ru, RU)
PTR: top-fwz1.mail.ru

top-fwz1.mail.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 93.158.134.119 (Moscow, Russian Federation) 3 redirects

ASN13238 (YANDEX, RU)
PTR: mc.yandex.ru

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 96.46.186.57 (United States) 2 redirects

ASN7979 (SERVERS-COM, US)

ads.betweendigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.200 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f8.1e100.net

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 88.212.201.210 (Russian Federation) 2 redirects

ASN39134 (UNITEDNET, RU)

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 87.250.250.90 (Russian Federation) 2 redirects

ASN13238 (YANDEX, RU)
PTR: bs.yandex.ru

an.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 216.58.212.162 (Mountain View, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f162.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 93.158.134.118 (Moscow, Russian Federation)

ASN13238 (YANDEX, RU)
PTR: matchid-production.adfox.yandex.ru

matchid.adfox.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 178.250.2.130 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.184.8.65 (Amsterdam, Netherlands)

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-65.rtbhouse.net

adfox-c2s-ams.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 193.232.148.151 (Russian Federation) 3 redirects

ASN48061 (UMA-TECH-AS, RU)
PTR: smtp12.sender.ltmse.com

px.adhigh.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 94.100.180.197 (Russian Federation)

ASN47764 (MAILRU-AS Mail.Ru, RU)
PTR: r.mail.ru

ad.mail.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 195.201.57.28 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.28.57.201.195.clients.your-server.de

yhb.p.otm-r.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 49.12.83.94 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.94.83.12.49.clients.your-server.de

exchange.buzzoola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 195.209.111.15 (Russian Federation)

ASN52007 (ADRIVER-AS, RU)

pb.adriver.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.18.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f2.1e100.net

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.2.131 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: bidder.am5.vip.prod.criteo.com

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.236.118.210 (Moscow, Russian Federation)

ASN204720 (CDNETWORKS, RU)

cache.betweendigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 18.192.203.176 (Frankfurt am Main, Germany) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-192-203-176.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.210.53.219 (Brussels, Belgium) 2 redirects

ASN19527 (GOOGLE-2, US)
PTR: 219.53.210.35.bc.googleusercontent.com

pool.admedo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 72.251.249.14 (Amsterdam, Netherlands) 3 redirects

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 31.172.81.160 (Germany) 7 redirects

ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE)

sync.bumlam.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync3.sniperlog.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.172.81.158 (Germany) 2 redirects

ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE)

sync3.adsniper.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 87.250.247.182 (Russian Federation)

ASN13238 (YANDEX, RU)
PTR: avatars.mds.yandex.net

avatars.mds.yandex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.29.132.245 (United Kingdom) 1 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 87.250.250.114 (Russian Federation)

ASN13238 (YANDEX, RU)
PTR: ysa-static.passport.yandex.net

ysa-static.passport.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.11.152.206 (Moscow, Russian Federation) 1 redirects

ASN8901 (Moscow Mayors Office, RU)

stats.mos.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 95.217.109.66 (Helsinki, Finland) 3 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.66.109.217.95.clients.your-server.de

sonar.semantiqo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn3.caltat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.magnitent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 81.222.128.215 (Russian Federation)

ASN20597 (ELTEL-AS, RU)
PTR: ad15.adriver.ru

ssp.adriver.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 142.250.185.194 (United States) 5 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.15.175.134 (Russian Federation) 2 redirects

ASN43226 (SAFEDATA Uplinks, RU)

dmg.digitaltarget.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 80.64.106.147 (Russian Federation) 2 redirects

ASN20764 (RASCOM-AS CJSC RASCOM ISP, RU)
PTR: s-fr2.rutarget.ru

yandex-dmp-sync.rutarget.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
yandex-sync.rutarget.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 89.108.119.43 (Russian Federation) 4 redirects

ASN197695 (AS-REG, RU)
PTR: d51370.reg.regrucolo.ru

x01.aidata.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.99.213.228 (Germany) 2 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.88-99-213-228.clients.your-server.de

sync.1dmp.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.16.14 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 14.16.190.35.bc.googleusercontent.com

redirect.frontend.weborama.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.192.150.30 (Russian Federation) 1 redirects

ASN42481 (BEGUN-AS, RU)
PTR: zvezda.ssp.rambler.ru

profile.ssp.rambler.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.77.217.29 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-77-217-29.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.18.16.16 (Russian Federation)

ASN205675 (HYBRID-AS, RU)

dm.hybrid.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 194.226.130.229 (Russian Federation) 1 redirects

ASN52016 (TNSMSK-, RU)

cm.tns-counter.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.tns-counter.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 148.251.129.43 (Germany) 2 redirects

ASN24940 (HETZNER-AS, DE)
PTR: prod-hzeu-bidder-23.community.moscow

sync.upravel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 78.46.16.13 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: prod-hzeu-bidder-2.community.moscow

18389d02-4c3e-4ca5-b168-0b9403028743.sync.upravel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 77.88.21.179 (Moscow, Russian Federation)

ASN13238 (YANDEX, RU)
PTR: adfox-external-l3-engine.stable.qloud-b.yandex.net

ads.adfox.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 142.250.186.33 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.37.42.132 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-42-132.deploy.static.akamaitechnologies.com

secure-assets.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.193 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f1.1e100.net

6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 142.250.185.70 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f6.1e100.net

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.74 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f10.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.106 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 172.217.23.100 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f100.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.33.106.135 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-33-106-135.eu-west-1.compute.amazonaws.com

s.pubmine.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.162 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.217.18.99 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.0.157 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.89.9.254 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ip254.ip-51-89-9.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 184.30.20.241 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-20-241.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.252.172.38 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 82.145.213.8 (Norway)

ASN39832 (NO-OPERA, NO)
PTR: n-sysadmin-jumpbox-03.feednews.opera.technology

t.adx.opera.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.166 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 76.223.111.131 (United States)

ASN16509 (AMAZON-02, US)
PTR: a97adde81b00f2ca4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 66.155.71.149 (Portsmouth, United Kingdom) 2 redirects

ASN13768 (COGECO-PEER1, CA)

pixel-sync.sitescout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.155.156.185 (Uppsala, Sweden) 2 redirects

ASN1299 (TWELVE99 Twelve99, Telia Carrier, SE)
PTR: 213-155-156-185.teliacarrier-cust.com

d5p.de17a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.186.253.211 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (Frankfurt am Main, Germany) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.156.0.31 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.131 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
50	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com	500 KB
43	profinance.ru 2 redirects profinance.ru www.profinance.ru	89 KB
36	doubleclick.net 7 redirects googleads.g.doubleclick.net cm.g.doubleclick.net securepubads.g.doubleclick.net googleads4.g.doubleclick.net ad.doubleclick.net	253 KB
32	yandex.ru 3 redirects yandex.ru mc.yandex.ru an.yandex.ru matchid.adfox.yandex.ru ysa-static.passport.yandex.ru	327 KB
13	google.com 4 redirects adservice.google.com www.google.com	2 KB
12	2mdn.net s0.2mdn.net	647 KB
10	yandex.com 2 redirects mc.yandex.com	3 KB
10	betweendigital.com 2 redirects ads.betweendigital.com cache.betweendigital.com	7 KB
9	yastatic.net 2 redirects yastatic.net	292 KB
8	google.de adservice.google.de www.google.de	2 KB
6	bumlam.com 6 redirects sync.bumlam.com	4 KB
6	bidswitch.net 6 redirects x.bidswitch.net	3 KB
6	mail.ru 1 redirects top-fwz1.mail.ru ad.mail.ru	17 KB
5	rubiconproject.com 2 redirects secure-assets.rubiconproject.com eus.rubiconproject.com token.rubiconproject.com pixel.rubiconproject.com	11 KB
5	adfox.ru ads.adfox.ru	398 B
5	googletagservices.com www.googletagservices.com	165 KB
4	casalemedia.com 2 redirects dsum-sec.casalemedia.com	4 KB
4	googleapis.com ajax.googleapis.com fonts.googleapis.com	61 KB
4	aidata.io 4 redirects x01.aidata.io	2 KB
4	criteo.com bidder.criteo.com gum.criteo.com	6 KB
4	googleadservices.com 2 redirects partner.googleadservices.com www.googleadservices.com	16 KB
4	adhigh.net 3 redirects px.adhigh.net	2 KB
3	gstatic.com fonts.gstatic.com	55 KB
3	adnxs.com 2 redirects ib.adnxs.com	2 KB
3	upravel.com 3 redirects sync.upravel.com 18389d02-4c3e-4ca5-b168-0b9403028743.sync.upravel.com	2 KB
3	yandex.net avatars.mds.yandex.net	34 KB
3	lijit.com 3 redirects ap.lijit.com	2 KB
3	criteo.net static.criteo.net	39 KB
3	yadro.ru 2 redirects counter.yadro.ru	2 KB
2	yahoo.com 2 redirects ups.analytics.yahoo.com	2 KB
2	openx.net 2 redirects rtb.openx.net	760 B
2	de17a.com 2 redirects d5p.de17a.com	722 B
2	sitescout.com 2 redirects pixel-sync.sitescout.com	978 B
2	tns-counter.ru 1 redirects cm.tns-counter.ru www.tns-counter.ru	802 B
2	demdex.net 1 redirects dpm.demdex.net	2 KB
2	weborama.fr 2 redirects redirect.frontend.weborama.fr	544 B
2	1dmp.io 2 redirects sync.1dmp.io	1018 B
2	rutarget.ru 2 redirects yandex-dmp-sync.rutarget.ru yandex-sync.rutarget.ru	847 B
2	digitaltarget.ru 2 redirects dmg.digitaltarget.ru	1 KB
2	semantiqo.com 2 redirects sonar.semantiqo.com	1 KB
2	adsniper.ru 2 redirects sync3.adsniper.ru	1 KB
2	admedo.com 2 redirects pool.admedo.com	715 B
2	adriver.ru pb.adriver.ru ssp.adriver.ru	506 B
2	buzzoola.com 1 redirects exchange.buzzoola.com	863 B
1	adsrvr.org match.adsrvr.org	265 B
1	opera.com t.adx.opera.com	392 B
1	onetag-sys.com onetag-sys.com	823 B
1	pubmine.com s.pubmine.com	286 B
1	sniperlog.ru 1 redirects sync3.sniperlog.ru	297 B
1	hybrid.ai dm.hybrid.ai	238 B
1	rambler.ru 1 redirects profile.ssp.rambler.ru	244 B
1	magnitent.com sync.magnitent.com	572 B
1	caltat.com 1 redirects cdn3.caltat.com	336 B
1	mos.ru 1 redirects stats.mos.ru	359 B
1	mathtag.com 1 redirects sync.mathtag.com	699 B
1	otm-r.com yhb.p.otm-r.com	254 B
1	creativecdn.com adfox-c2s-ams.creativecdn.com	211 B
1	google-analytics.com ssl.google-analytics.com	17 KB
1	forexpf.ru informers.forexpf.ru	636 B
258	59

	Domain	Requested by
42	www.profinance.ru	1 redirects www.profinance.ru
25	tpc.googlesyndication.com	www.profinance.ru googleads.g.doubleclick.net tpc.googlesyndication.com pagead2.googlesyndication.com securepubads.g.doubleclick.net 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com s0.2mdn.net
24	an.yandex.ru	2 redirects www.profinance.ru yastatic.net
23	pagead2.googlesyndication.com	www.profinance.ru pagead2.googlesyndication.com tpc.googlesyndication.com www.googletagservices.com securepubads.g.doubleclick.net 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com googleads.g.doubleclick.net s0.2mdn.net
18	googleads.g.doubleclick.net	2 redirects pagead2.googlesyndication.com www.profinance.ru googleads.g.doubleclick.net www.googleadservices.com 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
13	cm.g.doubleclick.net	5 redirects googleads.g.doubleclick.net 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
12	s0.2mdn.net	tpc.googlesyndication.com www.profinance.ru s0.2mdn.net
11	www.google.com	4 redirects tpc.googlesyndication.com 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
10	mc.yandex.com	2 redirects www.profinance.ru mc.yandex.ru
9	ads.betweendigital.com	2 redirects www.profinance.ru yastatic.net
9	yastatic.net	2 redirects yastatic.net www.profinance.ru
6	www.google.de
6	sync.bumlam.com	6 redirects
6	x.bidswitch.net	6 redirects
5	ads.adfox.ru	www.profinance.ru
5	www.googletagservices.com	yastatic.net googleads.g.doubleclick.net securepubads.g.doubleclick.net 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
5	top-fwz1.mail.ru	1 redirects www.profinance.ru top-fwz1.mail.ru
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	x01.aidata.io	4 redirects
4	px.adhigh.net	3 redirects www.profinance.ru
3	fonts.gstatic.com	fonts.googleapis.com
3	ib.adnxs.com	2 redirects googleads.g.doubleclick.net
3	www.googleadservices.com	2 redirects yastatic.net
3	avatars.mds.yandex.net	www.profinance.ru
3	ap.lijit.com	3 redirects
3	static.criteo.net	yastatic.net www.profinance.ru
3	counter.yadro.ru	2 redirects www.profinance.ru
3	mc.yandex.ru	1 redirects www.profinance.ru yastatic.net
3	yandex.ru	www.profinance.ru yastatic.net
2	ups.analytics.yahoo.com	2 redirects
2	rtb.openx.net	2 redirects
2	d5p.de17a.com	2 redirects
2	pixel-sync.sitescout.com	2 redirects
2	googleads4.g.doubleclick.net	www.profinance.ru
2	gum.criteo.com	static.criteo.net gum.criteo.com
2	fonts.googleapis.com	tpc.googlesyndication.com s0.2mdn.net
2	ajax.googleapis.com	tpc.googlesyndication.com
2	6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	eus.rubiconproject.com	cache.betweendigital.com eus.rubiconproject.com
2	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net
2	sync.upravel.com	2 redirects
2	dpm.demdex.net	1 redirects www.profinance.ru
2	redirect.frontend.weborama.fr	2 redirects
2	sync.1dmp.io	2 redirects
2	dmg.digitaltarget.ru	2 redirects
2	sonar.semantiqo.com	2 redirects
2	sync3.adsniper.ru	2 redirects
2	pool.admedo.com	2 redirects
2	bidder.criteo.com	static.criteo.net
2	adservice.google.com	pagead2.googlesyndication.com securepubads.g.doubleclick.net
2	adservice.google.de	pagead2.googlesyndication.com securepubads.g.doubleclick.net
2	exchange.buzzoola.com	1 redirects www.profinance.ru
1	pixel.rubiconproject.com	1 redirects
1	match.adsrvr.org	6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
1	ad.doubleclick.net	6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
1	t.adx.opera.com
1	onetag-sys.com	cache.betweendigital.com
1	s.pubmine.com	www.profinance.ru
1	www.tns-counter.ru	www.profinance.ru
1	token.rubiconproject.com	eus.rubiconproject.com
1	secure-assets.rubiconproject.com	1 redirects
1	sync3.sniperlog.ru	1 redirects
1	18389d02-4c3e-4ca5-b168-0b9403028743.sync.upravel.com	1 redirects
1	cm.tns-counter.ru	1 redirects
1	dm.hybrid.ai	www.profinance.ru
1	profile.ssp.rambler.ru	1 redirects
1	yandex-sync.rutarget.ru	1 redirects
1	yandex-dmp-sync.rutarget.ru	1 redirects
1	ssp.adriver.ru	www.profinance.ru
1	sync.magnitent.com	www.profinance.ru
1	cdn3.caltat.com	1 redirects
1	stats.mos.ru	1 redirects
1	ysa-static.passport.yandex.ru	www.profinance.ru
1	sync.mathtag.com	1 redirects
1	cache.betweendigital.com	ads.betweendigital.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	pb.adriver.ru	yastatic.net
1	yhb.p.otm-r.com	yastatic.net
1	ad.mail.ru	yastatic.net
1	adfox-c2s-ams.creativecdn.com	yastatic.net
1	matchid.adfox.yandex.ru	yastatic.net
1	ssl.google-analytics.com	www.profinance.ru
1	informers.forexpf.ru	www.profinance.ru
1	profinance.ru	1 redirects
258	84

This site contains links to these domains. Also see Links.

Domain
cabinet.profinanceservice.com
t.me
top.mail.ru
www.liveinternet.ru

Subject Issuer	Validity	Valid
profinance.ru R3	`2021-10-12` - `2022-01-10`	3 months	crt.sh
yandex.ru Yandex CA	`2021-08-30` - `2022-02-28`	6 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
informers.forexpf.ru R3	`2021-10-12` - `2022-01-10`	3 months	crt.sh
*.mail.ru GeoTrust ECC CA 2018	`2020-11-13` - `2021-11-17`	a year	crt.sh
mc.yandex.ru Yandex CA	`2021-07-28` - `2022-01-07`	5 months	crt.sh
*.yastatic.net Yandex CA	`2021-08-18` - `2022-02-16`	6 months	crt.sh
ads.betweendigital.com Sectigo RSA Domain Validation Secure Server CA	`2020-11-19` - `2021-12-20`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
counter.yadro.ru GoGetSSL ECC DV CA	`2020-02-02` - `2022-05-02`	2 years	crt.sh
bs.yandex.ru Yandex CA	`2021-05-31` - `2021-11-29`	6 months	crt.sh
matchid.adfox.yandex.ru Yandex CA	`2021-08-26` - `2022-02-18`	6 months	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-09-09` - `2021-12-07`	3 months	crt.sh
*.creativecdn.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2021-03-30` - `2022-04-12`	a year	crt.sh
ltmse.com R3	`2021-10-12` - `2022-01-10`	3 months	crt.sh
*.p.otm-r.com Sectigo RSA Domain Validation Secure Server CA	`2020-01-27` - `2022-02-06`	2 years	crt.sh
*.buzzoola.com Sectigo RSA Domain Validation Secure Server CA	`2020-06-30` - `2022-09-28`	2 years	crt.sh
*.adriver.ru RapidSSL RSA CA 2018	`2020-04-03` - `2022-04-24`	2 years	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.google.de GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.google.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-09-09` - `2021-12-07`	3 months	crt.sh
cache.betweendigital.com Sectigo RSA Domain Validation Secure Server CA	`2019-11-08` - `2022-02-05`	2 years	crt.sh
avatars.mds.yandex.net Yandex CA	`2021-08-31` - `2022-03-01`	6 months	crt.sh
ysa-static.passport.yandex.net Yandex CA	`2021-08-21` - `2022-02-19`	6 months	crt.sh
sync.magnitent.com R3	`2021-09-26` - `2021-12-25`	3 months	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2020-12-02` - `2022-01-02`	a year	crt.sh
*.hybrid.ai Sectigo RSA Domain Validation Secure Server CA	`2020-07-07` - `2022-10-05`	2 years	crt.sh
*.adfox.ru Yandex CA	`2021-07-27` - `2022-01-06`	5 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-04-01` - `2022-04-04`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
*.tns-counter.ru GlobalSign ECC OV SSL CA 2018	`2020-11-10` - `2021-12-12`	a year	crt.sh
s.pubmine.com Sectigo RSA Domain Validation Secure Server CA	`2020-10-27` - `2021-10-27`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
www.google.de GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh
onetag-sys.com R3	`2021-07-26` - `2021-10-24`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.adx.opera.com DigiCert TLS RSA SHA256 2020 CA1	`2021-05-14` - `2022-06-10`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2021-03-18` - `2022-04-19`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-09-13` - `2021-11-20`	2 months	crt.sh

This page contains 28 frames:

Primary Page: https://www.profinance.ru/
Frame ID: 8CC4C9C57493BA3D66E5594529F36C00
Requests: 102 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211007/r20190131/zrt_lookup.html
Frame ID: ECA912A25236B6D48296ECB262EB165F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2822498309427835&output=html&adk=1812271804&adf=3025194257&lmt=1634056324&plat=3%3A32%2C4%3A32%2C9%3A32904%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.profinance.ru%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372818&bpp=2&bdt=616&idt=125&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=782430866943&frm=20&pv=2&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=145
Frame ID: F3C87E94135ECDD12018E2CA21C57107
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1634056324&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372820&bpp=1&bdt=618&idt=148&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=782430866943&frm=20&pv=2&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=439&ady=717&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=BddfL1LK9N&p=https%3A//www.profinance.ru&dtd=152
Frame ID: F5A41B196D49261E5B33769A48AC63A3
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9865432956&adk=870026366&adf=2297262845&pi=t.ma~as.9865432956&w=240&lmt=1634056324&psa=0&format=240x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372821&bpp=1&bdt=619&idt=154&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C580x400&nras=1&correlator=782430866943&frm=20&pv=1&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=1345&ady=67&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=23chL86PX0&p=https%3A//www.profinance.ru&dtd=157
Frame ID: CA579483F1441BFA3F659DCF7885D458
Requests: 1 HTTP requests in this frame

Frame: https://cache.betweendigital.com/code/bidder_18.html?USER_ID=1726420c-09f8-531d-be21-7f82df44c736&CACHEBUSTER=887699
Frame ID: C712C45403F59BF81CCBC1A56B7E5C18
Requests: 7 HTTP requests in this frame

Frame: https://yastatic.net/safeframe-bundles/0.82/1-1-0/render.html
Frame ID: ACBB540CF099EBDEDC68278CD8B8E337
Requests: 38 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: D1C51EAF36E374C98A4F971C7706299D
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/index.html
Frame ID: 64D7D5C8782EA779C97EAE676624ECC1
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=CIrZttbhlYay0AaT0zAagj6iQBPzTisJjhsuVy80Nzr74lnEQASDmnIxpYJXikIKgB6AB_4St7QPIAQmoAwHIA0iqBMgBT9AuOzI5Q43-1K3GUiKZx-iuE1bSndbXrdvMZ1W_zn7yY68E0EAVcMJVlMLCNthl8du_-ImJAGFjaZmkeO8ArevyTsjshVeW8Vd3dK0fgVdOeKxc5ON1n81_v5j5myyZRUC59Z-9tU-AmgFk0JO_VwGsyXYd7CmR7D5eD8FJgTX2xPgjMtlJNKTToDy6Eh8eDIsngYkgrWKQqriFrrtDY6XwJwdWAaOE3q0cpRVzRHrR7mb0d4nvzcvBTgNRXWQFYZ_PBAuNxd3ABNz_xsL4ApIFBAgEGAGSBQQIBRgEoAYugAeS-5odqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G9gHAPIHBRC0jtEB0ggJCIDhgBAQARhfgAoByAsB2BMM0BUBgBcBshccChoIABIUcHViLTIyMTU5NjczODk5NTEwNjAYAA&sigh=PImjhWwlePo&template_id=419
Frame ID: 34B5086EB791E9C0BF1BF9AFE6F3B55A
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html
Frame ID: D25B9AEDC6781BF1B8773B2F82A39933
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=CQ_XQtbhlYfWsAdPBzAau0qbQCfzTisJj_saVy80Nzr74lnEQASDmnIxpYJXikIKgB6AB_4St7QPIAQmoAwHIA0iqBMgBT9CIyqjDfS12qFDVkooyOPQ1mdHPJqG7XlokraUQBj4ip4aSPVmjgfuYQgFrJuP0WRjusdrz9E-oo15yEbs3_WxBdiMvPd2SvR3WYcn51kA4NcvAlK-EAz5BuyFz2bjFo9gFK5CoqDEZ2Wu9Im84u9goQT4YNgkgt_mTeafzR-hSLYFMF4eG3Hy_XPSdgz2T4PB_e5hRugYJugsKbWnmC6SlE5aLthE26wsFFPnqHmj_M3-SXHChIhvj3qVHVD5tpfbKLFtZNzvABNz_xsL4ApIFBAgEGAGSBQQIBRgEoAYugAeS-5odqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G9gHAPIHBRD70ZIC0ggJCIDhgBAQARhfgAoByAsB2BMM0BUBgBcBshccChoIABIUcHViLTIyMTU5NjczODk5NTEwNjAYAA&sigh=uHrnAlR0oUQ&uach_m=[UACH]&template_id=419
Frame ID: 7A33271747B9BACC133F8140F81337A9
Requests: 7 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=btwnex&endpoint=eu
Frame ID: 903AA3156F7D577EF4B26B0E1C0BE718
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 691DB4674B095FACEF3FB59A69F9A03A
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 66A8DA79FAB949BE974F78AC6E17D620
Requests: 2 HTTP requests in this frame

Frame: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Frame ID: 42421325797C5906A3084C0D59D3A8B8
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.profinance.ru
Frame ID: 639E929D5DF9908ADC6226F1141AF11A
Requests: 2 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=5d1628750185ace
Frame ID: 19DED9EE80097FA694E9EF951AE8FA74
Requests: 1 HTTP requests in this frame

Frame: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Frame ID: FFAB96B2598DDDBD37AB72E098200056
Requests: 16 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 373F4736899606CE8FF47B2C7F647B01
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: ADF347649CFF91D34502B4A7A41E5C8E
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=COykVhCv2FYYv8KEsAEwAQ&v=APEucNVSmAsmhmX8N6CcHW4lSqsiDdSLcKkke2vVVBGI2-NALAaBNkQaCwRvPHZ1j0Vm5O1CskUwo4m3Y2M_PQORQgJ0akIkoQWe2KND38yxMry2cYB-vtbGDCOOvDZMOmQYNGqz9j-UCRJzPbrIERVBRZfONBW--wrxeyash_sBWi4H3rNfidY
Frame ID: 63719A5BD4F23302DD4F1080F1215B3A
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 03986F4B0151CFE7F641DF2F1338F799
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: E165AC78DC10E04927FC46BED891E7DA
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: D850ADB36DC1A7927C5EB3E480E18D08
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 21A0D96114D2E6EDA94F541BBED4324F
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/13379066290707103744/index.html?e=69&leftOffset=0&topOffset=0&c=9ptZeweDRe&t=1&renderingType=2
Frame ID: 2F217DF4F1189E73340FC60FA5ABBA69
Requests: 15 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/164xWCSuMRCufBnFuK3WuMS10bt2HArdrnuZlqXsEzU.js
Frame ID: 8EAAFD570FA3B09E7B0908CD39333E6D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Форекс на ProFinance.Ru. Курсы валют. Прогнозы валютного рынка.

Page URL History Show full URLs

http://profinance.ru/ HTTP 301
http://www.profinance.ru/ HTTP 301
https://www.profinance.ru/ Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googletagservices\.com/tag/js/gpt(?:_mobile)?\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Liveinternet (Analytics) Expand

Overall confidence: 100%
Detected patterns

<script[^<>]*>[^]{0,128}?src\s*=\s*['"]//counter\.yadro\.ru/hit(?:;\S+)?\?(?:t\d+\.\d+;)?r
<a href="http://www\.liveinternet\.ru/click"

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Yandex.Direct (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://an\.yandex\.ru/

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
/([\d.]+)/jquery(?:\.min)?\.js

Page Statistics

258
Requests

100 %
HTTPS

0 %
IPv6

59
Domains

84
Subdomains

54
IPs

11
Countries

2545 kB
Transfer

7287 kB
Size

84
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://cabinet.profinanceservice.com/real/
Title: Кабинет

Search URL Search Domain Scan URL

URL: https://t.me/marketsnapshot
Title: Telegram

Search URL Search Domain Scan URL

URL: https://top.mail.ru/jump?from=74564

Search URL Search Domain Scan URL

URL: http://www.liveinternet.ru/click

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://profinance.ru/ HTTP 301
http://www.profinance.ru/ HTTP 301
https://www.profinance.ru/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7

https://yastatic.net/pcode/adfox/header-bidding.js HTTP 302
https://yandex.ru/ads/system/header-bidding.js

Request Chain 9

https://yastatic.net/pcode/adfox/loader.js HTTP 302
https://yandex.ru/ads/system/context.js

Request Chain 18

https://top-fwz1.mail.ru/counter?id=74564;t=556;l=1 HTTP 302
https://top-fwz1.mail.ru/counter2?id=74564;t=556;l=1

Request Chain 42

https://ads.betweendigital.com/sspmatch-js?p=43185&randsalt=9573762198 HTTP 302
https://ads.betweendigital.com/sspmatch-js?p=43185&randsalt=9573762198&crf=1

Request Chain 49

https://counter.yadro.ru/hit?t29.3;r;s1600*1200*24;uhttps%3A//www.profinance.ru/;0.1492175597702916 HTTP 302
https://counter.yadro.ru/hit?q;t29.3;r;s1600*1200*24;uhttps%3A//www.profinance.ru/;0.1492175597702916

Request Chain 59

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9424.DYj4I62ZNPq9zcX07g-EPfZOAsrmSgMCUSwURKjiXfWyzDBMWpSHTw0meflt39aL.w3X_hGehNS3OotVmcxpeCIY7uDE%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=9424.3Syq0oISfKVTVHVFhBTJMuJylXfUthJ5QqUYYYv5qInIysIcIdjZL54re-2cq0npIDZH6twCGULlxzZUCH5Pdg%2C%2C.OjLfeEI9xN0TxiQyu_lWWq4_kf8%2C

Request Chain 64

https://px.adhigh.net/rtb/yandex_hb HTTP 307
https://px.adhigh.net/rtb/yandex_hb?bounced=1

Request Chain 68

https://exchange.buzzoola.com/ssp/adfox HTTP 307
https://exchange.buzzoola.com/ssp/adfox?set_buzzoola_cookie=t

Request Chain 78

https://mc.yandex.com/watch/9524?wmode=7&page-url=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&cnt-class=1&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A4phzp3o2dbm15p1mc%3Afp%3A825%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A660%3Acn%3A1%3Adp%3A0%3Als%3A582181938217%3Ahid%3A854096656%3Az%3A0%3Ai%3A202101012163252%3Aet%3A1634056373%3Ac%3A1%3Arn%3A290245099%3Arqn%3A1%3Au%3A1634056373589262977%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1634056371787%3Ads%3A0%2C90%2C81%2C1%2C240%2C0%2C%2C424%2C1%2C%2C%2C%2C907%3Adsn%3A0%2C90%2C82%2C1%2C241%2C0%2C%2C425%2C2%2C%2C%2C%2C907%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1634056373%3At%3A%D0%A4%D0%BE%D1%80%D0%B5%D0%BA%D1%81%20%D0%BD%D0%B0%20ProFinance.Ru.%20%D0%9A%D1%83%D1%80%D1%81%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82.%20%D0%9F%D1%80%D0%BE%D0%B3%D0%BD%D0%BE%D0%B7%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D1%8B%D0%BD%D0%BA%D0%B0. HTTP 302
https://mc.yandex.com/watch/9524/1?wmode=7&page-url=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&cnt-class=1&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A4phzp3o2dbm15p1mc%3Afp%3A825%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A660%3Acn%3A1%3Adp%3A0%3Als%3A582181938217%3Ahid%3A854096656%3Az%3A0%3Ai%3A202101012163252%3Aet%3A1634056373%3Ac%3A1%3Arn%3A290245099%3Arqn%3A1%3Au%3A1634056373589262977%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1634056371787%3Ads%3A0%2C90%2C81%2C1%2C240%2C0%2C%2C424%2C1%2C%2C%2C%2C907%3Adsn%3A0%2C90%2C82%2C1%2C241%2C0%2C%2C425%2C2%2C%2C%2C%2C907%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1634056373%3At%3A%D0%A4%D0%BE%D1%80%D0%B5%D0%BA%D1%81%20%D0%BD%D0%B0%20ProFinance.Ru.%20%D0%9A%D1%83%D1%80%D1%81%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82.%20%D0%9F%D1%80%D0%BE%D0%B3%D0%BD%D0%BE%D0%B7%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D1%8B%D0%BD%D0%BA%D0%B0.

Request Chain 80

https://x.bidswitch.net/sync?ssp=between HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=between HTTP 302
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=between&bsw_custom_parameter=54d6b61d-ab07-4e90-8370-0157819335bd HTTP 302
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=between&bsw_custom_parameter=54d6b61d-ab07-4e90-8370-0157819335bd HTTP 302
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=1228a75e-b2df-4273-aeb1-fd4fc085b70b&user_group=1&ssp=between&bsw_param=54d6b61d-ab07-4e90-8370-0157819335bd HTTP 302
https://ads.betweendigital.com/match?bidder_id=22&external_user_id=54d6b61d-ab07-4e90-8370-0157819335bd

Request Chain 81

https://px.adhigh.net/p/cm/btw HTTP 302
https://px.adhigh.net/p/cm/btw?bounced=1 HTTP 302
https://ads.betweendigital.com/match?bidder_id=37&external_user_id=mI6BXzHAPJ.AikABlF8dVmDOA

Request Chain 82

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fads.betweendigital.com%2Fmatch%3Fbidder_id%3D114%26external_user_id%3D%24UID HTTP 307
https://ap.lijit.com/pixel?redir=https%3A%2F%2Fads.betweendigital.com%2Fmatch%3Fbidder_id%3D114%26external_user_id%3D%24UID&sovrn_retry=true HTTP 307
https://ads.betweendigital.com/match?bidder_id=114&external_user_id=7f085b153c8deca91e300fb0

Request Chain 83

https://sync.bumlam.com/?src=bw1&uid=1726420c-09f8-531d-be21-7f82df44c736 HTTP 302
https://sync3.adsniper.ru/?src=ss1&s_data=CAEQABi18ZaLBlIFvp7KygpiJDE3MjY0MjBjLTA5ZjgtNTMxZC1iZTIxLTdmODJkZjQ0YzczNg** HTTP 302
https://sync3.adsniper.ru/?src=ss1&s_data=CAIQARi18ZaLBlIFvp7KygpiJDE3MjY0MjBjLTA5ZjgtNTMxZC1iZTIxLTdmODJkZjQ0YzczNqIBEAwg7QwrehHspukAJZDIJDc* HTTP 302
https://sync.bumlam.com/?src=bw1&s_data=CAIQABi18ZaLBmIkMTcyNjQyMGMtMDlmOC01MzFkLWJlMjEtN2Y4MmRmNDRjNzM2ogEQDCDtDCt6Eeym6QAlkMgkNw** HTTP 302
https://sync.bumlam.com/?src=bw1&s_data=CAIQARi18ZaLBmIkMTcyNjQyMGMtMDlmOC01MzFkLWJlMjEtN2Y4MmRmNDRjNzM2ogEQDCDtDCt6Eeym6QAlkMgkNw** HTTP 302
https://ads.betweendigital.com/match?bidder_id=18&external_user_id=0c20ed0c-2b7a-11ec-a6e9-002590c82437

Request Chain 96

https://x.bidswitch.net/sync?ssp=between HTTP 302
https://sync.mathtag.com/sync/img?mt_exid=46&redir=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D80%26user_id%3D%5BUUID%5D%26expires%3D30%26ssp%3Dbetween%26bsw_param%3D54d6b61d-ab07-4e90-8370-0157819335bd&gdpr=&gdpr_consent= HTTP 302
https://x.bidswitch.net/sync?dsp_id=80&user_id=6dcc6165-b8b4-4100-8f2f-be32008d8286&expires=30&ssp=between&bsw_param=54d6b61d-ab07-4e90-8370-0157819335bd&gdpr=&gdpr_consent= HTTP 302
https://ads.betweendigital.com/match?bidder_id=22&external_user_id=54d6b61d-ab07-4e90-8370-0157819335bd

Request Chain 98

https://stats.mos.ru/gc/ynd/ HTTP 302
https://an.yandex.ru/mapuid/ditmsk/Cg8qAWFluLWa5mHtNDSEAgA=?time=1634056373.385

Request Chain 99

https://sonar.semantiqo.com/dmp/scr.php HTTP 302
https://counter.yadro.ru/id127/reff-id.gif?sid=4f4d85664b5c488ead18a785b4d621cc HTTP 302
https://sonar.semantiqo.com/fbfli/data_sess_sync.php?spid=1823F8F67A42B79C&sid=4f4d85664b5c488ead18a785b4d621cc HTTP 302
https://cdn3.caltat.com/fbfc504c-89b0-4a80-bef4-c8e39daeee6f/sess.php?sid=4f4d85664b5c488ead18a785b4d621cc&spid=1823F8F67A42B79C&v= HTTP 302
https://sync.magnitent.com/fbfli/ct_sync.php?ct=d9e49ae7397d4e78b59be4802c3f2f45&sonar=4f4d85664b5c488ead18a785b4d621cc&spid=1823F8F67A42B79C&v=

Request Chain 101

https://an.yandex.ru/mapuid/google/ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yandexru&google_hm=AC5803E8D21425CA&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif HTTP 302
https://an.yandex.ru/resource/spacer.gif

Request Chain 102

https://dmg.digitaltarget.ru/1/119/i/i?i=1634056372 HTTP 307
https://dmg.digitaltarget.ru/awg/custom/119/i/i?call_source=awg&i=1634056372 HTTP 307
https://an.yandex.ru/mapuid/dmpamberdata/JgvIRyB4AivNsLB7AZGt

Request Chain 103

https://yandex-dmp-sync.rutarget.ru/sync HTTP 302
https://an.yandex.ru/mapuid/dmpsegmento/YOuouD63ab-x?sign=1565629791

Request Chain 104

https://yandex-sync.rutarget.ru/sync HTTP 302
https://an.yandex.ru/mapuid/rutargetis/P5rB783oSwK8

Request Chain 105

https://x01.aidata.io/0.gif?pid=YANDEX HTTP 302
https://x01.aidata.io/0.gif?pid=YANDEX&bounce=1 HTTP 302
https://an.yandex.ru/mapuid/dmpaidatame/ezHHwWhOGYWF8DWWYZ%2FVxQ?sign=2502469253

Request Chain 106

https://sync.1dmp.io/pixel.gif?cid=3cbc2ec8-1421-4677-89fe-2ac6fc52a09a&pid=w&o=au HTTP 302
https://sync.1dmp.io/pixel.gif?cid=3cbc2ec8-1421-4677-89fe-2ac6fc52a09a&pid=w&o=au&cs=1 HTTP 302
https://an.yandex.ru/mapuid/dmpcleverdata/0c35f530-2b7a-11ec-ae6b-901b0ea4a41b?sign=2897533073

Request Chain 107

https://redirect.frontend.weborama.fr/redirect/standard?url=https://an.yandex.ru/mapuid/dmpweborama/{WEBO_CID} HTTP 302
https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fdmpweborama%2F%7BWEBO_CID%7D&bounce=1&random=2069379913 HTTP 302
https://an.yandex.ru/mapuid/dmpweborama/aimGa80bZfNrZGVZKHK.l.

Request Chain 108

https://profile.ssp.rambler.ru/sync3.302?pid=188 HTTP 302
https://an.yandex.ru/mapuid/ramblerssp/

Request Chain 109

https://an.yandex.ru/mapuid/adobedmp/ HTTP 302
https://dpm.demdex.net/ibs:dpid=423652&dpuuid=31B74B07E448E697 HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=423652&dpuuid=31B74B07E448E697

Request Chain 111

https://cm.tns-counter.ru/yacm HTTP 302
https://an.yandex.ru/mapuid/mediascope/ead7fc39e3d37e7b7b7a628f0a2b2c258c54558451a1209ad6459a944c7ef662

Request Chain 112

https://sync.upravel.com/yandex/sync HTTP 302
https://sync.upravel.com/yandex/sync?session_tpt=eyJoZWFkZXJzIjp7InJlZmVyZXIiOlsiaHR0cHM6Ly95YXN0YXRpYy5uZXQvIl19fQ HTTP 302
https://18389d02-4c3e-4ca5-b168-0b9403028743.sync.upravel.com/yandex/sync?ud_tpt=eyJoZWFkZXJzIjp7InJlZmVyZXIiOlsiaHR0cHM6Ly95YXN0YXRpYy5uZXQvIiwiaHR0cHM6Ly95YXN0YXRpYy5uZXQvIl19fQ HTTP 302
https://an.yandex.ru/mapuid/upravelis/18389d02-4c3e-4ca5-b168-0b9403028743

Request Chain 115

https://sync.bumlam.com/?src=aid0 HTTP 302
https://x01.aidata.io/0.gif?pid=ADSNIPER&id=0c20ed0c-2b7a-11ec-a6e9-002590c82437 HTTP 302
https://x01.aidata.io/0.gif?pid=ADSNIPER&id=0c20ed0c-2b7a-11ec-a6e9-002590c82437&bounce=1 HTTP 302
https://sync.bumlam.com/?src=aid1&uid=PbMM3DtJLoa5H%2FiiHGQT4A& HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_cm&extra1=PbMM3DtJLoa5H/iiHGQT4A&extra2=aidata HTTP 302
https://sync3.sniperlog.ru/?src=ggl&extra1=PbMM3DtJLoa5H/iiHGQT4A&extra2=aidata&google_gid=CAESEPJ2qxAeW2A8Yr5zPtk88vI&google_cver=1 HTTP 301
https://sync.bumlam.com/?src=ggl&extra1=PbMM3DtJLoa5H/iiHGQT4A&extra2=aidata&google_gid=CAESEPJ2qxAeW2A8Yr5zPtk88vI&google_cver=1 HTTP 302
https://an.yandex.ru/setud/adsniper/dcb3d155a1e5da46?sign=774744254

Request Chain 132

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=btwnex&endpoint=eu HTTP 301
https://eus.rubiconproject.com/usync.html?p=btwnex&endpoint=eu

Request Chain 153

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 154

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 160

https://x.bidswitch.net/sync?dsp_id=429&user_id=1726420c-09f8-531d-be21-7f82df44c736&expires=60 HTTP 302
https://s.pubmine.com/match?bidder_id=1&external_user_id=54d6b61d-ab07-4e90-8370-0157819335bd&ssp_data=&gdpr=&gdpr_consent=

Request Chain 162

https://www.googleadservices.com/pagead/conversion/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=t7hlYYHzEIuOgQeWk7iYDA&random=690106872&sscte=1&crd= HTTP 302
https://www.google.com/pagead/1p-user-list/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=690106872&crd=&is_vtc=1&random=2191410085 HTTP 302
https://www.google.de/pagead/1p-user-list/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=690106872&crd=&is_vtc=1&random=2191410085&ipr=y

Request Chain 163

https://www.googleadservices.com/pagead/conversion/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=t7hlYabyEM_-gAf99p6QDg&random=1126875737&sscte=1&crd= HTTP 302
https://www.google.com/pagead/1p-user-list/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1126875737&crd=&is_vtc=1&random=2570722933 HTTP 302
https://www.google.de/pagead/1p-user-list/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1126875737&crd=&is_vtc=1&random=2570722933&ipr=y

Request Chain 197

https://ads.betweendigital.com/match?bidder_id=43554&callback_url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fbetweendigitalis%2F1726420c-09f8-531d-be21-7f82df44c736 HTTP 302
https://an.yandex.ru/mapuid/betweendigitalis/1726420c-09f8-531d-be21-7f82df44c736

Request Chain 212

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED9LMPKgolCuHXhS5m9rUTM&google_cver=1

Request Chain 213

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YWW4t4hHdsm64aL6pdS6lgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED9LMPKgolCuHXhS5m9rUTM&google_cver=1

Request Chain 214

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEBIuzvDkDGfBNIapwHcpLak&google_cver=1

Request Chain 215

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA4ODg4Njk3MzkxOTM2NDIyNw%3D%3D

Request Chain 230

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEF0M-6h1aPy_K4If8Js81u0&google_cver=1&google_push=AYg5qPKTK2LEOJCN95xQJzvnUUeoYklVuoRqzBpRJ87P7L_akyKJQfZgRaCOjry7BcfSChgBO2utlO-jyB4LHTFQuA8GjPuutipl HTTP 302
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=8&google_gid=CAESEF0M-6h1aPy_K4If8Js81u0&google_cver=1&google_push=AYg5qPKTK2LEOJCN95xQJzvnUUeoYklVuoRqzBpRJ87P7L_akyKJQfZgRaCOjry7BcfSChgBO2utlO-jyB4LHTFQuA8GjPuutipl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=aKOVN6OCSJKVarAqaezj7GFluLg

Request Chain 231

https://d5p.de17a.com/cookies/google?google_gid=CAESEPGqW-VFFLW1XVNA68PG_CM&google_cver=1&google_push=AYg5qPLkEt7IrtG1nAil5S2O-wmGAdYi8B36Q5AsbHx8PbQOTXgtg5Drq8JYva4ZHWPhrJxkU3StuSzEt832-OiyfFQlgj4voV8v HTTP 302
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEPGqW-VFFLW1XVNA68PG_CM&google_cver=1&google_push=AYg5qPLkEt7IrtG1nAil5S2O-wmGAdYi8B36Q5AsbHx8PbQOTXgtg5Drq8JYva4ZHWPhrJxkU3StuSzEt832-OiyfFQlgj4voV8v HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPLkEt7IrtG1nAil5S2O-wmGAdYi8B36Q5AsbHx8PbQOTXgtg5Drq8JYva4ZHWPhrJxkU3StuSzEt832-OiyfFQlgj4voV8v

Request Chain 232

https://rtb.openx.net/sync/dds?google_gid=CAESEP4lER_dOTGbb0LHKte8mq4&google_cver=1&google_push=AYg5qPL5pOr5ULcw6oBh_kWCtrJU5gjE48e75je1UY5O_fPt8xVRJFqDxpTFtzZgdgV1LMoZyUXPbJyLmg7njvP1kN21btEwZQs HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESEP4lER_dOTGbb0LHKte8mq4&google_cver=1&google_push=AYg5qPL5pOr5ULcw6oBh_kWCtrJU5gjE48e75je1UY5O_fPt8xVRJFqDxpTFtzZgdgV1LMoZyUXPbJyLmg7njvP1kN21btEwZQs&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPL5pOr5ULcw6oBh_kWCtrJU5gjE48e75je1UY5O_fPt8xVRJFqDxpTFtzZgdgV1LMoZyUXPbJyLmg7njvP1kN21btEwZQs&google_hm=Xkm810Pwy7ouB24GYaQhaA==

Request Chain 233

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEHn-T5pEQ5yZqULWbG_CmcM&google_cver=1&google_push=AYg5qPICssa-bjKv4y4a3FCV2k8URwoG8Qw-FtsKtA5Fb__tR1R5U-kviyU2LUI1YheKCY2fRRzwHTjJcfYGUZZk3Wf6oNar2QDW HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VPQVo1OU0tMjMtMklKQQ==&google_push=AYg5qPICssa-bjKv4y4a3FCV2k8URwoG8Qw-FtsKtA5Fb__tR1R5U-kviyU2LUI1YheKCY2fRRzwHTjJcfYGUZZk3Wf6oNar2QDW

Request Chain 234

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEGDyiyx1hHu9FWcxN7jS9qg&google_cver=1&google_push=AYg5qPJUQSdVM5CdFCsuVj3JLuIq1tYjlETuRcdGXfhI_JNovQpPDCV85v3lkdcizjTuz3boZGnKu7_3PgLi6-0B8YroPc0VA39f HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPJUQSdVM5CdFCsuVj3JLuIq1tYjlETuRcdGXfhI_JNovQpPDCV85v3lkdcizjTuz3boZGnKu7_3PgLi6-0B8YroPc0VA39f&google_hm=7f085b153c8deca91e300fb0

Request Chain 235

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEOR3FsK1WA-vLuIrzm13N7Y&google_cver=1&google_push=AYg5qPILQohfmW-hJ-JGBLPlE8Ibl8E1s5zOxRDf_pz8utsC8seV0urM3K5zcAbrG5EfpFi8W1OTL5mPaymqrSEYm1SNzgddyRe-Mw HTTP 302
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEOR3FsK1WA-vLuIrzm13N7Y&google_cver=1&google_push=AYg5qPILQohfmW-hJ-JGBLPlE8Ibl8E1s5zOxRDf_pz8utsC8seV0urM3K5zcAbrG5EfpFi8W1OTL5mPaymqrSEYm1SNzgddyRe-Mw&verify=true HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1IWEhkNjFsRTJ1Rk1Fbkd6VV8xRUlON3J6M1ZWWWZ1an5B&google_push=AYg5qPILQohfmW-hJ-JGBLPlE8Ibl8E1s5zOxRDf_pz8utsC8seV0urM3K5zcAbrG5EfpFi8W1OTL5mPaymqrSEYm1SNzgddyRe-Mw

258 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.profinance.ru/
Redirect Chain

http://profinance.ru/
http://www.profinance.ru/
https://www.profinance.ru/

62 KB
13 KB

172ms
82ms

Document
text/html

81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 91efa6eb86ecf7c7acbc99f2746d9dfb3f19fcc8398d3c832927192c2bf65ca9

Request headers

:method: GET
:authority: www.profinance.ru
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
server: nginx
last-modified: Tue, 12 Oct 2021 16:32:04 GMT
etag: W/"6165b884-f91b"
x-conf: news1-www www-to-news1
content-encoding: gzip

Redirect headers

Server: nginx
Date: Tue, 12 Oct 2021 16:32:52 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Keep-Alive: timeout=45
Location: https://www.profinance.ru/
x-conf: www-profinance

GET
H2 200 pro.css
www.profinance.ru/css/ 21 KB
3 KB 55ms
54ms Stylesheet
text/css 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/css/pro.css?181210
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 67d966655f66192caeabb47ca4d7ea5271a9a3083e906a44850a6932d5a0e2be

Request headers

:path: /css/pro.css?181210
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
last-modified: Thu, 10 Dec 2020 20:28:41 GMT
server: nginx
etag: W/"5fd284f9-548a"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 pro-bal-new.css
www.profinance.ru/css/ 658 B
589 B 97ms
97ms Stylesheet
text/css 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/css/pro-bal-new.css?18112103
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 1484b97dfb6d3aeaf32de990df919f0c59458097e85e61c57ec0cd3863a2aa17

Request headers

:path: /css/pro-bal-new.css?18112103
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
last-modified: Wed, 21 Nov 2018 17:17:43 GMT
server: nginx
etag: W/"5bf59337-292"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 bors-forexpf.css
www.profinance.ru/css/ 6 KB
2 KB 55ms
55ms Stylesheet
text/css 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/css/bors-forexpf.css?
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 7e1e066fbf2de0d0703956d8e95b15e51a7a444289ca1bffae0d841f5c53c9b8

Request headers

:path: /css/bors-forexpf.css?
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: W/"5ad47f6f-188f"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 ads.js Show response
www.profinance.ru/adv/ 85 B
350 B 97ms
97ms Script
application/javascript 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/adv/ads.js
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 88e5dc8f8a7799f095f0f957096776105f22b3c74a13a138431ae5e2487efa2f

Request headers

:path: /adv/ads.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
last-modified: Sun, 09 Dec 2018 22:16:30 GMT
server: nginx
etag: W/"5c0d943e-55"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 jquery-1.12.0.min.js Show response
www.profinance.ru/js/ 95 KB
33 KB 59ms
59ms Script
application/javascript 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/js/jquery-1.12.0.min.js
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 5f1ab65fe2ad6b381a1ae036716475bf78c9b2e309528cf22170c1ddeefddcbf

Request headers

:path: /js/jquery-1.12.0.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
last-modified: Fri, 08 Jan 2016 19:57:42 GMT
server: nginx
etag: W/"569014b6-17c52"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 forex.js Show response
www.profinance.ru/ 367 B
499 B 43ms
43ms Script
application/javascript 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/forex.js
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: e1574f8d5343d7b6218010a1e4a78b5a6f896a45eeab77317b6c29b28bc4509b

Request headers

:path: /forex.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: W/"5ad47f6f-16f"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 custom.js Show response
www.profinance.ru/js/ 704 B
554 B 67ms
66ms Script
text/javascript 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/js/custom.js
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 5c45c312dc1ba44ddeecb86f06d442b85f7816d393b81d3d8197971f80dae7da

Request headers

:path: /js/custom.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-language: ru
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-type: text/javascript; charset=utf-8
x-conf: www-to-site2
expires: 0

GET
H2

200

header-bidding.js Show response
yandex.ru/ads/system/
Redirect Chain

https://yastatic.net/pcode/adfox/header-bidding.js
https://yandex.ru/ads/system/header-bidding.js

152 KB
39 KB

125ms
58ms

Script
text/javascript

77.88.55.55
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/system/header-bidding.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

77.88.55.55 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

yandex.ru

Software

Resource Hash

15af425c19ea847baf1fb2cb8c5903d55c9d4cbd5276de1d7c5976c3423bcf69

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-encoding: br
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 86400, "success_fraction": 0.001, "failure_fraction": 0.1}
etag: 1996122819
x-yandex-req-id: 1634056372705135-10406981488737450272-man1-8149-man-l7-balancer-8080-BAL-4717
report-to: { "group": "network-errors", "max_age": 86400, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=3600
x-robots-tag: noindex, noarchive, nofollow
expires: Tue, 12 Oct 2021 17:32:52 GMT

Redirect headers

date: Tue, 12 Oct 2021 16:32:52 GMT
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
server: nginx/1.17.9
location: https://yandex.ru/ads/system/header-bidding.js
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
access-control-allow-origin: *
strict-transport-security: max-age=43200000; includeSubDomains;
timing-allow-origin: *
content-length: 0

GET
H2 200 pf_hb.js Show response
www.profinance.ru/js/ 18 KB
1 KB 96ms
96ms Script
application/javascript 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/js/pf_hb.js?2021040101
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 2c967cac40158b4a25c3f77d4123e5d9c203f5527322e6d51b6469df29abe2ae

Request headers

:path: /js/pf_hb.js?2021040101
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
last-modified: Thu, 01 Apr 2021 09:00:13 GMT
server: nginx
etag: W/"60658b9d-48d0"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2

200

context.js Show response
yandex.ru/ads/system/
Redirect Chain

https://yastatic.net/pcode/adfox/loader.js
https://yandex.ru/ads/system/context.js

299 KB
80 KB

175ms
41ms

Script
text/javascript

77.88.55.55
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/system/context.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

77.88.55.55 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

yandex.ru

Software

Resource Hash

d78bf4c3297ee116a687b02649b5c1fa73314a1b99f94f40402c3e5d785e79bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-encoding: br
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 86400, "success_fraction": 0.001, "failure_fraction": 0.1}
etag: 768949482
x-yandex-req-id: 1634056372469837-15281438330607391415-man1-4267-man-l7-balancer-8080-BAL-5981
report-to: { "group": "network-errors", "max_age": 86400, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=3600
x-robots-tag: noindex, noarchive, nofollow
expires: Tue, 12 Oct 2021 17:32:52 GMT

Redirect headers

date: Tue, 12 Oct 2021 16:32:52 GMT
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
server: nginx/1.17.9
location: https://yandex.ru/ads/system/context.js
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
access-control-allow-origin: *
strict-transport-security: max-age=43200000; includeSubDomains;
timing-allow-origin: *
content-length: 0

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 145 KB
51 KB 118ms
48ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

2ecf2f4f04ac8075406edb9cd8d67d7cdc79a7e5f7e9bca60f3b17b8f6c03c5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51395
x-xss-protection: 0
server: cafe
etag: 10909577954987558775
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 12 Oct 2021 16:32:52 GMT

GET
H2 200 tgbnr.js Show response
www.profinance.ru/js/ 2 KB
1 KB 54ms
54ms Script
application/javascript 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/js/tgbnr.js?2020120603
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: d7b6ed9e8166c815f86b056bb3caa013f5ac25dd030cc17ebe1b3fc2ebf06bbb

Request headers

:path: /js/tgbnr.js?2020120603
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
last-modified: Sun, 06 Dec 2020 21:34:14 GMT
server: nginx
etag: W/"5fcd4e56-670"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 top01.gif
www.profinance.ru/img/ 7 KB
8 KB 48ms
45ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/top01.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 07878131250c810ce67539c1e45c5930389a0609a97edd176ae3806f9276f293

Request headers

:path: /img/top01.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-1dd8"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 7640
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 top03.gif
www.profinance.ru/img/ 1 KB
1 KB 49ms
44ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/top03.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 9b64a3adaddf9e73cc1ba8465732e00807a306d0ab4c2fe3d49a207b27e7d890

Request headers

:path: /img/top03.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-475"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1141
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 ftl.js Show response
informers.forexpf.ru/internal/ 2 KB
636 B 294ms
66ms Script
text/javascript 81.177.34.136
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://informers.forexpf.ru/internal/ftl.js
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server: 81.177.34.136 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 9cc283c43be4ed22a91bb3fcd1d3fb594bd32248700b0e00c00c319ff2499f64

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
server: nginx/1.20.1
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
content-language: ru

GET
H2 200 ulang.gif
www.profinance.ru/img/ 68 B
287 B 49ms
45ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/ulang.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 273ba0c52e57a5c00ec7e68d64c13805cf735edee215ae624b0df5c01979de4a

Request headers

:path: /img/ulang.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-44"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 68
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 ugolt.gif
www.profinance.ru/img/ 77 B
296 B 49ms
44ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/ugolt.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 09cb736cb51c04a9c25e66bc769097be3b6aee29e7a8a9b2250344cca527c210

Request headers

:path: /img/ugolt.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-4d"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 77
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 sp.gif
www.profinance.ru/img/ 43 B
262 B 49ms
44ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/sp.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

:path: /img/sp.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-2b"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 43
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2

200

counter2
top-fwz1.mail.ru/
Redirect Chain

https://top-fwz1.mail.ru/counter?id=74564;t=556;l=1
https://top-fwz1.mail.ru/counter2?id=74564;t=556;l=1

2 KB
3 KB

54ms
54ms

Image
image/gif

217.69.133.145
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://top-fwz1.mail.ru/counter2?id=74564;t=556;l=1

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),

Reverse DNS

top-fwz1.mail.ru

Software

nginx /

Resource Hash

8f58a007d9628ad26386926f331940d636e6e7ffec8d91f3a3d33236b5d9eec2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
x-content-type-options: nosniff
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length: 2473
pragma: no-cache
amp-access-control-allow-source-origin: *
server: nginx
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: private, no-cache, no-store, max-age=0
access-control-allow-credentials: true
accept-ch-lifetime: 86400
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
timing-allow-origin: *
access-control-allow-headers: *

Redirect headers

date: Tue, 12 Oct 2021 16:32:52 GMT
x-content-type-options: nosniff
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length: 0
pragma: no-cache
amp-access-control-allow-source-origin: *
server: nginx
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
location: https://top-fwz1.mail.ru/counter2?id=74564;t=556;l=1
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: private, no-cache, no-store, max-age=0
access-control-allow-credentials: true
accept-ch-lifetime: 86400
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 dotv.gif
www.profinance.ru/img/ 43 B
262 B 50ms
45ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/dotv.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: e56916a41fd9c332af2b9eeaf98126db892a2be83d85b3bbaffdf828be2f2fc2

Request headers

:path: /img/dotv.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-2b"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 43
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 dotg.gif
www.profinance.ru/img/ 43 B
262 B 49ms
45ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/dotg.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 8ed705aab168de2a691e736e320622de21c10361048111100d539a75e3a8101e

Request headers

:path: /img/dotg.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-2b"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 43
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 dotgrey.gif
www.profinance.ru/img/ 43 B
262 B 48ms
45ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/dotgrey.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: bfd21dab62097e79d0a8736b29a340243e73d1472d427742117cd299f64461ee

Request headers

:path: /img/dotgrey.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-2b"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 43
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 profinance.js Show response
www.profinance.ru/js/ 5 KB
745 B 43ms
42ms Script
application/javascript 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/js/profinance.js?6
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 21be95910910148502d7064d8f8028d0424b88cc34a07858a433e48ed64c4bbf

Request headers

:path: /js/profinance.js?6
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
last-modified: Fri, 22 Jan 2021 12:41:42 GMT
server: nginx
etag: W/"600ac806-12df"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 EURUSD_A.gif
www.profinance.ru/img/ 140 B
360 B 49ms
45ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/EURUSD_A.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 7b82d70c7d4367a40c2ce524867410716831c036c90d5614561b513a7c4e4775

Request headers

:path: /img/EURUSD_A.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Wed, 01 Apr 2020 13:45:08 GMT
server: nginx
etag: "5e849ae4-8c"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 140
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 kot2razd.gif
www.profinance.ru/img/ 45 B
264 B 49ms
46ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/kot2razd.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 99297d3ca7b65b05d85e5a1f33e9685962430730b2736d628ad8cf01323266b2

Request headers

:path: /img/kot2razd.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-2d"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 45
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 GBPUSD.gif
www.profinance.ru/img/ 139 B
359 B 50ms
46ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/GBPUSD.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: a41a08961f5d7e2efc5048aaaa95fccf73212484b5eb95880edcdcf5aab6dc86

Request headers

:path: /img/GBPUSD.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-8b"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 139
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 USDCHF.gif
www.profinance.ru/img/ 135 B
355 B 50ms
47ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/USDCHF.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 183732f738678d361ae726869c4464577519acbbb8f1d73dea5acbf3cd7c09d8

Request headers

:path: /img/USDCHF.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-87"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 135
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 USDJPY.gif
www.profinance.ru/img/ 136 B
356 B 49ms
46ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/USDJPY.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: dfdac8d559ad6777c9d1cfab6038b05e4b5a8f38e15963e8708c5545f0f40866

Request headers

:path: /img/USDJPY.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-88"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 136
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 kotfix.gif
www.profinance.ru/img/ 54 B
273 B 49ms
46ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/kotfix.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 4428fa8a11efdc34826dd51d4e75030b868039b258d3854f45b1222e1794bb1b

Request headers

:path: /img/kotfix.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-36"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 54
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 graphgen-01.gif
www.profinance.ru/ic/ 2 KB
2 KB 91ms
88ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/ic/graphgen-01.gif?rnd=288280762
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 3e7581a56d46ce0dcc8549755ecdceff9ee8f5039dbea9380fe328722101bec8

Request headers

:path: /ic/graphgen-01.gif?rnd=288280762
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Tue, 12 Oct 2021 16:32:51 GMT
server: nginx
etag: "6165b8b3-6a4"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1700
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 USDRUB.gif
www.profinance.ru/img/ 139 B
359 B 90ms
87ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/USDRUB.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: dae6ffaec90ebdf8d644e69c53b5773def35e0f2ffba2b55492ff35ce37ee48a

Request headers

:path: /img/USDRUB.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Wed, 01 Apr 2020 14:35:51 GMT
server: nginx
etag: "5e84a6c7-8b"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 139
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 EURRUB.gif
www.profinance.ru/img/ 140 B
360 B 91ms
88ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/EURRUB.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 46f16a08e79604e878917477b6d17e0a00d3bc2b07a5f3bb9d4c5274f3fbe6d2

Request headers

:path: /img/EURRUB.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Wed, 01 Apr 2020 14:37:04 GMT
server: nginx
etag: "5e84a710-8c"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 140
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 BRENT.gif
www.profinance.ru/img/ 121 B
341 B 94ms
91ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/BRENT.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 4688af76f0aa4851953c45d5f4472b4328d046c0e5214de1502c79c6409948d9

Request headers

:path: /img/BRENT.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Wed, 01 Apr 2020 14:20:29 GMT
server: nginx
etag: "5e84a32d-79"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 121
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 GOLD.gif
www.profinance.ru/img/ 112 B
332 B 91ms
88ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/GOLD.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: c0489ecb12247fa7c6305949de4d92dba7e183559f236f28a3c449fddca5f52c

Request headers

:path: /img/GOLD.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Fri, 10 Apr 2020 11:07:36 GMT
server: nginx
etag: "5e905378-70"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 112
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 lmenu4.gif
www.profinance.ru/img/ 131 B
351 B 90ms
87ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/lmenu4.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: b72dce7fd4e527c1ce955795e14a8fc87395f8460eeb4790eb36e656d199edc9

Request headers

:path: /img/lmenu4.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-83"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 131
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 on-ready.js Show response
www.profinance.ru/js/ 567 B
601 B 92ms
89ms Script
application/javascript 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.profinance.ru/js/on-ready.js
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 5f8a6e6ed3d25c671cff494344b9b30fdad846dfe411fd22de4588640a31ff0c

Request headers

:path: /js/on-ready.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
last-modified: Thu, 20 Dec 2018 05:59:36 GMT
server: nginx
etag: W/"5c1b2fc8-237"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=2592000
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 watch.js Show response
mc.yandex.ru/metrika/ 131 KB
47 KB 131ms
65ms Script
application/javascript 93.158.134.119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/watch.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.158.134.119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

mc.yandex.ru

Software

Resource Hash

d5c91393fc42ed4d1234c6180d0bd54ab46c10bcac71822415902d5cec48163f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: br
last-modified: Tue, 12 Oct 2021 15:49:43 GMT
etag: "61658467-b968"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
content-length: 47464
expires: Tue, 12 Oct 2021 17:32:52 GMT

GET
H2 200 95a33e008a6495dbcd1a.js Show response
yastatic.net/partner-code-bundles/44818/ 13 KB
5 KB 32ms
32ms Script
text/javascript 178.154.131.215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/44818/95a33e008a6495dbcd1a.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.154.131.215 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

static.yandex.net

Software

nginx/1.17.9 /

Resource Hash

25da2450215ad8c9865f1c471ec5d8084c6b23b3e0947ea535bb5f62e8b3a97e

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.profinance.ru/
Origin: https://www.profinance.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: br
vary: Accept-Encoding
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 4465
last-modified: Tue, 12 Oct 2021 15:15:09 GMT
server: nginx/1.17.9
etag: "cf1b5a16acb815df9b37b663f0ce294e"
x-robots-tag: noindex, noarchive, nofollow
strict-transport-security: max-age=43200000; includeSubDomains;
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Oct 2051 23:03:53 GMT

GET
H2 200 ff571ec1d8627fa538c3.js Show response
yastatic.net/partner-code-bundles/44818/ 81 KB
18 KB 46ms
45ms Script
text/javascript 178.154.131.215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/44818/ff571ec1d8627fa538c3.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.154.131.215 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

static.yandex.net

Software

nginx/1.17.9 /

Resource Hash

85d0dc470dd897e40017aa85458b19d2df92a102dc6c28682a5d65b47860f79e

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.profinance.ru/
Origin: https://www.profinance.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: br
vary: Accept-Encoding
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 17432
last-modified: Tue, 12 Oct 2021 15:15:10 GMT
server: nginx/1.17.9
etag: "218403db84233a1186b32bb187a6fb98"
x-robots-tag: noindex, noarchive, nofollow
strict-transport-security: max-age=43200000; includeSubDomains;
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Oct 2051 23:03:54 GMT

GET
H2 200 host.js Show response
yastatic.net/safeframe-bundles/0.82/ 33 KB
9 KB 88ms
86ms Script
text/javascript 178.154.131.215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/safeframe-bundles/0.82/host.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.154.131.215 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

static.yandex.net

Software

nginx/1.17.9 /

Resource Hash

10c861bc88c25be1f3ee98f7652bc7fbb35857f42f923e00c6037b757c77685e

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.profinance.ru/
Origin: https://www.profinance.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: br
vary: Accept-Encoding
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 8879
last-modified: Mon, 28 Jun 2021 10:29:24 GMT
server: nginx/1.17.9
etag: "e4627697ff619d2b610d2b2fee975531"
x-robots-tag: noindex, noarchive, nofollow
strict-transport-security: max-age=43200000; includeSubDomains;
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Oct 2051 23:05:11 GMT

GET
H2 200 763bdb5d6503f351841a.js Show response
yastatic.net/partner-code-bundles/44818/ 948 KB
155 KB 63ms
63ms Script
text/javascript 178.154.131.215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/44818/763bdb5d6503f351841a.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.154.131.215 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

static.yandex.net

Software

nginx/1.17.9 /

Resource Hash

1609b5fa0f50d166f1e5bb5739a755104cb9f453ac531e13e524e5c8362c89af

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.profinance.ru/
Origin: https://www.profinance.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: br
vary: Accept-Encoding
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 157699
last-modified: Tue, 12 Oct 2021 15:15:09 GMT
server: nginx/1.17.9
etag: "52d15b055c0fe7acc8ec0f6462c1ff7e"
x-robots-tag: noindex, noarchive, nofollow
strict-transport-security: max-age=43200000; includeSubDomains;
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Oct 2051 23:03:54 GMT

GET
H2 200 2c81340b6793d7c2cfdc.js Show response
yastatic.net/partner-code-bundles/44818/ 337 KB
62 KB 91ms
91ms Script
text/javascript 178.154.131.215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/44818/2c81340b6793d7c2cfdc.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.154.131.215 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

static.yandex.net

Software

nginx/1.17.9 /

Resource Hash

2a91ee232d3833bef91e94c1f957cf2384f67f098d4c0abca935cf3689d3eb9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://www.profinance.ru/
Origin: https://www.profinance.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: br
vary: Accept-Encoding
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 62540
last-modified: Tue, 12 Oct 2021 15:15:09 GMT
server: nginx/1.17.9
etag: "18073baa3747107ffe6f165c67c217ad"
x-robots-tag: noindex, noarchive, nofollow
strict-transport-security: max-age=43200000; includeSubDomains;
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Oct 2051 23:03:54 GMT

GET
H2

200

sspmatch-js Show response
ads.betweendigital.com/
Redirect Chain

https://ads.betweendigital.com/sspmatch-js?p=43185&randsalt=9573762198
https://ads.betweendigital.com/sspmatch-js?p=43185&randsalt=9573762198&crf=1

882 B
980 B

103ms
103ms

Script
text/javascript

96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.betweendigital.com/sspmatch-js?p=43185&randsalt=9573762198&crf=1
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 9c844ff634fba01687deb75f6100bb9aac81a1a9978286f08e15a47f2c6daceb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 882
content-type: text/javascript

Redirect headers

location: /sspmatch-js?p=43185&randsalt=9573762198&crf=1
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H2 200 top01bg.gif
www.profinance.ru/img/ 572 B
793 B 94ms
92ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/top01bg.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 92b73c1401907b7e391360b9e7bb79de1d2f25896649434a0eb36d72cbb43210

Request headers

:path: /img/top01bg.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-23c"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 572
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 top02bg.gif
www.profinance.ru/img/ 10 KB
11 KB 90ms
89ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/top02bg.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: b0866549b1f1e9ba2859efe300f0ff9754b30146182f7fe4e169d696bfb02851

Request headers

:path: /img/top02bg.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-29a5"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 10661
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 top03bg.gif
www.profinance.ru/img/ 1 KB
1 KB 91ms
90ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/top03bg.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 65c1eec846990c5831250ac37e698c949675bbdce85f99a0f8be29193f022892

Request headers

:path: /img/top03bg.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-512"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1298
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 langbg3.gif
www.profinance.ru/img/ 43 B
262 B 90ms
90ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/langbg3.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 8d95bff25156e15e179589e93e70867ffcb65e4ff16834088bfb995f69b2f9f8

Request headers

:path: /img/langbg3.gif
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-2b"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 43
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 76ms
23ms Script
text/javascript 142.250.185.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f8.1e100.net

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 28 Sep 2021 21:34:48 GMT
server: Golfe2
age: 5725
date: Tue, 12 Oct 2021 14:57:27 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Tue, 12 Oct 2021 16:57:27 GMT

GET
H2 200 code.js Show response
top-fwz1.mail.ru/js/ 25 KB
11 KB 288ms
81ms Script
application/javascript 217.69.133.145
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to

Full URL

https://top-fwz1.mail.ru/js/code.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),

Reverse DNS

top-fwz1.mail.ru

Software

nginx /

Resource Hash

536cd983c5ac840349770984405fe9eb9e67b9d7e35e0c45673a653b003173b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
amp-access-control-allow-source-origin: *
last-modified: Thu, 15 Jul 2021 18:35:46 GMT
server: nginx
etag: W/"60f08002-64db"
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: max-age=3600, private
access-control-allow-credentials: true
accept-ch-lifetime: 86400
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
timing-allow-origin: *
access-control-allow-headers: *
expires: Tue, 12 Oct 2021 17:32:52 GMT

GET
H/1.1

200
OK

hit
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit?t29.3;r;s1600*1200*24;uhttps%3A//www.profinance.ru/;0.1492175597702916
https://counter.yadro.ru/hit?q;t29.3;r;s1600*1200*24;uhttps%3A//www.profinance.ru/;0.1492175597702916

748 B
1 KB

49ms
49ms

Image
image/gif

88.212.201.210
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit?q;t29.3;r;s1600*1200*24;uhttps%3A//www.profinance.ru/;0.1492175597702916

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

88.212.201.210 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

6287e00b9f91a82119167e184f7e4443a8cb7ee40369d044644501a321a052bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Oct 2021 16:32:52 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin: *
Cache-control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 748
Expires: Sun, 11 Oct 2020 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 12 Oct 2021 16:32:52 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Location: https://counter.yadro.ru/hit?q;t29.3;r;s1600*1200*24;uhttps%3A//www.profinance.ru/;0.1492175597702916
Cache-control: no-cache
Connection: keep-alive
Content-Type: text/html
Content-Length: 32
Expires: Sun, 11 Oct 2020 21:00:00 GMT

GET
H2 200 context.js Show response
an.yandex.ru/system/ 300 KB
80 KB 233ms
41ms Script
text/javascript 87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/system/context.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

aecbb63237c11caa18f9c0dc4310b902cf4aba5a1e43b2faf71a229805a5b3bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
strict-transport-security: max-age=31536000
content-encoding: br
etag: 2665959140
x-yandex-req-id: 1634056372832710-984416348045404995800348-production-app-host-man-pcode-67
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=3600
x-robots-tag: noindex, noarchive, nofollow
expires: Tue, 12 Oct 2021 17:32:52 GMT

GET
H2 200 bgkot2.gif
www.profinance.ru/img/ 49 B
268 B 55ms
55ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/bgkot2.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: e0371710b9ebdb4886d7e854b54fa3cbf606b7b9cefff78a01c9175a0174baca

Request headers

:path: /img/bgkot2.gif
pragma: no-cache
cookie: user_yndxpfs_ablc=null
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-31"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 49
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 bgwhite.gif
www.profinance.ru/img/ 49 B
268 B 57ms
57ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/bgwhite.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 7df5774ffcccb6de91ea0c3e95ea530c054c80d1150c517bd2b9920e9b3c3ace

Request headers

:path: /img/bgwhite.gif
pragma: no-cache
cookie: user_yndxpfs_ablc=null
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-31"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 49
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 bgkot1.gif
www.profinance.ru/img/ 49 B
268 B 58ms
58ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/bgkot1.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 1424ef028f97cd5d48afe88370d0a83d59d96f69f8181bc3c48dbcfba0a228c4

Request headers

:path: /img/bgkot1.gif
pragma: no-cache
cookie: user_yndxpfs_ablc=null
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-31"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 49
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 bgbej.gif
www.profinance.ru/img/ 49 B
268 B 57ms
57ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/bgbej.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: ecc05c55d6e7c828b235348fb0780e48361aaee003dfc79f9fd51f9879a5347f

Request headers

:path: /img/bgbej.gif
pragma: no-cache
cookie: user_yndxpfs_ablc=null
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-31"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 49
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 bgdown.gif
www.profinance.ru/img/ 49 B
268 B 57ms
57ms Image
image/gif 81.177.34.158
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.profinance.ru/img/bgdown.gif
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.34.158 Moscow, Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS
Software: nginx /
Resource Hash: ea418f0311393888cfee5111296147ec5be28a407f6a213d192d400cbb2f8250

Request headers

:path: /img/bgdown.gif
pragma: no-cache
cookie: user_yndxpfs_ablc=null
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.profinance.ru
referer: https://www.profinance.ru/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Mon, 16 Apr 2018 10:48:15 GMT
server: nginx
etag: "5ad47f6f-31"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 49
x-conf: www-to-news1
x-location: static
expires: Thu, 11 Nov 2021 16:32:52 GMT

GET
H2 200 9524 Show response
an.yandex.ru/meta/ 88 KB
27 KB 383ms
234ms XHR
application/json 87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/meta/9524?target-ref=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&pcode-test-ids=431004%2C0%2C94%3B428759%2C0%2C16%3B434271%2C0%2C72%3B436349%2C0%2C71%3B430931%2C0%2C52%3B435231%2C0%2C72%3B400735%2C0%2C36%3B428463%2C0%2C85%3B433499%2C0%2C25%3B433508%2C0%2C17%3B435773%2C0%2C9&pcode-flags-map=%7B%22ENABLE_CODECS_WHITELIST%22%3A%5B%7B%22value%22%3A%22TRUE%22%2C%22testId%22%3A%22429059%22%7D%5D%2C%22DISABLE_DEFAULT_THEME_EMPTY_DURATION%22%3A%5B%7B%22value%22%3A%22TRUE%22%2C%22testId%22%3A%22429073%22%7D%5D%2C%22MEDIA_FILE_BITRATE_PRIORITY_FACTOR%22%3A%5B%7B%22value%22%3A%220.000001%22%2C%22testId%22%3A%22429074%22%7D%5D%2C%22VOLUME_BUTTON_ANIMATION%22%3A%5B%7B%22value%22%3A%22ENABLE%22%2C%22testId%22%3A%22429077%22%7D%5D%2C%22UNIFORMAT%22%3A%5B%7B%22value%22%3A%22ENABLE%22%2C%22testId%22%3A%22429079%22%7D%5D%2C%22CHANGE_CLICK_THROUGH_LOGIC%22%3A%5B%7B%22value%22%3A%22ACTION_BUTTON_PRIORITY%22%2C%22testId%22%3A%22432722%22%7D%5D%2C%22VAS_STABLE_VERSION%22%3A%5B%7B%22value%22%3A%22434485%22%2C%22testId%22%3A%22435340%22%7D%5D%2C%22ADFOX_MRC_VISIBILITY_ON_CLICK%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22427330%22%7D%5D%2C%22UNILOADER_FOR_AMP%22%3A%5B%7B%22value%22%3Atrue%2C%22testId%22%3A%22428390%22%7D%5D%2C%22USE_SSR_IN_AMP%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22428390%22%7D%5D%2C%22FULL_SSR_PERCENT_LOG_META%22%3A%5B%7B%22value%22%3A0.0001%2C%22testId%22%3A%22435450%22%7D%5D%2C%22DEFAULT_SSR_FORMATS%22%3A%5B%7B%22value%22%3A%5B%22zen%22%2C%22zen2%22%2C%22zen2-gallery%22%2C%22billboard%22%2C%22horizontal%22%2C%22horizontal0318%22%2C%22adaptiveConstructor%22%2C%22modernAdaptive%22%2C%22posterCarousel%22%2C%22adaptiveCarousel%22%2C%22smart_tile%22%5D%2C%22testId%22%3A%22435450%22%7D%5D%2C%22RTB_BANNER_FLAGS%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22435450%22%7D%5D%2C%22HBVER%22%3A%5B%7B%22value%22%3A42153%2C%22testId%22%3A%22435450%22%7D%5D%2C%22DECODE_VAST%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22432455%22%7D%5D%2C%22RMP_SEND_BEACON%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22433605%22%7D%5D%2C%22ADFOX_MRC_VISIBILITY_BY_OWNER%22%3A%5B%7B%22value%22%3A%5B168627%2C259055%2C258881%2C354188%2C239538%2C235076%2C264443%2C374320%5D%2C%22testId%22%3A%22435688%22%7D%5D%2C%22REMOVE_GRAB_LIMIT_OTHER%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22434001%22%7D%5D%2C%22AD_SEEN_OBSERVER%22%3A%5B%7B%22value%22%3A%22enable%22%2C%22testId%22%3A%22436297%22%7D%5D%2C%22DISABLE_144P_QUALITY%22%3A%5B%7B%22value%22%3A%22FALSE%22%2C%22testId%22%3A%22431004%22%7D%5D%2C%22TEST_EXP_VAS_CONFIG_IN_PCODE%22%3A%5B%7B%22value%22%3A%22EXP%22%2C%22testId%22%3A%22428759%22%7D%5D%2C%22WIDGET_IN_PCODE%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22434271%22%7D%5D%2C%22REACALCULATES_HEIGHT_IF_IFRAME%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22436349%22%7D%5D%2C%22INPAGE_LOAD_MODULE_DIRECT%22%3A%5B%7B%22value%22%3A%22ctl%22%2C%22testId%22%3A%22430931%22%7D%5D%2C%22FIXED_FORMAT_RENDER%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22435231%22%7D%5D%2C%22GLOBAL_SIZE_INFO%22%3A%5B%7B%22value%22%3Atrue%2C%22testId%22%3A%22400735%22%7D%5D%2C%22ADFOX_AVAILABLE_SIZE%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22428463%22%7D%5D%2C%22PCODEVER%22%3A%5B%7B%22value%22%3A%2244781%22%2C%22testId%22%3A%22435773%22%7D%5D%7D&server-side-rendering-enabled-formats=zen%0Azen2%0Azen2-gallery%0Abillboard%0Ahorizontal%0Ahorizontal0318%0AadaptiveConstructor%0AmodernAdaptive%0AposterCarousel%0AadaptiveCarousel%0Asmart_tile&price-disabled-formats=adaptive0418%0Aadaptive%0AmodernAdaptive%0Ahorizontal%0Ahorizontal0318%0Agrid%0A160x600%0A240x400%0A200x300%0A300x300%0A300x250%0A250x250%0A728x90%0A1000x120%0A320x50%0A320x100%0A400x240%0A320x480%0A480x320%0A336x280%0A300x600%0A300x500%0A970x250%0A970x90&raw-smart-content=1&smart-format-names=smart-banner-adaptive_v1%0Asmart-banner-mosaic_v1&pcode-icookie=6mzc8v0t1VyWFWQXb9xD7TY3Mwg5AT5ESVisLv7QkbpxxWHiIIfyzFxCq8w9slt37KmHLgV7j945sJ3MgaiSrCGufSo%3D&imp-id=70&enable-flat-highlight=1&comboblock-unencoded-vast=1&test-tag=432159609323522&ad-session-id=1419741634056372648&target-id=84048583&tga-with-creatives=1&pcode-version=44818&pcodever=44818&flash-ver=0&available-width=240&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22quirks%22%3Atrue%2C%22w%22%3A240%2C%22h%22%3A0%2C%22width%22%3A240%2C%22height%22%3A0%2C%22visible%22%3A1%2C%22left%22%3A1345%2C%22top%22%3A740%2C%22fontFamily%22%3A%22roboto%22%2C%22ad_no%22%3A0%2C%22req_no%22%3A0%7D&grab-orig-len=1028&grab=dNCk0L7RgNC10LrRgSDQvdCwIFByb0ZpbmFuY2UuUnUuINCa0YPRgNGB0Ysg0LLQsNC70Y7Rgi4g0J_RgNC-0LPQvdC-0LfRiyDQstCw0LvRjtGC0L3QvtCz0L4g0YDRi9C90LrQsC4KMiDQoNC10LTQsNC60YbQuNGPIMK3INCg0LXQutC70LDQvNCwIMK3INCa0L7QvdGC0LDQutGC0YsgCjIg0JrQvtGC0LjRgNC-0LLQutC4IMK3INCa0L7RgtC40YDQvtCy0LrQuCDQvtC90LvQsNC50L0gwrcg0JPRgNCw0YTQuNC60Lggwrcg0JPRgNCw0YTQuNC60Lgg0L7QvdC70LDQudC9IMK3INCY0L3RhNC-0YDQvNC10YDRiyAtINCa0YPRgNGBINCy0LDQu9GO0YIg0KbQkSDQuCDQpNC-0YDQtdC60YEgCjIg0JrQvtGC0LjRgNC-0LLQutC4INCy0LDQu9GO0YIgwrcg0JrRg9GA0YEg0LTQvtC70LvQsNGA0LAg0Log0YDRg9Cx0LvRjiDCtyDQmtGD0YDRgSDQtdCy0YDQviDQuiDRgNGD0LHQu9GOIMK3INCa0YPRgNGB0Ysg0LLQsNC70Y7RgiDQuiDRgNGD0LHQu9GOIMK3INCa0L7RgtC40YDQvtCy0LrQuCDQsNC60YbQuNC5IMK3INCd0LXRhNGC0Ywgwrcg0JfQvtC70L7RgtC-IMK3INCR0LjRgtC60L7QuNC9IMK3INCd0LXRhNGC0YwgVXJhbHMgCjIg0JDRgNGF0LjQsiDQvdC-0LLQvtGB0YLQtdC5INCy0LDQu9GO0YLQvdC-0LPQviDQuCDRhNC-0L3QtNC-0LLQvtCz0L4g0YDRi9C90LrQsCDCtyDQkNGA0YXQuNCyINGN0LrQvtC90L7QvNC40YfQtdGB0LrQuNGFINC90L7QstC-0YHRgtC10Lkg0Lgg0YHQvtCx0YvRgtC40LkgCjIg0KTQvtGA0LXQutGBINCk0L7RgNGD0LwgCg%3D%3D&uniformat=true&callback=Ya%5B5377120464010%5D

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

9ce844350a4c873b7e169ce553b0a02b2e4e266b0e32f5692530fc6fc14ac727

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
x-yandex-req-id: 1634056372842952-1130261203783678738800350-production-app-host-vla-pcode-213
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
uniformat-product-type: Direct
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 12 Oct 2021 16:32:52 GMT
strict-transport-security: max-age=31536000
content-type: application/json
access-control-allow-origin: https://www.profinance.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
uniformat: true
expires: Tue, 12 Oct 2021 16:32:52 GMT

GET
H2 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110050101/ 272 KB
98 KB 50ms
50ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110050101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2822498309427835&plah=www.profinance.ru

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

e898396a63a31caead5610be17a0d5e1465f251e8f7dd0f1df02f144ff5c81d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 99725
x-xss-protection: 0
server: cafe
etag: 18043168443402353962
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 12 Oct 2021 16:32:52 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211007/r20190131/ Frame ECA9 10 KB
5 KB 51ms
14ms Document
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211007/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

f694b4fc5d667777e89694296218e249226ae1670bbe90a8a345f9f75298b9cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20211007/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.profinance.ru/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 11 Oct 2021 19:09:45 GMT
expires: Mon, 25 Oct 2021 19:09:45 GMT
content-type: text/html; charset=UTF-8
etag: 414810510046348021
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4645
x-xss-protection: 0
age: 76987
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2

400

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9424.DYj4I62ZNPq9zcX07g-EPfZOAsrmSgMCUSwURKjiXfWyzDBMWpSHTw0meflt39aL.w3X_hGehNS3OotVmcxpeCIY7uDE%2C
https://mc.yandex.com/sync_cookie_image_decide?token=9424.3Syq0oISfKVTVHVFhBTJMuJylXfUthJ5QqUYYYv5qInIysIcIdjZL54re-2cq0npIDZH6twCGULlxzZUCH5Pdg%2C%2C.OjLfeEI9xN0TxiQyu_lWWq4_kf8%2C

75 B
75 B

32ms
32ms

Image
text/html

93.158.134.119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=9424.3Syq0oISfKVTVHVFhBTJMuJylXfUthJ5QqUYYYv5qInIysIcIdjZL54re-2cq0npIDZH6twCGULlxzZUCH5Pdg%2C%2C.OjLfeEI9xN0TxiQyu_lWWq4_kf8%2C

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.158.134.119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

mc.yandex.ru

Software

Resource Hash

8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
strict-transport-security: max-age=31536000
content-length: 75
x-xss-protection: 1; mode=block
content-type: text/html; charset=utf-8

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=9424.3Syq0oISfKVTVHVFhBTJMuJylXfUthJ5QqUYYYv5qInIysIcIdjZL54re-2cq0npIDZH6twCGULlxzZUCH5Pdg%2C%2C.OjLfeEI9xN0TxiQyu_lWWq4_kf8%2C
date: Tue, 12 Oct 2021 16:32:52 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
112 B 36ms
32ms Image
image/gif 93.158.134.119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.158.134.119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

mc.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
last-modified: Tue, 12 Oct 2021 15:49:43 GMT
etag: "61658467-2b"
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Tue, 12 Oct 2021 17:32:52 GMT

GET
H2 200 getcookie Show response
matchid.adfox.yandex.ru/ 88 B
374 B 174ms
55ms XHR
application/json 93.158.134.118
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://matchid.adfox.yandex.ru/getcookie

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/header-bidding.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

93.158.134.118 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

matchid-production.adfox.yandex.ru

Software

Resource Hash

81760ba367557b7bdaae6ac5590021e8cef8af4717fd27193fa6e229fcd92c70

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin: https://www.profinance.ru
date: Tue, 12 Oct 2021 16:32:53 GMT
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 88
x-content-type-options: nosniff
content-type: application/json

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ 119 KB
39 KB 59ms
30ms Script
text/javascript 178.250.2.130
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.js
Requested by: Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/header-bidding.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: 808ecd508fafb1836f5a350eb2165824e8130f96ba29e1b35d9d473d8b13708e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
content-encoding: gzip
last-modified: Mon, 04 Oct 2021 12:34:27 GMT
server: nginx
etag: W/"615af4d3-1dd0f"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 13 Oct 2021 16:32:52 GMT

POST
H2 204 bids Show response
adfox-c2s-ams.creativecdn.com/bidder/adfox/ 0
211 B 50ms
17ms XHR
application/json 185.184.8.65
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://adfox-c2s-ams.creativecdn.com/bidder/adfox/bids
Requested by: Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/header-bidding.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.65 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-65.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.profinance.ru
date: Tue, 12 Oct 2021 16:32:52 GMT
access-control-allow-credentials: true
access-control-max-age: 3600
vary: Origin
access-control-allow-methods: POST
content-type: application/json;charset=utf-8

POST
H2

200

yandex_hb Show response
px.adhigh.net/rtb/
Redirect Chain

https://px.adhigh.net/rtb/yandex_hb
https://px.adhigh.net/rtb/yandex_hb?bounced=1

11 B
320 B

48ms
47ms

XHR
application/json

193.232.148.151
UMA-TECH-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://px.adhigh.net/rtb/yandex_hb?bounced=1
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 193.232.148.151 , Russian Federation, ASN48061 (UMA-TECH-AS, RU),
Reverse DNS: smtp12.sender.ltmse.com
Software: nginx /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
server: nginx
x-backend-id: f12-ru
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
access-control-allow-origin: https://www.profinance.ru
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 11
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
server: nginx
access-control-allow-origin: https://www.profinance.ru
x-backend-id: f12-ru
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://px.adhigh.net/rtb/yandex_hb?bounced=1
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 / Show response
ad.mail.ru/hbid_yandex/ 11 B
193 B 202ms
104ms XHR
application/json 94.100.180.197
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.mail.ru/hbid_yandex/
Requested by: Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/header-bidding.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 94.100.180.197 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),
Reverse DNS: r.mail.ru
Software: nginx /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.profinance.ru
date: Tue, 12 Oct 2021 16:32:53 GMT
cache-control: private, no-cache, no-store
access-control-allow-credentials: true
server: nginx
timing-allow-origin: *
content-type: application/json

POST
H2 200 adjson Show response
ads.betweendigital.com/ 11 B
922 B 103ms
102ms XHR
application/json 96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.betweendigital.com/adjson?t=adfox
Requested by: Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/header-bidding.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.profinance.ru
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json

POST
H2 200 yhb Show response
yhb.p.otm-r.com/ 11 B
254 B 59ms
23ms XHR
text/plain 195.201.57.28
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://yhb.p.otm-r.com/yhb
Requested by: Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/header-bidding.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 195.201.57.28 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.28.57.201.195.clients.your-server.de
Software: nginx/1.17.0 /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.profinance.ru
date: Tue, 12 Oct 2021 16:32:52 GMT
access-control-allow-credentials: true
server: nginx/1.17.0
content-length: 11
vary: Origin
content-type: text/plain; charset=utf-8

POST
H2

200

adfox Show response
exchange.buzzoola.com/ssp/
Redirect Chain

https://exchange.buzzoola.com/ssp/adfox
https://exchange.buzzoola.com/ssp/adfox?set_buzzoola_cookie=t

11 B
321 B

80ms
80ms

XHR
text/plain

49.12.83.94
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://exchange.buzzoola.com/ssp/adfox?set_buzzoola_cookie=t
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 49.12.83.94 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.94.83.12.49.clients.your-server.de
Software: nginx /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:53 GMT
server: nginx
serverid: TODO
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://www.profinance.ru
access-control-expose-headers: Set-Cookie, Etag
access-control-allow-credentials: true
access-control-allow-headers: Set-Cookie, X-Alt-Referer, X-First-Party-Cookie, If-None-Match
content-length: 11

Redirect headers

date: Tue, 12 Oct 2021 16:32:52 GMT
server: nginx
access-control-allow-origin: https://www.profinance.ru
etag: W/"76ae4778a56553b1df35970afaccd2490f295cf64a581933b35bb7f9caef66dd"
serverid: TODO
location: /ssp/adfox?set_buzzoola_cookie=t
access-control-expose-headers: Set-Cookie, Etag
access-control-allow-credentials: true
access-control-allow-headers: Set-Cookie, X-Alt-Referer, X-First-Party-Cookie, If-None-Match
content-length: 0

POST
H/1.1 204
No Content bid.cgi Show response
pb.adriver.ru/cgi-bin/ 0
305 B 261ms
78ms XHR
text/plain 195.209.111.15
ADRIVER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pb.adriver.ru/cgi-bin/bid.cgi
Requested by: Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/header-bidding.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.209.111.15 , Russian Federation, ASN52007 (ADRIVER-AS, RU),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.profinance.ru
Pragma: no-cache
Date: Tue, 12 Oct 2021 16:32:53 GMT
Cache-control: no-cache, max-age=0, must-revalidate, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 counter
top-fwz1.mail.ru/ 43 B
1012 B 42ms
41ms Ping
image/gif 217.69.133.145
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to

Full URL

https://top-fwz1.mail.ru/counter?js=13;id=74564;u=https%3A//www.profinance.ru/;st=1634056372626;title=%D0%A4%D0%BE%D1%80%D0%B5%D0%BA%D1%81%20%D0%BD%D0%B0%20ProFinance.Ru.%20%D0%9A%D1%83%D1%80%D1%81%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82.%20%D0%9F%D1%80%D0%BE%D0%B3%D0%BD%D0%BE%D0%B7%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D1%8B%D0%BD%D0%BA%D0%B0.;s=1600*1200;vp=1600*1662;touch=0;hds=1;frame=0;flash=;sid=a494689d6a797be6;ver=60.3.0;tz=0%2FEtc%2FUnknown;ni=10//4g/0/0/;lvid=1634056372925%3A1634056372932%3A1%3Af606ec10a486d213b4b054cab9aa423f;visible=true;_=0.09972204400415041

Requested by

Host: top-fwz1.mail.ru
URL: https://top-fwz1.mail.ru/js/code.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),

Reverse DNS

top-fwz1.mail.ru

Software

nginx /

Resource Hash

24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 12 Oct 2021 16:32:52 GMT
x-content-type-options: nosniff
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length: 43
pragma: no-cache
amp-access-control-allow-source-origin: https://www.profinance.ru
server: nginx
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: https://www.profinance.ru
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: private, no-cache, no-store, max-age=0
access-control-allow-credentials: true
accept-ch-lifetime: 86400
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
timing-allow-origin: https://www.profinance.ru
access-control-allow-headers: *

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 203 B
660 B 82ms
32ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.profinance.ru&callback=_gfp_s_&client=ca-pub-2822498309427835

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110050101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2822498309427835&plah=www.profinance.ru

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

8dd667af11cc0130c66afea9cfb1deaccc85e2199a7ae682a64372e6177c9584

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 194
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 67ms
27ms Script
application/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.profinance.ru

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Oct 2021 16:32:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 65ms
26ms Script
application/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.profinance.ru

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Oct 2021 16:32:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F3C8 603 B
68 B 76ms
53ms Document
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2822498309427835&output=html&adk=1812271804&adf=3025194257&lmt=1634056324&plat=3%3A32%2C4%3A32%2C9%3A32904%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.profinance.ru%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372818&bpp=2&bdt=616&idt=125&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=782430866943&frm=20&pv=2&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=145

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2822498309427835&output=html&adk=1812271804&adf=3025194257&lmt=1634056324&plat=3%3A32%2C4%3A32%2C9%3A32904%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.profinance.ru%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372818&bpp=2&bdt=616&idt=125&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=782430866943&frm=20&pv=2&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=145
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.profinance.ru/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 12 Oct 2021 16:32:53 GMT
server: cafe
content-length: 46
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Tue, 12-Oct-2021 16:47:53 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 12 Oct 2021 16:32:53 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F5A4 126 KB
38 KB 714ms
701ms Document
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1634056324&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372820&bpp=1&bdt=618&idt=148&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=782430866943&frm=20&pv=2&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=439&ady=717&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=BddfL1LK9N&p=https%3A//www.profinance.ru&dtd=152

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

c948a164d123328b1d641166a63cf9a44f70b3ec7118b71a9a3a091274d7782f

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLXboK2mxfMCFdMg0wodLqkJmg&gqi=tbhlYaQs9rTV8A_Zx5GABA&layout=/sadbundle/%24csp%253Der3%24/3857642822384818841/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1634056324&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372820&bpp=1&bdt=618&idt=148&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=782430866943&frm=20&pv=2&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=439&ady=717&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=BddfL1LK9N&p=https%3A//www.profinance.ru&dtd=152
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.profinance.ru/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLXboK2mxfMCFdMg0wodLqkJmg&gqi=tbhlYaQs9rTV8A_Zx5GABA&layout=/sadbundle/%24csp%253Der3%24/3857642822384818841/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 12 Oct 2021 16:32:53 GMT
server: cafe
content-length: 39208
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Tue, 12-Oct-2021 16:47:53 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 12 Oct 2021 16:32:53 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame CA57 126 KB
38 KB 603ms
594ms Document
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9865432956&adk=870026366&adf=2297262845&pi=t.ma~as.9865432956&w=240&lmt=1634056324&psa=0&format=240x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372821&bpp=1&bdt=619&idt=154&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C580x400&nras=1&correlator=782430866943&frm=20&pv=1&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=1345&ady=67&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=23chL86PX0&p=https%3A//www.profinance.ru&dtd=157

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

42827546cd6c059f627316f12116715faecc908bcfc38aeef06b37a14fed1e7f

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=COzioK2mxfMCFSQ60wodoAcKQg&gqi=tbhlYZcmj8bV8A_c-LbYBQ&layout=/sadbundle/%24csp%253Der3%24/16314837203521364516/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9865432956&adk=870026366&adf=2297262845&pi=t.ma~as.9865432956&w=240&lmt=1634056324&psa=0&format=240x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372821&bpp=1&bdt=619&idt=154&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C580x400&nras=1&correlator=782430866943&frm=20&pv=1&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=1345&ady=67&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=23chL86PX0&p=https%3A//www.profinance.ru&dtd=157
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.profinance.ru/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=COzioK2mxfMCFSQ60wodoAcKQg&gqi=tbhlYZcmj8bV8A_c-LbYBQ&layout=/sadbundle/%24csp%253Der3%24/16314837203521364516/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 12 Oct 2021 16:32:53 GMT
server: cafe
content-length: 39355
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Tue, 12-Oct-2021 16:47:53 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 12 Oct 2021 16:32:53 GMT
cache-control: private

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
190 B 43ms
14ms XHR
text/plain 178.250.2.131
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?ptv=114&profileId=184&cb=92203408422
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.131 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: bidder.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://www.profinance.ru
date: Tue, 12 Oct 2021 16:32:52 GMT
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Finatra
timing-allow-origin: *
vary: Origin

GET
H2

200

1 Show response
mc.yandex.com/watch/9524/
Redirect Chain

https://mc.yandex.com/watch/9524?wmode=7&page-url=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&cnt-class=1&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A4phzp3o2dbm15p1mc%3Afp%3A825%3Afu%3A0%3Aen%3Aut...
https://mc.yandex.com/watch/9524/1?wmode=7&page-url=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&cnt-class=1&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A4phzp3o2dbm15p1mc%3Afp%3A825%3Afu%3A0%3Aen%3A...

167 B
249 B

34ms
34ms

XHR
application/json

93.158.134.119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/9524/1?wmode=7&page-url=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&cnt-class=1&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A4phzp3o2dbm15p1mc%3Afp%3A825%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A660%3Acn%3A1%3Adp%3A0%3Als%3A582181938217%3Ahid%3A854096656%3Az%3A0%3Ai%3A202101012163252%3Aet%3A1634056373%3Ac%3A1%3Arn%3A290245099%3Arqn%3A1%3Au%3A1634056373589262977%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1634056371787%3Ads%3A0%2C90%2C81%2C1%2C240%2C0%2C%2C424%2C1%2C%2C%2C%2C907%3Adsn%3A0%2C90%2C82%2C1%2C241%2C0%2C%2C425%2C2%2C%2C%2C%2C907%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1634056373%3At%3A%D0%A4%D0%BE%D1%80%D0%B5%D0%BA%D1%81%20%D0%BD%D0%B0%20ProFinance.Ru.%20%D0%9A%D1%83%D1%80%D1%81%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82.%20%D0%9F%D1%80%D0%BE%D0%B3%D0%BD%D0%BE%D0%B7%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D1%8B%D0%BD%D0%BA%D0%B0.

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.158.134.119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

mc.yandex.ru

Software

Resource Hash

5910a16b697acfca758539f6a5724f5aefc174b29bdb4e705b475540ac071d3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 12-Oct-2021 16:32:53 GMT
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.profinance.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 167
x-xss-protection: 1; mode=block
expires: Tue, 12-Oct-2021 16:32:53 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
last-modified: Tue, 12-Oct-2021 16:32:53 GMT
location: /watch/9524/1?wmode=7&page-url=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&cnt-class=1&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A4phzp3o2dbm15p1mc%3Afp%3A825%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A660%3Acn%3A1%3Adp%3A0%3Als%3A582181938217%3Ahid%3A854096656%3Az%3A0%3Ai%3A202101012163252%3Aet%3A1634056373%3Ac%3A1%3Arn%3A290245099%3Arqn%3A1%3Au%3A1634056373589262977%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1634056371787%3Ads%3A0%2C90%2C81%2C1%2C240%2C0%2C%2C424%2C1%2C%2C%2C%2C907%3Adsn%3A0%2C90%2C82%2C1%2C241%2C0%2C%2C425%2C2%2C%2C%2C%2C907%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1634056373%3At%3A%D0%A4%D0%BE%D1%80%D0%B5%D0%BA%D1%81%20%D0%BD%D0%B0%20ProFinance.Ru.%20%D0%9A%D1%83%D1%80%D1%81%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82.%20%D0%9F%D1%80%D0%BE%D0%B3%D0%BD%D0%BE%D0%B7%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D1%8B%D0%BD%D0%BA%D0%B0.
strict-transport-security: max-age=31536000
access-control-allow-origin: https://www.profinance.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Tue, 12-Oct-2021 16:32:53 GMT

GET
H2 200 bidder_18.html Show response
cache.betweendigital.com/code/ Frame C712 4 KB
1 KB 80ms
11ms Document
text/html 151.236.118.210
CDNETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.betweendigital.com/code/bidder_18.html?USER_ID=1726420c-09f8-531d-be21-7f82df44c736&CACHEBUSTER=887699
Requested by: Host: ads.betweendigital.com
URL: https://ads.betweendigital.com/sspmatch-js?p=43185&randsalt=9573762198
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 151.236.118.210 Moscow, Russian Federation, ASN204720 (CDNETWORKS, RU),
Reverse DNS
Software: nginx /
Resource Hash: 0efe00c23297e5c56485eabb6ea548c2669b896704fcb2c426d898148543ccad

Request headers

:method: GET
:authority: cache.betweendigital.com
:scheme: https
:path: /code/bidder_18.html?USER_ID=1726420c-09f8-531d-be21-7f82df44c736&CACHEBUSTER=887699
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.profinance.ru/
accept-encoding: gzip, deflate, br
cookie: dc=was1; ss=1; tuuid=ed89d0c0-8635-531d-9b1c-1208fa79aabc; ut=YWW4tAAOgtiYSRWVFfI3f02UJyJffMJg2HAztA==; unm=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

server: nginx
date: Tue, 12 Oct 2021 16:32:53 GMT
content-type: text/html
last-modified: Tue, 08 Jun 2021 15:45:03 GMT
etag: W/"60bf907f-ee9"
content-encoding: gzip

GET
H2

200

match
ads.betweendigital.com/
Redirect Chain

https://x.bidswitch.net/sync?ssp=between
https://x.bidswitch.net/ul_cb/sync?ssp=between
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=between&bsw_custom_parameter=54d6b61d-ab07-4e90-8370-0157819335bd
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=between&bsw_custom_parameter=54d6b61d-ab07-4e90-8370-0157819335bd
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=1228a75e-b2df-4273-aeb1-fd4fc085b70b&user_group=1&ssp=between&bsw_param=54d6b61d-ab07-4e90-8370-0157819335bd
https://ads.betweendigital.com/match?bidder_id=22&external_user_id=54d6b61d-ab07-4e90-8370-0157819335bd

68 B
607 B

101ms
100ms

Image
image/png

96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=22&external_user_id=54d6b61d-ab07-4e90-8370-0157819335bd
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

Location: //ads.betweendigital.com/match?bidder_id=22&external_user_id=54d6b61d-ab07-4e90-8370-0157819335bd
Date: Tue, 12 Oct 2021 16:32:53 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2

200

match
ads.betweendigital.com/
Redirect Chain

https://px.adhigh.net/p/cm/btw
https://px.adhigh.net/p/cm/btw?bounced=1
https://ads.betweendigital.com/match?bidder_id=37&external_user_id=mI6BXzHAPJ.AikABlF8dVmDOA

68 B
607 B

101ms
101ms

Image
image/png

96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=37&external_user_id=mI6BXzHAPJ.AikABlF8dVmDOA
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
server: nginx
access-control-allow-origin: *
x-backend-id: f12-ru
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ads.betweendigital.com/match?bidder_id=37&external_user_id=mI6BXzHAPJ.AikABlF8dVmDOA
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

match
ads.betweendigital.com/
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fads.betweendigital.com%2Fmatch%3Fbidder_id%3D114%26external_user_id%3D%24UID
https://ap.lijit.com/pixel?redir=https%3A%2F%2Fads.betweendigital.com%2Fmatch%3Fbidder_id%3D114%26external_user_id%3D%24UID&sovrn_retry=true
https://ads.betweendigital.com/match?bidder_id=114&external_user_id=7f085b153c8deca91e300fb0

68 B
607 B

103ms
103ms

Image
image/png

96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=114&external_user_id=7f085b153c8deca91e300fb0
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

Date: Tue, 12 Oct 2021 16:32:53 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://ads.betweendigital.com/match?bidder_id=114&external_user_id=7f085b153c8deca91e300fb0
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H2

200

match
ads.betweendigital.com/
Redirect Chain

https://sync.bumlam.com/?src=bw1&uid=1726420c-09f8-531d-be21-7f82df44c736
https://sync3.adsniper.ru/?src=ss1&s_data=CAEQABi18ZaLBlIFvp7KygpiJDE3MjY0MjBjLTA5ZjgtNTMxZC1iZTIxLTdmODJkZjQ0YzczNg**
https://sync3.adsniper.ru/?src=ss1&s_data=CAIQARi18ZaLBlIFvp7KygpiJDE3MjY0MjBjLTA5ZjgtNTMxZC1iZTIxLTdmODJkZjQ0YzczNqIBEAwg7QwrehHspukAJZDIJDc*
https://sync.bumlam.com/?src=bw1&s_data=CAIQABi18ZaLBmIkMTcyNjQyMGMtMDlmOC01MzFkLWJlMjEtN2Y4MmRmNDRjNzM2ogEQDCDtDCt6Eeym6QAlkMgkNw**
https://sync.bumlam.com/?src=bw1&s_data=CAIQARi18ZaLBmIkMTcyNjQyMGMtMDlmOC01MzFkLWJlMjEtN2Y4MmRmNDRjNzM2ogEQDCDtDCt6Eeym6QAlkMgkNw**
https://ads.betweendigital.com/match?bidder_id=18&external_user_id=0c20ed0c-2b7a-11ec-a6e9-002590c82437

68 B
607 B

147ms
147ms

Image
image/png

96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=18&external_user_id=0c20ed0c-2b7a-11ec-a6e9-002590c82437
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

Date: Tue, 12 Oct 2021 16:32:53 GMT
Server: nginx
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: https://ads.betweendigital.com/match?bidder_id=18&external_user_id=0c20ed0c-2b7a-11ec-a6e9-002590c82437
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate, s-maxage=0
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0

POST
H2 204 events
bidder.criteo.com/csm/ 0
190 B 15ms
12ms Ping
text/plain 178.250.2.131
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/csm/events
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.131 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: bidder.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.profinance.ru
date: Tue, 12 Oct 2021 16:32:52 GMT
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Finatra
timing-allow-origin: *
vary: Origin

GET
H2 200 pixel.gif
static.criteo.net/images/ 43 B
337 B 21ms
17ms Image
image/gif 178.250.2.130
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=1
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:53 GMT
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "493ea254-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 43
expires: Fri, 07 Oct 2022 16:32:53 GMT

GET
H2 200 pixel.gif
static.criteo.net/images/ 43 B
337 B 20ms
16ms Image
image/gif 178.250.2.130
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=2
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:53 GMT
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "493ea254-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 43
expires: Fri, 07 Oct 2022 16:32:53 GMT

OPTIONS
H2 200 event_confirmation
an.yandex.ru/ Frame 0
0 123ms
54ms Preflight 87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/event_confirmation

Protocol

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.profinance.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

timing-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
date: Tue, 12 Oct 2021 16:32:53 GMT
access-control-max-age: 1728000
access-control-allow-headers: content-type
access-control-allow-origin: https://www.profinance.ru
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-encoding: gzip
strict-transport-security: max-age=31536000

POST
H2 200 event_confirmation Show response
an.yandex.ru/ 0
296 B 60ms
58ms XHR
text/plain 87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/event_confirmation

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 16:32:53 GMT
strict-transport-security: max-age=31536000
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin: https://www.profinance.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 12 Oct 2021 16:32:53 GMT

GET
H2 200 wy300
avatars.mds.yandex.net/get-direct/5191943/ZNuFb08ZerMcNnB5EU6wQg/ 12 KB
13 KB 108ms
32ms Image
image/webp 87.250.247.182
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://avatars.mds.yandex.net/get-direct/5191943/ZNuFb08ZerMcNnB5EU6wQg/wy300
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 87.250.247.182 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS: avatars.mds.yandex.net
Software: nginx /
Resource Hash: 550a6cdc780792439612dfe3ca5fb833e62fabb46a77ba585e2aca943a9166e6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:53 GMT
last-modified: Wed, 06 Oct 2021 09:40:55 GMT
server: nginx
nel: {"report_to": "network-errors", "max_age": 600, "success_fraction": 0.001, "failure_fraction": 0.01}
report-to: {"group": "network-errors", "max_age": 600, "endpoints": [ { "url": "https://dr.yandex.net/s3_nel"}]}
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=604800,immutable
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 12746
x-request-id: e1614271cc2b6f2

GET
H2 200 y300
avatars.mds.yandex.net/get-direct/4576471/DjlvSzuimUl3t8gmvEsPUA/ 11 KB
11 KB 108ms
32ms Image
image/webp 87.250.247.182
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://avatars.mds.yandex.net/get-direct/4576471/DjlvSzuimUl3t8gmvEsPUA/y300
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 87.250.247.182 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS: avatars.mds.yandex.net
Software: nginx /
Resource Hash: f5737d03b8ab39fead5245d364588723fa5a5e3316b66d3efc40e8b0de976ac5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:53 GMT
last-modified: Wed, 11 Aug 2021 14:14:17 GMT
server: nginx
nel: {"report_to": "network-errors", "max_age": 600, "success_fraction": 0.001, "failure_fraction": 0.01}
report-to: {"group": "network-errors", "max_age": 600, "endpoints": [ { "url": "https://dr.yandex.net/s3_nel"}]}
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=604800,immutable
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 10864
x-request-id: 7157a9d28d257742

GET
H2 200 y300
avatars.mds.yandex.net/get-direct/1520687/Yq5m0FCKwBySKwVEKtfSNQ/ 9 KB
10 KB 108ms
32ms Image
image/webp 87.250.247.182
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://avatars.mds.yandex.net/get-direct/1520687/Yq5m0FCKwBySKwVEKtfSNQ/y300
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 87.250.247.182 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS: avatars.mds.yandex.net
Software: nginx /
Resource Hash: 09cd78d927dcb725c0a40c0fa03a201c211c37b4ff700de66088a0d75da44cfb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:53 GMT
last-modified: Wed, 16 Sep 2020 06:07:29 GMT
server: nginx
nel: {"report_to": "network-errors", "max_age": 600, "success_fraction": 0.001, "failure_fraction": 0.01}
report-to: {"group": "network-errors", "max_age": 600, "endpoints": [ { "url": "https://dr.yandex.net/s3_nel"}]}
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=604800,immutable
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 9570
x-request-id: 9f6c3e533494f88e

POST
H2 200 1 Show response
mc.yandex.com/watch/9524/ 43 B
73 B 37ms
36ms XHR
image/gif 93.158.134.119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/9524/1?page-url=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&cnt-class=1&browser-info=pa%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3A4phzp3o2dbm15p1mc%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A660%3Acn%3A1%3Adp%3A1%3Als%3A582181938217%3Ahid%3A854096656%3Az%3A0%3Ai%3A202101012163253%3Aet%3A1634056373%3Ac%3A1%3Arn%3A335335481%3Arqn%3A2%3Au%3A1634056373589262977%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Aeu%3A1%3Ans%3A1634056371787%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1634056373

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.158.134.119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

mc.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
last-modified: Tue, 12-Oct-2021 16:32:53 GMT
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: https://www.profinance.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Tue, 12-Oct-2021 16:32:53 GMT

GET
H2 200 9524 Show response
mc.yandex.com/watch/ 43 B
73 B 44ms
44ms XHR
image/gif 93.158.134.119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/9524?page-url=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&cnt-class=1&browser-info=pv%3A1%3Aar%3A1%3Agdpr%3A14%3Avf%3A4phzp3o2dbm15p1mc%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A660%3Acn%3A1%3Adp%3A1%3Als%3A582181938217%3Ahid%3A854096656%3Az%3A0%3Ai%3A202101012163253%3Aet%3A1634056373%3Ac%3A1%3Arn%3A397576479%3Arqn%3A3%3Au%3A1634056373589262977%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Aeu%3A1%3Ans%3A1634056371787%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1634056373%3At%3A%D0%A4%D0%BE%D1%80%D0%B5%D0%BA%D1%81%20%D0%BD%D0%B0%20ProFinance.Ru.%20%D0%9A%D1%83%D1%80%D1%81%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82.%20%D0%9F%D1%80%D0%BE%D0%B3%D0%BD%D0%BE%D0%B7%D1%8B%20%D0%B2%D0%B0%D0%BB%D1%8E%D1%82%D0%BD%D0%BE%D0%B3%D0%BE%20%D1%80%D1%8B%D0%BD%D0%BA%D0%B0.

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.158.134.119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

mc.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
last-modified: Tue, 12-Oct-2021 16:32:53 GMT
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: https://www.profinance.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Tue, 12-Oct-2021 16:32:53 GMT

GET
H2 200 render.html Show response
yastatic.net/safeframe-bundles/0.82/1-1-0/ Frame ACBB 24 KB
7 KB 36ms
34ms Document
text/html 178.154.131.215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/safeframe-bundles/0.82/1-1-0/render.html

Requested by

Host: yastatic.net
URL: https://yastatic.net/safeframe-bundles/0.82/host.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.154.131.215 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

static.yandex.net

Software

nginx/1.17.9 /

Resource Hash

9c911ab93cf6099aeeddb19cb1903d0ef838329443c3a0549c754da47f90a70a

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

:method: GET
:authority: yastatic.net
:scheme: https
:path: /safeframe-bundles/0.82/1-1-0/render.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.profinance.ru/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

server: nginx/1.17.9
date: Tue, 12 Oct 2021 16:32:53 GMT
content-type: text/html
content-length: 6262
access-control-allow-origin: *
cache-control: public, max-age=946708560
content-encoding: br
etag: "eb77de48712912aadc9aa8171ac75ede"
expires: Thu, 12 Oct 2051 23:06:56 GMT
last-modified: Mon, 28 Jun 2021 10:29:24 GMT
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
strict-transport-security: max-age=43200000; includeSubDomains;
timing-allow-origin: *
vary: Accept-Encoding
x-robots-tag: noindex, noarchive, nofollow
accept-ranges: bytes

GET
H2 200 v2 Show response
an.yandex.ru/adfox/341266/getBulk/ 12 KB
4 KB 324ms
324ms XHR
application/json 87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/adfox/341266/getBulk/v2?dl=https%3A%2F%2Fwww.profinance.ru%2F&date=2021-10-12T16%3A32%3A53.168%2B00%3A00&pd=12&pdh=1200&pdw=1600&pr1=2871933677&pr=4044112377&prr=&pv=16&pw=2&extid_loader=MTYzNDA1NjM3MzU4OTI2Mjk3Nw%3D%3D&extid_tag_loader=www.profinance.ru&ylv=0.44818&ybv=0.44818&ytt=432108075091989&is-turbo=0&skip-token=yabs.NzIwNTc2MDUyMjI3MTQ5NzkKNzIwNTc2MDQ4MDc5NDUwNDEKNzIwNTc2MDM4ODE5ODYzNTI%3D&ad-session-id=1419741634056372648&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22quirks%22%3Atrue%2C%22w%22%3A1600%2C%22h%22%3A0%2C%22width%22%3A1600%2C%22height%22%3A0%2C%22visible%22%3A1%2C%22left%22%3A0%2C%22top%22%3A0%2C%22fontFamily%22%3A%22roboto%22%2C%22req_no%22%3A0%2C%22ad_no%22%3A3%7D&enable-flat-highlight=1&pcode-version=44818&availableWidth=1600&availableHeight=0&pp=g&ps=dxjd&p2=gyqo&slotNumber=1&bids=W3siY2FtcGFpZ25faWQiOjEzMjQ0MTYsInJlc3BvbnNlX3RpbWUiOjEzNiwiZXJyb3IiOnsiY29kZSI6MX0sInBsYWNlbWVudF9pZCI6IjE1NTQ0NDMifSx7ImNhbXBhaWduX2lkIjoxMzI0NDYzLCJyZXNwb25zZV90aW1lIjo2OSwiZXJyb3IiOnsiY29kZSI6NH0sInBsYWNlbWVudF9pZCI6IjRxSUJUdlRnQXlzSjJxMEJHY3BuIn0seyJjYW1wYWlnbl9pZCI6MTMyNDQ2NiwicmVzcG9uc2VfdGltZSI6MjM5LCJlcnJvciI6eyJjb2RlIjoxfSwicGxhY2VtZW50X2lkIjoiNjZfOTcweDI1MF9hbGZhZGFydCJ9LHsiY2FtcGFpZ25faWQiOjEzMjQ0NzEsInJlc3BvbnNlX3RpbWUiOjI0MCwiZXJyb3IiOnsiY29kZSI6MX0sInBsYWNlbWVudF9pZCI6IjgyODUyNSJ9LHsiY2FtcGFpZ25faWQiOjEzMjQ0NzcsInJlc3BvbnNlX3RpbWUiOjEwNiwiZXJyb3IiOnsiY29kZSI6MX0sInBsYWNlbWVudF9pZCI6IjM5NTU0MTQifSx7ImNhbXBhaWduX2lkIjoxNTYzMTY4LCJyZXNwb25zZV90aW1lIjo3MCwiZXJyb3IiOnsiY29kZSI6MX0sInBsYWNlbWVudF9pZCI6Ijk4MDFfXzcwMjkifSx7ImNhbXBhaWduX2lkIjoxNjAwNDA2LCJyZXNwb25zZV90aW1lIjoxNTEsImVycm9yIjp7ImNvZGUiOjF9LCJwbGFjZW1lbnRfaWQiOiIxMjIxNTMyIn0seyJjYW1wYWlnbl9pZCI6MTU3ODQxOSwicmVzcG9uc2VfdGltZSI6MjY3LCJlcnJvciI6eyJjb2RlIjo0fSwicGxhY2VtZW50X2lkIjoiOTg6cHJvZmluYW5jZV85NzB4MjUwX3RvcCJ9XQ%3D%3D&utf8=%E2%9C%93&duid=MTYzNDA1NjM3MzU4OTI2Mjk3Nw%3D%3D&pcode-test-ids=431004%2C0%2C94%3B428759%2C0%2C16%3B434271%2C0%2C72%3B436349%2C0%2C71%3B430931%2C0%2C52%3B435231%2C0%2C72%3B400735%2C0%2C36%3B428463%2C0%2C85%3B433499%2C0%2C25%3B433508%2C0%2C17%3B435773%2C0%2C9&pcode-flags-map=%7B%22ENABLE_CODECS_WHITELIST%22%3A%5B%7B%22value%22%3A%22TRUE%22%2C%22testId%22%3A%22429059%22%7D%5D%2C%22DISABLE_DEFAULT_THEME_EMPTY_DURATION%22%3A%5B%7B%22value%22%3A%22TRUE%22%2C%22testId%22%3A%22429073%22%7D%5D%2C%22MEDIA_FILE_BITRATE_PRIORITY_FACTOR%22%3A%5B%7B%22value%22%3A%220.000001%22%2C%22testId%22%3A%22429074%22%7D%5D%2C%22VOLUME_BUTTON_ANIMATION%22%3A%5B%7B%22value%22%3A%22ENABLE%22%2C%22testId%22%3A%22429077%22%7D%5D%2C%22UNIFORMAT%22%3A%5B%7B%22value%22%3A%22ENABLE%22%2C%22testId%22%3A%22429079%22%7D%5D%2C%22CHANGE_CLICK_THROUGH_LOGIC%22%3A%5B%7B%22value%22%3A%22ACTION_BUTTON_PRIORITY%22%2C%22testId%22%3A%22432722%22%7D%5D%2C%22VAS_STABLE_VERSION%22%3A%5B%7B%22value%22%3A%22434485%22%2C%22testId%22%3A%22435340%22%7D%5D%2C%22ADFOX_MRC_VISIBILITY_ON_CLICK%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22427330%22%7D%5D%2C%22UNILOADER_FOR_AMP%22%3A%5B%7B%22value%22%3Atrue%2C%22testId%22%3A%22428390%22%7D%5D%2C%22USE_SSR_IN_AMP%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22428390%22%7D%5D%2C%22FULL_SSR_PERCENT_LOG_META%22%3A%5B%7B%22value%22%3A0.0001%2C%22testId%22%3A%22435450%22%7D%5D%2C%22DEFAULT_SSR_FORMATS%22%3A%5B%7B%22value%22%3A%5B%22zen%22%2C%22zen2%22%2C%22zen2-gallery%22%2C%22billboard%22%2C%22horizontal%22%2C%22horizontal0318%22%2C%22adaptiveConstructor%22%2C%22modernAdaptive%22%2C%22posterCarousel%22%2C%22adaptiveCarousel%22%2C%22smart_tile%22%5D%2C%22testId%22%3A%22435450%22%7D%5D%2C%22RTB_BANNER_FLAGS%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22435450%22%7D%5D%2C%22HBVER%22%3A%5B%7B%22value%22%3A42153%2C%22testId%22%3A%22435450%22%7D%5D%2C%22DECODE_VAST%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22432455%22%7D%5D%2C%22RMP_SEND_BEACON%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22433605%22%7D%5D%2C%22ADFOX_MRC_VISIBILITY_BY_OWNER%22%3A%5B%7B%22value%22%3A%5B168627%2C259055%2C258881%2C354188%2C239538%2C235076%2C264443%2C374320%5D%2C%22testId%22%3A%22435688%22%7D%5D%2C%22REMOVE_GRAB_LIMIT_OTHER%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22434001%22%7D%5D%2C%22AD_SEEN_OBSERVER%22%3A%5B%7B%22value%22%3A%22enable%22%2C%22testId%22%3A%22436297%22%7D%5D%2C%22DISABLE_144P_QUALITY%22%3A%5B%7B%22value%22%3A%22FALSE%22%2C%22testId%22%3A%22431004%22%7D%5D%2C%22TEST_EXP_VAS_CONFIG_IN_PCODE%22%3A%5B%7B%22value%22%3A%22EXP%22%2C%22testId%22%3A%22428759%22%7D%5D%2C%22WIDGET_IN_PCODE%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22434271%22%7D%5D%2C%22REACALCULATES_HEIGHT_IF_IFRAME%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22436349%22%7D%5D%2C%22INPAGE_LOAD_MODULE_DIRECT%22%3A%5B%7B%22value%22%3A%22ctl%22%2C%22testId%22%3A%22430931%22%7D%5D%2C%22FIXED_FORMAT_RENDER%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22435231%22%7D%5D%2C%22GLOBAL_SIZE_INFO%22%3A%5B%7B%22value%22%3Atrue%2C%22testId%22%3A%22400735%22%7D%5D%2C%22ADFOX_AVAILABLE_SIZE%22%3A%5B%7B%22value%22%3A%22exp%22%2C%22testId%22%3A%22428463%22%7D%5D%2C%22PCODEVER%22%3A%5B%7B%22value%22%3A%2244781%22%2C%22testId%22%3A%22435773%22%7D%5D%7D&use-server-side-rendering=1&server-side-rendering-enabled-formats=zen%0Azen2%0Azen2-gallery%0Abillboard%0Ahorizontal%0Ahorizontal0318%0AadaptiveConstructor%0AmodernAdaptive%0AposterCarousel%0AadaptiveCarousel%0Asmart_tile&price-disabled-formats=adaptive0418%0Aadaptive%0AmodernAdaptive%0Ahorizontal%0Ahorizontal0318%0Agrid%0A160x600%0A240x400%0A200x300%0A300x300%0A300x250%0A250x250%0A728x90%0A1000x120%0A320x50%0A320x100%0A400x240%0A320x480%0A480x320%0A336x280%0A300x600%0A300x500%0A970x250%0A970x90&raw-smart-content=1&smart-format-names=smart-banner-adaptive_v1%0Asmart-banner-mosaic_v1&pcode-icookie=6mzc8v0t1VyWFWQXb9xD7TY3Mwg5AT5ESVisLv7QkbpxxWHiIIfyzFxCq8w9slt37KmHLgV7j945sJ3MgaiSrCGufSo%3D&grab-orig-len=1028&grab=dNCk0L7RgNC10LrRgSDQvdCwIFByb0ZpbmFuY2UuUnUuINCa0YPRgNGB0Ysg0LLQsNC70Y7Rgi4g0J_RgNC-0LPQvdC-0LfRiyDQstCw0LvRjtGC0L3QvtCz0L4g0YDRi9C90LrQsC4KMiDQoNC10LTQsNC60YbQuNGPIMK3INCg0LXQutC70LDQvNCwIMK3INCa0L7QvdGC0LDQutGC0YsgCjIg0JrQvtGC0LjRgNC-0LLQutC4IMK3INCa0L7RgtC40YDQvtCy0LrQuCDQvtC90LvQsNC50L0gwrcg0JPRgNCw0YTQuNC60Lggwrcg0JPRgNCw0YTQuNC60Lgg0L7QvdC70LDQudC9IMK3INCY0L3RhNC-0YDQvNC10YDRiyAtINCa0YPRgNGBINCy0LDQu9GO0YIg0KbQkSDQuCDQpNC-0YDQtdC60YEgCjIg0JrQvtGC0LjRgNC-0LLQutC4INCy0LDQu9GO0YIgwrcg0JrRg9GA0YEg0LTQvtC70LvQsNGA0LAg0Log0YDRg9Cx0LvRjiDCtyDQmtGD0YDRgSDQtdCy0YDQviDQuiDRgNGD0LHQu9GOIMK3INCa0YPRgNGB0Ysg0LLQsNC70Y7RgiDQuiDRgNGD0LHQu9GOIMK3INCa0L7RgtC40YDQvtCy0LrQuCDQsNC60YbQuNC5IMK3INCd0LXRhNGC0Ywgwrcg0JfQvtC70L7RgtC-IMK3INCR0LjRgtC60L7QuNC9IMK3INCd0LXRhNGC0YwgVXJhbHMgCjIg0JDRgNGF0LjQsiDQvdC-0LLQvtGB0YLQtdC5INCy0LDQu9GO0YLQvdC-0LPQviDQuCDRhNC-0L3QtNC-0LLQvtCz0L4g0YDRi9C90LrQsCDCtyDQkNGA0YXQuNCyINGN0LrQvtC90L7QvNC40YfQtdGB0LrQuNGFINC90L7QstC-0YHRgtC10Lkg0Lgg0YHQvtCx0YvRgtC40LkgCjIg0KTQvtGA0LXQutGBINCk0L7RgNGD0LwgCg%3D%3D

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

94d0ab851357981e5741741713784d34ead9d838f7ada21512ac9099a8659fd2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 16:32:53 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
x-yandex-req-id: 1634056373231715-46933674387911034900348-production-app-host-sas-pcode-147
strict-transport-security: max-age=31536000
content-type: application/json
access-control-allow-origin: https://www.profinance.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 12 Oct 2021 16:32:53 GMT

GET
H2

200

match
ads.betweendigital.com/ Frame C712
Redirect Chain

https://x.bidswitch.net/sync?ssp=between
https://sync.mathtag.com/sync/img?mt_exid=46&redir=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D80%26user_id%3D%5BUUID%5D%26expires%3D30%26ssp%3Dbetween%26bsw_param%3D54d6b61d-ab07-4e90-8370-0157819335b...
https://x.bidswitch.net/sync?dsp_id=80&user_id=6dcc6165-b8b4-4100-8f2f-be32008d8286&expires=30&ssp=between&bsw_param=54d6b61d-ab07-4e90-8370-0157819335bd&gdpr=&gdpr_consent=
https://ads.betweendigital.com/match?bidder_id=22&external_user_id=54d6b61d-ab07-4e90-8370-0157819335bd

68 B
607 B

103ms
103ms

Image
image/png

96.46.186.57
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.betweendigital.com/match?bidder_id=22&external_user_id=54d6b61d-ab07-4e90-8370-0157819335bd
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 96.46.186.57 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cache.betweendigital.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png

Redirect headers

Location: //ads.betweendigital.com/match?bidder_id=22&external_user_id=54d6b61d-ab07-4e90-8370-0157819335bd
Date: Tue, 12 Oct 2021 16:32:53 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
Ok d.png
ysa-static.passport.yandex.ru/static/1/d959d7e39d5067fad30d9c06204866e9/ Frame ACBB 95 B
400 B 107ms
31ms Image
image/png 87.250.250.114
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ysa-static.passport.yandex.ru/static/1/d959d7e39d5067fad30d9c06204866e9/d.png?ex=yes

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.114 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

ysa-static.passport.yandex.net

Software

nginx/1.14.2 /

Resource Hash

18c327afa903633f86c3efcf12b77f098077eacaa8be101bb007846fd74f8b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 12 Oct 2021 16:32:53 GMT
Server: nginx/1.14.2
Strict-Transport-Security: max-age=315360000; includeSubDomains
X-RT-IH: 0.0002
Content-Type: image/png
Cache-Control: private
Connection: close
X-RT-IQ: 0.0001
Content-Length: 95
Expires: Wed, 13 Oct 2021 16:32:53 GMT

GET
H2

200

Cg8qAWFluLWa5mHtNDSEAgA=
an.yandex.ru/mapuid/ditmsk/ Frame ACBB
Redirect Chain

https://stats.mos.ru/gc/ynd/
https://an.yandex.ru/mapuid/ditmsk/Cg8qAWFluLWa5mHtNDSEAgA=?time=1634056373.385

43 B
80 B

75ms
75ms

Image
image/gif

87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/ditmsk/Cg8qAWFluLWa5mHtNDSEAgA=?time=1634056373.385

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 16:32:53 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 12 Oct 2021 16:32:53 GMT

Redirect headers

Location: https://an.yandex.ru/mapuid/ditmsk/Cg8qAWFluLWa5mHtNDSEAgA=?time=1634056373.385
Date: Tue, 12 Oct 2021 16:32:53 GMT
Server: nginx/1.14.0
Connection: keep-alive
Content-Length: 161
Content-Type: text/html

GET
H2

200

ct_sync.php
sync.magnitent.com/fbfli/ Frame ACBB
Redirect Chain

https://sonar.semantiqo.com/dmp/scr.php
https://counter.yadro.ru/id127/reff-id.gif?sid=4f4d85664b5c488ead18a785b4d621cc
https://sonar.semantiqo.com/fbfli/data_sess_sync.php?spid=1823F8F67A42B79C&sid=4f4d85664b5c488ead18a785b4d621cc
https://cdn3.caltat.com/fbfc504c-89b0-4a80-bef4-c8e39daeee6f/sess.php?sid=4f4d85664b5c488ead18a785b4d621cc&spid=1823F8F67A42B79C&v=
https://sync.magnitent.com/fbfli/ct_sync.php?ct=d9e49ae7397d4e78b59be4802c3f2f45&sonar=4f4d85664b5c488ead18a785b4d621cc&spid=1823F8F67A42B79C&v=

0
572 B

254ms
34ms

Image
text/html

95.217.109.66
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.magnitent.com/fbfli/ct_sync.php?ct=d9e49ae7397d4e78b59be4802c3f2f45&sonar=4f4d85664b5c488ead18a785b4d621cc&spid=1823F8F67A42B79C&v=
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 95.217.109.66 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.66.109.217.95.clients.your-server.de
Software: nginx/1.20.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin: *, *
date: Tue, 12 Oct 2021 16:32:53 GMT
mode: no-cors, no-cors
server: nginx/1.20.1
cache-control: no-cache, no-cache
content-encoding: gzip
content-type: text/html; charset=UTF-8

Redirect headers

location: https://sync.magnitent.com/fbfli/ct_sync.php?ct=d9e49ae7397d4e78b59be4802c3f2f45&sonar=4f4d85664b5c488ead18a785b4d621cc&spid=1823F8F67A42B79C&v=
date: Tue, 12 Oct 2021 16:32:53 GMT
mode: no-cors
server: nginx/1.20.1
access-control-allow-origin: *
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK sync.cgi
ssp.adriver.ru/cgi-bin/ Frame ACBB 42 B
201 B 223ms
52ms Image
image/gif 81.222.128.215
ELTEL-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssp.adriver.ru/cgi-bin/sync.cgi?dsp_id=109
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.222.128.215 , Russian Federation, ASN20597 (ELTEL-AS, RU),
Reverse DNS: ad15.adriver.ru
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 12 Oct 2021 16:32:53 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: image/gif

GET
H2

200

spacer.gif
an.yandex.ru/resource/ Frame ACBB
Redirect Chain

https://an.yandex.ru/mapuid/google/
https://cm.g.doubleclick.net/pixel?google_nid=yandexru&google_hm=AC5803E8D21425CA&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
https://an.yandex.ru/resource/spacer.gif

43 B
135 B

55ms
54ms

Image
image/gif

87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/resource/spacer.gif

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Oct 2021 16:32:53 GMT
content-encoding: gzip
last-modified: Wed, 18 Apr 2001 10:28:03 GMT
strict-transport-security: max-age=31536000
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-type: image/gif
x-xss-protection: 1; mode=block
expires: Tue, 27 Sep 2022 16:32:53 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://an.yandex.ru/resource/spacer.gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 237
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

JgvIRyB4AivNsLB7AZGt
an.yandex.ru/mapuid/dmpamberdata/ Frame ACBB
Redirect Chain

https://dmg.digitaltarget.ru/1/119/i/i?i=1634056372
https://dmg.digitaltarget.ru/awg/custom/119/i/i?call_source=awg&i=1634056372
https://an.yandex.ru/mapuid/dmpamberdata/JgvIRyB4AivNsLB7AZGt

43 B
80 B

56ms
56ms

Image
image/gif

87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/dmpamberdata/JgvIRyB4AivNsLB7AZGt

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:54 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 16:32:54 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 12 Oct 2021 16:32:54 GMT

Redirect headers

Date: Tue, 12 Oct 2021 16:32:54 GMT
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Server: nginx
X-Frame-Options: DENY
Access-Control-Allow-Methods: GET, POST, OPTIONS
Location: https://an.yandex.ru/mapuid/dmpamberdata/JgvIRyB4AivNsLB7AZGt
X-XSS-Protection: 1; mode=block
X-Permitted-Cross-Domain-Policies: master-only
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 86400
Connection: keep-alive
Request-Time: 484
Content-Length: 0
X-Content-Type-Options: nosniff

GET
H2

200

YOuouD63ab-x
an.yandex.ru/mapuid/dmpsegmento/ Frame ACBB
Redirect Chain

https://yandex-dmp-sync.rutarget.ru/sync
https://an.yandex.ru/mapuid/dmpsegmento/YOuouD63ab-x?sign=1565629791

43 B
80 B

73ms
73ms

Image
image/gif

87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/dmpsegmento/YOuouD63ab-x?sign=1565629791

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 16:32:53 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 12 Oct 2021 16:32:53 GMT

Redirect headers

Location: https://an.yandex.ru/mapuid/dmpsegmento/YOuouD63ab-x?sign=1565629791
Date: Tue, 12 Oct 2021 16:32:53 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
P3P: CP="This is not a P3P policy. Please visit http://rutarget.ru/p3p/ to get more information."

GET
H2

200

P5rB783oSwK8
an.yandex.ru/mapuid/rutargetis/ Frame ACBB
Redirect Chain

https://yandex-sync.rutarget.ru/sync
https://an.yandex.ru/mapuid/rutargetis/P5rB783oSwK8

43 B
80 B

56ms
55ms

Image
image/gif

87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/rutargetis/P5rB783oSwK8

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 16:32:53 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 12 Oct 2021 16:32:53 GMT

Redirect headers

Location: https://an.yandex.ru/mapuid/rutargetis/P5rB783oSwK8
Date: Tue, 12 Oct 2021 16:32:53 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
P3P: CP="This is not a P3P policy. Please visit http://rutarget.ru/p3p/ to get more information."

GET
H2

200

ezHHwWhOGYWF8DWWYZ%2FVxQ
an.yandex.ru/mapuid/dmpaidatame/ Frame ACBB
Redirect Chain

https://x01.aidata.io/0.gif?pid=YANDEX
https://x01.aidata.io/0.gif?pid=YANDEX&bounce=1
https://an.yandex.ru/mapuid/dmpaidatame/ezHHwWhOGYWF8DWWYZ%2FVxQ?sign=2502469253

43 B
80 B

76ms
76ms

Image
image/gif

87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/dmpaidatame/ezHHwWhOGYWF8DWWYZ%2FVxQ?sign=2502469253

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 16:32:53 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 12 Oct 2021 16:32:53 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
last-modified: Tue, 12 Oct 2021 16:32:52 GMT
server: nginx
access-control-allow-methods: GET, POST
p3p: CP='NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA'
location: https://an.yandex.ru/mapuid/dmpaidatame/ezHHwWhOGYWF8DWWYZ%2FVxQ?sign=2502469253
cache-control: no-cache, no-store, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Tue, 12 Oct 2021 16:32:52 GMT

GET
H2

200

0c35f530-2b7a-11ec-ae6b-901b0ea4a41b
an.yandex.ru/mapuid/dmpcleverdata/ Frame ACBB
Redirect Chain

https://sync.1dmp.io/pixel.gif?cid=3cbc2ec8-1421-4677-89fe-2ac6fc52a09a&pid=w&o=au
https://sync.1dmp.io/pixel.gif?cid=3cbc2ec8-1421-4677-89fe-2ac6fc52a09a&pid=w&o=au&cs=1
https://an.yandex.ru/mapuid/dmpcleverdata/0c35f530-2b7a-11ec-ae6b-901b0ea4a41b?sign=2897533073

43 B
101 B

58ms
57ms

Image
image/gif

87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/dmpcleverdata/0c35f530-2b7a-11ec-ae6b-901b0ea4a41b?sign=2897533073

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 16:32:53 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 12 Oct 2021 16:32:53 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/dmpcleverdata/0c35f530-2b7a-11ec-ae6b-901b0ea4a41b?sign=2897533073
date: Tue, 12 Oct 2021 16:32:53 GMT
cache-control: private, no-cache, no-store, no-cache=Set-Cookie, proxy-revalidate, private, no-cache, no-store, no-cache=Set-Cookie, proxy-revalidate
server: nginx
content-length: 0
expires: 0, 0

GET
H2

200

aimGa80bZfNrZGVZKHK.l.
an.yandex.ru/mapuid/dmpweborama/ Frame ACBB
Redirect Chain

https://redirect.frontend.weborama.fr/redirect/standard?url=https://an.yandex.ru/mapuid/dmpweborama/{WEBO_CID}
https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fdmpweborama%2F%7BWEBO_CID%7D&bounce=1&random=2069379913
https://an.yandex.ru/mapuid/dmpweborama/aimGa80bZfNrZGVZKHK.l.

43 B
80 B

55ms
55ms

Image
image/gif

87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/dmpweborama/aimGa80bZfNrZGVZKHK.l.

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 16:32:53 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 12 Oct 2021 16:32:53 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
via: 1.1 google
last-modified: Tue, 12 Oct 2021 16:32:53 GMT
server: nginx/1.12.0
location: https://an.yandex.ru/mapuid/dmpweborama/aimGa80bZfNrZGVZKHK.l.
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: clear
content-length: 0
expires: Tue, 03 Jul 2001 06:00:00 GMT

GET
H2

200

/
an.yandex.ru/mapuid/ramblerssp/ Frame ACBB
Redirect Chain

https://profile.ssp.rambler.ru/sync3.302?pid=188
https://an.yandex.ru/mapuid/ramblerssp/

43 B
97 B

55ms
55ms

Image
image/gif

87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/ramblerssp/

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 16:32:53 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 12 Oct 2021 16:32:53 GMT

Redirect headers

date: Tue, 12 Oct 2021 16:32:53 GMT
server: nginx
strict-transport-security: max-age=0
p3p: policyref="/w3c/p3p.xml", CP="NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA"
location: //an.yandex.ru/mapuid/ramblerssp/
x-passed: 0bal2
content-type: application/x-javascript; charset=Windows-1251
content-length: 0

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame ACBB
Redirect Chain

https://an.yandex.ru/mapuid/adobedmp/
https://dpm.demdex.net/ibs:dpid=423652&dpuuid=31B74B07E448E697
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=423652&dpuuid=31B74B07E448E697

42 B
945 B

32ms
32ms

Image
image/gif

54.77.217.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=423652&dpuuid=31B74B07E448E697

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.77.217.29 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-77-217-29.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v018-05435f1dc.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: LxC1wAwyTX0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v018-046f9c0b1.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: eIfrivQkQW0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=423652&dpuuid=31B74B07E448E697
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 204 yandexdmp-match
dm.hybrid.ai/ Frame ACBB 0
238 B 152ms
47ms Image
text/plain 37.18.16.16
HYBRID-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dm.hybrid.ai/yandexdmp-match

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

37.18.16.16 , Russian Federation, ASN205675 (HYBRID-AS, RU),

Reverse DNS

Software

Hybrid Web Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
server: Hybrid Web Server
p3p: CP="NOI DSP COR CUR ADMa DEVo TAIo PSAo PSDo IVAo IVDo OUR IND COM NAV INT STA OTC"
access-control-allow-origin: *
cache-control: no-cache, no-store
x-mode: 109
x-xss-protection: 1; mode=block
expires: -1

GET
H2

200

ead7fc39e3d37e7b7b7a628f0a2b2c258c54558451a1209ad6459a944c7ef662
an.yandex.ru/mapuid/mediascope/ Frame ACBB
Redirect Chain

https://cm.tns-counter.ru/yacm
https://an.yandex.ru/mapuid/mediascope/ead7fc39e3d37e7b7b7a628f0a2b2c258c54558451a1209ad6459a944c7ef662

43 B
80 B

73ms
73ms

Image
image/gif

87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/mediascope/ead7fc39e3d37e7b7b7a628f0a2b2c258c54558451a1209ad6459a944c7ef662

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 16:32:53 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 12 Oct 2021 16:32:53 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
server: ms-counter-3.2.12/1.20.1
content-type: text/html
location: https://an.yandex.ru/mapuid/mediascope/ead7fc39e3d37e7b7b7a628f0a2b2c258c54558451a1209ad6459a944c7ef662
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate
timing-allow-origin: *
content-length: 0
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2

200

18389d02-4c3e-4ca5-b168-0b9403028743
an.yandex.ru/mapuid/upravelis/ Frame ACBB
Redirect Chain

https://sync.upravel.com/yandex/sync
https://sync.upravel.com/yandex/sync?session_tpt=eyJoZWFkZXJzIjp7InJlZmVyZXIiOlsiaHR0cHM6Ly95YXN0YXRpYy5uZXQvIl19fQ
https://18389d02-4c3e-4ca5-b168-0b9403028743.sync.upravel.com/yandex/sync?ud_tpt=eyJoZWFkZXJzIjp7InJlZmVyZXIiOlsiaHR0cHM6Ly95YXN0YXRpYy5uZXQvIiwiaHR0cHM6Ly95YXN0YXRpYy5uZXQvIl19fQ
https://an.yandex.ru/mapuid/upravelis/18389d02-4c3e-4ca5-b168-0b9403028743

43 B
152 B

55ms
55ms

Image
image/gif

87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/upravelis/18389d02-4c3e-4ca5-b168-0b9403028743

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:54 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 16:32:54 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 12 Oct 2021 16:32:54 GMT

Redirect headers

date: Tue, 12 Oct 2021 16:32:53 GMT
server: nginx
location: https://an.yandex.ru/mapuid/upravelis/18389d02-4c3e-4ca5-b168-0b9403028743
access-control-allow-methods: GET, POST, OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
access-control-allow-credentials: false
content-type: image/png
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 0

OPTIONS
H2 200 event_confirmation
an.yandex.ru/ Frame 0
0 53ms
53ms Preflight 87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/event_confirmation

Protocol

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.profinance.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

timing-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
date: Tue, 12 Oct 2021 16:32:53 GMT
access-control-max-age: 1728000
access-control-allow-headers: content-type
access-control-allow-origin: https://www.profinance.ru
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
content-encoding: gzip
strict-transport-security: max-age=31536000

POST
H2 200 event_confirmation Show response
an.yandex.ru/ 0
51 B 78ms
78ms XHR
text/plain 87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/event_confirmation

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 16:32:53 GMT
strict-transport-security: max-age=31536000
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
access-control-allow-origin: https://www.profinance.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 12 Oct 2021 16:32:53 GMT

GET
H2

200

dcb3d155a1e5da46
an.yandex.ru/setud/adsniper/ Frame C712
Redirect Chain

https://sync.bumlam.com/?src=aid0
https://x01.aidata.io/0.gif?pid=ADSNIPER&id=0c20ed0c-2b7a-11ec-a6e9-002590c82437
https://x01.aidata.io/0.gif?pid=ADSNIPER&id=0c20ed0c-2b7a-11ec-a6e9-002590c82437&bounce=1
https://sync.bumlam.com/?src=aid1&uid=PbMM3DtJLoa5H%2FiiHGQT4A&
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_cm&extra1=PbMM3DtJLoa5H/iiHGQT4A&extra2=aidata
https://sync3.sniperlog.ru/?src=ggl&extra1=PbMM3DtJLoa5H/iiHGQT4A&extra2=aidata&google_gid=CAESEPJ2qxAeW2A8Yr5zPtk88vI&google_cver=1
https://sync.bumlam.com/?src=ggl&extra1=PbMM3DtJLoa5H/iiHGQT4A&extra2=aidata&google_gid=CAESEPJ2qxAeW2A8Yr5zPtk88vI&google_cver=1
https://an.yandex.ru/setud/adsniper/dcb3d155a1e5da46?sign=774744254

43 B
154 B

81ms
81ms

Image
image/gif

87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/setud/adsniper/dcb3d155a1e5da46?sign=774744254

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cache.betweendigital.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:54 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 16:32:54 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 12 Oct 2021 16:32:54 GMT

Redirect headers

Date: Tue, 12 Oct 2021 16:32:53 GMT
Server: nginx
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: https://an.yandex.ru/setud/adsniper/dcb3d155a1e5da46?sign=774744254
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate, s-maxage=0
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0

POST
H2 200 jstracer Show response
an.yandex.ru/ 2 B
112 B 53ms
53ms XHR
application/json 87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://an.yandex.ru/jstracer

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
vary: Accept-Encoding, Origin
access-control-allow-methods: POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
timing-allow-origin: *
access-control-allow-headers: Content-Type
content-length: 2
x-xss-protection: 1; mode=block

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame D1C5 79 KB
27 KB 461ms
28ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/pcode/adfox/loader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

sffe /

Resource Hash

cea5906b034af795bb02ae46bb563d4164861fc8e85d0acf5cbb9bdcc309d9a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1013 / 679 of 1000 / last-modified: 1634036682"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27018
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 12 Oct 2021 16:32:53 GMT

GET
H2 204 event
ads.adfox.ru/341266/ 0
230 B 507ms
71ms Image
text/plain 77.88.21.179
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.adfox.ru/341266/event?duid=1634056373589262977&hash=4485dd3f62512aa2&pm=bmo&pxo=HYRYShED1OpS-u51BbJ_JbqFTXAtX7A1YvRVpIsCvXnr0I-wV4y8_9apbRdQkuldIMKW97b3YXElv_ufctWVSnKvDM0mpG6ZUVO7PYVirVKV1tBFjip5UQi0HFgl-8jiVW5hXe8oGaB2Hu1EVejrijjTVpKL86FFwec2lpvmhopKwgUiAGE2&p5=inscz&rand=ieoyjed&sj=oxuQQHeVmUpFIeA6Rd5Fpmw04D98u-4RsM6HL9knGBsy6TqSItcb9OaHisk1OQ%3D%3D&ad-session-id=1419741634056372648&lts=fhnuxeb&ytt=432108075091989&ybv=0.44818&ylv=0.44818&dl=https%3A%2F%2Fwww.profinance.ru%2F&pr=ncjswtt&p1=cmmml&rqs=tTA6jCtnLRm1uGVhTnNkdE0pSpO_6Ncx&rtb-si=b&p2=gyqo

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

77.88.21.179 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

adfox-external-l3-engine.stable.qloud-b.yandex.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:53 GMT
x-content-type-options: nosniff
last-modified: Tue, 12 Oct 2021 16:32:53 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
expires: Mon, 04 Dec 1999 21:29:02 GMT

GET
H2 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/ Frame 64D7 6 KB
4 KB 199ms
39ms Document
text/html 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/index.html

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

sffe /

Resource Hash

fa4b61a121a36b2647400b6e50f41ccfa21c96ac0ecdbd88154c32a84f978a42

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/16314837203521364516/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2401
date: Sun, 10 Oct 2021 16:24:59 GMT
expires: Mon, 10 Oct 2022 16:24:59 GMT
last-modified: Thu, 15 Apr 2021 13:45:14 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
age: 173275
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 34B5 0
0 86ms
85ms Fetch
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CIrZttbhlYay0AaT0zAagj6iQBPzTisJjhsuVy80Nzr74lnEQASDmnIxpYJXikIKgB6AB_4St7QPIAQmoAwHIA0iqBMgBT9AuOzI5Q43-1K3GUiKZx-iuE1bSndbXrdvMZ1W_zn7yY68E0EAVcMJVlMLCNthl8du_-ImJAGFjaZmkeO8ArevyTsjshVeW8Vd3dK0fgVdOeKxc5ON1n81_v5j5myyZRUC59Z-9tU-AmgFk0JO_VwGsyXYd7CmR7D5eD8FJgTX2xPgjMtlJNKTToDy6Eh8eDIsngYkgrWKQqriFrrtDY6XwJwdWAaOE3q0cpRVzRHrR7mb0d4nvzcvBTgNRXWQFYZ_PBAuNxd3ABNz_xsL4ApIFBAgEGAGSBQQIBRgEoAYugAeS-5odqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G9gHAPIHBRC0jtEB0ggJCIDhgBAQARhfgAoByAsB2BMM0BUBgBcBshccChoIABIUcHViLTIyMTU5NjczODk5NTEwNjAYAA&sigh=PImjhWwlePo&template_id=419

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9865432956&adk=870026366&adf=2297262845&pi=t.ma~as.9865432956&w=240&lmt=1634056324&psa=0&format=240x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372821&bpp=1&bdt=619&idt=154&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C580x400&nras=1&correlator=782430866943&frm=20&pv=1&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=1345&ady=67&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=23chL86PX0&p=https%3A//www.profinance.ru&dtd=157
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 12 Oct 2021 16:32:54 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211007/r20110914/ Frame 34B5 18 KB
8 KB 180ms
21ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211007/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9865432956&adk=870026366&adf=2297262845&pi=t.ma~as.9865432956&w=240&lmt=1634056324&psa=0&format=240x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372821&bpp=1&bdt=619&idt=154&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C580x400&nras=1&correlator=782430866943&frm=20&pv=1&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=1345&ady=67&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=23chL86PX0&p=https%3A//www.profinance.ru&dtd=157

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

cafe /

Resource Hash

d19d72f9c6e5bb747a38571cf87013b5fdc205a277e307aaded38c30339bcfd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:26:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 359
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7688
x-xss-protection: 0
server: cafe
etag: 9086524265215974373
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Oct 2021 16:26:55 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211007/r20110914/client/ Frame 34B5 3 KB
1 KB 207ms
48ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211007/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Oct 2021 16:32:43 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 34B5 123 KB
37 KB 64ms
36ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

sffe /

Resource Hash

393cf048c5b518e266aa392aa2540de2a0d5538f0bae4f44b1b6a89f095a85f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37935
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1633952256361887"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 12 Oct 2021 16:32:54 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211007/r20110914/client/ Frame 34B5 14 KB
6 KB 199ms
41ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211007/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

cafe /

Resource Hash

f4726d988effd5253298f2a2738ca92d780d4105af0ce67eb7e7d1c748fb6909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:29:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6281
x-xss-protection: 0
server: cafe
etag: 18349783599053866072
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Oct 2021 16:29:55 GMT

GET
H2 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/ Frame D25B 3 KB
1 KB 183ms
40ms Document
text/html 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

sffe /

Resource Hash

d125872944107e62b360bd1c4472ca833c0b113ef2b51270b31e1cdcb3312982

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/3857642822384818841/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 1369
date: Mon, 11 Oct 2021 12:35:45 GMT
expires: Tue, 11 Oct 2022 12:35:45 GMT
last-modified: Thu, 15 Apr 2021 13:44:52 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
age: 100629
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 7A33 0
0 84ms
84ms Fetch
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CQ_XQtbhlYfWsAdPBzAau0qbQCfzTisJj_saVy80Nzr74lnEQASDmnIxpYJXikIKgB6AB_4St7QPIAQmoAwHIA0iqBMgBT9CIyqjDfS12qFDVkooyOPQ1mdHPJqG7XlokraUQBj4ip4aSPVmjgfuYQgFrJuP0WRjusdrz9E-oo15yEbs3_WxBdiMvPd2SvR3WYcn51kA4NcvAlK-EAz5BuyFz2bjFo9gFK5CoqDEZ2Wu9Im84u9goQT4YNgkgt_mTeafzR-hSLYFMF4eG3Hy_XPSdgz2T4PB_e5hRugYJugsKbWnmC6SlE5aLthE26wsFFPnqHmj_M3-SXHChIhvj3qVHVD5tpfbKLFtZNzvABNz_xsL4ApIFBAgEGAGSBQQIBRgEoAYugAeS-5odqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G9gHAPIHBRD70ZIC0ggJCIDhgBAQARhfgAoByAsB2BMM0BUBgBcBshccChoIABIUcHViLTIyMTU5NjczODk5NTEwNjAYAA&sigh=uHrnAlR0oUQ&uach_m=[UACH]&template_id=419

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1634056324&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372820&bpp=1&bdt=618&idt=148&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=782430866943&frm=20&pv=2&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=439&ady=717&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=BddfL1LK9N&p=https%3A//www.profinance.ru&dtd=152
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 12 Oct 2021 16:32:54 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211007/r20110914/ Frame 7A33 18 KB
8 KB 167ms
25ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211007/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1634056324&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372820&bpp=1&bdt=618&idt=148&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=782430866943&frm=20&pv=2&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=439&ady=717&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=BddfL1LK9N&p=https%3A//www.profinance.ru&dtd=152

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

cafe /

Resource Hash

d19d72f9c6e5bb747a38571cf87013b5fdc205a277e307aaded38c30339bcfd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:26:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 359
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7688
x-xss-protection: 0
server: cafe
etag: 9086524265215974373
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Oct 2021 16:26:55 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211007/r20110914/client/ Frame 7A33 3 KB
1 KB 189ms
48ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211007/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1634056324&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372820&bpp=1&bdt=618&idt=148&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=782430866943&frm=20&pv=2&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=439&ady=717&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=BddfL1LK9N&p=https%3A//www.profinance.ru&dtd=152

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Oct 2021 16:32:43 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7A33 123 KB
37 KB 59ms
49ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1634056324&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372820&bpp=1&bdt=618&idt=148&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=782430866943&frm=20&pv=2&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=439&ady=717&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=BddfL1LK9N&p=https%3A//www.profinance.ru&dtd=152

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

sffe /

Resource Hash

393cf048c5b518e266aa392aa2540de2a0d5538f0bae4f44b1b6a89f095a85f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37935
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1633952256361887"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 12 Oct 2021 16:32:54 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211007/r20110914/client/ Frame 7A33 14 KB
6 KB 185ms
44ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211007/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1634056324&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372820&bpp=1&bdt=618&idt=148&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=782430866943&frm=20&pv=2&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=439&ady=717&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=BddfL1LK9N&p=https%3A//www.profinance.ru&dtd=152

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

cafe /

Resource Hash

f4726d988effd5253298f2a2738ca92d780d4105af0ce67eb7e7d1c748fb6909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:29:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 179
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6281
x-xss-protection: 0
server: cafe
etag: 18349783599053866072
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Oct 2021 16:29:55 GMT

GET
H2 200 pubads_impl_2021100701.js Show response
securepubads.g.doubleclick.net/gpt/ Frame D1C5 366 KB
124 KB 162ms
40ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021100701.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

sffe /

Resource Hash

74e0705ba9740aea8c7f1f7a8e582ae656c55e1c8d047b212683fadb5e623fa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126551
x-xss-protection: 0
last-modified: Thu, 07 Oct 2021 08:38:34 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 12 Oct 2021 16:32:54 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 903A
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=btwnex&endpoint=eu
https://eus.rubiconproject.com/usync.html?p=btwnex&endpoint=eu

281 B
554 B

34ms
7ms

Document
text/html

23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=btwnex&endpoint=eu
Requested by: Host: cache.betweendigital.com
URL: https://cache.betweendigital.com/code/bidder_18.html?USER_ID=1726420c-09f8-531d-be21-7f82df44c736&CACHEBUSTER=887699
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.42.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://cache.betweendigital.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: about:blank

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Thu, 30 Sep 2021 18:24:26 GMT
ETag: "4001a-119-5cd3a8e7e6a80"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 12 Oct 2021 16:32:54 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://eus.rubiconproject.com/usync.html?p=btwnex&endpoint=eu
Date: Tue, 12 Oct 2021 16:32:54 GMT
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 691D 143 B
163 B 16ms
15ms Document
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9865432956&adk=870026366&adf=2297262845&pi=t.ma~as.9865432956&w=240&lmt=1634056324&psa=0&format=240x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372821&bpp=1&bdt=619&idt=154&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C580x400&nras=1&correlator=782430866943&frm=20&pv=1&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=1345&ady=67&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=23chL86PX0&p=https%3A//www.profinance.ru&dtd=157
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnKpgbc7TANvxoLcZHox37o7jg73_KYjA9_ybP1Im6M84FCv2Uap1NVryZqjTA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9865432956&adk=870026366&adf=2297262845&pi=t.ma~as.9865432956&w=240&lmt=1634056324&psa=0&format=240x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372821&bpp=1&bdt=619&idt=154&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C580x400&nras=1&correlator=782430866943&frm=20&pv=1&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=1345&ady=67&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=23chL86PX0&p=https%3A//www.profinance.ru&dtd=157

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 12 Oct 2021 16:00:15 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1959
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 66A8 143 B
163 B 14ms
13ms Document
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1634056324&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372820&bpp=1&bdt=618&idt=148&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=782430866943&frm=20&pv=2&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=439&ady=717&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=BddfL1LK9N&p=https%3A//www.profinance.ru&dtd=152

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1634056324&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372820&bpp=1&bdt=618&idt=148&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=782430866943&frm=20&pv=2&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=439&ady=717&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=BddfL1LK9N&p=https%3A//www.profinance.ru&dtd=152
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnKpgbc7TANvxoLcZHox37o7jg73_KYjA9_ybP1Im6M84FCv2Uap1NVryZqjTA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1634056324&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372820&bpp=1&bdt=618&idt=148&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=782430866943&frm=20&pv=2&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=439&ady=717&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=BddfL1LK9N&p=https%3A//www.profinance.ru&dtd=152

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 12 Oct 2021 16:00:15 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1960
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 34B5 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1435b0ad38fdc7153b2647d030f50ff0540703d5302704feff8a1a697a2ab01c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 7A33 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e58509ed834e61974af63135af3f86f44c6dfb6c963b0190b479fc5d32d6421f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ Frame D1C5 107 B
122 B 44ms
22ms Script
application/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.profinance.ru

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021100701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame D1C5 107 B
122 B 57ms
24ms Script
application/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.profinance.ru

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021100701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame D1C5 15 KB
9 KB 683ms
650ms XHR
text/plain 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4110945755293157&correlator=1994381749766682&output=ldjh&impl=fifs&eid=44749396%2C31062949&vrg=2021100701&ptt=17&sc=1&sfv=1-0-38&ecs=20211012&iu_parts=21951151498%2Cprofinance.ru%2C970x250quote_show_2&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=970x250&cust_params=Bids%3D30&cookie=ID%3D8fb81349e7e5303a-22a57b0df0ca0063%3AT%3D1634056373%3ART%3D1634056373%3AS%3DALNI_MYjE-foYMLHWVnAG-Sq5D3XLko6OA&cdm=www.profinance.ru&bc=31&abxe=1&lmt=1634056375&dt=1634056375032&dlt=1634056373507&idt=797&ea=0&frm=23&biw=1600&bih=1200&isw=970&ish=250&oid=3&adxs=315&adys=0&adks=4257258892&ucis=ky3yyeajqo8&ifi=1&ifk=2376887133&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&url=https%3A%2F%2Fwww.profinance.ru%2F&top=https%3A%2F%2Fwww.profinance.ru%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x250&msz=970x-1&ga_vid=994921277.1634056375&ga_sid=1634056375&ga_hid=326816416&ga_fc=false&fws=256&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021100701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

8ffb8a1e1268d1f34a479fdb5bb3616bbef859e5356a381bc64b09da03c2fa80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9017
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.profinance.ru
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 4242 6 KB
4 KB 97ms
28ms Document
text/html 142.250.185.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021100701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f1.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html?n=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.profinance.ru/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 12 Oct 2021 16:32:55 GMT
expires: Wed, 12 Oct 2022 16:32:55 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 64D7 9 KB
3 KB 69ms
37ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 01:24:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54497
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Wed, 13 Oct 2021 01:24:38 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 64D7 26 KB
10 KB 64ms
31ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 11 Oct 2021 23:30:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 61345
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 12 Oct 2021 23:30:30 GMT

GET
H2 200 createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 64D7 186 KB
48 KB 144ms
77ms Script
text/javascript 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

sffe /

Resource Hash

575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49100
x-xss-protection: 0
last-modified: Wed, 16 Mar 2016 13:51:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Oct 2021 16:32:55 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ Frame 64D7 84 KB
30 KB 78ms
22ms Script
text/javascript 142.250.185.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f10.1e100.net

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:23:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 537
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="hosted-libraries-pushers"
expires: Wed, 12 Oct 2022 16:23:58 GMT

GET
H3 200 index.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/ Frame 64D7 87 KB
20 KB 80ms
48ms Script
application/x-javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/index.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

sffe /

Resource Hash

fb0be8b1600db51f53288882eaf6cb5f5e3b08840c94c20b36a870ab84590fda

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 81064
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20553
x-xss-protection: 0
last-modified: Thu, 15 Apr 2021 13:45:14 GMT
server: sffe
date: Mon, 11 Oct 2021 18:01:51 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 11 Oct 2022 18:01:51 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 64D7 2 KB
1 KB 88ms
32ms Stylesheet
text/css 142.250.186.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f10.1e100.net

Software

ESF /

Resource Hash

7888a75eac5f8b9dc4c448f10e8dc9030fcae612cb236f1a9e9700d56ae6ef34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 15:06:54 GMT
server: ESF
date: Tue, 12 Oct 2021 16:32:55 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires: Tue, 12 Oct 2021 16:32:55 GMT

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame D25B 9 KB
3 KB 61ms
30ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 01:24:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54497
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Wed, 13 Oct 2021 01:24:38 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame D25B 26 KB
10 KB 55ms
25ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 11 Oct 2021 23:30:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 61345
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 12 Oct 2021 23:30:30 GMT

GET
H2 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame D25B 236 KB
63 KB 97ms
31ms Script
text/javascript 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Oct 2021 16:32:55 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ Frame D25B 84 KB
29 KB 103ms
48ms Script
text/javascript 142.250.185.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f10.1e100.net

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:23:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 537
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="hosted-libraries-pushers"
expires: Wed, 12 Oct 2022 16:23:58 GMT

GET
H3 200 index.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/ Frame D25B 191 KB
45 KB 69ms
39ms Script
application/x-javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

sffe /

Resource Hash

77d2cbdd8a3d06678d37227e4f4b8dc09cb17619d8364b84a0ad14b4b6f5652a

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 188012
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46040
x-xss-protection: 0
last-modified: Thu, 15 Apr 2021 13:44:52 GMT
server: sffe
date: Sun, 10 Oct 2021 12:19:23 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 10 Oct 2022 12:19:23 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 903A 31 KB
9 KB 8ms
8ms Script
text/html 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=btwnex&endpoint=eu
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.42.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 273282a153ded9e3bf56932b20e17408048ddd0d3edf359ebc52e1312a927c4e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=btwnex&endpoint=eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 12 Oct 2021 16:32:55 GMT
Content-Encoding: gzip
Last-Modified: Thu, 30 Sep 2021 18:24:26 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=84362
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9275
Expires: Wed, 13 Oct 2021 15:58:57 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 691D
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

48ms
48ms

Document
text/html

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si?st=NO_DATA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnKpgbc7TANvxoLcZHox37o7jg73_KYjA9_ybP1Im6M84FCv2Uap1NVryZqjTA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 12 Oct 2021 16:32:55 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 12-Oct-2021 17:32:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 12 Oct 2021 16:32:55 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 12 Oct 2021 16:32:55 GMT
server: safe
content-length: 257
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 66A8
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

205ms
205ms

Document
text/html

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1634056324&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372820&bpp=1&bdt=618&idt=148&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=782430866943&frm=20&pv=2&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=439&ady=717&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=BddfL1LK9N&p=https%3A//www.profinance.ru&dtd=152

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si?st=NO_DATA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnKpgbc7TANvxoLcZHox37o7jg73_KYjA9_ybP1Im6M84FCv2Uap1NVryZqjTA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 12 Oct 2021 16:32:55 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 12-Oct-2021 17:32:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 12 Oct 2021 16:32:55 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 12 Oct 2021 16:32:55 GMT
server: safe
content-length: 257
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 903A 284 B
536 B 40ms
10ms Image
image/jpg 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=btwnex&endpoint=eu
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
Content-Type: image/jpg

GET
H2 200 bundle.js Show response
yastatic.net/q/set/s/rsya-tag-users/ Frame ACBB 105 KB
37 KB 43ms
41ms Script
application/javascript 178.154.131.215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/q/set/s/rsya-tag-users/bundle.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

178.154.131.215 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

static.yandex.net

Software

nginx/1.17.9 /

Resource Hash

e1cff21864c46e1da263fa83c14ed6d190bc5afbdd35188de15f10eb8bedd264

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/safeframe-bundles/0.82/1-1-0/render.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: br
last-modified: Wed, 19 May 2021 13:42:44 GMT
server: nginx/1.17.9
etag: W/"82bdc8db563d3e71c35534315f8a9fd5"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: application/javascript
access-control-allow-origin: *
expires: Fri, 15 Oct 2021 04:31:03 GMT
cache-control: public, max-age=31556952
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
strict-transport-security: max-age=43200000; includeSubDomains;
timing-allow-origin: *
x-nginx-request-id: fdecfa3ed35fb29a

GET
H2 200 887699
www.tns-counter.ru/V13a****betweenx_ru/ru/CP1251/tmsec=betweenx_bx-ban-1/ Frame C712 43 B
415 B 45ms
44ms Image
image/gif 194.226.130.229
TNSMSK-

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.tns-counter.ru/V13a****betweenx_ru/ru/CP1251/tmsec=betweenx_bx-ban-1/887699

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

194.226.130.229 , Russian Federation, ASN52016 (TNSMSK-, RU),

Reverse DNS

Software

ms-counter-3.2.12/1.20.1 /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=2678400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cache.betweendigital.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: ms-counter-3.2.12/1.20.1
strict-transport-security: max-age=2678400
content-type: image/gif
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate
timing-allow-origin: *
content-length: 43
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 watch.js Show response
mc.yandex.ru/metrika/ Frame ACBB 131 KB
47 KB 63ms
62ms Script
application/javascript 93.158.134.119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/watch.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/q/set/s/rsya-tag-users/bundle.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.158.134.119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

mc.yandex.ru

Software

Resource Hash

d5c91393fc42ed4d1234c6180d0bd54ab46c10bcac71822415902d5cec48163f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: br
last-modified: Tue, 12 Oct 2021 15:49:43 GMT
etag: "61658467-b968"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
content-length: 47464
expires: Tue, 12 Oct 2021 17:32:55 GMT

GET
H2 200 data Show response
yandex.ru/set/s/rsya-tag-users/ Frame ACBB 403 B
846 B 43ms
42ms Fetch
application/json 77.88.55.55
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/set/s/rsya-tag-users/data?referrer=https%3A%2F%2Fwww.profinance.ru%2F

Requested by

Host: yastatic.net
URL: https://yastatic.net/q/set/s/rsya-tag-users/bundle.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

77.88.55.55 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

yandex.ru

Software

Resource Hash

675c8a007369f3ee8d30772a81d99d6bf891d2bad3f3f3c2b1cc02a184dcc1c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 86400, "success_fraction": 0.001, "failure_fraction": 0.1}
report-to: { "group": "network-errors", "max_age": 86400, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: application/json; charset=utf-8
access-control-allow-origin: https://yastatic.net
cache-control: public,max-age=300
access-control-allow-credentials: true
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

match
s.pubmine.com/ Frame C712
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=429&user_id=1726420c-09f8-531d-be21-7f82df44c736&expires=60
https://s.pubmine.com/match?bidder_id=1&external_user_id=54d6b61d-ab07-4e90-8370-0157819335bd&ssp_data=&gdpr=&gdpr_consent=

43 B
286 B

232ms
29ms

Image
image/gif

63.33.106.135
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.pubmine.com/match?bidder_id=1&external_user_id=54d6b61d-ab07-4e90-8370-0157819335bd&ssp_data=&gdpr=&gdpr_consent=
Requested by: Host: www.profinance.ru
URL: https://www.profinance.ru/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.33.106.135 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-33-106-135.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cache.betweendigital.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 12 Oct 2021 16:32:55 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Encoding: gzip
Transfer-Encoding: chunked
Content-Type: image/gif

Redirect headers

Location: //s.pubmine.com/match?bidder_id=1&external_user_id=54d6b61d-ab07-4e90-8370-0157819335bd&ssp_data=&gdpr=&gdpr_consent=
Date: Tue, 12 Oct 2021 16:32:55 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ Frame ACBB 37 KB
14 KB 89ms
33ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: yastatic.net
URL: https://yastatic.net/q/set/s/rsya-tag-users/bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

8e170827cf6b2dfdb810cef652d70f9cbd9ff58f4242cb735622833b5ff69bd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14427
x-xss-protection: 0
server: cafe
etag: 14346040707932117602
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 12 Oct 2021 16:32:55 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/1014923426/ Frame ACBB
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=t7hlYYHzEIuOgQeWk7iYDA...
https://www.google.com/pagead/1p-user-list/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=690106872&crd=&is_vtc=1&random=2191410085
https://www.google.de/pagead/1p-user-list/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=690106872&crd=&is_vtc=1&random=2191410085&ipr=y

42 B
108 B

173ms
28ms

Image
image/gif

172.217.18.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=690106872&crd=&is_vtc=1&random=2191410085&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/1014923426/?label=uXlUCLqxpmMQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=690106872&crd=&is_vtc=1&random=2191410085&ipr=y
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/1014923426/ Frame ACBB
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=t7hlYabyEM_-gAf99p6QDg...
https://www.google.com/pagead/1p-user-list/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1126875737&crd=&is_vtc=1&random=2570722933
https://www.google.de/pagead/1p-user-list/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1126875737&crd=&is_vtc=1&random=2570722933&ipr=y

42 B
569 B

171ms
27ms

Image
image/gif

172.217.18.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1126875737&crd=&is_vtc=1&random=2570722933&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/1014923426/?label=ZLOgCM6elGEQooH64wM&value=0&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1126875737&crd=&is_vtc=1&random=2570722933&ipr=y
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 index_atlas_1.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/ Frame D25B 41 KB
41 KB 27ms
27ms Image
image/png 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3857642822384818841/index_atlas_1.png?1616060212154

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2215967389951060&output=html&h=400&slotname=9909759162&adk=2895220004&adf=2269621859&pi=t.ma~as.9909759162&w=580&lmt=1634056324&psa=0&format=580x400&url=https%3A%2F%2Fwww.profinance.ru%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1634056372820&bpp=1&bdt=618&idt=148&shv=r20211007&mjsv=m202110050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=782430866943&frm=20&pv=2&ga_vid=245205467.1634056373&ga_sid=1634056373&ga_hid=581908575&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&adx=439&ady=717&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062931&oid=2&pvsid=892301725972480&pem=833&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=BddfL1LK9N&p=https%3A//www.profinance.ru&dtd=152

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

sffe /

Resource Hash

b72cbad51b7a44789fcce6b237621a000e9a9e59c5cb1a2a98b38fec5842ccf6

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 364269
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41918
x-xss-protection: 0
last-modified: Thu, 15 Apr 2021 13:44:52 GMT
server: sffe
date: Fri, 08 Oct 2021 11:21:46 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 08 Oct 2022 11:21:46 GMT

GET
H3 200 164xWCSuMRCufBnFuK3WuMS10bt2HArdrnuZlqXsEzU.js Show response
pagead2.googlesyndication.com/bg/ Frame D25B 35 KB
13 KB 24ms
24ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/164xWCSuMRCufBnFuK3WuMS10bt2HArdrnuZlqXsEzU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

sffe /

Resource Hash

d7ae315824ae3110ae7c19c5b8add6b8c4b5d1bb761c0addae7b9996a5ec1335

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 14:41:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6688
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13308
x-xss-protection: 0
last-modified: Tue, 05 Oct 2021 11:38:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 12 Oct 2022 14:41:27 GMT

GET
H3 200 index_atlas_.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/ Frame 64D7 4 KB
4 KB 24ms
23ms Image
image/png 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16314837203521364516/index_atlas_.png?1569856372288

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

sffe /

Resource Hash

0cd2de224a5d82178ff763e688fb8d1d834ff25244eff3e11d8ab74ff2225982

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 81257
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4116
x-xss-protection: 0
last-modified: Thu, 15 Apr 2021 13:45:14 GMT
server: sffe
date: Mon, 11 Oct 2021 17:58:38 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 11 Oct 2022 17:58:38 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 34B5 42 B
64 B 89ms
60ms Fetch
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssoQQ8SpBZVj4VqtdfQE-tcs8-uoTE1WhkTxBUF1nOCctgYgnhvL3-dntl1sEQRLTO250zd5tpDCsfFPTkUSTHa8Rc-gwdUBunsapwbm2XsoTO5V77tbA&sai=AMfl-YR-SOnoCJpKfocrHaI9fEYCv2UKw2DpN2ZNg8KxLpAq8UKNXqwFu7HMbJ8Lvm2k5ijhTAsWuv2u_Qlj&sig=Cg0ArKJSzLMBqZLg6V--EAE&id=lidar2&mcvt=1028&p=0,0,400,200&mtos=1028,1028,1028,1028,1028&tos=1028,0,0,0,0&v=20211011&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=2&adk=870026366&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1634056373962&rpt=266&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 3 Show response
mc.yandex.com/watch/ Frame ACBB 167 B
262 B 34ms
34ms XHR
application/json 93.158.134.119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/3?wmode=7&page-url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.82%2F1-1-0%2Frender.html&page-ref=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A%3Avf%3A4phzp3o2dbm15p1mc%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A660%3Acn%3A1%3Adp%3A0%3Als%3A1391040989614%3Ahid%3A670292384%3Az%3A0%3Ai%3A202101012163255%3Aet%3A1634056375%3Ac%3A1%3Arn%3A67970091%3Arqn%3A1%3Au%3A1634056375533255544%3Aw%3A1x1%3As%3A1600x1200x24%3Ask%3A1%3Aifr%3A1%3Acpf%3A1%3Ans%3A1634056373150%3Ads%3A0%2C0%2C35%2C1%2C3%2C0%2C%2C15%2C1%2C60%2C60%2C0%2C59%3Adsn%3A0%2C0%2C35%2C0%2C4%2C0%2C%2C18%2C0%2C60%2C60%2C0%2C60%3Ati%3A2%3Ast%3A1634056375

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.158.134.119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

mc.yandex.ru

Software

Resource Hash

373a2dff293196be4e7eedaf5681ce79587b37d0d70c96918a25c62fb7bd3fc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
last-modified: Tue, 12-Oct-2021 16:32:55 GMT
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: https://yastatic.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 167
x-xss-protection: 1; mode=block
expires: Tue, 12-Oct-2021 16:32:55 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7A33 42 B
64 B 60ms
60ms Fetch
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstSQBF1KENZ8c7hax1W3cUt4SjoDIIgz7Zs140Vx7maypuVGWA5LfW_eiAsoiSRgJPEV6tok_4g4C40xY2SHjr_5Tao5LgyqBU7aF8IbFP6PeuiufvOxg&sai=AMfl-YRKC5I1Uqkre9VHSGZi51g0nbxc4ROz8254ch7msFUV_2hz78rWjdjszm-3RbYbhoxDCSSKsgHBhDuO&sig=Cg0ArKJSzFCH9Jt5R5Z9EAE&id=lidar2&mcvt=1094&p=1,0,388,580&mtos=0,0,1094,1094,1094&tos=0,0,1094,0,0&v=20211011&bin=7&avms=nio&bs=0,0&mc=0.6&if=1&app=0&itpl=2&adk=2895220004&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1634056373970&rpt=291&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 advert.gif
mc.yandex.com/metrika/ Frame ACBB 43 B
112 B 33ms
33ms Image
image/gif 93.158.134.119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.158.134.119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

mc.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:55 GMT
last-modified: Tue, 12 Oct 2021 15:49:43 GMT
etag: "61658467-2b"
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Tue, 12 Oct 2021 17:32:55 GMT

GET
H3 200 164xWCSuMRCufBnFuK3WuMS10bt2HArdrnuZlqXsEzU.js Show response
pagead2.googlesyndication.com/bg/ Frame 64D7 35 KB
13 KB 22ms
22ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/164xWCSuMRCufBnFuK3WuMS10bt2HArdrnuZlqXsEzU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

sffe /

Resource Hash

d7ae315824ae3110ae7c19c5b8add6b8c4b5d1bb761c0addae7b9996a5ec1335

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 14:41:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6688
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13308
x-xss-protection: 0
last-modified: Tue, 05 Oct 2021 11:38:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 12 Oct 2022 14:41:27 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/947884341/ Frame ACBB 3 KB
1 KB 31ms
31ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/947884341/?random=1634056375472&cv=9&fst=1634056375472&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.82%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

2895fa3398443b64b2c9bca884f4c96564af2e4cef62f5b612fd952e505c9608

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1117
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/693627671/ Frame ACBB 3 KB
1 KB 30ms
30ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/693627671/?random=1634056375476&cv=9&fst=1634056375476&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.82%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

63ef7a29e8d135a3f538f7fd9efc046280bfb745f7cc34f8b2e7ad048d78989f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1118
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/947884341/ Frame ACBB 3 KB
1 KB 43ms
42ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/947884341/?random=1634056375481&cv=9&fst=1634056375481&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.82%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

097615c181c3395b2d2aceaaaa6e8f18364f3726b2d7152a5a31583f3fd16b29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1118
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/693627671/ Frame ACBB 3 KB
1 KB 28ms
28ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/693627671/?random=1634056375482&cv=9&fst=1634056375482&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.82%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

b983eb00a6ab6eb78ca18ec893324e858fac45c5c38643ce974fbd3f149c4771

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1118
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 tracker
top-fwz1.mail.ru/ 43 B
929 B 44ms
43ms Ping
image/gif 217.69.133.145
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to

Full URL

https://top-fwz1.mail.ru/tracker?js=13;id=74564;u=https%3A//www.profinance.ru/;st=1634056372626;s=1600*1200;vp=1600*1912;touch=0;hds=1;frame=0;flash=;sid=a494689d6a797be6;ver=60.3.0;tz=0%2FEtc%2FUnknown;nt=0/0/1634056371787/////240/241/241/241/331/282/331/412/413/415/839/907/908/3721/3721/;ni=10//4g/0/0/;lvid=1634056372925%3A1634056375510%3A2%3Af606ec10a486d213b4b054cab9aa423f;visible=true;_=0.2136884244131827;e=RT/load;et=1634056375508

Requested by

Host: top-fwz1.mail.ru
URL: https://top-fwz1.mail.ru/js/code.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),

Reverse DNS

top-fwz1.mail.ru

Software

nginx /

Resource Hash

24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.profinance.ru/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
p3p: CP="NOI DSP COR NID CUR PSA OUR NOR"
content-length: 43
pragma: no-cache
amp-access-control-allow-source-origin: https://www.profinance.ru
server: nginx
access-control-allow-methods: GET, POST, HEAD, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: https://www.profinance.ru
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: private, no-cache, no-store, max-age=0
access-control-allow-credentials: true
accept-ch-lifetime: 86400
accept-ch: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
timing-allow-origin: https://www.profinance.ru
access-control-allow-headers: *

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 44ms
43ms XHR
application/json 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20211007&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

cc2ca51e7d7eaa870dacecb5404cbe84116852c578466d47eff77afd715a6837

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8579
x-xss-protection: 0

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 639E 11 KB
5 KB 49ms
17ms Document
text/html 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.profinance.ru

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

44fdd1eb3c024fe9fb4faeb815b2367ace182437a87eb25a75d7802d0f3c88c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: gum.criteo.com
:scheme: https
:path: /syncframe?origin=publishertag&topUrl=www.profinance.ru
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.profinance.ru/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 2048
set-cookie: uid=f337e167-65ac-4954-b0e8-6cda36d8caa4; expires=Sun, 06 Nov 2022 16:32:54 GMT; domain=.criteo.com; path=/; secure; samesite=none
date: Tue, 12 Oct 2021 16:32:54 GMT
content-length: 4685

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 19DE 2 KB
823 B 25ms
8ms Document
text/html 51.89.9.254
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=5d1628750185ace

Requested by

Host: cache.betweendigital.com
URL: https://cache.betweendigital.com/code/bidder_18.html?USER_ID=1726420c-09f8-531d-be21-7f82df44c736&CACHEBUSTER=887699

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip254.ip-51-89-9.eu

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:method: GET
:authority: onetag-sys.com
:scheme: https
:path: /usync/?pubId=5d1628750185ace
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cache.betweendigital.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cache.betweendigital.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H2 200 37412095 Show response
mc.yandex.com/watch/ Frame ACBB 350 B
409 B 33ms
33ms XHR
application/json 93.158.134.119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/37412095?wmode=7&page-url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.82%2F1-1-0%2Frender.html&page-ref=https%3A%2F%2Fwww.profinance.ru%2F&charset=utf-8&site-info=%7B%22extensions%22%3A%22%22%2C%22fromGoogle%22%3A%22false%22%2C%22fromCancel%22%3A%22false%22%2C%22loyal%22%3A%220%22%2C%22sbscrb%22%3A%22%22%2C%22p%22%3A%22%22%2C%22b%22%3A%22%22%2C%22fresh%22%3A%220%22%2C%22infected%22%3A%22%22%2C%22slow%22%3A%22%22%2C%22os%22%3A%22windows%22%2C%22browser%22%3A%22chrome%22%2C%22winxp%22%3A%22false%22%2C%22old%22%3A%22actual%22%2C%22yabroAge%22%3Anull%7D&browser-info=pv%3A1%3Agdpr%3A6%3Avf%3A4phzp3o2dbm15p1mc%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A660%3Acn%3A2%3Adp%3A1%3Als%3A517498242047%3Ahid%3A670292384%3Az%3A0%3Ai%3A202101012163255%3Aet%3A1634056376%3Ac%3A1%3Arn%3A826725487%3Arqn%3A1%3Au%3A1634056375533255544%3Aw%3A1x1%3As%3A1600x1200x24%3Ask%3A1%3Aifr%3A1%3Acpf%3A1%3Ans%3A1634056373150%3Ads%3A0%2C0%2C35%2C1%2C3%2C0%2C%2C15%2C1%2C60%2C60%2C0%2C59%3Adsn%3A0%2C0%2C35%2C0%2C4%2C0%2C%2C18%2C0%2C60%2C60%2C0%2C60%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1634056376%3At%3A

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.158.134.119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

mc.yandex.ru

Software

Resource Hash

2d5fe146be1983fa0e2ca252c82203ef7f1936a1e777fb0512af015fb39cc904

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
last-modified: Tue, 12-Oct-2021 16:32:55 GMT
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: https://yastatic.net
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 350
x-xss-protection: 1; mode=block
expires: Tue, 12-Oct-2021 16:32:55 GMT

GET
H2 204 event
ads.adfox.ru/341266/ 0
66 B 70ms
70ms Image
text/plain 77.88.21.179
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.adfox.ru/341266/event?duid=1634056373589262977&hash=a8fb8f7dce5d3376&pm=bmp&pxo=HYRYShED1OpS-u51BbJ_JbqFTXAtX7A1YvRVpIsCvXnr0I-wV4y8_9apbRdQkuldIMKW97b3YXElv_ufctWVSnKvDM0mpG6ZUVO7PYVirVKV1tBFjip5UQi0HFgl-8jiVW5hXe8oGaB2Hu1EVejrijjTVpKL86FFwec2lpvmhopKwgUiAGE2&p5=inscz&rand=mpwjwmv&sj=oxuQQHeVmUpFIeA6Rd5Fpmw04D98u-4RsM6HL9knGBsy6TqSItcb9OaHisk1OQ%3D%3D&ad-session-id=1419741634056372648&lts=fhnuxeb&ytt=432108075091989&ybv=0.44818&ylv=0.44818&dl=https%3A%2F%2Fwww.profinance.ru%2F&pr=ncjswtt&p1=cmmml&rqs=tTA6jCtnLRm1uGVhTnNkdE0pSpO_6Ncx&rtb-si=b&p2=gyqo

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

77.88.21.179 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

adfox-external-l3-engine.stable.qloud-b.yandex.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
last-modified: Tue, 12 Oct 2021 16:32:55 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
expires: Mon, 04 Dec 1999 21:29:02 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 100ms
100ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Tue, 12 Oct 2021 16:32:55 GMT

GET
H2 200 WK8ejI_zO8i0nGa0D11HntWJCgWamGK0Ym4GW8200J6qk6LX000003Zeb0680aQv0jl0X-mipWuiy0BgvBUr1i2XOl050Q06uWAu1i01oGQqk1QB9FNgBwa7iinSUGyBWrF01uJzwLhG1mBG28A0W802W0e1Y0e9Y0kC0QeB4DepLLEop000roUcPIhEy0i6g0-oc...
an.yandex.ru/count/ 43 B
183 B 61ms
61ms Image
image/gif 87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/count/WK8ejI_zO8i0nGa0D11HntWJCgWamGK0Ym4GW8200J6qk6LX000003Zeb0680aQv0jl0X-mipWuiy0BgvBUr1i2XOl050Q06uWAu1i01oGQqk1QB9FNgBwa7iinSUGyBWrF01uJzwLhG1mBG28A0W802W0e1Y0e9Y0kC0QeB4DepLLEop000roUcPIhEy0i6g0-ocRE1-E72mLEG4CJiXDMRrQpafW7u40d2_hGjCk0K0TWLmOhsxAEFlFnZyCaMy3-15wWN3PaOq1WX-1Y06RWPm1cqgOtHbzQ9YdJI6H9vOM9pNtDbSdPbSYzoDJSqBJBe6V01y1c0mWE270r3Cq4wQNXlL6TKC5KtwHo07Vz_401GPBnh42Y6ZK71NHKDa-WMGa29WRbi5QxC1R3225dFoK0ypoWZYJou1iBEYNA80K81~1=WdyejI_zO0S2hHC0n26vCwe91mFQqDA00O010OW1sQ-rb7-G0SQvqghJW8200fW1nhdIgbEW0V2sg07mjjAgKxW1aEoaWIFO0VAeafu1u06WZAEL0UW1wWFu0SYAthu1c0AYagaOe0A-vgSOm08Bi0Ff18W5zVTea0NZ-Qe2i0MhZ6gu1QkCQi05siC-o0Mzc1RG1O3s7-05b06O1khTX88Bg0RY0hW7W0NG1nRO1n3W1v0DyGS00CA2d_EJ31H0oTaBiinSUGyBWrFe2_NtQ9i6c0s9Yqa_e0x0X3s04BdIiH_0e13G4Ddthr-O4Swx6k0HtgsX0kWHbEdpwlxK-PKDA90CGPc3w2vYajS_c1C2u1EhZ6g85CJRe9kRWlVkjW6W5AkCQgWKu_cg0i0Km8Axs9R8wsdO5BZJWOi6w1IC0j0LkDE1YmRO5S6AzkoZZxpyOvWM0Q0M0R0MiWF95j0Mik_VlW615m3mFvWNfTZ6AxWN0S0NjHBG5z260zWNgQuww1S1cHYW61Mm6EFIbei6k1W1-1YxnEUEbRtoolW1W1c96G-41W000000a1a1e1d00RWP____0U0P0UWPy07m6O320u4Q__-tqACyGow86i24FP0QW42u6WFr6W40002O6ucBITWRW820W07f6s24K3I5J7T1y1lZpUaW-1kom-KVs1przsZW7EFvgWBf703mFu0T_t-P7G3mF-0TXE5VYHu0542e7W4T040Gk0IaLj2WSEu5A3WCXu8zYZBSNg4XfV3XUcXW0ybxQLX-gQTC25duha9mHK05WYKGbasVCwLohC9HKancWB7dkM1kn5YrJXe38gwKph0rymjcY280~1=WduejI_zO082fHC0L26bP0DY0WFSrg-WfGg00SkIJeW1fR2L_tUG0QAjYv_GW8200fW1egsBdr2W0Qwgg06kgekVKBW1WFJmaYBO0SB1yfe1u06MbQ-P0UW1-0AW0exwXG6W0mIm0-85Y0MnxXoG1V-sLh05qFmLk0NG_1N01SYFMyW5g9KNq0McdGdW1PMe1k82k0U01T070jW74E07XWhn1m00Y8VzGe0A0S4A29bLy0OExZ_9-0g0jHZP2xBCN7aF2uDJw0knxXo83BoR1fWDYOj9i3wW3i24FO0GuTxX7S2ma881c17EknhW4TwjeGBe4PJfy-h-rFcL3IYG347iniL47072FvWJ0k0JqFmLY1J4sw2RcuBtxhO1e1JG_1Me5F-sLh0Kwu4mk1I0qmu2q1JVtTOUs1IRiUMA1kWKZ0BG5PknvOe6s1N1YlRieu-y_6EO5W6W5W6m5h83oHRG5hoWthu1WHS0y3-O5vUrj2ou5m705xKIq1VGXWFO5-lHFUWN0vaOe1W7i1ZZqfQB1hWO1FWOkyJdZfMzyihu0O0PYHaFX0O00000090P0Q0Pm06u6V___m7W6H7e6V01y1c0mWE16l__Y_dBVIRvY1h0X3sG6e10k1e3zHe10000c1k9YqdO6o3f6_4lq1MD2eP1y1kNWjbM-1l__Peas1onxXpW7F-sLkaS0F0_W1t_VvaT0F0_u1sXmWM97gWU0Hu05mGTS0b8NQ11uV0RK4OO3WLx56Mu7Ow6G70MjK1S0o5hQLYtr4CYX2nwLo6O8g060XSG4jE0EAETM6NBaVI-cUU1fH5ZcPF685WiIA6Lqdd2_3uoGSsiWsq23W00~1=Wf0ejI_zO102DHG0L29IikM640FAz-gGYnQ00VlNexA9ykQDDuW1Xl-Uj5UG0U2aWwp9W8200fW1uAI3h4cW0Twe0Twu0OQyXhyWs06UexIL0U01X9kqbG7e0L3u0Po8thu1e0BAbAqOc0F0X3sW0mQm0_i4Y0NulH-G1VI98x05mU0Ak0N1u0h01SwKtGJ81U73kG7G1RVV0-05TvW6aj2vgGMe1k82k0U01QGFyGS00CAbofOCW0e1mGfgIElDAPoaFydP2xBCN7aF2uDJw0lulH-839o8thu1w0oR1fWDYOj9S3sW3i24FO0Gpy-26veG6ma00FW_6SWGmA0Gc17EkngXu17UhQ42w16KwVFg_jJvbGqea0n1CSCvGR6Brp-O4mBW4y7W2eWKnDkWcvk2z-ws0Q0KmU0Ag1JqYIF0582GlFskylK_s1J7d-kA1kWKZ0BG5SUVwue6s1N1YlRieu-y_6EO5W6W5W6m5h83oHRG5fo8thu1WHUO5uJqoIku5m705xKIq1VGXWFO5-3BEkWN0vaOe1WLi1ZLn9QB1hWOAVWOkyJdZfMzyihu0O0PYHaFX0O00000090P0Q0Pm06u6V___m7W6G7e6V01y1c0mWE16l__fskjKw6DY1h0X3sG6e10e1ghxC2BjBk7-_q1zHe10000c1k9Yqdf6sZpyEhFM7H1y1k-n9SX-1lvrEy8s1pulH_W7FI98-aS0F0_W1t_VvaT0F0_YHwe7W4W01a44N09IBsWGU7mwr1660u5SnJ9D4Is-OYcxdmC_MmWEJCTgqlU0AZiQyZ4qWp-Lnsvx-e6MiHgqF0CXETyK1r05gJdWkc8GTfYWv2A9uq1xokbim3hMfFeO9k00m00~1?stat-id=70&test-tag=432159923951153&banner-sizes=eyI3MjA1NzYwNTIyMjcxNDk3OSI6IjI0MHgxOTYiLCI3MjA1NzYwNDgwNzk0NTA0MSI6IjI0MHgxOTYiLCI3MjA1NzYwMzg4MTk4NjM1MiI6IjI0MHgxOTYifQ%3D%3D&format-type=117&actual-format=13&pcodever=44818&banner-test-tags=eyI3MjA1NzYwNTIyMjcxNDk3OSI6IjU3MzYxIiwiNzIwNTc2MDQ4MDc5NDUwNDEiOiI1NzM2MiIsIjcyMDU3NjAzODgxOTg2MzUyIjoiNTczNjMifQ%3D%3D&pcode-active-testids=435231%2C0%2C72%3B434271%2C0%2C72%3B436349%2C0%2C71%3B400735%2C0%2C36%3B428463%2C0%2C85&width=240&height=598&confirmTime=2156000&confirmRatio=150000&wmode=0

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 16:32:55 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 12 Oct 2021 16:32:55 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/947884341/ Frame ACBB 42 B
64 B 28ms
28ms Image
image/gif 172.217.23.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/947884341/?random=1634056375472&cv=9&fst=1634054400000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.82%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&async=1&fmt=3&is_vtc=1&random=1119725378&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f100.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/947884341/ Frame ACBB 42 B
108 B 152ms
30ms Image
image/gif 172.217.18.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/947884341/?random=1634056375472&cv=9&fst=1634054400000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.82%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&async=1&fmt=3&is_vtc=1&random=1119725378&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/693627671/ Frame ACBB 42 B
64 B 30ms
30ms Image
image/gif 172.217.23.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/693627671/?random=1634056375476&cv=9&fst=1634054400000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.82%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&async=1&fmt=3&is_vtc=1&random=1317254604&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f100.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/693627671/ Frame ACBB 42 B
108 B 161ms
39ms Image
image/gif 172.217.18.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/693627671/?random=1634056375476&cv=9&fst=1634054400000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.82%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&async=1&fmt=3&is_vtc=1&random=1317254604&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/693627671/ Frame ACBB 42 B
64 B 29ms
29ms Image
image/gif 172.217.23.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/693627671/?random=1634056375482&cv=9&fst=1634054400000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.82%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&async=1&fmt=3&is_vtc=1&random=891248813&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f100.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/693627671/ Frame ACBB 42 B
108 B 149ms
28ms Image
image/gif 172.217.18.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/693627671/?random=1634056375482&cv=9&fst=1634054400000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.82%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&async=1&fmt=3&is_vtc=1&random=891248813&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/947884341/ Frame ACBB 42 B
64 B 29ms
29ms Image
image/gif 172.217.23.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/947884341/?random=1634056375481&cv=9&fst=1634054400000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.82%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&async=1&fmt=3&is_vtc=1&random=2604583280&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f100.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/947884341/ Frame ACBB 42 B
108 B 146ms
28ms Image
image/gif 172.217.18.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/947884341/?random=1634056375481&cv=9&fst=1634054400000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&data=extensions%3D%3BfromGoogle%3Dfalse%3BfromCancel%3Dfalse%3Bloyal%3D0%3Bsbscrb%3D%3Bp%3D%3Bb%3D%3Bfresh%3D0%3Binfected%3D%3Bslow%3D%3Bos%3Dwindows%3Bbrowser%3Dchrome%3Bwinxp%3Dfalse%3Bold%3Dactual&frm=2&url=https%3A%2F%2Fyastatic.net%2Fsafeframe-bundles%2F0.82%2F1-1-0%2Frender.html&ref=https%3A%2F%2Fwww.profinance.ru%2F&async=1&fmt=3&is_vtc=1&random=2604583280&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yastatic.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame 639E 428 B
523 B 19ms
18ms Fetch
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=publishertag&domain=profinance.ru&sn=ChromeSyncframe&so=0&topUrl=www.profinance.ru&cw=1&lsw=1

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.profinance.ru

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

e3093aa486cec4fb49580b862e5bf49e625a88d65ebff6241760d3389c996338

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.profinance.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Tue, 12 Oct 2021 16:32:55 GMT
vary: Accept-Encoding
content-type: application/json; charset=utf-8
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 3163
expires: 0

GET
H3 200 container.html Show response
6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame FFAB 6 KB
3 KB 58ms
27ms Document
text/html 142.250.185.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021100701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f1.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html?n=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.profinance.ru/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 12 Oct 2021 16:32:55 GMT
expires: Wed, 12 Oct 2022 16:32:55 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 204 event
ads.adfox.ru/341266/ 0
18 B 70ms
69ms Image
text/plain 77.88.21.179
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.adfox.ru/341266/event?duid=1634056373589262977&hash=4fc6183b3629377b&pm=bmu&pxo=HYRYShED1OpS-u51BbJ_JbqFTXAtX7A1YvRVpIsCvXnr0I-wV4y8_9apbRdQkuldIMKW97b3YXElv_ufctWVSnKvDM0mpG6ZUVO7PYVirVKV1tBFjip5UQi0HFgl-8jiVW5hXe8oGaB2Hu1EVejrijjTVpKL86FFwec2lpvmhopKwgUiAGE2&p5=inscz&rand=kgqipcl&sj=oxuQQHeVmUpFIeA6Rd5Fpmw04D98u-4RsM6HL9knGBsy6TqSItcb9OaHisk1OQ%3D%3D&ad-session-id=1419741634056372648&lts=fhnuxeb&ytt=432108075091989&ybv=0.44818&ylv=0.44818&dl=https%3A%2F%2Fwww.profinance.ru%2F&pr=ncjswtt&p1=cmmml&rqs=tTA6jCtnLRm1uGVhTnNkdE0pSpO_6Ncx&rtb-si=b&p2=gyqo&resp-time=2255

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

77.88.21.179 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

adfox-external-l3-engine.stable.qloud-b.yandex.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
last-modified: Tue, 12 Oct 2021 16:32:55 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
expires: Mon, 04 Dec 1999 21:29:02 GMT

GET
H3 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame D1C5 72 KB
27 KB 30ms
30ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021100701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

sffe /

Resource Hash

9d95be8c77455d049fd9b1b0cf720b8bb3529a03fe60d71687ce2031d6d85c10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27658
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1633952273750605"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 12 Oct 2021 16:32:55 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame D1C5 11 KB
8 KB 39ms
39ms XHR
application/json 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021100701&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021100701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

3d79822a10942d4aefde26ea7b154f47d9218452a86a236241667e6139c7932e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8492
x-xss-protection: 0

GET
H2

200

1726420c-09f8-531d-be21-7f82df44c736
an.yandex.ru/mapuid/betweendigitalis/ Frame C712
Redirect Chain

https://ads.betweendigital.com/match?bidder_id=43554&callback_url=https%3A%2F%2Fan.yandex.ru%2Fmapuid%2Fbetweendigitalis%2F1726420c-09f8-531d-be21-7f82df44c736
https://an.yandex.ru/mapuid/betweendigitalis/1726420c-09f8-531d-be21-7f82df44c736

43 B
96 B

57ms
57ms

Image
image/gif

87.250.250.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/betweendigitalis/1726420c-09f8-531d-be21-7f82df44c736

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.250.250.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cache.betweendigital.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 16:32:55 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Tue, 12 Oct 2021 16:32:55 GMT

Redirect headers

location: https://an.yandex.ru/mapuid/betweendigitalis/1726420c-09f8-531d-be21-7f82df44c736
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 373F 12 KB
5 KB 23ms
23ms Document
text/html 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.profinance.ru/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Tue, 12 Oct 2021 16:27:49 GMT
expires: Wed, 12 Oct 2022 16:27:49 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 306
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame ADF3 783 B
535 B 29ms
28ms Document
text/html 172.217.23.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f100.1e100.net

Software

GSE /

Resource Hash

81e9ee9c729ecf390cf2ce8bc307e378748821d26f3d5c35583c5809157d1555

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-BSPOpVj1DmZXyTUVyMQVDA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.profinance.ru/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Tue, 12 Oct 2021 16:32:55 GMT
date: Tue, 12 Oct 2021 16:32:55 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-BSPOpVj1DmZXyTUVyMQVDA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame D1C5 17 KB
6 KB 46ms
46ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021100701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Tue, 12 Oct 2021 16:32:55 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6371 624 B
297 B 28ms
27ms Document
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COykVhCv2FYYv8KEsAEwAQ&v=APEucNVSmAsmhmX8N6CcHW4lSqsiDdSLcKkke2vVVBGI2-NALAaBNkQaCwRvPHZ1j0Vm5O1CskUwo4m3Y2M_PQORQgJ0akIkoQWe2KND38yxMry2cYB-vtbGDCOOvDZMOmQYNGqz9j-UCRJzPbrIERVBRZfONBW--wrxeyash_sBWi4H3rNfidY

Requested by

Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=COykVhCv2FYYv8KEsAEwAQ&v=APEucNVSmAsmhmX8N6CcHW4lSqsiDdSLcKkke2vVVBGI2-NALAaBNkQaCwRvPHZ1j0Vm5O1CskUwo4m3Y2M_PQORQgJ0akIkoQWe2KND38yxMry2cYB-vtbGDCOOvDZMOmQYNGqz9j-UCRJzPbrIERVBRZfONBW--wrxeyash_sBWi4H3rNfidY
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnKpgbc7TANvxoLcZHox37o7jg73_KYjA9_ybP1Im6M84FCv2Uap1NVryZqjTA; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 12 Oct 2021 16:32:55 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame FFAB 81 KB
30 KB 62ms
62ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AXjkjUyN7L09Qyr2AWYPMDSm7B3QJt3ZNO0cKpxfWBGkpH6aUGiI6CYllApKB5DQS7pUrsuRqdZyBM8HG22-y3rrPj9FE82FV71dcf-3AjXCW4yM6xQY8JEVNpTBpry-sMMGlIsxn29RB98JB4rQ6FMd42JA&dbm_d=AKAmf-BVdTzylFcz7cCmfIy6D6GprE7kZR_d7lBHBHW0qPT-2nJlhl83tiVm16A8eQi1wnLzEOuf4YmsUW_jG6eidoa4nYBl0lbHODN3JHCfOVFUxTdYsF7_9p4W6G6luoWnQIgBLWVenMiSnjXI7GXR9iclTAUzdgR_St3eu44oOUscFvHsg68caYvsrziL96oPiE29rLb64wZAw-0bT8dWIdVL8tK2cbCrdkyTE8F5il2qUa73-FVg-3PUoRUJfHQpzD27_96DU2w_fKaGf18YbSGGDEqmjGzXcKaxhTG27XM8ebJSmFaDsPru8PKfKBf8G1EKTPz3uNYnExMa3JEuMS1QqJkfokppKWN5oPBTG4pvDFblRXn0qW2te2ElqYy7CoYf9u-zcLU_lmsDDk5BwOo9i3dbYREk5P3aYETQJXypD81-tBEL5ItRp3Wx-jM2tzTGXe_DyvDSGkmhOkNohkSdwh8pvq9BN2_-TXgsB8JIpxQCrVmCJGxHIfm95l7f7fyz9Om5NbinXhHpTGhbZ5Pa2T7wsucFSfwh8q-V-WqKQ-pdiVlZaP1FyBCLtYWvxXk6-V4VN5_4g3i6IuLCFgY9VvAr96ifTKw-cC4CbzgPBsBuyi_gQJVfOTK9tm1IN330CQXMX4gErZiwAxHSTGdKJU7ubjYKtKPrTzjdIFj4CDra707nqkqXP9VtuR7if8XH2Q74tQVQgTojnM91VR6C7wcswco1DUTpFIYN-JxBkJDpS8gNPSAZg5nwf9BJEnCiiyBB_D2mEHHoStLr_X6-m_U2um9WcQ9FRHFo6ZpHo_RCjruadL_t-S79G_rXu6gbiZEYNwgs89ioGgR-nRaCJFAJzzTB14s3YCiNRWmyg4BkbcqJYFRbnfYeBjlaaXdbumNcknZeYBE5qCAc_cu3twSKhtHUJeXsLLZoMm4Wx4f2dwq-oN1XfVOR0zUtQOYMad3VMji09Fr1lP8ETpHV1PlEU80tkN4cpiwjHlSAs5w4-jvmxAl2sp_UuUs-kXnGt-CK2jjZi4ZbnAfzabA1wtpYCkbU3TSdbxWT2mwwnKgW2tXksyKotA_ER1Pyl6tkDnzudtdaQlYMyWz_nC-aI7jYJi1f92fqbn8c10cZBvJfUHmJiHC130vuXKcQD7UKVbh5_EOm7ylNXDdB9rhyoOqxdAAEmdIVh_Cy2dpGOUJy3-uK6UTy8R2Hhy4PmkKutemOO_WKcA8oavCRrKmbFa76Fccmm-Zv3MCFDy7Ai3LC43AP8W7_d6juG_p-gRzPF8TjnKGU2Fie7c2vwck5pMfsAqBDVK51AC5vsRlgKGW8Y67lv6XOyOlHD06u5SXkUbUMo1JlwgyPbQzcElfc1m9JgsYGW3ptztLSCZdJnMANTPCJa1_oHYyhCjoQUXel4nFDS9biS27esEnLXyOPO5n1PtkmsI_iNVTlAzSrukbODHOz9VtxHHruX5ljEkgLe3nIf3CZi08G9lSjo1YQkYWQ_g8y1mGJljaslFkeC2t7FL20-FkT2YDBGtqiiVen9CMIpp6TjjTpo-Ll5WAlbYhjUL_Zn7vtWkfWhPs4X-YS5-1noye52NcOgLryOT-Y_mH3NsooXF4CIdRG-7y_jepuTYeEZGaLt968VU0cH2nwhZAnN7z_mqYxrpSZNyUYPLH2G-TkPEgSjEEhO0U7M6PlZt3VdBQTq3IFUNWpEKvlQaCE65bvRFLKixq0RbdK-1rLHLihpLVlHhCxS0lOR5yaxcp9EJICYit9tbMcV6mkmRH1tIDVF706MA_kEUangckbI540Ndsmao9tIJdwdbEvp28G7Z1LqiwunCMkNAGdRDgpJek0cz-Aw63Illld-P45lF0JcEdIROKFe3xXpVxqEaPLluow2Shflh4RPdaoEStysq155qOwSs3iulVBAEiPYkRvPH9X3x7hbFQXkBqioiI7hj7cgTk7v-hycx74l9qTjwpwMCBGsjUwZiOrt4kjqrM3E0rhltZO62LafD_xxijUlzKElpYxdL6zGviMneXjcM_iwh6HuNlER3SvF4c7O4ofI1S0ps0wuSdUYlGns3tCvroauS4cdwYmhNP_svK6M2IqRUQZnlCW6X2Fkjar0HgPgNVGVlnAXR32rnSxlWLoIisqPj9NUN61bJL9sIKm46LnSX91yC-_3GCgs9FmsLy2IM8IdUrt3cYZsTX3sGwWund6yZmNiBoRegIPJWboeA0HlBf_mNfGyDpzMK8lO-WVv8hpnj61Wme-_56RHu-atYFTcg0_ryAZeYvEzIEIhd4We2Uw0tZ4zvwZDzV69PuCxp7m5YmZDVP3QnLVDLZH77OaZIvZYxodJk7JmgwJbGOMX5JDy2jfIlmGmuo1u7MDS1iEIHUvf0dzWs1QVzuuj8pTkxVttJlU47t1UAi8J8-CQ3QOAwYnTSgPxxpMm7hMtvsd7vzv_2OQYBXSaVcNBZhj21gW5Uw02wFCTmVIGEIg53ece5DygWncOIEh3WTrxuNObK93WyxKOtjlv3ivzHHS2JHx6IQxApVc0GmjBjIvfmcIjF7dNkmTippwFfWDTTtF7RMyNilAe_Uiu82uAmbbetg4lRFRC2EY1Z2T2FoQuNFaFs09gqQFX43xR7EcR962O_xcgCtnq-_QFY9L4GZxOH9BekAv5EuJtH5KIPVvLJHfkD33pBMVpx3FqakLZjqti43XsyHLSba0rv11WhNRVSsm5Y3ATX15QJofdjZDd4sSUKTmJz4k1YkkUiAcs2m-3q2b-7PaayqcP42PLaRTndFFavfSdCNfZiuoViBTBPhbTyzHiMDmjYa6SVk2KQKfq5a_BJLS_gb1M9aow53BkrMD4YZrZWvfVzo-_7Qrk8Nf8oeMK5w8ZmQVXRvlvBvp_ERfNTlt-WcgPMZV4fKIBhOC2q0ZLcjhNGqwuN4x84FjvpybpxGaAt1eL57pkRXAM-hfsP38u7efI-TmsUsF4Gtb7G8RAyF92JQaE0y2V5YX4l6_sSq5DqdqRHQQuGqoTbopgqbrK5JanRJM6uShWOkXHpLhU35yEYY6Nz92r_50ot3AJGVGn0EhgmNKqp7UnRZze2BEE9HSKRQLfwqDmMbVS4gp0c0Tpl5tkTNvWi8zLkW2-Of386q6xDe3nFcIi4G2wU1rQk3JvZmnMfu5KF3RK7ZJM9tgJ3RuMxRXCF9JupLIqcHlT0pDPI1FUw6nuUh-KbITOYAI8VNFVb22mO2oPY1Ier8ANQfXtN8YhrDfJMjyrwG8bnB_D_-L44HiftqLM1PCC4AHV0Rbbmwb_FS_xmHAlFCJ5io&cid=CAASEuRoefEguaesMHd0BlseqnAD6g&rfl=2%2Chttps%253A%252F%252Fwww.profinance.ru%242%2Chttps%253A%252F%252Fwww.profinance.ru%252F%240

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

1c9866090dab321a8670adc59970b9bee414933fab6f0f124ad64c0f87378912

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30197
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame FFAB 42 B
63 B 55ms
54ms Image
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-By_LdGGonfVh_MntmJKIvrs_qh5Orj3gWfZIU2GfpsHPiARSX6hf484CZpk1vTiXZmBlpaZfcUMKF8Uc4mI45TRbDxxiMSspQP1TQbtUZLIyj_gvE

Requested by

Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211007/r20110914/client/ Frame FFAB 3 KB
1 KB 24ms
23ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211007/r20110914/client/window_focus_fy2019.js

Requested by

Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Oct 2021 16:32:43 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FFAB 123 KB
37 KB 36ms
35ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

sffe /

Resource Hash

393cf048c5b518e266aa392aa2540de2a0d5538f0bae4f44b1b6a89f095a85f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37935
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1633952256361887"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 12 Oct 2021 16:32:55 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211007/r20110914/client/ Frame FFAB 14 KB
6 KB 24ms
23ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211007/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

cafe /

Resource Hash

f4726d988effd5253298f2a2738ca92d780d4105af0ce67eb7e7d1c748fb6909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:29:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 180
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6281
x-xss-protection: 0
server: cafe
etag: 18349783599053866072
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Oct 2021 16:29:55 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame FFAB 0
0 25ms
24ms Image
text/html 172.217.23.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQCKyaSPmquI9JxouiwB4LAzE6-0JtHgKEs4fj72HAKdKVoqR662vAmxOkEb5OcJyn3Q0bPPKe4nc2-H-Krg8e72DO87w
Requested by: Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.23.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: mil04s23-in-f100.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame ADF3 0
0 77ms
77ms Image
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gda_r20211007&jk=892301725972480&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.74.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s02-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 164xWCSuMRCufBnFuK3WuMS10bt2HArdrnuZlqXsEzU.js Show response
pagead2.googlesyndication.com/bg/ Frame 373F 35 KB
13 KB 22ms
21ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/164xWCSuMRCufBnFuK3WuMS10bt2HArdrnuZlqXsEzU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

sffe /

Resource Hash

d7ae315824ae3110ae7c19c5b8add6b8c4b5d1bb761c0addae7b9996a5ec1335

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 14:41:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6688
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13308
x-xss-protection: 0
last-modified: Tue, 05 Oct 2021 11:38:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 12 Oct 2022 14:41:27 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 0398 12 KB
5 KB 23ms
23ms Document
text/html 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.profinance.ru/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Tue, 12 Oct 2021 16:27:49 GMT
expires: Wed, 12 Oct 2022 16:27:49 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 306
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame E165 783 B
535 B 28ms
28ms Document
text/html 172.217.23.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f100.1e100.net

Software

GSE /

Resource Hash

1e70bd86f045fe84cd231681101c4dad25471dc78d95743606d84bc3681820d2

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-sk+TpwQ+AGTJaY76RQS1zg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.profinance.ru/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Tue, 12 Oct 2021 16:32:55 GMT
date: Tue, 12 Oct 2021 16:32:55 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-sk+TpwQ+AGTJaY76RQS1zg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6371
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED9LMPKgolCuHXhS5m9rUTM&google_cver=1

43 B
1014 B

26ms
22ms

Image
image/gif

184.30.20.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED9LMPKgolCuHXhS5m9rUTM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COykVhCv2FYYv8KEsAEwAQ&v=APEucNVSmAsmhmX8N6CcHW4lSqsiDdSLcKkke2vVVBGI2-NALAaBNkQaCwRvPHZ1j0Vm5O1CskUwo4m3Y2M_PQORQgJ0akIkoQWe2KND38yxMry2cYB-vtbGDCOOvDZMOmQYNGqz9j-UCRJzPbrIERVBRZfONBW--wrxeyash_sBWi4H3rNfidY
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.20.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-20-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Oct 2021 16:32:56 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 12 Oct 2021 16:32:56 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED9LMPKgolCuHXhS5m9rUTM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6371
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YWW4t4hHdsm64aL6pdS6lgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED9LMPKgolCuHXhS5m9rUTM&google_cver=1

43 B
1014 B

14ms
13ms

Image
image/gif

184.30.20.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED9LMPKgolCuHXhS5m9rUTM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COykVhCv2FYYv8KEsAEwAQ&v=APEucNVSmAsmhmX8N6CcHW4lSqsiDdSLcKkke2vVVBGI2-NALAaBNkQaCwRvPHZ1j0Vm5O1CskUwo4m3Y2M_PQORQgJ0akIkoQWe2KND38yxMry2cYB-vtbGDCOOvDZMOmQYNGqz9j-UCRJzPbrIERVBRZfONBW--wrxeyash_sBWi4H3rNfidY
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.20.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-20-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Oct 2021 16:32:56 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 12 Oct 2021 16:32:56 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:56 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESED9LMPKgolCuHXhS5m9rUTM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 6371
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEBIuzvDkDGfBNIapwHcpLak&google_cver=1

0
580 B

18ms
8ms

Image
text/html

37.252.172.38
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEBIuzvDkDGfBNIapwHcpLak&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COykVhCv2FYYv8KEsAEwAQ&v=APEucNVSmAsmhmX8N6CcHW4lSqsiDdSLcKkke2vVVBGI2-NALAaBNkQaCwRvPHZ1j0Vm5O1CskUwo4m3Y2M_PQORQgJ0akIkoQWe2KND38yxMry2cYB-vtbGDCOOvDZMOmQYNGqz9j-UCRJzPbrIERVBRZfONBW--wrxeyash_sBWi4H3rNfidY

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Oct 2021 16:32:55 GMT
X-Proxy-Origin: 216.131.111.132; 216.131.111.132; 690.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: eb9ef320-57f8-44ab-adc3-bc6c98a8ab56
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEBIuzvDkDGfBNIapwHcpLak&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6371
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA4ODg4Njk3MzkxOTM2NDIyNw%3D%3D

170 B
188 B

35ms
35ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA4ODg4Njk3MzkxOTM2NDIyNw%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 12 Oct 2021 16:32:55 GMT
X-Proxy-Origin: 216.131.111.132; 216.131.111.132; 690.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 250cc780-fce5-45d4-9af1-7c43c497456a
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA4ODg4Njk3MzkxOTM2NDIyNw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame FFAB 169 KB
58 KB 54ms
23ms Script
text/javascript 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

sffe /

Resource Hash

2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
Origin: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 11:08:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19493
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59842
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 13 Oct 2021 11:08:02 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211007/r20110914/elements/html/ Frame FFAB 8 KB
3 KB 22ms
21ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211007/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AXjkjUyN7L09Qyr2AWYPMDSm7B3QJt3ZNO0cKpxfWBGkpH6aUGiI6CYllApKB5DQS7pUrsuRqdZyBM8HG22-y3rrPj9FE82FV71dcf-3AjXCW4yM6xQY8JEVNpTBpry-sMMGlIsxn29RB98JB4rQ6FMd42JA&dbm_d=AKAmf-BVdTzylFcz7cCmfIy6D6GprE7kZR_d7lBHBHW0qPT-2nJlhl83tiVm16A8eQi1wnLzEOuf4YmsUW_jG6eidoa4nYBl0lbHODN3JHCfOVFUxTdYsF7_9p4W6G6luoWnQIgBLWVenMiSnjXI7GXR9iclTAUzdgR_St3eu44oOUscFvHsg68caYvsrziL96oPiE29rLb64wZAw-0bT8dWIdVL8tK2cbCrdkyTE8F5il2qUa73-FVg-3PUoRUJfHQpzD27_96DU2w_fKaGf18YbSGGDEqmjGzXcKaxhTG27XM8ebJSmFaDsPru8PKfKBf8G1EKTPz3uNYnExMa3JEuMS1QqJkfokppKWN5oPBTG4pvDFblRXn0qW2te2ElqYy7CoYf9u-zcLU_lmsDDk5BwOo9i3dbYREk5P3aYETQJXypD81-tBEL5ItRp3Wx-jM2tzTGXe_DyvDSGkmhOkNohkSdwh8pvq9BN2_-TXgsB8JIpxQCrVmCJGxHIfm95l7f7fyz9Om5NbinXhHpTGhbZ5Pa2T7wsucFSfwh8q-V-WqKQ-pdiVlZaP1FyBCLtYWvxXk6-V4VN5_4g3i6IuLCFgY9VvAr96ifTKw-cC4CbzgPBsBuyi_gQJVfOTK9tm1IN330CQXMX4gErZiwAxHSTGdKJU7ubjYKtKPrTzjdIFj4CDra707nqkqXP9VtuR7if8XH2Q74tQVQgTojnM91VR6C7wcswco1DUTpFIYN-JxBkJDpS8gNPSAZg5nwf9BJEnCiiyBB_D2mEHHoStLr_X6-m_U2um9WcQ9FRHFo6ZpHo_RCjruadL_t-S79G_rXu6gbiZEYNwgs89ioGgR-nRaCJFAJzzTB14s3YCiNRWmyg4BkbcqJYFRbnfYeBjlaaXdbumNcknZeYBE5qCAc_cu3twSKhtHUJeXsLLZoMm4Wx4f2dwq-oN1XfVOR0zUtQOYMad3VMji09Fr1lP8ETpHV1PlEU80tkN4cpiwjHlSAs5w4-jvmxAl2sp_UuUs-kXnGt-CK2jjZi4ZbnAfzabA1wtpYCkbU3TSdbxWT2mwwnKgW2tXksyKotA_ER1Pyl6tkDnzudtdaQlYMyWz_nC-aI7jYJi1f92fqbn8c10cZBvJfUHmJiHC130vuXKcQD7UKVbh5_EOm7ylNXDdB9rhyoOqxdAAEmdIVh_Cy2dpGOUJy3-uK6UTy8R2Hhy4PmkKutemOO_WKcA8oavCRrKmbFa76Fccmm-Zv3MCFDy7Ai3LC43AP8W7_d6juG_p-gRzPF8TjnKGU2Fie7c2vwck5pMfsAqBDVK51AC5vsRlgKGW8Y67lv6XOyOlHD06u5SXkUbUMo1JlwgyPbQzcElfc1m9JgsYGW3ptztLSCZdJnMANTPCJa1_oHYyhCjoQUXel4nFDS9biS27esEnLXyOPO5n1PtkmsI_iNVTlAzSrukbODHOz9VtxHHruX5ljEkgLe3nIf3CZi08G9lSjo1YQkYWQ_g8y1mGJljaslFkeC2t7FL20-FkT2YDBGtqiiVen9CMIpp6TjjTpo-Ll5WAlbYhjUL_Zn7vtWkfWhPs4X-YS5-1noye52NcOgLryOT-Y_mH3NsooXF4CIdRG-7y_jepuTYeEZGaLt968VU0cH2nwhZAnN7z_mqYxrpSZNyUYPLH2G-TkPEgSjEEhO0U7M6PlZt3VdBQTq3IFUNWpEKvlQaCE65bvRFLKixq0RbdK-1rLHLihpLVlHhCxS0lOR5yaxcp9EJICYit9tbMcV6mkmRH1tIDVF706MA_kEUangckbI540Ndsmao9tIJdwdbEvp28G7Z1LqiwunCMkNAGdRDgpJek0cz-Aw63Illld-P45lF0JcEdIROKFe3xXpVxqEaPLluow2Shflh4RPdaoEStysq155qOwSs3iulVBAEiPYkRvPH9X3x7hbFQXkBqioiI7hj7cgTk7v-hycx74l9qTjwpwMCBGsjUwZiOrt4kjqrM3E0rhltZO62LafD_xxijUlzKElpYxdL6zGviMneXjcM_iwh6HuNlER3SvF4c7O4ofI1S0ps0wuSdUYlGns3tCvroauS4cdwYmhNP_svK6M2IqRUQZnlCW6X2Fkjar0HgPgNVGVlnAXR32rnSxlWLoIisqPj9NUN61bJL9sIKm46LnSX91yC-_3GCgs9FmsLy2IM8IdUrt3cYZsTX3sGwWund6yZmNiBoRegIPJWboeA0HlBf_mNfGyDpzMK8lO-WVv8hpnj61Wme-_56RHu-atYFTcg0_ryAZeYvEzIEIhd4We2Uw0tZ4zvwZDzV69PuCxp7m5YmZDVP3QnLVDLZH77OaZIvZYxodJk7JmgwJbGOMX5JDy2jfIlmGmuo1u7MDS1iEIHUvf0dzWs1QVzuuj8pTkxVttJlU47t1UAi8J8-CQ3QOAwYnTSgPxxpMm7hMtvsd7vzv_2OQYBXSaVcNBZhj21gW5Uw02wFCTmVIGEIg53ece5DygWncOIEh3WTrxuNObK93WyxKOtjlv3ivzHHS2JHx6IQxApVc0GmjBjIvfmcIjF7dNkmTippwFfWDTTtF7RMyNilAe_Uiu82uAmbbetg4lRFRC2EY1Z2T2FoQuNFaFs09gqQFX43xR7EcR962O_xcgCtnq-_QFY9L4GZxOH9BekAv5EuJtH5KIPVvLJHfkD33pBMVpx3FqakLZjqti43XsyHLSba0rv11WhNRVSsm5Y3ATX15QJofdjZDd4sSUKTmJz4k1YkkUiAcs2m-3q2b-7PaayqcP42PLaRTndFFavfSdCNfZiuoViBTBPhbTyzHiMDmjYa6SVk2KQKfq5a_BJLS_gb1M9aow53BkrMD4YZrZWvfVzo-_7Qrk8Nf8oeMK5w8ZmQVXRvlvBvp_ERfNTlt-WcgPMZV4fKIBhOC2q0ZLcjhNGqwuN4x84FjvpybpxGaAt1eL57pkRXAM-hfsP38u7efI-TmsUsF4Gtb7G8RAyF92JQaE0y2V5YX4l6_sSq5DqdqRHQQuGqoTbopgqbrK5JanRJM6uShWOkXHpLhU35yEYY6Nz92r_50ot3AJGVGn0EhgmNKqp7UnRZze2BEE9HSKRQLfwqDmMbVS4gp0c0Tpl5tkTNvWi8zLkW2-Of386q6xDe3nFcIi4G2wU1rQk3JvZmnMfu5KF3RK7ZJM9tgJ3RuMxRXCF9JupLIqcHlT0pDPI1FUw6nuUh-KbITOYAI8VNFVb22mO2oPY1Ier8ANQfXtN8YhrDfJMjyrwG8bnB_D_-L44HiftqLM1PCC4AHV0Rbbmwb_FS_xmHAlFCJ5io&cid=CAASEuRoefEguaesMHd0BlseqnAD6g&rfl=2%2Chttps%253A%252F%252Fwww.profinance.ru%242%2Chttps%253A%252F%252Fwww.profinance.ru%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3128
x-xss-protection: 0
server: cafe
etag: 3658073882064373855
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Oct 2021 16:32:54 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211007/r20110914/ Frame FFAB 23 KB
9 KB 22ms
22ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211007/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

599ad71fae7cb8d014f7c2d29b8450bc7c34f8e32d49fa103716becef8ae9964

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:30:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 158
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9283
x-xss-protection: 0
server: cafe
etag: 1044373809082006429
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Oct 2021 16:30:17 GMT

GET
H2 200 sync
t.adx.opera.com/ Frame C712 0
392 B 79ms
25ms Image
text/plain 82.145.213.8
NO-OPERA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.adx.opera.com/sync?vendor=60079&uid=1726420c-09f8-531d-be21-7f82df44c736
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 82.145.213.8 , Norway, ASN39832 (NO-OPERA, NO),
Reverse DNS: n-sysadmin-jumpbox-03.feednews.opera.technology
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cache.betweendigital.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:56 GMT
server: Tengine
access-control-allow-methods: POST, GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
content-length: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame E165 0
0 77ms
77ms Image
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021100701&jk=4110945755293157&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.74.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s02-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 164xWCSuMRCufBnFuK3WuMS10bt2HArdrnuZlqXsEzU.js Show response
pagead2.googlesyndication.com/bg/ Frame 0398 35 KB
13 KB 22ms
22ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/164xWCSuMRCufBnFuK3WuMS10bt2HArdrnuZlqXsEzU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

sffe /

Resource Hash

d7ae315824ae3110ae7c19c5b8add6b8c4b5d1bb761c0addae7b9996a5ec1335

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 14:41:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6689
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13308
x-xss-protection: 0
last-modified: Tue, 05 Oct 2021 11:38:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 12 Oct 2022 14:41:27 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FFAB 41 KB
15 KB 24ms
24ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 11:05:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19625
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Wed, 12 Oct 2022 11:05:51 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D850 1 KB
749 B 22ms
21ms Document
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 12 Oct 2021 08:58:57 GMT
expires: Wed, 13 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 27239
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame FFAB 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0574454d747d1de69a8f438cbf9b9eadd695669b989a1bb57d1c3ca0241aaeed

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 21A0 22 KB
8 KB 23ms
23ms Document
text/html 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Tue, 12 Oct 2021 11:08:33 GMT
expires: Wed, 12 Oct 2022 11:08:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 19463
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/13379066290707103744/ Frame 2F21 138 KB
36 KB 57ms
29ms Document
text/html 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13379066290707103744/index.html?e=69&leftOffset=0&topOffset=0&c=9ptZeweDRe&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

sffe /

Resource Hash

f0c0b837d6e1f168f98cd597a21c7b650ca6050382524ff57bc8b8abf9a35268

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /sadbundle/13379066290707103744/index.html?e=69&leftOffset=0&topOffset=0&c=9ptZeweDRe&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
date: Tue, 12 Oct 2021 16:32:56 GMT
expires: Wed, 12 Oct 2022 16:32:56 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 27 Jul 2021 12:13:17 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame FFAB 0
255 B 115ms
100ms Ping
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvLIyWRDlEytdtNvBjsNN24KOkogvyYeRcHR7sgG5WXeo3HH9-lGXqieuXXDKrdaAGxhh7go9-14Po2gypzoXmvXu-IzUKu9kjNdZSOYEN0NOxFdDtyIKhYIagPNlTWtFN5F__lOkLL3jc9lo2nytDWaBH3Xtaqglr7BAHHr6Q45Fm2SS2e95t-ist95BvMUSM3bgRZrLe9ZxQmx-om6QnIuX1u4ofTiowIc8xVzE5TCpkXHd5v8-rAlvrfMRKrpM2uY44DlnJSMtTiihx42aCZvWrgmqEhxsgFecRQ_ulEQrCQTXZ8hGn0s8YUn1UH6t2glJMdlA2qSRoTu1xAVCd2t8shLBkbZpjeau5jR8IljizBwzFDdPwqc-85QVTFOaGiow1OyJ8oyWRIz1Ttxg-rclmB5kzCzlB6ZkYVmzVjxorh4OYEn5k9Q5XY-tH9Mqp_Mz6cS7WvK_QM7OMCAtDG5iQnq9qikirRxGcFIwho2SSmWIuiqyQv2tOn3vhgHsAPJtvM3i7uvpZYk95KEDHS4eRUUC5nYd-5VEqM54YN89Hp1EiaRTyIQ359q0IFAg_HtUc8U9j1M91XFMapzetBYlCU7Bs2l7FUqr-JbIOBYrIN2hx2j8_e2NB9dg1oDfUVY-TA4XVOWjK5_Qty3uQnJGQspwMF7VLHGpFCp-US2eIFQjujpCYTxkIloyTA4luriySLd_sN_F28xkSPSvrL2iKtn4hI40dWrRmVswN94ef1SWSB0uMtMn9xicx8Z9Y3QFHc-mvmFmWVRyV_DZVb9kj0csd0b_cLJadhwB8ZTgu7f78AVEQnzaRTcR82z-Sz-Ib1S4Vi8evfnAMawC6aPlopwISfvyMTMRvt-lTcp7154dD4wwL0qXOUhDMbxG5RrRmwK-MLlnjcHNLiRxX_05KMxCbyQrsci61_pnbDXkjeSwnnNizdxDpz6AtPeQWJMMZ0BdDIeLi1D1257Pps7RO7ELDuhDaBhfG8SBOS0cQ_C29BTO6-2PRQJrZiWpS6Fog_XYQEG3Jx8Jegg_5QTObR-aRVuAkf1GhT07SdyrgqCYXLPiYf1tcYxfATEYyjj3z559_dzPjPbixBHnkldpeNFd9f24yr10mzrxdSosKp4IdF3e7_euhY6wTs2tSKNucWoHmj8n8JESf3uvcrNRJL_A3tRdInV1RyfpQmmFzLfdf0UqiJXbTp21ynLYP2EvAttzuTqwcsS9dXwJUshVI2Ug&sai=AMfl-YQb73YKztxAbwe2cKltQ_yW5oxZwbmyxEU1qTwNkE9W5NGOBnrIpnhengMCIQ2aBR75S-3lPXiYWqIqqUOpmlj2PS-Y_TupJYUEujnIo-FxlTyG2xniSu9PWhvjvlByziOYSRgV8vDVczKHdnTPEM93wgSWpEuntgmZC7AG9GKjbpkTkXPX&sig=Cg0ArKJSzL9bUo-ZGZGyEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=138&cbvp=1&cstd=133&cisv=r20211007.29705&adurl=

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 12 Oct 2021 16:32:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 B25588981.300162258;dc_trk_aid=492858035;dc_trk_cid=149951559;ord=[timestamp];dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;dc_exteid=ABAjH0iUvkii-LvyqbsMW_gNOy2S;dc_pubid=5;dc_dbm_token...
ad.doubleclick.net/ddm/trackimp/N209203.279382DBMYOOX.COMOFF-764/ Frame FFAB 42 B
554 B 101ms
44ms Image
image/gif 142.250.185.166
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N209203.279382DBMYOOX.COMOFF-764/B25588981.300162258;dc_trk_aid=492858035;dc_trk_cid=149951559;ord=[timestamp];dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;dc_exteid=ABAjH0iUvkii-LvyqbsMW_gNOy2S;dc_pubid=5;dc_dbm_token=AD1EzRQAAACTCooBCgwIABUAAAAAHQAAAAASDAgAFQAAAAAdAAAAACIQCLXBoRuoAq_YVrACw5_7CkAB0gIqGAEiEwjuwKCupsXzAhVn5bsIHTlDCssoATABOJTV556SDkACSAFYmYEgqgMeQ0FBU0V1Um9lZkVndWFlc01IZDBCbHNlcW5BRDZnsgMJCIDhgBAQARgdEL_ChLABG0Qp6ZKe2O0LyS6Qxd8HCw?

Requested by

Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame D850 70 B
265 B 108ms
36ms Image
image/gif 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEKsgShz0MR_Au0hKX2PMnjY&google_cver=1&google_push=AYg5qPLLeWGs5SVOyRkmt4u5UKGC2wE1t0mVGgijJbuakkzpsT4xWNGqz1aNIREIJ03dvB_vn-CbYzayCitbUs2tqNYMQNkL4t2L
Requested by: Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:56 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D850
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEF0M-6h1aPy_K4If8Js81u0&google_cver=1&google_push=AYg5qPKTK2LEOJCN95xQJzvnUUeoYklVuoRqzBpRJ87P7L_akyKJQfZgRaCOjry7BcfSChgBO2utlO-...
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=8&google_gid=CAESEF0M-6h1aPy_K4If8Js81u0&google_cver=1&google_push=AYg5qPKTK2LEOJCN95xQJzvnUUeoYklVuoRqzBpRJ87P7L_akyKJQfZgRaCOjry7BcfSC...
https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=aKOVN6OCSJKVarAqaezj7GFluLg

170 B
188 B

36ms
35ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=aKOVN6OCSJKVarAqaezj7GFluLg

Requested by

Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=aKOVN6OCSJKVarAqaezj7GFluLg
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D850
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEPGqW-VFFLW1XVNA68PG_CM&google_cver=1&google_push=AYg5qPLkEt7IrtG1nAil5S2O-wmGAdYi8B36Q5AsbHx8PbQOTXgtg5Drq8JYva4ZHWPhrJxkU3StuSzEt832-OiyfFQlgj4...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEPGqW-VFFLW1XVNA68PG_CM&google_cver=1&google_push=AYg5qPLkEt7IrtG1nAil5S2O-wmGAdYi8B36Q5AsbHx8PbQOTXgtg5Drq8JYva4ZHWPhrJxkU3StuSzEt832-OiyfFQlg...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPLkEt7IrtG1nAil5S2O-wmGAdYi8B36Q5AsbHx8PbQOTXgtg5Drq8JYva4ZHWPhrJxkU3StuSzEt832-OiyfFQlgj4voV8v

170 B
188 B

39ms
39ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPLkEt7IrtG1nAil5S2O-wmGAdYi8B36Q5AsbHx8PbQOTXgtg5Drq8JYva4ZHWPhrJxkU3StuSzEt832-OiyfFQlgj4voV8v

Requested by

Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPLkEt7IrtG1nAil5S2O-wmGAdYi8B36Q5AsbHx8PbQOTXgtg5Drq8JYva4ZHWPhrJxkU3StuSzEt832-OiyfFQlgj4voV8v
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D850
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEP4lER_dOTGbb0LHKte8mq4&google_cver=1&google_push=AYg5qPL5pOr5ULcw6oBh_kWCtrJU5gjE48e75je1UY5O_fPt8xVRJFqDxpTFtzZgdgV1LMoZyUXPbJyLmg7njvP1kN21btEwZQs
https://rtb.openx.net/sync/dds?google_gid=CAESEP4lER_dOTGbb0LHKte8mq4&google_cver=1&google_push=AYg5qPL5pOr5ULcw6oBh_kWCtrJU5gjE48e75je1UY5O_fPt8xVRJFqDxpTFtzZgdgV1LMoZyUXPbJyLmg7njvP1kN21btEwZQs&o...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPL5pOr5ULcw6oBh_kWCtrJU5gjE48e75je1UY5O_fPt8xVRJFqDxpTFtzZgdgV1LMoZyUXPbJyLmg7njvP1kN21btEwZQs&google_hm=Xkm810Pwy7ouB24GYaQhaA==

170 B
188 B

36ms
35ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPL5pOr5ULcw6oBh_kWCtrJU5gjE48e75je1UY5O_fPt8xVRJFqDxpTFtzZgdgV1LMoZyUXPbJyLmg7njvP1kN21btEwZQs&google_hm=Xkm810Pwy7ouB24GYaQhaA==

Requested by

Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:55 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPL5pOr5ULcw6oBh_kWCtrJU5gjE48e75je1UY5O_fPt8xVRJFqDxpTFtzZgdgV1LMoZyUXPbJyLmg7njvP1kN21btEwZQs&google_hm=Xkm810Pwy7ouB24GYaQhaA==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: r2dtokeo3gokjohg5qhi8uumk7c15r6p

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D850
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEHn-T5pEQ5yZqULWbG_CmcM&google_cver=1&google_push=AYg5qPICssa-bjKv4y4a3FCV2k8URwoG8Qw-FtsKtA5Fb__tR1R5U-kviyU2LUI1YheKCY2fRRz...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VPQVo1OU0tMjMtMklKQQ==&google_push=AYg5qPICssa-bjKv4y4a3FCV2k8URwoG8Qw-FtsKtA5Fb__tR1R5U-kviyU2LUI1YheKCY2fRRzwHTjJcfYGUZZk3Wf6oNar2QDW

170 B
188 B

35ms
34ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VPQVo1OU0tMjMtMklKQQ==&google_push=AYg5qPICssa-bjKv4y4a3FCV2k8URwoG8Qw-FtsKtA5Fb__tR1R5U-kviyU2LUI1YheKCY2fRRzwHTjJcfYGUZZk3Wf6oNar2QDW

Requested by

Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VPQVo1OU0tMjMtMklKQQ==&google_push=AYg5qPICssa-bjKv4y4a3FCV2k8URwoG8Qw-FtsKtA5Fb__tR1R5U-kviyU2LUI1YheKCY2fRRzwHTjJcfYGUZZk3Wf6oNar2QDW
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 78e3bdce5107450057bade54d54a0a7e
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D850
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEGDyiyx1hHu9FWcxN7jS9qg&google_cver=1&google_push=AYg5qPJUQSdVM5CdFCsuVj3JLuIq1tYjlETuRcdGXfhI_JNovQpPDCV85v3lkdcizjTuz3boZGnKu7_3PgLi6-0B8...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPJUQSdVM5CdFCsuVj3JLuIq1tYjlETuRcdGXfhI_JNovQpPDCV85v3lkdcizjTuz3boZGnKu7_3PgLi6-0B8YroPc0VA39f&google_hm=7f085b153c8deca91e300fb0

170 B
188 B

35ms
35ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPJUQSdVM5CdFCsuVj3JLuIq1tYjlETuRcdGXfhI_JNovQpPDCV85v3lkdcizjTuz3boZGnKu7_3PgLi6-0B8YroPc0VA39f&google_hm=7f085b153c8deca91e300fb0

Requested by

Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 12 Oct 2021 16:32:56 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPJUQSdVM5CdFCsuVj3JLuIq1tYjlETuRcdGXfhI_JNovQpPDCV85v3lkdcizjTuz3boZGnKu7_3PgLi6-0B8YroPc0VA39f&google_hm=7f085b153c8deca91e300fb0
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D850
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEOR3FsK1WA-vLuIrzm13N7Y&google_cver=1&google_push=AYg5qPILQohfmW-hJ-JGBLPlE8Ibl8E1s5zOxRDf_pz8utsC8seV0urM3K5zcAbrG5EfpFi8W1...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEOR3FsK1WA-vLuIrzm13N7Y&google_cver=1&google_push=AYg5qPILQohfmW-hJ-JGBLPlE8Ibl8E1s5zOxRDf_pz8utsC8seV0urM3K5zcAbrG5EfpFi8W1...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1IWEhkNjFsRTJ1Rk1Fbkd6VV8xRUlON3J6M1ZWWWZ1an5B&google_push=AYg5qPILQohfmW-hJ-JGBLPlE8Ibl8E1s5zOxRDf_pz8utsC8seV0urM3...

170 B
188 B

37ms
37ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1IWEhkNjFsRTJ1Rk1Fbkd6VV8xRUlON3J6M1ZWWWZ1an5B&google_push=AYg5qPILQohfmW-hJ-JGBLPlE8Ibl8E1s5zOxRDf_pz8utsC8seV0urM3K5zcAbrG5EfpFi8W1OTL5mPaymqrSEYm1SNzgddyRe-Mw

Requested by

Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 12 Oct 2021 16:32:56 GMT
Server: ATS/7.1.2.138
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1IWEhkNjFsRTJ1Rk1Fbkd6VV8xRUlON3J6M1ZWWWZ1an5B&google_push=AYg5qPILQohfmW-hJ-JGBLPlE8Ibl8E1s5zOxRDf_pz8utsC8seV0urM3K5zcAbrG5EfpFi8W1OTL5mPaymqrSEYm1SNzgddyRe-Mw
Connection: keep-alive
Content-Length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame D850 0
12 B 33ms
31ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JBklSv7_0hxv6ZDa2rX9IDqBr62Wg640Sg7TZffAbOtGO30KX2kdR4DzPTXpgiNHpfbm3gAg

Requested by

Host: 6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
URL: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:56 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 css
fonts.googleapis.com/ Frame 2F21 3 KB
576 B 60ms
32ms Stylesheet
text/css 142.250.186.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:regular,700

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13379066290707103744/index.html?e=69&leftOffset=0&topOffset=0&c=9ptZeweDRe&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f10.1e100.net

Software

ESF /

Resource Hash

162a3eebb385684e99a8b624b77189f9b5c38cb51d1b814c1c3a84fc17c324a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 15:23:24 GMT
server: ESF
date: Tue, 12 Oct 2021 16:32:56 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires: Tue, 12 Oct 2021 16:32:56 GMT

GET
H3 200 Enabler_01_246.js Show response
s0.2mdn.net/879366/ Frame 2F21 116 KB
39 KB 21ms
21ms Script
text/javascript 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_246.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13379066290707103744/index.html?e=69&leftOffset=0&topOffset=0&c=9ptZeweDRe&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

sffe /

Resource Hash

b64291fc91dc77833930ffcead244193c5cfd9e882af312ecc89b580160c22a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13379066290707103744/index.html?e=69&leftOffset=0&topOffset=0&c=9ptZeweDRe&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 11:08:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19493
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40237
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 13 Oct 2021 11:08:03 GMT

GET
H3 200 164xWCSuMRCufBnFuK3WuMS10bt2HArdrnuZlqXsEzU.js Show response
pagead2.googlesyndication.com/bg/ Frame 21A0 35 KB
13 KB 21ms
21ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/164xWCSuMRCufBnFuK3WuMS10bt2HArdrnuZlqXsEzU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

sffe /

Resource Hash

d7ae315824ae3110ae7c19c5b8add6b8c4b5d1bb761c0addae7b9996a5ec1335

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 14:41:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6689
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13308
x-xss-protection: 0
last-modified: Tue, 05 Oct 2021 11:38:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 12 Oct 2022 14:41:27 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v18/ Frame 2F21 19 KB
20 KB 73ms
23ms Font
font/woff2 142.250.185.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:regular,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f3.1e100.net

Software

sffe /

Resource Hash

2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 06 Oct 2021 13:18:36 GMT
x-content-type-options: nosniff
age: 530060
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19844
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:10 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 06 Oct 2022 13:18:36 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v18/ Frame 2F21 20 KB
20 KB 95ms
45ms Font
font/woff2 142.250.185.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:regular,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f3.1e100.net

Software

sffe /

Resource Hash

ec7d69015be507ee6045d259f50b6cf8ccb52ec7b41ec1bf50fee681683bea60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 06 Oct 2021 22:28:30 GMT
x-content-type-options: nosniff
age: 497066
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20040
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:44 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 06 Oct 2022 22:28:30 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 58ms
58ms Image
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20211007&jk=892301725972480&bg=!eXqlej7NAAbGFvHlxhY7ACkAdvg8WrN4er7rKGDtZD5FfPolHMXpSrRljKCVGW1m5QlIkddDqk0apQIAAAESUgAAACVoAQcKAHo3scB_bb7RM_4VCAARpK0h48Df0ZpBzOetw4UDh9iGeALjKbRvV4K1sg1foFqa2L28TUaky_md7hB7FIszd44C3Grx9TSJ7HS0FEH7uaEh6WcTP1RT1ngJHwsBrb-CsR5exvytFGMx2jh3yEZa3MJLxeVbxKr15m9YppkCqaxbLiUEki0aYoaIv1IOlzZUnQplgQG3HEamVhO0SE1AYbhoKOzH7j6owzN6K_JmJKT3JTMVI5yFK6bBciNF_N-n-jzCxFOvwH9iJ2wOlpXBozK9-_7wpbpl9Ju-BBlHOBpXZrmmarrg-z1j-pYcHgelPouDjlkmL2s8eURjIwSLjuN31w2Z73UnRPI5GrSCifCP_e-iT7ab0Z_nW6IZSGCOuGK4c0eAhVWb6TqzEpCTELB6BHA7-WKcNVuNmyZifUij0Da9FYinpJblY_bIPepq-yqSTWAsXPapdgvzLPI0PLisPv-oT86VEU4GU51wx5WX5sW_n5DuuQKRxilfktUD-_Cu-y0Rc1zNanm95r6207j66DX93bVxsD9y077_3M2Fw04G2scFOKAv_fc2QwxubZJcVGg63NrJr2ALPtrssGSgj_9G0tibYiLXyhBeM-SV7Hz5aP4c3FumPhA9-_OHUgWJ7VOV4yjK6o0fyXCjUDk2e3513lHWqUCboX8N43YPdStKQ1Um3E1I-OQjRzZh1ES28Pg8MoBLZck2QyZ7JTld3HULBGHBAUiSn393zSE-WM7KccR9uFH6cnRTvzjfQYKv3kr9bYhGOEtYglA52J5vBLSMcMJIykjzO1yM8zSM7kGrV5PXrW3AAblaYZH0ZN3oqeMZUmL2q4TkzzrZM2ILC7IjtUL2wwe1mHqp4s5pIojk-9U_glTmxUc9wcdgLlpaOGGEn_0bo-R66m_cCcpMmN_ZqXQ7pHw-rC16vQCJGYvrUgDrIMTNwka1jkxoniXx0WjMai9tRXiA9SXSseO0xDYJ0T5hWnpjQhne7QYxwOm6ASx8_R4vTryv1IYu6i-YA_3XuoGjtgX7ZzAx2GoWuaiQaEUq2rSM2v3EDuSQjN7w2T2qQQ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 2F21 6 KB
4 KB 37ms
37ms XHR
application/json 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_246&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_246.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

c5d63a1538862cb515d0f67d4e13fbab3928ab3de5980351f67f56f3f543be46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Oct 2021 16:32:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4446
x-xss-protection: 0

GET
H3 200 prod_studio_01_246_configurablemodule.js Show response
s0.2mdn.net/879366/ Frame 2F21 30 KB
10 KB 22ms
21ms Script
text/javascript 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/prod_studio_01_246_configurablemodule.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_246.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

sffe /

Resource Hash

60cee2b7c0e6399de0c613d7abdf961da05ffb4f02406eba30bb2569fa9d64e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13379066290707103744/index.html?e=69&leftOffset=0&topOffset=0&c=9ptZeweDRe&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 06:54:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34718
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10534
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 13 Oct 2021 06:54:18 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D1C5 0
20 B 57ms
57ms Image
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021100701&jk=4110945755293157&bg=!4-Cl4KTNAAbGFvHlxhY7ACkAdvg8Wm7o958ZHlhh2i0KNaBw1dcAgsocygiHs0ba4WuJCh-EkO9CoAIAAAEQUgAAABZoAQeZAuxHt1e4evcRjcadb9BFSaCNGZH2f3PVjNbsR819sVm5lOLiUwBzqnRUfAADoIapqKzgP2TeEhHlO9oWdeV7d-unGau1o_StPF0Ph7TrlcS2XVGDwmucKNBmm9Mv5OXKvEmZF_wf0t1JfyOCjhTMPff200BHwNUaZ_cbyNerUmuRvyCvhUuytDbZpxXUzbcx9mgRohmLZwTDp-ScGHupuAvX36lQAa1_UgpFHfLL22i9BvtR3K2F1apgowguRmkepMk0iySMMzMYpMDpdev6tU6tn-4vFPiSXiuF8NqQlBrOd_Y2jEyMqH9umUr2vou1rWuPNNsg4sknmZOcbB744Sp6ThzUoKIj06bvQ1nDCCwDcZCOn128AlhcuFd4aytLBo3HOqUTaAWVSe6E_Z4oPvLT6SaHHxxcqbI1zWD_mlRPv2SARcZJMkZYQa7mWcPR97ZP2s_kew3N9d2PHygrN-NmYtEDC3t8y6pBBXsVCBRq8wzGIM2PAm8YZlatxLdCcXruLYCY8Vein7vmyBHPa_d0Wudoj6vjucfSxE9HCpCANHQWYCVau9XQCGQTU1z5VGFCs8b_xExFozoF4uVhmwtCAz9QC0xebcO5uht1-PDa1R6FcA5NPqZ1kAhcMt84Hy_iOEqzTXyQZhk0IJr08ZGxBtQAL4TEkHxg0b0pQcDW3wuwBmEBtHfi7DuxJkM-BbEApQFasDBwo5oxlXFLKNxcoqEud5gqbU87CKk87MD6Co7GdMmqWX6zFCKzNRlenmFNcx07ZUMzNGULezVJVyW3BwWq9ucoh6N6epBR91evWhAhPGsJ68RI-q2YfJS8B3J0WI17Ca6czPg61gLVktKoXN7m0LsCNDm5-7h2ZOzrHZHuWkRw9gaoyTIcFmhMY-_Odkj6kAAGU4206Vjoe6H_b9kYiaJbQGWyG7H6xmH2ba66clC3CTGG1B9myaMNLaH3D5DOOJoxlyjs2L1fLFTWWEj73d6g482bYC9r

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 2F21 17 KB
6 KB 38ms
38ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_246.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f1.1e100.net

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 16:32:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Tue, 12 Oct 2021 16:32:56 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FFAB 0
23 B 61ms
61ms Ping
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.profinance.ru
URL: https://www.profinance.ru/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 12 Oct 2021 16:32:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 YOOX_Logo_Resize.png
s0.2mdn.net/sadbundle/13379066290707103744/ Frame 2F21 9 KB
9 KB 24ms
23ms Image
image/png 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13379066290707103744/YOOX_Logo_Resize.png

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

sffe /

Resource Hash

7d6b5e55ca0f80ae85e2979e7a2c08394c1d49ac1b9e16754dc24174139e7245

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13379066290707103744/index.html?e=69&leftOffset=0&topOffset=0&c=9ptZeweDRe&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 05 Oct 2021 18:15:23 GMT
x-content-type-options: nosniff
age: 598653
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9046
x-xss-protection: 0
last-modified: Tue, 27 Jul 2021 12:13:17 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Oct 2022 18:15:23 GMT

GET
H3 200 yoox-logo.svg
s0.2mdn.net/sadbundle/13379066290707103744/ Frame 2F21 1 KB
749 B 24ms
23ms Image
image/svg+xml 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13379066290707103744/yoox-logo.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

sffe /

Resource Hash

92dbc2a3849a9695c3993d193cf1f65fa2987b46f499083805cd970af7c6bea0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13379066290707103744/index.html?e=69&leftOffset=0&topOffset=0&c=9ptZeweDRe&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 08 Oct 2021 10:23:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 367763
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 720
x-xss-protection: 0
last-modified: Tue, 27 Jul 2021 12:13:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 08 Oct 2022 10:23:33 GMT

GET
H3 200 14256590217948860927
s0.2mdn.net/pimgad/ Frame 2F21 186 KB
186 KB 25ms
24ms Image
image/jpeg 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/pimgad/14256590217948860927

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

sffe /

Resource Hash

a178a447b70484730b1e1da50a536dccc7510d8875e98e87404d0abe801d55e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13379066290707103744/index.html?e=69&leftOffset=0&topOffset=0&c=9ptZeweDRe&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 05:00:54 GMT
x-content-type-options: nosniff
age: 41522
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 190351
x-xss-protection: 0
last-modified: Sun, 25 Jul 2021 13:13:14 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Oct 2022 05:00:54 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 21A0 0
20 B 60ms
59ms Image
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BP0D0t7hlYZmxNZqz3gOgmr0wAAAAADgB4AQC&bg=!Hh2lHVnNAAbGFvHlxhY7ACkAdvg8WmFqgZfvOOUnxS6Xs0kqX1ZRocdjtHuNooDFFi0ef0BhLfrADgIAAADRUgAAAAtoAQeZAz87LlZd7cKNr2g1Xp1PlKbSAVz0CALmvIL_fHi7raPREC11B1JGbcq5EMrPCMmLjAnGIne04Rz7u4Kq0EhXmA3WV-rcQJ_o1QYJBbew97nUg3ZlBmmqBNwYLL8Me6IDLQWcHB-vxo7X5PX-vTkOURF5BizYZXgpAzoy5CSVo4dUdBbzUeynHQi91cNop2zobNOhkRJIHzBPWGVaBZyhOv-p2iRjDlCBdOBeumAIwo91tju2isEMVyXcKy1s1Wuq5v1xfhTtEQLye75FiT0OvTtF91gnNMyHzN-Jszb8_EpV3nsDZukWyq2x-esV27WsKvEtjErHtc59X6ZPJnR2o6qmTZP1y_X39UHkiv7VV4h-ynzqbTMzEqQ7VyYBCR4zGj0jDtR6KSde85LXlpaEaACox9W-Be-T8Y-6CfH4S2JuEFFi6B8msj0b_cKu66y__-iTKa77UNgeAHoSfIVUFUyTZBCEnprJL6yOA_mfBomKi-72McQf-Gx4TyI_IWn8RA_bqCZwtluNqX2XT9SJzNram8Kpufd5B7_pPb7qbIedAwkXOSzuw7a47ZUO6nW3HokOqF8IX1Ziogz4nymmlI9ewfBeYqap7gV24Q6TVzzouPoCwju95hhnlO1q8_Dldq5BPzNBzcayWjpjUfqlHb7pnh0hNu8fwU-FM_jW23izyum0NvjnNoUT-VyLADtdtfCUCCLA62HJtBqnAoCwY716TaUYQPI9XmFtdfaiwUvGUWFNtP1QkGshXiSvIisKs4-x42heS7v2yb0O1Xc9YZoU2iYsew-fVPoUii5iYrgiRcruFB3ylccWcZ7TJPD6OCs0gnDmXy2bvwXrX3xMP2yKeOsbHbwaGuMtQZzMcv9qhvvvYQcXsKTnAo2AyEpN-vUvHKqyaTSCNBnUt7zdHCiByukRvMASM3bG29Kau98EcwiiYKnwlGaDVX2bvdioWdyDeStAHmOH1IVLh0AmW7VeR0jjc7aasPZ6OSywA95U7bp5RM3EUlUc7XxInv8yBbzdcoagS7_umwE5lN4-zCOFiIUFmcFO3WcnVbIxuuCMDuLTS8FDQFrd6ZxjM4nXbdrCn6rrlfiujwbvzuC5wj4

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 164xWCSuMRCufBnFuK3WuMS10bt2HArdrnuZlqXsEzU.js Show response
pagead2.googlesyndication.com/bg/ Frame 8EAA 35 KB
13 KB 22ms
21ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/164xWCSuMRCufBnFuK3WuMS10bt2HArdrnuZlqXsEzU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

sffe /

Resource Hash

d7ae315824ae3110ae7c19c5b8add6b8c4b5d1bb761c0addae7b9996a5ec1335

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 14:41:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6689
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13308
x-xss-protection: 0
last-modified: Tue, 05 Oct 2021 11:38:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 12 Oct 2022 14:41:27 GMT

GET
DATA 200
OK truncated
/ Frame 2F21 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3 200 yoox-logo.svg
s0.2mdn.net/sadbundle/13379066290707103744/ Frame 2F21 1 KB
749 B 20ms
20ms Image
image/svg+xml 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13379066290707103744/yoox-logo.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

sffe /

Resource Hash

92dbc2a3849a9695c3993d193cf1f65fa2987b46f499083805cd970af7c6bea0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13379066290707103744/index.html?e=69&leftOffset=0&topOffset=0&c=9ptZeweDRe&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 08 Oct 2021 10:23:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 367763
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 720
x-xss-protection: 0
last-modified: Tue, 27 Jul 2021 12:13:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 08 Oct 2022 10:23:33 GMT

GET
H3 200 YOOX_Logo_Resize.png
s0.2mdn.net/sadbundle/13379066290707103744/ Frame 2F21 9 KB
9 KB 23ms
23ms Image
image/png 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/13379066290707103744/YOOX_Logo_Resize.png

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

sffe /

Resource Hash

7d6b5e55ca0f80ae85e2979e7a2c08394c1d49ac1b9e16754dc24174139e7245

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13379066290707103744/index.html?e=69&leftOffset=0&topOffset=0&c=9ptZeweDRe&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 05 Oct 2021 18:15:23 GMT
x-content-type-options: nosniff
age: 598653
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9046
x-xss-protection: 0
last-modified: Tue, 27 Jul 2021 12:13:17 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Oct 2022 18:15:23 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 64D7 15 KB
15 KB 55ms
25ms Font
font/woff2 142.250.185.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f3.1e100.net

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 11 Oct 2021 17:27:37 GMT
x-content-type-options: nosniff
age: 83119
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 11 Oct 2022 17:27:37 GMT

GET
H3 200 14256590217948860927
s0.2mdn.net/pimgad/ Frame 2F21 186 KB
186 KB 21ms
20ms Image
image/jpeg 142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/pimgad/14256590217948860927

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

sffe /

Resource Hash

a178a447b70484730b1e1da50a536dccc7510d8875e98e87404d0abe801d55e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13379066290707103744/index.html?e=69&leftOffset=0&topOffset=0&c=9ptZeweDRe&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 05:00:54 GMT
x-content-type-options: nosniff
age: 41522
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 190351
x-xss-protection: 0
last-modified: Sun, 25 Jul 2021 13:13:14 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 12 Oct 2022 05:00:54 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FFAB 42 B
64 B 66ms
66ms Fetch
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu-jmh1zyhRPxYG0ht5OXuHnXtmxYZ5GFYtzBbBAlc-2WCWxvbq5eC5LuN-Nqp6JcXhmERJ8lytJpYqBvDSMq75xzc7DgHimldm9XAKBFZUr7aUtF-vxw&sai=AMfl-YQar2PsffQXnH0gPo5CK4lP8kJTD8BB0B_AzE3aMgUxsFukcFpGmtELTklzkh6yb7bo7EILWD5_jOcpvq_i1ZRX8AW-lsmWCWfN5tFHKQXzRiwF6qrqK-wyQ1wl&sig=Cg0ArKJSzFtAKl4tEkj3EAE&cid=CAASEuRoefEguaesMHd0BlseqnAD6g&id=lidar2&mcvt=1000&p=0,0,250,970&asp=0,315,250,1285&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211011&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=4257258892&rs=4&la=1&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1634056375757&rpt=257&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:57 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 event
ads.adfox.ru/341266/ 0
66 B 69ms
69ms Image
text/plain 77.88.21.179
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.adfox.ru/341266/event?duid=1634056373589262977&hash=03c15f0a5f899062&pm=bmn&pxo=HYRYShED1OpS-u51BbJ_JbqFTXAtX7A1YvRVpIsCvXnr0I-wV4y8_9apbRdQkuldIMKW97b3YXElv_ufctWVSnKvDM0mpG6ZUVO7PYVirVKV1tBFjip5UQi0HFgl-8jiVW5hXe8oGaB2Hu1EVejrijjTVpKL86FFwec2lpvmhopKwgUiAGE2&p5=inscz&rand=gpwidjo&sj=oxuQQHeVmUpFIeA6Rd5Fpmw04D98u-4RsM6HL9knGBsy6TqSItcb9OaHisk1OQ%3D%3D&ad-session-id=1419741634056372648&lts=fhnuxeb&ytt=432108075091989&ybv=0.44818&ylv=0.44818&dl=https%3A%2F%2Fwww.profinance.ru%2F&pr=ncjswtt&p1=cmmml&rqs=tTA6jCtnLRm1uGVhTnNkdE0pSpO_6Ncx&rtb-si=b&p2=gyqo

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

77.88.21.179 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

adfox-external-l3-engine.stable.qloud-b.yandex.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:58 GMT
x-content-type-options: nosniff
last-modified: Tue, 12 Oct 2021 16:32:58 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
expires: Mon, 04 Dec 1999 21:29:02 GMT

GET
H2 204 event
ads.adfox.ru/341266/ 0
18 B 63ms
63ms Image
text/plain 77.88.21.179
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.adfox.ru/341266/event?duid=1634056373589262977&hash=5408e064e2c8bb9b&pm=bmq&pxo=HYRYShED1OpS-u51BbJ_JbqFTXAtX7A1YvRVpIsCvXnr0I-wV4y8_9apbRdQkuldIMKW97b3YXElv_ufctWVSnKvDM0mpG6ZUVO7PYVirVKV1tBFjip5UQi0HFgl-8jiVW5hXe8oGaB2Hu1EVejrijjTVpKL86FFwec2lpvmhopKwgUiAGE2&p5=inscz&rand=ldbxrcq&sj=oxuQQHeVmUpFIeA6Rd5Fpmw04D98u-4RsM6HL9knGBsy6TqSItcb9OaHisk1OQ%3D%3D&ad-session-id=1419741634056372648&lts=fhnuxeb&ytt=432108075091989&ybv=0.44818&ylv=0.44818&dl=https%3A%2F%2Fwww.profinance.ru%2F&pr=ncjswtt&p1=cmmml&rqs=tTA6jCtnLRm1uGVhTnNkdE0pSpO_6Ncx&rtb-si=b&p2=gyqo

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

77.88.21.179 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

adfox-external-l3-engine.stable.qloud-b.yandex.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.profinance.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Oct 2021 16:32:58 GMT
x-content-type-options: nosniff
last-modified: Tue, 12 Oct 2021 16:32:58 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
expires: Mon, 04 Dec 1999 21:29:02 GMT

Verdicts & Comments Add Verdict or Comment

89 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

84 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
yastatic.net/safeframe-bundles/0.82/1-1-0	1970-01-19 21:55:42	Name: afpix Value: 1
yastatic.net/safeframe-bundles/0.82/1-1-0	1970-01-19 22:02:54	Name: pcssspb Value: 1
yastatic.net/safeframe-bundles/0.82/1-1-0	1970-01-19 21:55:42	Name: pcs3 Value: 1
www.profinance.ru/	1969-12-31 23:59:59	Name: user_yndxpfs_ablc Value: null
.yadro.ru/	1970-01-20 06:38:42	Name: FTID Value: 1XPRYq1x2PeB1XPRYq0007-9
.profinance.ru/	1970-01-20 06:39:52	Name: _ym_uid Value: 1634056373589262977
.profinance.ru/	1970-01-20 06:39:52	Name: _ym_d Value: 1634056373
.mc.yandex.com/	1970-01-19 21:54:16	Name: sync_cookie_csrf Value: 826612456fake
.betweendigital.com/	1970-01-20 06:39:52	Name: dc Value: was1
.betweendigital.com/	1970-01-20 06:39:52	Name: ss Value: 1
.profinance.ru/	1970-01-20 05:53:47	Name: tmr_lvid Value: f606ec10a486d213b4b054cab9aa423f
.profinance.ru/	1970-01-20 05:53:47	Name: tmr_lvidTS Value: 1634056372925
.yadro.ru/	1970-01-20 06:38:42	Name: VID Value: 0ZypfX3OmdeB1XPRYq000M3Q
.profinance.ru/	1970-01-19 21:55:28	Name: _ym_isad Value: 2
.exchange.buzzoola.com/	1970-01-19 22:37:28	Name: uuid Value: 79871b8e-ef3d-4a82-6c6e-20f33023b494
.mc.yandex.ru/	1970-01-19 21:54:16	Name: sync_cookie_csrf Value: 2703999561fake
.otm-r.com/	1970-01-20 06:39:52	Name: mpid Value: NjE2NWI4YjQwM2ZkZmU5OA==
.betweendigital.com/	1970-01-20 06:39:52	Name: tuuid Value: ed89d0c0-8635-531d-9b1c-1208fa79aabc
.betweendigital.com/	1970-01-20 06:39:52	Name: unm Value: 1
.yandex.com/	1970-01-20 06:39:52	Name: yandexuid Value: 5731870851634056373
.yandex.com/	1970-01-20 06:39:52	Name: yuidss Value: 5731870851634056373
mc.yandex.com/	1969-12-31 23:59:59	Name: yabs-sid Value: 812054701634056373
.yandex.com/	1970-01-23 13:30:16	Name: i Value: qcURXg53MGoH9ynrGYKgn+SgSYPZyIfUfrCLl9kHamFwhPSgEkm0HLvPfSUqZwqDJ6mzCXizFYV2azO3cDT8e2eJznQ=
.yandex.com/	1970-01-20 06:39:52	Name: ymex Value: 1665592373.yrts.1634056373#1665592373.yrtsi.1634056373
.an.yandex.ru/	1970-01-19 22:04:21	Name: yabs-vdrf Value: A0
.yandex.ru/	1970-01-23 13:30:16	Name: yandexuid Value: 1814219661634056373
.bidswitch.net/	1970-01-20 06:39:52	Name: tuuid Value: 54d6b61d-ab07-4e90-8370-0157819335bd
.bidswitch.net/	1970-01-20 06:39:52	Name: c Value: 1634056373
.bidswitch.net/	1970-01-20 06:39:52	Name: tuuid_lu Value: 1634056373
.adhigh.net/	1970-01-20 06:39:52	Name: gi_u Value: mI6BXzHAPJ.AikABlF8dVmDOA
.adsniper.ru/	1970-01-27 05:06:16	Name: uuid3 Value: IiQwYzIwZWQwYy0yYjdhLTExZWMtYTZlOS0wMDI1OTBjODI0Mzc*
.lijit.com/	1970-01-20 06:39:52	Name: ljt_reader Value: 7f085b153c8deca91e300fb0
.bumlam.com/	1970-01-20 15:25:26	Name: suuid3 Value: IiQwYzIwZWQwYy0yYjdhLTExZWMtYTZlOS0wMDI1OTBjODI0Mzc*
.adhigh.net/	1970-01-20 06:39:52	Name: btw_sync Value: Itz
.1dmp.io/	1970-01-20 06:39:52	Name: uid Value: 0c35f530-2b7a-11ec-ae6b-901b0ea4a41b
.mathtag.com/	1970-01-20 07:20:11	Name: uuid Value: 6dcc6165-b8b4-4100-8f2f-be32008d8286
.1dmp.io/	1970-01-19 21:54:16	Name: ru-seq Value: null
.weborama.fr/	1970-01-20 07:25:57	Name: AFFICHE_W Value: 8@ILc3wdZxbz47
.yandex.ru/	1970-01-23 13:30:16	Name: yuidss Value: 1814219661634056373
.sonar.semantiqo.com/	1970-01-21 18:32:40	Name: semantiqo_a Value: 4f4d85664b5c488ead18a785b4d621cc
.sonar.semantiqo.com/	1970-01-20 06:49:57	Name: check Value: c567bc0a88604f8fa17985e1cb95e363
.doubleclick.net/	1970-01-20 07:15:52	Name: IDE Value: AHWqTUnKpgbc7TANvxoLcZHox37o7jg73_KYjA9_ybP1Im6M84FCv2Uap1NVryZqjTA
.dmg.digitaltarget.ru/	1970-01-20 23:49:28	Name: viuserid Value: JgvIRyB4AivNsLB7AZGt
.aidata.io/	1970-01-20 15:25:28	Name: __upints Value: 1634056373
.demdex.net/	1970-01-20 02:13:28	Name: demdex Value: 04883480194409621760709695803729526072
pool.admedo.com/	1970-01-20 06:39:52	Name: tuuid Value: 1228a75e-b2df-4273-aeb1-fd4fc085b70b
pool.admedo.com/	1970-01-20 06:39:52	Name: c Value: 1634056373
pool.admedo.com/	1970-01-20 06:39:52	Name: tuuid_lu Value: 1634056373
.dpm.demdex.net/	1970-01-20 02:13:28	Name: dpm Value: 04883480194409621760709695803729526072
x01.aidata.io/	1970-01-19 22:04:21	Name: yaya Value: 1
.upravel.com/	1970-01-19 21:54:16	Name: session_tptc Value: 1634056373482
.rutarget.ru/	1970-01-20 02:13:28	Name: userId Value: YOuouD63ab-x
.tns-counter.ru/	1970-01-20 06:39:52	Name: guid Value: CFC978236165B8B5X1634056373
.aidata.io/	1970-01-20 15:25:28	Name: __upin Value: PbMM3DtJLoa5H/iiHGQT4A
.upravel.com/	1970-01-23 13:30:16	Name: user_id Value: 18389d02-4c3e-4ca5-b168-0b9403028743
.caltat.com/	1970-01-21 18:32:40	Name: caltat Value: d9e49ae7397d4e78b59be4802c3f2f45
.bumlam.com/	1970-01-20 15:25:28	Name: guid Value: DCB3D155A1E5DA46
.magnitent.com/	1970-01-21 18:32:40	Name: sonar Value: 4f4d85664b5c488ead18a785b4d621cc
.magnitent.com/	1970-01-21 18:32:40	Name: ct Value: d9e49ae7397d4e78b59be4802c3f2f45
.magnitent.com/	1970-01-21 18:32:40	Name: spid Value: 1823F8F67A42B79C
.an.yandex.ru/	1969-12-31 23:59:59	Name: yabs-dsp Value: adsniper.ZGNiM2QxNTVhMWU1ZGE0Ng==
.yandex.ru/	1970-01-20 15:25:28	Name: is_gdpr Value: 1
.yandex.ru/	1970-01-20 15:25:28	Name: is_gdpr_b Value: COCvChDjShgB
.yandex.ru/	1970-01-20 15:25:28	Name: i Value: FXjLS6aHk9tWfnlu0FppCdZhjfDNsb2+aEugTsPVUFi0uIWwVdn/UTnkO45bzBD/7Lqfwr/gIpWCmPNaNiS11xQwpTk=
.doubleclick.net/	1970-01-19 21:54:19	Name: DSID Value: NO_DATA
.profinance.ru/	1970-01-20 05:53:47	Name: tmr_reqNum Value: 2
.mail.ru/	1970-01-20 06:41:18	Name: VID Value: 30p5Gk1PSMo500000W10H425:::0-0-0-6801174:CAASEDCudJwvSA-NawVHMWn2c2YaYNu8Y_w5JMS8TemAn2BJy9gKZpTMBQ_ZGJswGmSAmlyvMh2BKj5rbGelIFZkIVec-ddKNAopdH9AB-AbNJHKFrfkakXDBL0XtNLDZENblvH4x9SmcVQ7_1LsKPUu_-DJOQ
.criteo.com/	1970-01-20 07:15:52	Name: uid Value: f337e167-65ac-4954-b0e8-6cda36d8caa4
.profinance.ru/	1970-01-20 07:15:52	Name: __gads Value: ID=8fb81349e7e5303a:T=1634056373:S=ALNI_MaokAuFlG2yxIeBy5-KpMC8FCXQCw
.profinance.ru/	1970-01-20 07:15:52	Name: cto_bundle Value: JamlMl90bnJIdlZzNWFEJTJGZkRiJTJCJTJCdDRQM1Bxd3E2MTV4T1lOVHl5M3RNeXRBdGp3WW9Nek9jS1YySnM5TGgzZWVkbWFLanNSMm1sTUFQVlg2emdGRWtodkxVcjNuR2dZS3hIUkxZcHVPeHJrbk0yYjNDVUcwTDE0alJOYTlyMEROS2k4cmQ0V2VOanllTGZiam8xRXNRZ0RXa3clM0QlM0Q
.betweendigital.com/	1970-01-20 06:39:52	Name: ut Value: YWW4twAMnngT-gOmn4Mt4npqb5fm0S8DJcxy8Q==
.adnxs.com/	1970-01-20 00:03:52	Name: uuid2 Value: 8088886973919364227
www.profinance.ru/	1970-01-19 21:55:42	Name: tmr_detect Value: 0%7C1634056375970
.casalemedia.com/	1970-01-20 06:39:52	Name: CMID Value: YWW4t4hHdsm64aL6pdS6lgAA
.casalemedia.com/	1970-01-20 00:03:52	Name: CMPS Value: 3218
.casalemedia.com/	1970-01-20 00:03:52	Name: CMPRO Value: 1174
.casalemedia.com/	1970-01-20 06:39:52	Name: CMRUM3 Value: 2d6165b8b82760CAESED9LMPKgolCuHXhS5m9rUTM
.casalemedia.com/	1970-01-19 21:55:42	Name: CMST Value: YWW4t2FluLgA
.yahoo.com/	1970-01-20 06:40:13	Name: A3 Value: d=AQABBLi4ZWECELFX_2KQ9GnC4O84QiU8zO8FEgEBAQEKZ2FvYQAAAAAA_eMAAA&S=AQAAAmOZ7SMljKjiYMhc_pG0aLg
.openx.net/	1970-01-20 06:39:52	Name: i Value: 52b309b2-43f1-4d63-92a5-ea59d69a282f\|1634056376
.analytics.yahoo.com/	1970-01-20 06:41:18	Name: IDSYNC Value: 18yx~20x4
.sitescout.com/	1970-01-20 06:39:52	Name: ssi Value: 68a39537-a382-4892-956a-b02a69ece3ec#1634056376199
.de17a.com/	1970-01-20 06:32:40	Name: guid2 Value: 1.6976446714812456535
.sitescout.com/	1970-01-19 22:37:28	Name: _ssuma Value: e30

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://mc.yandex.com/sync_cookie_image_decide?token=9424.3Syq0oISfKVTVHVFhBTJMuJylXfUthJ5QqUYYYv5qInIysIcIdjZL54re-2cq0npIDZH6twCGULlxzZUCH5Pdg%2C%2C.OjLfeEI9xN0TxiQyu_lWWq4_kf8%2C Message: Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

18389d02-4c3e-4ca5-b168-0b9403028743.sync.upravel.com
6fe3c6c06a632b107d47bbd35b1b6a29.safeframe.googlesyndication.com
ad.doubleclick.net
ad.mail.ru
adfox-c2s-ams.creativecdn.com
ads.adfox.ru
ads.betweendigital.com
adservice.google.com
adservice.google.de
ajax.googleapis.com
an.yandex.ru
ap.lijit.com
avatars.mds.yandex.net
bidder.criteo.com
cache.betweendigital.com
cdn3.caltat.com
cm.g.doubleclick.net
cm.tns-counter.ru
counter.yadro.ru
d5p.de17a.com
dm.hybrid.ai
dmg.digitaltarget.ru
dpm.demdex.net
dsum-sec.casalemedia.com
eus.rubiconproject.com
exchange.buzzoola.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gum.criteo.com
ib.adnxs.com
informers.forexpf.ru
match.adsrvr.org
matchid.adfox.yandex.ru
mc.yandex.com
mc.yandex.ru
onetag-sys.com
pagead2.googlesyndication.com
partner.googleadservices.com
pb.adriver.ru
pixel-sync.sitescout.com
pixel.rubiconproject.com
pool.admedo.com
profile.ssp.rambler.ru
profinance.ru
px.adhigh.net
redirect.frontend.weborama.fr
rtb.openx.net
s.pubmine.com
s0.2mdn.net
secure-assets.rubiconproject.com
securepubads.g.doubleclick.net
sonar.semantiqo.com
ssl.google-analytics.com
ssp.adriver.ru
static.criteo.net
stats.mos.ru
sync.1dmp.io
sync.bumlam.com
sync.magnitent.com
sync.mathtag.com
sync.upravel.com
sync3.adsniper.ru
sync3.sniperlog.ru
t.adx.opera.com
token.rubiconproject.com
top-fwz1.mail.ru
tpc.googlesyndication.com
ups.analytics.yahoo.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagservices.com
www.profinance.ru
www.tns-counter.ru
x.bidswitch.net
x01.aidata.io
yandex-dmp-sync.rutarget.ru
yandex-sync.rutarget.ru
yandex.ru
yastatic.net
yhb.p.otm-r.com
ysa-static.passport.yandex.ru
142.250.185.131
142.250.185.162
142.250.185.166
142.250.185.193
142.250.185.194
142.250.185.200
142.250.185.70
142.250.185.74
142.250.185.98
142.250.186.106
142.250.186.33
142.250.186.98
142.250.74.194
148.251.129.43
151.236.118.210
172.217.18.98
172.217.18.99
172.217.23.100
178.154.131.215
178.250.0.157
178.250.2.130
178.250.2.131
18.156.0.31
18.192.203.176
184.30.20.241
185.15.175.134
185.184.8.65
185.29.132.245
193.232.148.151
194.226.130.229
195.201.57.28
195.209.111.15
212.11.152.206
213.155.156.185
216.58.212.162
217.69.133.145
23.37.42.132
31.172.81.158
31.172.81.160
35.186.253.211
35.190.16.14
35.210.53.219
37.18.16.16
37.252.172.38
49.12.83.94
51.89.9.254
54.77.217.29
63.33.106.135
66.155.71.149
69.173.144.139
69.173.144.165
72.251.249.14
76.223.111.131
77.88.21.179
77.88.55.55
78.46.16.13
80.64.106.147
81.177.34.136
81.177.34.158
81.222.128.215
82.145.213.8
87.250.247.182
87.250.250.114
87.250.250.90
88.212.201.210
88.99.213.228
89.108.119.43
91.192.150.30
93.158.134.118
93.158.134.119
94.100.180.197
95.217.109.66
96.46.186.57
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
0574454d747d1de69a8f438cbf9b9eadd695669b989a1bb57d1c3ca0241aaeed
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
07878131250c810ce67539c1e45c5930389a0609a97edd176ae3806f9276f293
097615c181c3395b2d2aceaaaa6e8f18364f3726b2d7152a5a31583f3fd16b29
09cb736cb51c04a9c25e66bc769097be3b6aee29e7a8a9b2250344cca527c210
09cd78d927dcb725c0a40c0fa03a201c211c37b4ff700de66088a0d75da44cfb
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d
0cd2de224a5d82178ff763e688fb8d1d834ff25244eff3e11d8ab74ff2225982
0efe00c23297e5c56485eabb6ea548c2669b896704fcb2c426d898148543ccad
10c861bc88c25be1f3ee98f7652bc7fbb35857f42f923e00c6037b757c77685e
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
1424ef028f97cd5d48afe88370d0a83d59d96f69f8181bc3c48dbcfba0a228c4
1435b0ad38fdc7153b2647d030f50ff0540703d5302704feff8a1a697a2ab01c
1484b97dfb6d3aeaf32de990df919f0c59458097e85e61c57ec0cd3863a2aa17
15af425c19ea847baf1fb2cb8c5903d55c9d4cbd5276de1d7c5976c3423bcf69
1609b5fa0f50d166f1e5bb5739a755104cb9f453ac531e13e524e5c8362c89af
162a3eebb385684e99a8b624b77189f9b5c38cb51d1b814c1c3a84fc17c324a7
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
183732f738678d361ae726869c4464577519acbbb8f1d73dea5acbf3cd7c09d8
18c327afa903633f86c3efcf12b77f098077eacaa8be101bb007846fd74f8b93
1c9866090dab321a8670adc59970b9bee414933fab6f0f124ad64c0f87378912
1e70bd86f045fe84cd231681101c4dad25471dc78d95743606d84bc3681820d2
21be95910910148502d7064d8f8028d0424b88cc34a07858a433e48ed64c4bbf
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
25da2450215ad8c9865f1c471ec5d8084c6b23b3e0947ea535bb5f62e8b3a97e
273282a153ded9e3bf56932b20e17408048ddd0d3edf359ebc52e1312a927c4e
273ba0c52e57a5c00ec7e68d64c13805cf735edee215ae624b0df5c01979de4a
2895fa3398443b64b2c9bca884f4c96564af2e4cef62f5b612fd952e505c9608
2a91ee232d3833bef91e94c1f957cf2384f67f098d4c0abca935cf3689d3eb9b
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3
2c967cac40158b4a25c3f77d4123e5d9c203f5527322e6d51b6469df29abe2ae
2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77
2d5fe146be1983fa0e2ca252c82203ef7f1936a1e777fb0512af015fb39cc904
2ecf2f4f04ac8075406edb9cd8d67d7cdc79a7e5f7e9bca60f3b17b8f6c03c5b
373a2dff293196be4e7eedaf5681ce79587b37d0d70c96918a25c62fb7bd3fc1
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
393cf048c5b518e266aa392aa2540de2a0d5538f0bae4f44b1b6a89f095a85f7
3d79822a10942d4aefde26ea7b154f47d9218452a86a236241667e6139c7932e
3e7581a56d46ce0dcc8549755ecdceff9ee8f5039dbea9380fe328722101bec8
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
42827546cd6c059f627316f12116715faecc908bcfc38aeef06b37a14fed1e7f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4428fa8a11efdc34826dd51d4e75030b868039b258d3854f45b1222e1794bb1b
44fdd1eb3c024fe9fb4faeb815b2367ace182437a87eb25a75d7802d0f3c88c0
4688af76f0aa4851953c45d5f4472b4328d046c0e5214de1502c79c6409948d9
46f16a08e79604e878917477b6d17e0a00d3bc2b07a5f3bb9d4c5274f3fbe6d2
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
536cd983c5ac840349770984405fe9eb9e67b9d7e35e0c45673a653b003173b6
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
550a6cdc780792439612dfe3ca5fb833e62fabb46a77ba585e2aca943a9166e6
575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e
5910a16b697acfca758539f6a5724f5aefc174b29bdb4e705b475540ac071d3a
599ad71fae7cb8d014f7c2d29b8450bc7c34f8e32d49fa103716becef8ae9964
5c45c312dc1ba44ddeecb86f06d442b85f7816d393b81d3d8197971f80dae7da
5f1ab65fe2ad6b381a1ae036716475bf78c9b2e309528cf22170c1ddeefddcbf
5f8a6e6ed3d25c671cff494344b9b30fdad846dfe411fd22de4588640a31ff0c
60cee2b7c0e6399de0c613d7abdf961da05ffb4f02406eba30bb2569fa9d64e4
6287e00b9f91a82119167e184f7e4443a8cb7ee40369d044644501a321a052bb
63ef7a29e8d135a3f538f7fd9efc046280bfb745f7cc34f8b2e7ad048d78989f
65c1eec846990c5831250ac37e698c949675bbdce85f99a0f8be29193f022892
675c8a007369f3ee8d30772a81d99d6bf891d2bad3f3f3c2b1cc02a184dcc1c6
67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab
67d966655f66192caeabb47ca4d7ea5271a9a3083e906a44850a6932d5a0e2be
74e0705ba9740aea8c7f1f7a8e582ae656c55e1c8d047b212683fadb5e623fa7
77d2cbdd8a3d06678d37227e4f4b8dc09cb17619d8364b84a0ad14b4b6f5652a
7888a75eac5f8b9dc4c448f10e8dc9030fcae612cb236f1a9e9700d56ae6ef34
7b82d70c7d4367a40c2ce524867410716831c036c90d5614561b513a7c4e4775
7d6b5e55ca0f80ae85e2979e7a2c08394c1d49ac1b9e16754dc24174139e7245
7df5774ffcccb6de91ea0c3e95ea530c054c80d1150c517bd2b9920e9b3c3ace
7e1e066fbf2de0d0703956d8e95b15e51a7a444289ca1bffae0d841f5c53c9b8
808ecd508fafb1836f5a350eb2165824e8130f96ba29e1b35d9d473d8b13708e
81760ba367557b7bdaae6ac5590021e8cef8af4717fd27193fa6e229fcd92c70
81e9ee9c729ecf390cf2ce8bc307e378748821d26f3d5c35583c5809157d1555
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b
85d0dc470dd897e40017aa85458b19d2df92a102dc6c28682a5d65b47860f79e
88e5dc8f8a7799f095f0f957096776105f22b3c74a13a138431ae5e2487efa2f
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8d95bff25156e15e179589e93e70867ffcb65e4ff16834088bfb995f69b2f9f8
8dd667af11cc0130c66afea9cfb1deaccc85e2199a7ae682a64372e6177c9584
8e170827cf6b2dfdb810cef652d70f9cbd9ff58f4242cb735622833b5ff69bd3
8ed705aab168de2a691e736e320622de21c10361048111100d539a75e3a8101e
8f58a007d9628ad26386926f331940d636e6e7ffec8d91f3a3d33236b5d9eec2
8ffb8a1e1268d1f34a479fdb5bb3616bbef859e5356a381bc64b09da03c2fa80
91efa6eb86ecf7c7acbc99f2746d9dfb3f19fcc8398d3c832927192c2bf65ca9
92b73c1401907b7e391360b9e7bb79de1d2f25896649434a0eb36d72cbb43210
92dbc2a3849a9695c3993d193cf1f65fa2987b46f499083805cd970af7c6bea0
94d0ab851357981e5741741713784d34ead9d838f7ada21512ac9099a8659fd2
99297d3ca7b65b05d85e5a1f33e9685962430730b2736d628ad8cf01323266b2
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b64a3adaddf9e73cc1ba8465732e00807a306d0ab4c2fe3d49a207b27e7d890
9c844ff634fba01687deb75f6100bb9aac81a1a9978286f08e15a47f2c6daceb
9c911ab93cf6099aeeddb19cb1903d0ef838329443c3a0549c754da47f90a70a
9cc283c43be4ed22a91bb3fcd1d3fb594bd32248700b0e00c00c319ff2499f64
9ce844350a4c873b7e169ce553b0a02b2e4e266b0e32f5692530fc6fc14ac727
9d95be8c77455d049fd9b1b0cf720b8bb3529a03fe60d71687ce2031d6d85c10
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a178a447b70484730b1e1da50a536dccc7510d8875e98e87404d0abe801d55e9
a41a08961f5d7e2efc5048aaaa95fccf73212484b5eb95880edcdcf5aab6dc86
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
aecbb63237c11caa18f9c0dc4310b902cf4aba5a1e43b2faf71a229805a5b3bd
b0866549b1f1e9ba2859efe300f0ff9754b30146182f7fe4e169d696bfb02851
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b64291fc91dc77833930ffcead244193c5cfd9e882af312ecc89b580160c22a1
b72cbad51b7a44789fcce6b237621a000e9a9e59c5cb1a2a98b38fec5842ccf6
b72dce7fd4e527c1ce955795e14a8fc87395f8460eeb4790eb36e656d199edc9
b983eb00a6ab6eb78ca18ec893324e858fac45c5c38643ce974fbd3f149c4771
bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27
bfd21dab62097e79d0a8736b29a340243e73d1472d427742117cd299f64461ee
c0489ecb12247fa7c6305949de4d92dba7e183559f236f28a3c449fddca5f52c
c5d63a1538862cb515d0f67d4e13fbab3928ab3de5980351f67f56f3f543be46
c948a164d123328b1d641166a63cf9a44f70b3ec7118b71a9a3a091274d7782f
cc2ca51e7d7eaa870dacecb5404cbe84116852c578466d47eff77afd715a6837
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cea5906b034af795bb02ae46bb563d4164861fc8e85d0acf5cbb9bdcc309d9a5
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d125872944107e62b360bd1c4472ca833c0b113ef2b51270b31e1cdcb3312982
d19d72f9c6e5bb747a38571cf87013b5fdc205a277e307aaded38c30339bcfd9
d5c91393fc42ed4d1234c6180d0bd54ab46c10bcac71822415902d5cec48163f
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d78bf4c3297ee116a687b02649b5c1fa73314a1b99f94f40402c3e5d785e79bd
d7ae315824ae3110ae7c19c5b8add6b8c4b5d1bb761c0addae7b9996a5ec1335
d7b6ed9e8166c815f86b056bb3caa013f5ac25dd030cc17ebe1b3fc2ebf06bbb
dae6ffaec90ebdf8d644e69c53b5773def35e0f2ffba2b55492ff35ce37ee48a
dfdac8d559ad6777c9d1cfab6038b05e4b5a8f38e15963e8708c5545f0f40866
e0371710b9ebdb4886d7e854b54fa3cbf606b7b9cefff78a01c9175a0174baca
e1574f8d5343d7b6218010a1e4a78b5a6f896a45eeab77317b6c29b28bc4509b
e1cff21864c46e1da263fa83c14ed6d190bc5afbdd35188de15f10eb8bedd264
e3093aa486cec4fb49580b862e5bf49e625a88d65ebff6241760d3389c996338
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e56916a41fd9c332af2b9eeaf98126db892a2be83d85b3bbaffdf828be2f2fc2
e58509ed834e61974af63135af3f86f44c6dfb6c963b0190b479fc5d32d6421f
e898396a63a31caead5610be17a0d5e1465f251e8f7dd0f1df02f144ff5c81d6
ea418f0311393888cfee5111296147ec5be28a407f6a213d192d400cbb2f8250
ec7d69015be507ee6045d259f50b6cf8ccb52ec7b41ec1bf50fee681683bea60
ecc05c55d6e7c828b235348fb0780e48361aaee003dfc79f9fd51f9879a5347f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0c0b837d6e1f168f98cd597a21c7b650ca6050382524ff57bc8b8abf9a35268
f4726d988effd5253298f2a2738ca92d780d4105af0ce67eb7e7d1c748fb6909
f5737d03b8ab39fead5245d364588723fa5a5e3316b66d3efc40e8b0de976ac5
f694b4fc5d667777e89694296218e249226ae1670bbe90a8a345f9f75298b9cd
fa4b61a121a36b2647400b6e50f41ccfa21c96ac0ecdbd88154c32a84f978a42
fb0be8b1600db51f53288882eaf6cb5f5e3b08840c94c20b36a870ab84590fda

www.profinance.ru Open in urlscan Pro 81.177.34.158 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

258 Requests

100 %HTTPS

0 %IPv6

59 Domains

84 Subdomains

54 IPs

11 Countries

2545 kBTransfer

7287 kBSize

84 Cookies

4 Outgoing links

Page URL History

Redirected requests

258 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.profinance.ru Open in urlscan Pro
81.177.34.158 Public Scan

Screenshot
Live screenshot

Full Image

258
Requests

100 %
HTTPS

0 %
IPv6

59
Domains

84
Subdomains

54
IPs

11
Countries

2545 kB
Transfer

7287 kB
Size

84
Cookies

258 HTTP transactions
4 data transactions